From nobody Mon Oct 1 05:48:03 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D50AA130DDC; Mon, 1 Oct 2018 05:47:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.956 X-Spam-Level: X-Spam-Status: No, score=-14.956 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.456, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ms_lOneKxQGs; Mon, 1 Oct 2018 05:47:44 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29497130E60; Mon, 1 Oct 2018 05:47:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=14564; q=dns/txt; s=iport; t=1538398064; x=1539607664; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=VCIfZGsz71B8emzO/ZgrodXUtQgirjlmUhgr68FuHoM=; b=QEKmvICQih7NL+jexVolUzt6/oIPj/9AewM7Dhq2chkUrwpNuxQkz+eQ l0u6Sqgr8JBzWKEFymIQQBjA4Zgty0SWUCBRNpR2Juv7tIEcLZUOrMucj R+m3IWFpbBxwqk0NJtBsylfSHsRa5TiICZVyFDFnpEgNy46I7/1ARvbV0 o=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AZAADyFrJb/xbLJq1aGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVINeEoQciHSNKi2RG4VTgWYIA4RsAoQxNxUBAwEBAgE?= =?us-ascii?q?BAm0ohTgBAQEBAgEjVgULCxgqAgJXBgEMCAEBgx0BgXkIpByBLh+JXA+CbYV?= =?us-ascii?q?OdhCBWIIAgRIngmuEOggWgyeCVwKIYxuTXE8JhAGBZoNqhl0GF4kFhkqVMYF?= =?us-ascii?q?YIoFVMxoIGxU7gm2QVT2KagEkB4IgAQE?= X-IronPort-AV: E=Sophos;i="5.54,327,1534809600"; d="asc'?scan'208,217";a="6921976" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Oct 2018 12:47:32 +0000 Received: from [10.61.94.24] (ams3-vpn-dhcp7705.cisco.com [10.61.94.24]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTP id w91ClVkx019355; Mon, 1 Oct 2018 12:47:31 GMT To: Christian Huitema , Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <2df690be-21ac-bfc8-5ffd-e5b5b9d83a5f@cisco.com> Date: Mon, 1 Oct 2018 14:47:30 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <057bd957-06b4-824e-a7c8-214383819621@huitema.net> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gJihEWo3W3olZEykyEyFxsUWi3BreJY3D" X-Outbound-SMTP-Client: 10.61.94.24, ams3-vpn-dhcp7705.cisco.com X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2018 12:47:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gJihEWo3W3olZEykyEyFxsUWi3BreJY3D Content-Type: multipart/mixed; boundary="KZUrUXHIHU6NvkbcjJg7sTdlKsz0FvQuG"; protected-headers="v1" From: Eliot Lear To: Christian Huitema , Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate Message-ID: <2df690be-21ac-bfc8-5ffd-e5b5b9d83a5f@cisco.com> Subject: Re: Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> In-Reply-To: <057bd957-06b4-824e-a7c8-214383819621@huitema.net> --KZUrUXHIHU6NvkbcjJg7sTdlKsz0FvQuG Content-Type: multipart/alternative; boundary="------------FFFE7C9D5CC765E9FE4F0484" Content-Language: en-US This is a multi-part message in MIME format. --------------FFFE7C9D5CC765E9FE4F0484 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Christian, On 01.10.18 07:42, Christian Huitema wrote: > If the manufacturer is willing to issue "good until time=3DX" vouchers,= > then in theory you could provide the voucher to your buyer, provided th= e > time limit of the voucher has not elapsed. If the manufacturer signs a > voucher "good until infinity", then the device can in theory be sold an= d > resold forever. But that's probably not true in practice, because the > voucher is written for a specific domain, and includes the certificate > of the domain for which the voucher is good. You may be able to play > games with some kind of certificate chain and make it work, but I will > believe that when I see it. IMHO it should be possible as an option to not pin the domain.=C2=A0 In t= hat case, a voucher could be a scannable label or BOM that can be handed off directly with the device.=C2=A0 Obviously that's a nonceless option as we= ll.=C2=A0 Think of it as a file that one simply uploads to the registrar.=C2=A0 The= key thing here is that the manufacturer needs to make the decision for which devices it wants to do this.=C2=A0 This would also solve [6] in your list= of issues.=C2=A0 However, this mitigation will not always be appropriate, particularly for devices that may transit from one network to another, or where it is simply inconvenient to retain a label. Addressing some more of your LC comments: > 1) Denial of service against the vendor MASA service. Adversaries could= mount an > attack against the service at a critical time, preventing real-time iss= uance of > nonced vouchers. This could for example prevent the deployment of auton= omic networks > during emergencies. This can be mitigated by onboarding devices in inventory *before* the emergency.=C2=A0 It could also be mitigated as per the above. > 2) Compromise of the vendor's public key. This would allow attackers to= get > "ugly ducklings" imprinted in the domain. Let's be clearer, because there are two separate threats: 1. A compromised end point inappropriately being onboarded in order to attack a network; where the registrar is validating the signature and certificate; and 2. A perfectly fine endpoint being inappropriately onboarded to an unauthorized network; where the endpoint is validating the signature and certificate. Also, I think you are referring to the *private* key associated with a vendor certificate.=C2=A0 [1] can be mitigated by the registrar by the ve= ndor reissuing the voucher signing cert and checking a CRL.=C2=A0 [2] requires= a bit more care and a backup certificate of some form. > 3) Rotation of the vendor's public key. This could prevent old devices = from > joining the domain, or from verifying the new vouchers. Old certificates never die.=C2=A0 They just fade away.=C2=A0 More serious= ly, if the cert is used, it should be kept available, unless a backup is also provided. > 7) The closest to ship and forget is a MASA service configured to alway= s > issue vouchers, regardless of the device ID and the registrar domain. I= would > expect that to be popular with some manufacturers. It is mentioned in > section 6.4, which recommend that manufacturers should not do that. Wha= t > are the consequences if they still do?=20 In a wireless scenario this could be problematic, since the device could imprint on the first network seen.=C2=A0 This presumes something like draft-lear-eap-teap-brski.txt.=C2=A0 We haven't gotten that far, but it i= s clearly an issue and something we want to discuss in Bangkok.=C2=A0 In a wired environment this is less of an issue, although there are still risk= s. > 8) Attacks by the device. What happens if a device refuses to be imprin= ted? It will not be able to trust the local environment, and may not be able to retrieve a local certificate.=C2=A0 I presume lots of issues would cro= p up from there. > 11) Attacks by the MASA. What happens if the MASA refuses to provide a = voucher, > or provides a wrong voucher?=20 Same as above.=C2=A0 There is a mitigating factor against this behavior: = the cost of a support call. > 12) Device implementation of random numbers. The draft discusses manage= ment of=20 > time in a drop ship device, but what about the management of random num= bers? For > example, what if poorly manufactured devices always generated the same = nonce, > or a predictable nonce? Then we have bigger fish to fry.=C2=A0 The device's crypto is broken. > 13) Device individualization. The drop ship model assumes that devices = are > shipped with factory default, but BRSKI also assumes that devices come = with > individuals ID and certificate. This requires a specific per device ste= p in > the manufacturing process. Some makers of inexpensive devices don't do = that, > and ship devices that are all strictly identical. How does that affect = the > BRSKI process? It's a prerequisite, so... > 14) Privacy considerations. Third parties will be able to observe traff= ic > between domain registrar and service provider MASA. They will at a mini= mum > be able to learn that domain X is a customer of provider Y. Can they do= more? > The communication is protected by TLS. How much is revealed by clear > text components like the SNI? How much can be obtained by traffic > analysis? This could be mitigated by using unpinned vouchers that come with the device. Eliot --------------FFFE7C9D5CC765E9FE4F0484 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi Christian,

On 01.10.18 07:42, Christian Huitema wrote:
If the manufacturer is willing to issue "good until =
time=3DX" vouchers,
then in theory you could provide the voucher to your buyer, provided the
time limit of the voucher has not elapsed. If the manufacturer signs a
voucher "good until infinity", then the device can in theory be sold and
resold forever. But that's probably not true in practice, because the
voucher is written for a specific domain, and includes the certificate
of the domain for which the voucher is good. You may be able to play
games with some kind of certificate chain and make it work, but I will
believe that when I see it.

IMHO it should be possible as an option to not pin the domain.=C2=A0 = In that case, a voucher could be a scannable label or BOM that can be handed off directly with the device.=C2=A0 Obviously that's a noncele= ss option as well.=C2=A0 Think of it as a file that one simply uploads t= o the registrar.=C2=A0 The key thing here is that the manufacturer need= s to make the decision for which devices it wants to do this.=C2=A0 This w= ould also solve [6] in your list of issues.=C2=A0 However, this mitigation= will not always be appropriate, particularly for devices that may transit from one network to another, or where it is simply inconvenient to retain a label.

Addressing some more of your LC comments:

1) Denial of service against the vendor MASA service=
=2E Adversaries could mount an
attack against the service at a critical time, preventing real-time issua=
nce of
nonced vouchers. This could for example prevent the deployment of autonom=
ic networks
during emergencies.

This can be mitigated by onboarding devices in inventory before the emergency.=C2=A0 It could also be mitigated as per the above.
= 
2) Compromise of the vendor's public key. This would=
 allow attackers to get
"ugly ducklings" imprinted in the domain.

Let's be clearer, because there are two separate threats:
  1. A compromised end point inappropriately being onboarded in order to attack a network; where the registrar is validating the signature and certificate; and
  2. A perfectly fine endpoint being inappropriately onboarded to an unauthorized network; where the endpoint is validating the signature and certificate.
Also, I think you are referring to the private key associated with a vendor certificate.=C2=A0 [1] can be mitigated by t= he registrar by the vendor reissuing the voucher signing cert and checking a CRL.=C2=A0 [2] requires a bit more care and a backup certificate of some form.

3) Rotation of the vendor's public key. This could p=
revent old devices from
joining the domain, or from verifying the new vouchers.

Old certificates never die.=C2=A0 They just fade away.=C2=A0 More ser= iously, if the cert is used, it should be kept available, unless a backup is also provided.

7) The closest to ship and forget is a MASA service =
configured to always
issue vouchers, regardless of the device ID and the registrar domain. I w=
ould
expect that to be popular with some manufacturers. It is mentioned in
section 6.4, which recommend that manufacturers should not do that. What
are the consequences if they still do?

In a wireless scenario this could be problematic, since the device could imprint on the first network seen.=C2=A0 This presumes somethin= g like draft-lear-eap-teap-brski.txt.=C2=A0 We haven't gotten that far,= but it is clearly an issue and something we want to discuss in Bangkok.=C2= =A0 In a wired environment this is less of an issue, although there are still risks.

8) Attacks by the device. What happens if a device r=
efuses to be imprinted?

It will not be able to trust the local environment, and may not be able to retrieve a local certificate.=C2=A0 I presume lots of issues would crop up from there.
11) Attacks by the MASA. What happens if the MASA re=
fuses to provide a voucher,
or provides a wrong voucher?

Same as above.=C2=A0 There is a mitigating factor against this behavi= or: the cost of a support call.

12) Device implementation of random numbers. The dra=
ft discusses management of=20
time in a drop ship device, but what about the management of random numbe=
rs? For
example, what if poorly manufactured devices always generated the same no=
nce,
or a predictable nonce?

Then we have bigger fish to fry.=C2=A0 The device's crypto is broken.= 

13) Device individualization. The drop ship model as=
sumes that devices are
shipped with factory default, but BRSKI also assumes that devices come wi=
th
individuals ID and certificate. This requires a specific per device step =
in
the manufacturing process. Some makers of inexpensive devices don't do th=
at,
and ship devices that are all strictly identical. How does that affect th=
e
BRSKI process?

It's a prerequisite, so...
14) Privacy considerations. Third parties will be ab=
le to observe traffic
between domain registrar and service provider MASA. They will at a minimu=
m
be able to learn that domain X is a customer of provider Y. Can they do m=
ore?
The communication is protected by TLS. How much is revealed by clear
text components like the SNI? How much can be obtained by traffic
analysis?

This could be mitigated by using unpinned vouchers that come with the device.

Eliot

--------------FFFE7C9D5CC765E9FE4F0484-- --KZUrUXHIHU6NvkbcjJg7sTdlKsz0FvQuG-- --gJihEWo3W3olZEykyEyFxsUWi3BreJY3D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAluyF2IACgkQh7ZrRtnS ejOpygf/YkmgI7VMTKWMCIWraz1fnT9CEbYRdMXffqyE53VY8K9OD07paUJ5ncY6 jc9ifyJCQcViEmVJUIasgc5j/hf88kpOOqFo0e2BUGODG3z3HMX2ueG0BS2vUI4T yWNggLKDPBvWarxo6DYYxfGhf2oSmPr4OCPhKAQGXzhIzHWGxf1zTiZotM1xHjr9 XpHEkv7WSWMh0PVmBMJwiOJy1WKtwaDhUm+CqKEawXCckVAI7I7L6cJYbyycQ9BD kGRzWBYDxt13IwEZCuPwNI8LY5FDiH390L9VMk1auKPDjHIED6HzV4GDtDFaT2Z0 qufwgAyLFzVN2TadL4a7uAEAY2xQiw== =3VTU -----END PGP SIGNATURE----- --gJihEWo3W3olZEykyEyFxsUWi3BreJY3D-- From nobody Mon Oct 1 12:37:24 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 350CA130EDE; Mon, 1 Oct 2018 12:37:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mZJD4qZNYM8o; Mon, 1 Oct 2018 12:37:03 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6DE5130EC9; Mon, 1 Oct 2018 12:37:03 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7401-0000i6-7c; Mon, 01 Oct 2018 19:36:57 +0000 Date: Mon, 01 Oct 2018 12:36:56 -0700 Message-ID: From: Randy Bush To: Michael Richardson Cc: "Joel M. Halpern" , Brian E Carpenter , Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate In-Reply-To: <3136.1538342967@localhost> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <0cbdf93d-c432-57f5-5000-8595b006d6d0@gmail.com> <3136.1538342967@localhost> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2018 19:37:15 -0000 >> a stunning review as usual. but i have two questions which you kind >> of finessed. they are simple binary, i.e. yes/no, questions that the >> end user, to whom the IETF is ultimately responsible, really cares >> about. > >> if the manufacturer's servers go down, either permanently or even for >> a day, does the device i have purchased still work? i.e. is it fail >> soft? [0] > > First, BRSKI as used by ANIMA is specifically not targetted at Things. > (We are developing profiles of BRSKI that are about Things, but I > think that this internet-draft should not be be evaluated on that > basis). > > It's targetted at routers and other devices found at ISPs or > Enterprises. i missed where i said light bulbs. i do have some of those, but i run routers, servers, etc.; and do not want $vendor to break my network for *any* reason. > Second, the only time the manufacturer's servers need to be alive is > when device ownership is claimed. i.e. when i sell the router to some other op. that was my second question. > Once the device is claimed, it joins *YOUR* network, and trusts your > infrastructure, not the manufacturer. Whether or not the device will > *operate* without the manufacturer's servers is really outside of > BRSKI. ahhh. we just sell the guns, we do not say how they are used. >> That answer seems to imply that if the MASA is down before I try to >> transfer my device, and if the MASA is still down when the recipient >> tries to get my device working, it won't work. > >> Which seems to mean that once a MASA goes down permanently, any new >> can not get a device reliant on that MASA to work. > >> Seems a pretty severe limitation. > > You are answering a different question than Randy asked no. he is speaking to the second question i asked. and his answer deeply concerns me. > This is a pretty important question and we have discussed it at > length. I remain concerned, but as far as I can see, we have this > problem already. if i understand correctly, it creates a new problem, needing the manufacturer's consent for me to resell my light^Hrouter. > It fundamentally depends upon a number of things which unfortunately, the > manufacturer has ultimate decision making about. see above about guns randy From nobody Mon Oct 1 14:47:49 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9C14130E16; Mon, 1 Oct 2018 14:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KaXNZythURds; Mon, 1 Oct 2018 14:47:31 -0700 (PDT) Received: from mail-pf1-x436.google.com (mail-pf1-x436.google.com [IPv6:2607:f8b0:4864:20::436]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE66A130EC0; Mon, 1 Oct 2018 14:47:31 -0700 (PDT) Received: by mail-pf1-x436.google.com with SMTP id p24-v6so1697129pff.10; Mon, 01 Oct 2018 14:47:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=s6Vur4LMpNXyMO7Jswd2CEC8I24lJS4WG4Odp2xZI9A=; b=IHCUOEelgkVWdqU/TnMM18lAH5AxyF9ulJsjMeUuAzLRfTNSzVw/N9JXGEuOopl08M TmqI3Y0bZrOKVxCNYBIqC1W2nEzQWCBk4R35e+8kCuzBPWDjVFMZxcG+6WTiKzXKjqe2 4xpDE7/juehc7vHw/YSbwI+IDraOH6Qqnxbv4YUtUKEtjqAJrng5rJYzeUhmNaSI7K8a mFownzOE9VfGi2ufiYdQik61K5hKTta+xCQd9WBv8WqMTkhAv7Iu4qS3yzQp5gAu4MSF CLa8ZkO4Z1gEdrtiA+UJKGJ1qPb83wEkAaarKLjPu0UjfDp6kxhEkzmZoeZsCgYDarE5 r8yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=s6Vur4LMpNXyMO7Jswd2CEC8I24lJS4WG4Odp2xZI9A=; b=moon0Tnzt66Yl9IZKeryJN2mQZUMFIy49WX8dQCGNrQ4DkwZ+0lIAM/BEKapW2xVo1 eeXWdn0wfUjCA0RMIwvpKeh8klXiOj2mXK4kp1tx1v9CyQCB1XrUc9tck/BauUB8tPwM Fd+4T2hEKlIU8yMmq52xiZ9aTVNLLVEcC/KewEt4L/yoiMvBBZPjWyC5CAzG+c+jCHm3 2k67wrDcVHneNHlu2oXh4PYmFGlMCdcsXkSr/Fi5A6KgwXulFtdk3HzRn2za0fbmbXr9 bR7yvXKe2cd+Y8KRz9jNIsvBv3Cu5LTvag6DafrJrAWDK0cT4xRvU5NxNX8WYExFnz3o Ox5Q== X-Gm-Message-State: ABuFfojgRGXwtG9KZZ53e9LsMZdCyihpisTHhu5fm0oPyiGHsEI5UZRO Mi76t4IwGJEYQTodVcjnkhnX387r X-Google-Smtp-Source: ACcGV63NpOL5ltarTKfVNyuCrAADOkSKKE5jtWOV70og14D15S+UliFXGIEyS+zSbMvrlLsyeC4xEg== X-Received: by 2002:a17:902:758b:: with SMTP id j11-v6mr13717604pll.5.1538430451047; Mon, 01 Oct 2018 14:47:31 -0700 (PDT) Received: from [130.216.38.15] (ggim001.sfac.auckland.ac.nz. [130.216.38.15]) by smtp.gmail.com with ESMTPSA id v81-v6sm29708505pfj.25.2018.10.01.14.47.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 01 Oct 2018 14:47:30 -0700 (PDT) To: Randy Bush , Michael Richardson Cc: "Joel M. Halpern" , Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF discussion list , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <0cbdf93d-c432-57f5-5000-8595b006d6d0@gmail.com> <3136.1538342967@localhost> From: Brian E Carpenter Message-ID: <8303d9ed-237e-1960-cf2f-d277a92338f7@gmail.com> Date: Tue, 2 Oct 2018 10:44:56 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2018 21:47:34 -0000 On 2018-10-02 08:36, Randy Bush wrote: >>> a stunning review as usual. but i have two questions which you kind >>> of finessed. they are simple binary, i.e. yes/no, questions that the >>> end user, to whom the IETF is ultimately responsible, really cares >>> about. >> >>> if the manufacturer's servers go down, either permanently or even for >>> a day, does the device i have purchased still work? i.e. is it fail >>> soft? [0] >> >> First, BRSKI as used by ANIMA is specifically not targetted at Things. >> (We are developing profiles of BRSKI that are about Things, but I >> think that this internet-draft should not be be evaluated on that >> basis). >> >> It's targetted at routers and other devices found at ISPs or >> Enterprises. > > i missed where i said light bulbs. i do have some of those, but i run > routers, servers, etc.; and do not want $vendor to break my network for > *any* reason. > >> Second, the only time the manufacturer's servers need to be alive is >> when device ownership is claimed. > > i.e. when i sell the router to some other op. that was my second > question. > >> Once the device is claimed, it joins *YOUR* network, and trusts your >> infrastructure, not the manufacturer. Whether or not the device will >> *operate* without the manufacturer's servers is really outside of >> BRSKI. > > ahhh. we just sell the guns, we do not say how they are used. It's not quite that. We sell X's. We cannot control how the X's are used. But if they are used without calling home to our MASA, we cannot certify that they are genuine X's. They might be counterfeit X's. BRSKI is a way of proving that the X announcing its identity as X12345 really is the one and only X12345. If you sell it to someone who doesn't care about that, they can use it anyway. Anyway, that's how I understand it. Brian > >>> That answer seems to imply that if the MASA is down before I try to >>> transfer my device, and if the MASA is still down when the recipient >>> tries to get my device working, it won't work. >> >>> Which seems to mean that once a MASA goes down permanently, any new >>> can not get a device reliant on that MASA to work. >> >>> Seems a pretty severe limitation. >> >> You are answering a different question than Randy asked > > no. he is speaking to the second question i asked. and his answer > deeply concerns me. > >> This is a pretty important question and we have discussed it at >> length. I remain concerned, but as far as I can see, we have this >> problem already. > > if i understand correctly, it creates a new problem, needing the > manufacturer's consent for me to resell my light^Hrouter. > >> It fundamentally depends upon a number of things which unfortunately, the >> manufacturer has ultimate decision making about. > > see above about guns > > randy > From nobody Mon Oct 1 15:45:06 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E242A129619; Mon, 1 Oct 2018 15:44:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y8rZNIa2OdhD; Mon, 1 Oct 2018 15:44:54 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F7D2124C04; Mon, 1 Oct 2018 15:44:54 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g76vs-0001P4-8M; Mon, 01 Oct 2018 22:44:52 +0000 Date: Mon, 01 Oct 2018 15:44:51 -0700 Message-ID: From: Randy Bush To: Christian Huitema Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate In-Reply-To: <057bd957-06b4-824e-a7c8-214383819621@huitema.net> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Oct 2018 22:44:56 -0000 > The "soft fail" happens if devices need to be reset to factory > settings for some reason, then you will have to wait for the > manufacturer's servers to bring them back up. when i sell the lightb^Hrouter to mary, of course i reset to factory settings. > That may be mitigated if the manufacturer provided you with nonceless > vouchers, valid until "time=3DX", and in particular if the manufacturer > gave you vouchers "good until infinity". In that case, your old > devices could still be reset to factory condition and restarted, > without even "soft fail". dear world: be absolutely sure that, when you buy a lightb^Hrouter, you get a nonceless voucher with an infinite lifetime. before handing them your cash, you can test this by .... right how about the spec says that "the manufacturer MUST accompany the lightb^Hrouter with a nonceless voucher with an infinite lifetime. purchasers who, for whatever reason, with more restricted vouchers may negotiate." >> if the manufacturer's servers go down, either permanently or even for >> a day, can i give/sell the device i have purchased to a third, well >> fourth i guess, party, at my whim and seamlessly unencumbered? >=20 > It depends somewhat on the type of voucher that the manufacturer is > willing to give you, but the short answer is No, you can't. >=20 > If the manufacturer only wants to provide real time vouchers that > incorporate the random nonce issued by the device, then the answer is > very clearly no, you cannot resell the device without approval from the > manufacturer. The voucher in that case acts as a kind of DRM. then i strongly object to the ietf specifying this; c.f. selling guns. =20 > If the manufacturer is willing to issue "good until time=3DX" vouchers, > then in theory you could provide the voucher to your buyer, provided the > time limit of the voucher has not elapsed. If the manufacturer signs a > voucher "good until infinity", then the device can in theory be sold and > resold forever. But that's probably not true in practice, because the > voucher is written for a specific domain, and includes the certificate > of the domain for which the voucher is good. You may be able to play > games with some kind of certificate chain and make it work, but I will > believe that when I see it. i.e. practically you can not resell something you thought you had bought. baaaaaad. > The BRSKI specification is a tradeoff and that's why I would really > like to see the tradeoff explained in clear terms in the spec. It is > designed to prevent hijacking of the device during its registration in > the buyer's network. if, to actually own a device i bought, i need to manage my own security, then i will take that. > If BRSKI implemented a pure RFC 7030 process, the device=A0 might have > to accept to be imprinted by the registrar without having verified to > whom it is talking. In practice that would mean relying on some kind > of physical security, or maybe relying on the kind of trust anchors > commonly used for web services. From the registrar point of view, the > failure mode is that some kind of man-in-the-middle inserts itself > during the registration process, and maintains control of the device > after it is connected to the network. >=20 > The voucher system mitigates that risk, but at the cost of strong > dependency on the manufacturer. As I say, that's a trade-off, and I > could see different buyers having different opinions on that > dependency. In fact, I could see buyers willing to buy devices only > if they permitted "voucher-less" initialization. If the standard > allowed that option, then market forces would quickly define how > valuable the voucher system is. two problems. the buyer will not realize that they just rented the lightb^Hrouter until they go to sell it; way too late to do anything about it. the manufactures have very small incentive to lower drm barriers. i can point to a jillion current examples. my favorite of the week is john deere. randy From nobody Mon Oct 1 17:28:20 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B45D9126CB6; Mon, 1 Oct 2018 17:28:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v7c8TWRr-MIe; Mon, 1 Oct 2018 17:28:09 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35074124C04; Mon, 1 Oct 2018 17:28:09 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 9265720090; Mon, 1 Oct 2018 20:28:07 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 3D3FF1537; Mon, 1 Oct 2018 20:28:08 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 38EBBAE0; Mon, 1 Oct 2018 20:28:08 -0400 (EDT) From: Michael Richardson To: Randy Bush cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <0cbdf93d-c432-57f5-5000-8595b006d6d0@gmail.com> <3136.1538342967@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 00:28:12 -0000 --=-=-= Content-Type: text/plain Randy Bush wrote: >>> a stunning review as usual. but i have two questions which you kind >>> of finessed. they are simple binary, i.e. yes/no, questions that the >>> end user, to whom the IETF is ultimately responsible, really cares >>> about. >> >>> if the manufacturer's servers go down, either permanently or even for >>> a day, does the device i have purchased still work? i.e. is it fail >>> soft? [0] >> >> First, BRSKI as used by ANIMA is specifically not targetted at Things. >> (We are developing profiles of BRSKI that are about Things, but I >> think that this internet-draft should not be be evaluated on that >> basis). >> >> It's targetted at routers and other devices found at ISPs or >> Enterprises. > i missed where i said light bulbs. i do have some of those, but i run > routers, servers, etc.; and do not want $vendor to break my network for > *any* reason. Then I suggest that you never patch the OS or apply firmware updates :-) The reality is that they can break your network trivially if they want to. But, you have a contract that says that they won't do that. >> Second, the only time the manufacturer's servers need to be alive is >> when device ownership is claimed. > i.e. when i sell the router to some other op. that was my second > question. Yes, so when you sell the router, whether or not the buyer gets firmware updates, the export firmware, or even a license is also up to the vendor, and so the vendor already has a say. This really changes nothing, except that it formalizes the arrangement in computer code rather than legal code. I'm not particularly happy about this, btw, but I don't see a way to both do secure imprinting and liberate the end user from vendor control. If you have a way to solve this tussle, I'd really like to know. >> Once the device is claimed, it joins *YOUR* network, and trusts your >> infrastructure, not the manufacturer. Whether or not the device will >> *operate* without the manufacturer's servers is really outside of >> BRSKI. > ahhh. we just sell the guns, we do not say how they are used. naw, we just sell 3D printers, we do not say how they are used. >> This is a pretty important question and we have discussed it at >> length. I remain concerned, but as far as I can see, we have this >> problem already. > if i understand correctly, it creates a new problem, needing the > manufacturer's consent for me to resell my light^Hrouter. Yes, but operators already had this problem. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluyu5cACgkQgItw+93Q 3WWKiQf+OPn8ipGAzsk4PKHSKUdQfgcpGmVTBFyEvyrMmR3xyi8PjCgLlp42tFU7 BL0qadKNE0LxYr2l7BwTxHNGJ1pYV+M0ZV02h9Vtjg1w/19t9qsUPCzkQkW1kbqQ 4eErnfLWBxzqK8Wduwu1EumbuNOGgm7G/RinljuS5X1wcfemlLUcp+Fw+R6VxP94 6HXoh4CCtcZOOYRIBi0aQJDwvJR4vH4FCL04Zv+AWjPMZFT2dLqVhJ5IFaTc5+Cg gfnZcgij+IhYzganB9nGzXA42oRHZqW5rSswPapyEfV9mJiEWLoAfPsn/820j6Aj r+8N1Lc0X/8YVg6PaRnny69G3oitHA== =A4CK -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Oct 1 17:32:34 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2E56126CB6; Mon, 1 Oct 2018 17:32:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KR9jyFwa94Er; Mon, 1 Oct 2018 17:32:29 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90461124C04; Mon, 1 Oct 2018 17:32:29 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 0DF5620090; Mon, 1 Oct 2018 20:32:28 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id B4C2F1537; Mon, 1 Oct 2018 20:32:28 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id B13D5AE0; Mon, 1 Oct 2018 20:32:28 -0400 (EDT) From: Michael Richardson To: Randy Bush , Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, anima@ietf.org, Security Directorate In-Reply-To: <8303d9ed-237e-1960-cf2f-d277a92338f7@gmail.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <0cbdf93d-c432-57f5-5000-8595b006d6d0@gmail.com> <3136.1538342967@localhost> <8303d9ed-237e-1960-cf2f-d277a92338f7@gmail.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 00:32:32 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: > It's not quite that. > We sell X's. We cannot control how the X's are used. But if they are > used without calling home to our MASA, we cannot certify that they are > genuine X's. They might be counterfeit X's. Or, they might be genuine X's running trojaned's software. The fact that between leaving seller A and buyer C, they were activated by attacker M will be in the MASA's audit log, if buyer C looks. {Can attacker M replace software via serial console without leaving a trace? Not BRSKI's problem exactly, but it's certainly a concern} > BRSKI is a way of proving that the X announcing its identity as X12345 > really is the one and only X12345. > If you sell it to someone who doesn't care about that, they can use it > anyway. Depending upon the software in X, you may be able to hook up a craft/serial console and just configure it the way you want, just like you do today. Or it might be some new-fangled SDN switch that won't operate with a controller attached, and it doesn't even have a serial console. Nothing I can do will change that. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluyvJwACgkQgItw+93Q 3WVo7Af/fSlpLqGMU4OuRP1YaDhmUYOdT+OzYulfGPkqG6BQ1xzGAzdmoIGkVgHe yy/hck+z0NbI0eI3ekJIQ9exBtNXqo3xOrsWUMKvN1gN4PEqMnZ5BPm9wQTOJgB9 fLtReT2XGBhqIg4+vrtA+SWS/J/k0zGsVitGihG/qHASv5sCp0goM4feA21l9WfO ONksjiaJ0iHKK8QVDAu4J0B1eX1s4t5gm0JBJp/XtD2zGXj6OostdtB+MpZa0J25 NR//UCjG0Yr9pxhh3ojcBM1Wifjzv7z+CquQeBzY/rlDXFIFrU1qjOavlfsbSzwd mEhVpP3ov+nmF1KFwIM3qjPJhktBKw== =5AKc -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Oct 1 18:07:15 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CA42126CB6; Mon, 1 Oct 2018 18:07:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sz9bMKQdw1GF; Mon, 1 Oct 2018 18:07:06 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFBC6124C04; Mon, 1 Oct 2018 18:07:05 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 13F5320090; Mon, 1 Oct 2018 21:07:04 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id B54B21537; Mon, 1 Oct 2018 21:07:04 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id B09B6AE0; Mon, 1 Oct 2018 21:07:04 -0400 (EDT) From: Michael Richardson To: Randy Bush cc: Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 01:07:07 -0000 --=-=-= Content-Type: text/plain Randy Bush wrote: >> The BRSKI specification is a tradeoff and that's why I would really >> like to see the tradeoff explained in clear terms in the spec. It is >> designed to prevent hijacking of the device during its registration in >> the buyer's network. > if, to actually own a device i bought, i need to manage my own > security, then i will take that. I think that this is already the case, and I see BRSKI as a mechanism by which to safely handoff control from the manufacturer to the owner. If the manufacturer doesn't want to do this, BRSKI isn't very useful to them. They should retain control of the device via their cloud infrastructure, and not let the end user have any control at all. > the manufactures have very small incentive to lower drm barriers. i > can point to a jillion current examples. my favorite of the week is > john deere. You are right. But at least it's clear that john deere actually owns the tractor, not the farmer and walk away from the mortgage. It's not a pretty picture, but I don't think we are making the situation worse: there is already DRM and TPM. What we are doing is making it clear that the tractor is actually owned, and not p0wned. However, I'm not sure that BRSKI has a value for large devices with real user interfaces. Maybe it has value for implements though. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluyxLgACgkQgItw+93Q 3WVrcAgAriqToqpvzaWt6001Z/RlAoVwhVBvoSZmFdCnn+Nwx/rnQDYjFJG0hijj T7bov2B2Vt56P8OEinl5Zwnq2l4qLAp8RuEU8m0rW0bOg9drKOR3F3+2IoZtdLH3 rdHEN7nrxN5yIo2PFtOIBj689nXOSxDfFZAQBbD928q9gAmHIrYEQOBhFzZYBqUL qIO2jqCv4XQbsgXO8Z46odUfliQ2H99qH8PuGIjhP2Y/377nhSZzu+MSVZx5x5tO PponiE49GwwEBkhMMxuIaGyvQ5CdwNWtmo06eysCIeTJ0EZzJmdZLshQ38ipcbBh EOku+ACO1n3vPzooRpYLA4PHKr/0hw== =oH9n -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Oct 1 23:53:38 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2384D128B14; Mon, 1 Oct 2018 23:53:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.957 X-Spam-Level: X-Spam-Status: No, score=-14.957 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.456, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zpn4mBRPCXvj; Mon, 1 Oct 2018 23:53:34 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0F77130E14; Mon, 1 Oct 2018 23:53:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2028; q=dns/txt; s=iport; t=1538463212; x=1539672812; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=VsSz0uQik/ipShhRjd/lMyOGAEDiH4WWl5nq8E97YFQ=; b=mT/sJftVoDs6055gt9XY2KDX8SM18FkSiK7h6Z51P8whZYxA7NCGJZQh HW9E259iTCoCAiQRZPqH6Wy5Diun1tvcvUlGFLABp/SP5MNC8pGcRg7Zp LLymoSoJ4Vkk1YTovcurMCn6TA33uq+eOe17znZwN4Tr0rVrFferpLS0I A=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BTAADZE7Nb/xbLJq1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGFMhKEHIh0jRstlnCBZggDhGwChDk4FAEDAQECAQECbSi?= =?us-ascii?q?FOQEFI1YQCxgqAgJXBgEMCAEBFYMIAYIBpTeBLooQD4JtiCuCAIE5gj0uhGe?= =?us-ascii?q?DGIJXAohklFYJhAGBaIpJBheBOgGHUoZNlTeBWSGBVTMaCBsVgyiCTI4JPY4?= =?us-ascii?q?AAQE?= X-IronPort-AV: E=Sophos; i="5.54,330,1534809600"; d="asc'?scan'208"; a="6935203" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Oct 2018 06:53:29 +0000 Received: from [10.61.94.24] (ams3-vpn-dhcp7705.cisco.com [10.61.94.24]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTP id w926rSfN007880; Tue, 2 Oct 2018 06:53:29 GMT To: Randy Bush , Christian Huitema Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: Date: Tue, 2 Oct 2018 08:53:30 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="mHBIiA4gvzbBGDATbrEUcoJNRYiH8F6qW" X-Outbound-SMTP-Client: 10.61.94.24, ams3-vpn-dhcp7705.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 06:53:36 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --mHBIiA4gvzbBGDATbrEUcoJNRYiH8F6qW Content-Type: multipart/mixed; boundary="IZl78ocgpfyg34izfs8TvJSwcWYYJ9dre"; protected-headers="v1" From: Eliot Lear To: Randy Bush , Christian Huitema Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate Message-ID: Subject: Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> In-Reply-To: --IZl78ocgpfyg34izfs8TvJSwcWYYJ9dre Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US On 02.10.18 00:44, Randy Bush wrote: > when i sell the lightb^Hrouter to mary, of course i reset to factory > settings. Great.=C2=A0 Mary can register the device with light^hrouter manufacturer= and life goes on. Eliot --IZl78ocgpfyg34izfs8TvJSwcWYYJ9dre-- --mHBIiA4gvzbBGDATbrEUcoJNRYiH8F6qW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAluzFeoACgkQh7ZrRtnS ejN90wf/Yen2BSSLhzd9SQbqRv8TyscrERJ/YE/U08do7pX2T7OdI4CCXmJmFGrT EvSiW0CEMwTniq1PUrFoCmXbzWI/4BW1gGSP+luds1Ch8zLsyLABfTz8+kYKzU87 v6ettBUBLVphgHwKdPh0KXkhqChyFgXsCLkstrpQSa2F9VLAbEkt0bo2DXzL2AoX MnjTtzPHhASBL217D0IjoR6v+SIgHij+dhTyLjeki6b+h0/mKsveXEEX9dk3R47K G4uM/Uh1255hNVTCEm05UyP0wyW8vzv84u6NYhqSI1+O+Ogh63JBy00Yh8n08d3Q hnvPYi+S3gw99/OPwyQg6TJ/EBxc2Q== =GjiY -----END PGP SIGNATURE----- --mHBIiA4gvzbBGDATbrEUcoJNRYiH8F6qW-- From nobody Tue Oct 2 04:21:34 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51730126BED; Tue, 2 Oct 2018 04:21:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pj_TKCXGTmYp; Tue, 2 Oct 2018 04:21:31 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58A19130DDD; Tue, 2 Oct 2018 04:21:31 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7Ik2-0004fE-Mh; Tue, 02 Oct 2018 11:21:26 +0000 Date: Tue, 02 Oct 2018 04:21:25 -0700 Message-ID: From: Randy Bush To: Eliot Lear Cc: Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 11:21:33 -0000 >> when i sell the lightb^Hrouter to mary, of course i reset to factory >> settings. >=20 > Great.=A0 Mary can register the device with light^hrouter manufacturer > and life goes on. iff the manufacturer still exists and the manufacture is willing. you and others seem to be missing that there is a major right of ownership war going on out here in the real world. randy From nobody Tue Oct 2 05:28:35 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5ACC5130DF6; Tue, 2 Oct 2018 05:28:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.957 X-Spam-Level: X-Spam-Status: No, score=-14.957 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.456, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YSCG_jKCMB6v; Tue, 2 Oct 2018 05:28:30 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4472127598; Tue, 2 Oct 2018 05:28:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3584; q=dns/txt; s=iport; t=1538483310; x=1539692910; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=8Gv5Czrt/DhmoP2K9wKZdxr2S8OWXww42a/nZJ44jME=; b=h8hWIMhtw0RJM8fx7uJyooOd5UBprNR/DADq5PSY6tdbgFSJwCoSxvTk bXvJa6VSHD3lOColFPAINlaIkgOtUbGU2LsGM35AeW0D7DZWQNypFYvC1 Z4Kg8cygcOaqmTw3aU48y3Hvbku1Ap8CUuNqFaT3qsugtKNfuy1BcmLd9 Y=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AiAAD4Y7Nb/xbLJq1aGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBVINeEoQciHSNSZZwgWYIA4F3gnUChC43FQEDAQECAQECbSi?= =?us-ascii?q?FOQEFI1YQCxgqAgJXBg0IAQEVAoMGAYIBpTqBLooND4JtiC2CAIE5gW1QLoR?= =?us-ascii?q?ngxiCVwKIZJRYCYQBgWiKSQYXiQ2GTZVAgVgigVUzGggbFYMogiQXEY4JPY8?= =?us-ascii?q?AAQE?= X-IronPort-AV: E=Sophos; i="5.54,331,1534809600"; d="asc'?scan'208"; a="6884293" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Oct 2018 12:28:27 +0000 Received: from [10.61.94.24] (ams3-vpn-dhcp7705.cisco.com [10.61.94.24]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTP id w92CSRgv003734; Tue, 2 Oct 2018 12:28:27 GMT To: Randy Bush Cc: Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> Date: Tue, 2 Oct 2018 14:28:28 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="981ih7QmMURQLEwL07H96ixPyUQlTuSjH" X-Outbound-SMTP-Client: 10.61.94.24, ams3-vpn-dhcp7705.cisco.com X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 12:28:32 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --981ih7QmMURQLEwL07H96ixPyUQlTuSjH Content-Type: multipart/mixed; boundary="caSgmM5l1X2XeNJf9IG7t9GzBummopEyD"; protected-headers="v1" From: Eliot Lear To: Randy Bush Cc: Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate Message-ID: <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> Subject: Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> In-Reply-To: --caSgmM5l1X2XeNJf9IG7t9GzBummopEyD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Randy On 02.10.18 13:21, Randy Bush wrote: >>> when i sell the lightb^Hrouter to mary, of course i reset to factory >>> settings. >> Great.=C2=A0 Mary can register the device with light^hrouter manufactu= rer >> and life goes on. > iff the manufacturer still exists and the manufacture is willing. > > you and others seem to be missing that there is a major right of > ownership war going on out here in the real world. > > I think we've lost sight of what we're talking about.=C2=A0 We're talking= about a completely automated method for a local trust anchor to be installed on a device, and a kick to EST for the device to receive a local credential.=C2=A0 For that to happen there needs to be a trusted introduction, and the device manufacturer or its agent is in the best position to do that. There are many ways for a manufacturer to lock a device to a deployment without this, just one example being a software license that gets erased on device reset (remember?=C2=A0 you said you were going to perform a dev= ice reset).=C2=A0 I'd suggest that we not get wrapped around the axle over th= e ownership war.=C2=A0 I would be more concerned about what happens if the manufacturer goes out of business.=C2=A0 I think that's a bigger deal, but can I ask that w= e also consider that problem with some more experience under our belts?=C2=A0= I could easily envision a few solutions, but better would be to face down the problem with some more code and deployment.=C2=A0 BTW, manufacturer g= oing out of business also means no more {bug fixes, security patches, h/w support, etc}, and so zooming in and just dealing with this may be suboptimal. Eliot --caSgmM5l1X2XeNJf9IG7t9GzBummopEyD-- --981ih7QmMURQLEwL07H96ixPyUQlTuSjH Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAluzZGwACgkQh7ZrRtnS ejPECQf9F1/qVd9vmNdYUyfWMxzHswq/ljodJwlnD2WMLIVDMvtrNIbnjMk3H9In ixpBK1q9+p9vlWdEnKHzICJvGusg/NVLO9FZm2UH/QSEVVNcFLtz/yUQSvXM33BC tPgwUUx3NtiaOtr2OnpK8897cBInoe4KxlC6V4y36RCNil9qsywBC972cIRCX0ab VbFmNGB0neAL4EOiVc3QAuBrXhehtEbQE8vutmtBUrMMLA9DOUAKH1UZ2yF0aiG2 630FXeStC+GUzZUydsJIk97QVAiik5dmz+ISxAqaQnCOPRSTrMYSUtctZnRxGYMV v3pex2jABm8Qt4JUYyXuL8nExnINUw== =WSHg -----END PGP SIGNATURE----- --981ih7QmMURQLEwL07H96ixPyUQlTuSjH-- From nobody Tue Oct 2 05:42:04 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E47FD1277D2; Tue, 2 Oct 2018 05:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jPB1ISBYmJRQ; Tue, 2 Oct 2018 05:41:47 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DB21124D68; Tue, 2 Oct 2018 05:41:47 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7Jzj-0005P5-9H; Tue, 02 Oct 2018 12:41:43 +0000 Date: Tue, 02 Oct 2018 05:41:42 -0700 Message-ID: From: Randy Bush To: Eliot Lear Cc: Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate In-Reply-To: <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 12:41:49 -0000 > I think we've lost sight of what we're talking about.=A0 We're talking > about a completely automated method for a local trust anchor to be > installed on a device, and a kick to EST for the device to receive a > local credential.=A0 For that to happen there needs to be a trusted > introduction, and the device manufacturer or its agent is in the best > position to do that. no. the owner's trust controller is. randy From nobody Tue Oct 2 11:20:38 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 969CF131165 for ; Tue, 2 Oct 2018 11:20:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TUHi-3umeecb for ; Tue, 2 Oct 2018 11:20:13 -0700 (PDT) Received: from mail-yw1-xc36.google.com (mail-yw1-xc36.google.com [IPv6:2607:f8b0:4864:20::c36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EBEC131188 for ; Tue, 2 Oct 2018 11:20:06 -0700 (PDT) Received: by mail-yw1-xc36.google.com with SMTP id m129-v6so1174497ywc.1 for ; Tue, 02 Oct 2018 11:20:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=gKbf2s4R/eQAFu+inewXkAYmdCohSvIIa8Uj5iPp1k0=; b=bewdmOUtrFUBMYNhltm5C6TaS50+u4nnUool8cPSfmcuFMGMtDidWmb5t6dP1EsRof UYwrxzK/om6yZ38gFbNFh0Lym6t30LXQ279zk+FX19ICay90+HcGiPZVCo/Nqzt4scjo F+puitzD9IPRHcJ+xgnVIEy6N6jzsKF0VvlpMtWW8AivwOFymKtDqdfuBj18qCQjmx9w Q22kdq3n+e3zdgakilHQuffR2xoQ8l9XFu1Hfgmugsjc1oYkUNABBUUTRV/PvhyIRmQv KxFk+EzjmBXDp2BLIuVaiU9g4/mmUZVlyAmi8zh4hGY2kp9lwHfm88MXuvGUTsoQnUPJ ZPFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=gKbf2s4R/eQAFu+inewXkAYmdCohSvIIa8Uj5iPp1k0=; b=VnZLkiYXO4yhjos5LlL4yj7ffk59JSq5btYXlrX908OV99E2/nKGakXxxh6IE4MHiQ 726QiCjpUQROi8XrNNpFETNaKxKvqNarB82HypObAVBbXsY0zffusrAYOLIB1sDNckJB 98R7pL+9PgMWPqsZfiiete/ac+KTRATjQc3u8C97z+akET9+AvX9xYvpYjCA0yLWWZi7 YTxNunH14raxaI60cSmw8o1PzU4LuFHpW9O31T0JYdzKotSbj55cUmIsDIdgSdbQZ9IP /sVCAeq1NtHjU4WbR2on13Bi0mLapSHlTepCVtkExnE7Q3BnGgGTXgKAJVzM4pAn2kA3 kC7w== X-Gm-Message-State: ABuFfohiGmk6cjAWuEHykRrpbcjtqXBJT9wtrlzqYM20zIILRH+DigZk gb6ywXPpIX/ECm+eXJrkVGp/jA== X-Google-Smtp-Source: ACcGV62YMxFY8d4ashTiXpxZTrlL3yIhp5Lx5EUD+VlvDq7n+p5W1w/YELU8LzmN9tq6fBUtkjBBRw== X-Received: by 2002:a81:4fd4:: with SMTP id d203-v6mr9292894ywb.71.1538504406055; Tue, 02 Oct 2018 11:20:06 -0700 (PDT) Received: from [10.0.100.12] (c-73-167-89-221.hsd1.ma.comcast.net. [73.167.89.221]) by smtp.gmail.com with ESMTPSA id 200-v6sm6648664ywr.102.2018.10.02.11.20.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 11:20:04 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_85F2328B-CBC1-498D-9A7E-2A85ADB8C27B" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Tue, 2 Oct 2018 14:20:02 -0400 In-Reply-To: <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> Cc: Randy Bush , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, Christian Huitema , IETF Rinse Repeat , anima@ietf.org, Security Directorate To: Eliot Lear References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 18:20:20 -0000 --Apple-Mail=_85F2328B-CBC1-498D-9A7E-2A85ADB8C27B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Oct 2, 2018, at 8:28 AM, Eliot Lear wrote: > I would be more concerned about what happens if the manufacturer goes > out of business. I think that's a bigger deal, but can I ask that we > also consider that problem with some more experience under our belts? = I > could easily envision a few solutions, but better would be to face = down > the problem with some more code and deployment. BTW, manufacturer = going > out of business also means no more {bug fixes, security patches, h/w > support, etc}, and so zooming in and just dealing with this may be > suboptimal. The manufacturer-going-out-of-business use case argues for there being a = way that a person with physical access to the unit can re-key it without = contacting the manufacturer. It also argues for open source, but = that's out of scope. :) --Apple-Mail=_85F2328B-CBC1-498D-9A7E-2A85ADB8C27B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Oct 2, 2018, at 8:28 AM, Eliot Lear <lear@cisco.com> wrote:
I would be more concerned about what happens if the = manufacturer goes
out of business.  I think that's a bigger deal, but can = I ask that we
also consider = that problem with some more experience under our belts?  = I
could easily = envision a few solutions, but better would be to face down
the problem = with some more code and deployment.  BTW, manufacturer = going
out of = business also means no more {bug fixes, security patches, h/w
support, = etc}, and so zooming in and just dealing with this may be
suboptimal.

The manufacturer-going-out-of-business use case argues for = there being a way that a person with physical access to the unit can = re-key it without contacting the manufacturer.   It also argues for = open source, but that's out of scope. :)

= --Apple-Mail=_85F2328B-CBC1-498D-9A7E-2A85ADB8C27B-- From nobody Tue Oct 2 11:32:55 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED0C5130FF5; Tue, 2 Oct 2018 11:32:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tf7etlYMrFYR; Tue, 2 Oct 2018 11:32:46 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCDCF130FF3; Tue, 2 Oct 2018 11:32:46 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7PTR-0006vU-1o; Tue, 02 Oct 2018 18:32:45 +0000 Date: Tue, 02 Oct 2018 11:32:41 -0700 Message-ID: From: Randy Bush To: Christian Huitema Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate In-Reply-To: <9e9604ff-6c1e-87f3-9b5f-fa9d9e7535c3@huitema.net> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <9e9604ff-6c1e-87f3-9b5f-fa9d9e7535c3@huitema.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 18:32:48 -0000 >> The BRSKI specification is a tradeoff and that's why I would really >> like to see the tradeoff explained in clear terms in the spec. It is >> designed to prevent hijacking of the device during its registration >> in the buyer's network. > > By the way, there are many cases where the buyers and the > manufacturers interests are well aligned, besides just securing the > bootstrap. For example, consider the "router fell from the back of the > truck" scenario. I assume that both the original buyer and the > manufacturer will be interested to find out who the second hand buyer > is. yep. i like the idea of find my iphone, though it has not helped find a lost phone for me. but it is MY choice to use it. MY choice to register the phone with apple's add-on service. to quote myself from a private thread > i might have other relationships with the manufacture or third > parties, such as warranty, add-ons with non-ownership, color-matched > magenta paint, etc. but when i purchase the bleeping thing, i bloody > own it. randy From nobody Tue Oct 2 11:43:26 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24BE6131038 for ; Tue, 2 Oct 2018 11:43:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dK7Uk29ZfQYY for ; Tue, 2 Oct 2018 11:43:22 -0700 (PDT) Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAFB4130FF0 for ; Tue, 2 Oct 2018 11:43:21 -0700 (PDT) Received: from xsmtp03.mail2web.com ([168.144.250.223]) by mx36.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1g7PNv-00081K-Do for secdir@ietf.org; Tue, 02 Oct 2018 20:27:04 +0200 Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp03.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1g7PNq-0008N8-CC for secdir@ietf.org; Tue, 02 Oct 2018 14:26:58 -0400 Received: (qmail 1304 invoked from network); 2 Oct 2018 18:26:53 -0000 Received: from unknown (HELO [192.168.1.105]) (Authenticated-user:_huitema@huitema.net@[172.56.42.134]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 2 Oct 2018 18:26:53 -0000 From: Christian Huitema To: Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, IETF Rinse Repeat , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= xsBNBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAHNJ0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PsLAeQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1bOwE0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAcLBfgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <9e9604ff-6c1e-87f3-9b5f-fa9d9e7535c3@huitema.net> Date: Tue, 2 Oct 2018 11:26:48 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <057bd957-06b4-824e-a7c8-214383819621@huitema.net> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: 168.144.250.223 X-AntiSpamCloud-Domain: xsmtpout.mail2web.com X-AntiSpamCloud-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-AntiSpamCloud-Outgoing-Class: unsure X-AntiSpamCloud-Outgoing-Evidence: Combined (0.28) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5rU0K0vHYo+5Zk65+YOG09x602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvOzniiMFxnOFMHTZqw+apvQzTV/3OdXD2Xdo8CfrY5CQSgPFIdLz1unxTwjgQwrhD9Yyz NJVaeAWax4WOe4pTBX2DwIE7VKe+bqpcdCns72R1LbMPSKYhVrQfdc5wqHK1VaXe0Of4jddu9xC8 8+iQ5nb6BRFVjXUbiREH8mlR1JtP/UPTAAMnNuB6/0WWjH77oh6ijzwzq5HGxV3pRhOdYuobeA2G NaAif0QyGEAJd8kel+zffa+S3paXsykGResyE7dAzbZabvf4+eAvvSn0D5YzxzA4C4+ILjmdkQoL 6F7cCSavQBrPoagEXfZ210Cx8bwqyT5p50x81ZKcmzCu2U1l0pLLr6Q2GfeLeJGF+80D4WY7xWSn pVjQVprFFOt2hDWKtLT9WR57oxUvRixjadcobnduoQv5Sp6y3SmK1n5SK/lIPtlUiBhTzlv5XU8Y E2iH1Wgh6RAenBR+licROGaH4/0U4FJ9vjKi3sUCfiaJ9UkpdnrhQDdS0ycQb/W4VoB7/CFa15C4 m6meUtwLvwCeMNnfXgg9myaSPB/HPOOqfJlbZZh01urflxdd2g4lVBsXybHsG54cmqy4G6ri+/v3 Y80OmAux3oN13+ztUzneqpOX2FVtJUXg5QBOB1Oa2Nr9ZdPSjq7LLQXOTkb//f3vdb/kEbycBqOY qSUjcVcwxlDoOj1CS47TObP/gldnulFfEoXm0/FPF8PR0w363ln2vwxpYOJbUV/+bJKKFZGLyULT tCfm6HMTHVpTenudIYu1gPmxmMWQMERQ8Lpknps2MrkRjNu5H6sW2bzBfYO/3jR5NeVaJQBh0uaw l0Cg8sKH0lJP3SQ3Hl0AH0QpMBIkYAzMcdhZar+1dDSXmWgfeWn7/ueLrlp+ZPRlQaamlokd2x35 zAiBFPp64JaIysDeBo8dSr9xryLrvIVUMlnB X-Report-Abuse-To: spam@quarantine6.antispamcloud.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 18:43:24 -0000 On 9/30/2018 10:42 PM, Christian Huitema wrote: > The BRSKI specification is a tradeoff and that's why I would really like > to see the tradeoff explained in clear terms in the spec. It is designed > to prevent hijacking of the device during its registration in the > buyer's network. By the way, there are many cases where the buyers and the manufacturers interests are well aligned, besides just securing the bootstrap. For example, consider the "router fell from the back of the truck" scenario. I assume that both the original buyer and the manufacturer will be interested to find out who the second hand buyer is. -- Christian Huitema From nobody Tue Oct 2 12:01:30 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF1FE13119F; Tue, 2 Oct 2018 12:01:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oXa0kKzoKnpu; Tue, 2 Oct 2018 12:01:12 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B9D2131184; Tue, 2 Oct 2018 12:00:47 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 996B920090; Tue, 2 Oct 2018 15:00:44 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 56E16230C; Tue, 2 Oct 2018 15:00:45 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 539CEAE; Tue, 2 Oct 2018 15:00:45 -0400 (EDT) From: Michael Richardson To: Randy Bush cc: Eliot Lear , Christian Huitema , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:01:21 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable lear> I think we've lost sight of what we're talking about.=C2=A0 We're= talking lear> about a completely automated method for a local trust anchor to be lear> installed on a device, and a kick to EST for the device to receiv= e a lear> local credential.=C2=A0 For that to happen there needs to be a tr= usted lear> introduction, and the device manufacturer or its agent is in the = best lear> position to do that. Randy Bush wrote: > no. the owner's trust controller is. Cool. It's a relief to know that we've missed something obvious. Could you please explain things more? We call the owner's trust controller the "Registrar", or sometimes the Join-Registrar/Coordinator. I don't mind calling it a trust controller, but maybe your term has a different meaning. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluzwFwACgkQgItw+93Q 3WX/mwgAnfum05CcMHrt2QQkQH5q2EeRG/hlYzgDVWMmpGleZVjRSL2bVvHSgR7x jRI2FVEVRTQJsb1Gzayd/AUjSkMJeot65zFMlq1fgOurGe1fb8Mr+SEImgVJneu0 KBi62Mwl82fAy9IGVH5Ol/gGDII2HIYBu0h1WqQLAdg2HlbLkN4mLp9agVCFbs7i NVBfDuefwYfxA95DUnwOgdkkZaDzCa0Vc//fELZgEgTneoPT1BF6xWb5cI6n/UB+ uVyAGu7tCmkcPYpkRR3VQy1epn34/KcieujsAJbLXNLDeeCwGmaw21vDsj3ekOSs /FE0fDkYaYQyeeQVLlQpXqNDESspTQ== =dx7o -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 2 12:05:40 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DD68131057; Tue, 2 Oct 2018 12:05:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gXEEmnjdydME; Tue, 2 Oct 2018 12:05:35 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95824130EF5; Tue, 2 Oct 2018 12:05:35 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id EC57D20090; Tue, 2 Oct 2018 15:05:33 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id ACB12230C; Tue, 2 Oct 2018 15:05:34 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id A983BAE; Tue, 2 Oct 2018 15:05:34 -0400 (EDT) From: Michael Richardson To: Ted Lemon cc: Eliot Lear , draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, Security Directorate , Randy Bush , Christian Huitema , anima@ietf.org In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:05:38 -0000 --=-=-= Content-Type: text/plain Ted Lemon wrote: > The manufacturer-going-out-of-business use case argues for there being > a way that a person with physical access to the unit can re-key it > without contacting the manufacturer. It also argues for open source, > but that's out of scope. :) The authors think that having the box rekeyed is a feature that some manufacturers will provide, and some buyers will **insist** upon. It has to be difficult, and in some cases, physical access may be too insecure! It's not much different than handing an (sometimes encrypted) QIC-tape/CD/DVD containing source code over to an escrow lawyer, something I've regularly done when I've worked on products with proprietary stacks. We will see such things being discussed when we do the security review for SUIT as well. Being able to replace the manufacturer trust anchors for firmware, and the trust anchor for validating ownership vouchers will become a checkmark feature. Any company can become Nortel. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluzwX4ACgkQgItw+93Q 3WVFtggAgxp6wjhFCaCigsZfOPvIvCliTwDF9LyJqzBgg12cmJJLRvQNujluf+xb pgt2BuYfZwCSkF0AtmK9sGaVHlAGvtT8EDJvMGtezhEud02z6FYx0PLvSuuBGVmz jxCVXYuQqES3NDaUdlx4dpafL/ICp1EWUzEAHasJTiN/YE3IsAunfn7nVcuMIyTv 1R+cJqBYG8hKhA8j5nOxJerNMiNI/SIWMQTZcQDfLmDxBxENrf6G8Lnz7jGAen58 b7TLty5sUGbse4Gmkt3lVeZMp79I6hoisxEIZ1gLIjDNkmY3/rkMPi0iaskkj2uY rd5dpMfXb+d1OWhFrOehwmVZcdijsQ== =zuNB -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 2 12:10:24 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A97ED131065 for ; Tue, 2 Oct 2018 12:10:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wQMEnKwRRlsQ for ; Tue, 2 Oct 2018 12:10:19 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 624FB130EF5 for ; Tue, 2 Oct 2018 12:10:19 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id w16-v6so3000449iom.7 for ; Tue, 02 Oct 2018 12:10:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Nq3Ae4ZSLV2QQq2AKAH76nAAemmvFkeIYqY8bxmcZt4=; b=JtK2+lzF+KzFrh1yIJ3o7EBLGQL+jO2hjiSI+EwmNC1NywsvXJA+/I216x/4galG90 vrF+LqIY8Bp2qSXECyod9ADDtd2f2iQnytdjxhh+mKFM0u0qRmWW/kqjX2V+jbWcYRlF SuJoXBlI85OCqsgHBj1PdX4C8l4ZIm9Rhk8QonfdaYCrvzOlt6f1V7DjT3fEu2pJv9et HajttE0ja45Yov/52M6V1TSs/zT6c/NfRfgLa4ZmYZDuEP+wh1YXys+sY+LWjNZk3SV6 lkd/P6rALFZeVaBy4Ccmqe713HT2USob7sAtufNV+tmSUyG15MmaQCl8zLOvwCDAorL+ Yocw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Nq3Ae4ZSLV2QQq2AKAH76nAAemmvFkeIYqY8bxmcZt4=; b=GMCLr5Squ+aN+kdTgtGdbzb7H8LAZ0t6p4/BIvQBkTjmLnC1m7OQIyPTI9J/C/SLE1 STCSJRqxP+L0VJgLRiveESD5BNKuJGMM9Clqy1BYAs0CZQfPlQkPKU74AqSi59whpCxJ 81uoGJsxgjAU9zJL7NXb03t8y5K2d3YVMcRDCprNm7BKQFyUeKoQkN4DmIcgxaeFIdoB SGULY5YTWP4A/ARBdwqpu2rhUUtbfXlujANtQfX2gXB8WA9RdxYA/ESc3uvdm2aq+CsO Ir5TFiIHohB6689+1AkuXBduJ8LQ/rztW46ZgPVmKB0bk7jsCS9yH3zrQOdVf7jxyNXr YTNg== X-Gm-Message-State: ABuFfogBEXBhOZd8Cf/tk6Mqu2O88rfg7J2O3HAHZE5j3GLNTDngfbcM 5BXGaPE5fqL+q8X6Z+hr+y5pKg7KO0ZqeTbWCZ8KCQ== X-Google-Smtp-Source: ACcGV61wToRuIZ5KZ8TMrjFmib3lpRIrgJPzrbnXRUHzq2cd2lXhkdnwCEnmvWLEZzDYXs+bofF3UhoXWwZhgfTxGOM= X-Received: by 2002:a6b:dd11:: with SMTP id f17-v6mr11506671ioc.45.1538507418570; Tue, 02 Oct 2018 12:10:18 -0700 (PDT) MIME-Version: 1.0 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> In-Reply-To: <3590.1538507134@localhost> From: Ted Lemon Date: Tue, 2 Oct 2018 15:10:07 -0400 Message-ID: To: Michael Richardson Cc: Christian Huitema , Eliot Lear , Randy Bush , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org Content-Type: multipart/alternative; boundary="0000000000002b25f6057743ac43" Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:10:22 -0000 --0000000000002b25f6057743ac43 Content-Type: text/plain; charset="UTF-8" The problem is that possibly billions of devices will be bricked and landfilled before this becomes the norm. On Tue, Oct 2, 2018 at 3:05 PM Michael Richardson wrote: > > Ted Lemon wrote: > > The manufacturer-going-out-of-business use case argues for there > being > > a way that a person with physical access to the unit can re-key it > > without contacting the manufacturer. It also argues for open source, > > but that's out of scope. :) > > The authors think that having the box rekeyed is a feature that some > manufacturers will provide, and some buyers will **insist** upon. > > It has to be difficult, and in some cases, physical access may be too > insecure! > > It's not much different than handing an (sometimes encrypted) > QIC-tape/CD/DVD > containing source code over to an escrow lawyer, something I've regularly > done when I've worked on products with proprietary stacks. > We will see such things being discussed when we do the security review for > SUIT as well. > > Being able to replace the manufacturer trust anchors for firmware, and the > trust anchor for validating ownership vouchers will become a checkmark > feature. Any company can become Nortel. > > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > --0000000000002b25f6057743ac43 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The problem is that possibly billions of devices wil= l be bricked and landfilled before this becomes the norm.=C2=A0
=

On Tue, Oct 2, 2018 at= 3:05 PM Michael Richardson <= mcr+ietf@sandelman.ca> wrote:
mellon@= fugue.com> wrote:
=C2=A0 =C2=A0 > The manufacturer-going-out-of-business use case argues f= or there being
=C2=A0 =C2=A0 > a way that a person with physical access to the unit can= re-key it
=C2=A0 =C2=A0 > without contacting the manufacturer. It also argues for = open source,
=C2=A0 =C2=A0 > but that's out of scope. :)

The authors think that having the box rekeyed is a feature that some
manufacturers will provide, and some buyers will **insist** upon.

It has to be difficult, and in some cases, physical access may be too
insecure!

It's not much different than handing an (sometimes encrypted) QIC-tape/= CD/DVD
containing source code over to an escrow lawyer, something I've regular= ly
done when I've worked on products with proprietary stacks.
We will see such things being discussed when we do the security review for<= br> SUIT as well.

Being able to replace the manufacturer trust anchors for firmware, and the<= br> trust anchor for validating ownership vouchers will become a checkmark
feature.=C2=A0 Any company can become Nortel.


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
=C2=A0-=3D IPv6 IoT consulting =3D-



--0000000000002b25f6057743ac43-- From nobody Tue Oct 2 12:29:44 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEE9B1310AB; Tue, 2 Oct 2018 12:29:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a1cFNQPHfhqb; Tue, 2 Oct 2018 12:29:40 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19334130DC2; Tue, 2 Oct 2018 12:29:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2658; q=dns/txt; s=iport; t=1538508579; x=1539718179; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=aZBlvvK/8Jqw5z34euu9cRSzuuiIe9Vz6EH5TM5LMKU=; b=j8PpevJWc8/GOFsT+AfvqSm4T6YR3r5iqcHG54bKZVojZdukRpZyQ4Ln w3GgW75fnmb1NRtVgfkwbotJTubb/C+A3MLTj6VWU+dYKy61lOGQhnlVg M1C+Iey+hCbEwor1w1HfdD674ArDVXmz1sahl09UNLixcf6h3hMBnQc2e Y=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BVAACJxrNb/xbLJq1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGFMhKEHIh0jRwtmFYIA4RsAoQvOBQBAwEBAgEBAm0ohTk?= =?us-ascii?q?BBSNWEAsOCioCAlcGAQwIAQGDHQGCAadDgS6KCA+CbYgtggCBOYI9Lod/glc?= =?us-ascii?q?ChieXFQmEAYFohnuDTgYXgTqHU4ZNlUCBWSGBVTMaCBsVgyiCTI4JPY57AQE?= X-IronPort-AV: E=Sophos; i="5.54,333,1534809600"; d="asc'?scan'208"; a="6952553" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Oct 2018 19:29:36 +0000 Received: from [10.61.94.24] (ams3-vpn-dhcp7705.cisco.com [10.61.94.24]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTP id w92JTbTZ013089; Tue, 2 Oct 2018 19:29:37 GMT To: Ted Lemon , Michael Richardson Cc: Christian Huitema , Randy Bush , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> Date: Tue, 2 Oct 2018 21:29:40 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="aUK4cjAPDaFAxXhp6oO2m93j5ySncQt31" X-Outbound-SMTP-Client: 10.61.94.24, ams3-vpn-dhcp7705.cisco.com X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:29:43 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --aUK4cjAPDaFAxXhp6oO2m93j5ySncQt31 Content-Type: multipart/mixed; boundary="Yjy9CSExcmEFZjcSJjAzdT8ycNyndjZYo"; protected-headers="v1" From: Eliot Lear To: Ted Lemon , Michael Richardson Cc: Christian Huitema , Randy Bush , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org Message-ID: <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> Subject: Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> In-Reply-To: --Yjy9CSExcmEFZjcSJjAzdT8ycNyndjZYo Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Ted, On 02.10.18 21:10, Ted Lemon wrote: > The problem is that possibly billions of devices will be bricked and > landfilled before this becomes the norm. You really answered your own concern.=C2=A0 Nobody would put up with such= an approach that either intentionally bricked* a perfectly functional device.=C2=A0 We have to pay some attention change of ownership and organizations going out of business.=C2=A0 That's work to do, not a reaso= n to claim the sky is falling. Eliot --Yjy9CSExcmEFZjcSJjAzdT8ycNyndjZYo-- --aUK4cjAPDaFAxXhp6oO2m93j5ySncQt31 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAluzxyQACgkQh7ZrRtnS ejMr+Af/eHssFZmERHdMbzmxGqtjJR6dt1TdyWEAWiuQwL4rs+lhBEk/Ul6oWJcR fCa+E57Clf49Leq8gxySOE2c4P851uNlBDk/uZ4bdRWsrjsRW66eiGqayI9k0q6G CJoVQeKIANWRopD61WlbcOkB6My6LdIuxsSGgNPBAo9JQ0tgmwAk6iTkZrhfTK4G RsqHc4TU5Fw3IWBJL0R/ah4PjxQLqu+UcLixgxAQ3rbdhmxCEKOuq0rR5MErb0A3 gGq88IoWUXvJi7Dn1Yh97Gy3ez97J0q0F0Yx+9Mblth6Qxepo5v3bxdcRGh6rqrx M28U7I4bA84isHxdGG6WmiyjF/yWgw== =5x0e -----END PGP SIGNATURE----- --aUK4cjAPDaFAxXhp6oO2m93j5ySncQt31-- From nobody Tue Oct 2 12:31:13 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AFEA130FF0; Tue, 2 Oct 2018 12:31:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0BTN33tJmu7o; Tue, 2 Oct 2018 12:31:10 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68825130EF5; Tue, 2 Oct 2018 12:31:10 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7QNu-00077z-VF; Tue, 02 Oct 2018 19:31:07 +0000 Date: Tue, 02 Oct 2018 12:31:06 -0700 Message-ID: From: Randy Bush To: Eliot Lear Cc: Ted Lemon , Michael Richardson , Christian Huitema , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org In-Reply-To: <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:31:12 -0000 > Nobody would put up with such an approach that either intentionally > bricked* a perfectly functional device. https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-glitch-battery-dies-software-freeze.html From nobody Tue Oct 2 12:46:40 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A7D21310B0; Tue, 2 Oct 2018 12:46:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2jyutI7u_Mx9; Tue, 2 Oct 2018 12:46:30 -0700 (PDT) Received: from mail-pf1-x443.google.com (mail-pf1-x443.google.com [IPv6:2607:f8b0:4864:20::443]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03B1A1310AB; Tue, 2 Oct 2018 12:46:30 -0700 (PDT) Received: by mail-pf1-x443.google.com with SMTP id c25-v6so158816pfe.6; Tue, 02 Oct 2018 12:46:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=RBJ1d0Y2FJ0NRy3aQO7xTgD4YIJfWRJgJmVbmoZdjok=; b=ZFV2IWrUXXfXHgIC1iZUhmRqaIbd/JlWUJGc//FMLjPO0hJJqdeTYg82Jc2PykC+3c jiNNOU5TH0awX8FALYAlVej1jRFXnvdQAhGqMCZGY3ckonaDRgFNGLwVgu66QLE/j0Uh SS01XG1iAKhaRTYBQaL5vNm8DaWEtmG/QGOA7VXsRK5R9A2uR1vncPKqF6/fRjT98KkB 1uac0LeszzJV1Jp32qbvJdA0wCgMQrzgJmAsIOAUll8yM8WstIfX/oBPvdVoJed/GqDo QZu5zA6GdkoMwwwiP91ul6yoyLvJUecV3T+CfJn4OAX16Zu7EqeJBwsX7Yv6o73hz0pG uTpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=RBJ1d0Y2FJ0NRy3aQO7xTgD4YIJfWRJgJmVbmoZdjok=; b=YYELoNQiQElnXi0cW47KIfqVj3PYoZ9LdtGrmjXdkQCDrf1bZR6zZvkAMN2z4HYV1f nfu6eKEt5x6U4padSRazm4ct4J8IlToTxJ+otb0xMFOc02toLj5NogvRDe+wbx5nNfyz XciGJDft17DlHQVTGIM43weaT4Sddky+K3JCY8G43grEDsIKw2RENpVtpZz75sbxo8WV b6ZwMnkg8sa5lZQnkwAia6om7+q8ZaYZ6w0hjP3+99T41MzVSxjqHBN7A/+8wKkYi4jx TIHFRqZqufNH9FCruy9ETcRXXJp8z+RIs3uKrqv1WpsbBHJYcG+N1BCfDQQbMImLk8Ps GBLA== X-Gm-Message-State: ABuFfojgTPvKE3hFyAD6PMhJFnU9sterNRw9LOA9TNMfKJFHDzVwed/w CmYLVwMk6DfdxU4YXr8dsvQfkf8a X-Google-Smtp-Source: ACcGV61PochD+3zjYIIuWVPtWqBAUu9VZrKLLBytR5u+YoypAtGY4kZK7Wgrux61JYZ8kOQwrNya6g== X-Received: by 2002:aa7:83cb:: with SMTP id j11-v6mr13844945pfn.91.1538509589229; Tue, 02 Oct 2018 12:46:29 -0700 (PDT) Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id w23-v6sm22499056pgi.18.2018.10.02.12.46.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 12:46:28 -0700 (PDT) To: Michael Richardson , Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, Christian Huitema , anima@ietf.org, Eliot Lear , Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> From: Brian E Carpenter Message-ID: <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> Date: Wed, 3 Oct 2018 08:46:17 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <2555.1538506845@localhost> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 19:46:32 -0000 On 2018-10-03 08:00, Michael Richardson wrote: >=20 > lear> I think we've lost sight of what we're talking about.=C2=A0 W= e're talking > lear> about a completely automated method for a local trust anchor = to be > lear> installed on a device, and a kick to EST for the device to re= ceive a > lear> local credential.=C2=A0 For that to happen there needs to be = a trusted > lear> introduction, and the device manufacturer or its agent is in = the best > lear> position to do that. >=20 > Randy Bush wrote: > > no. the owner's trust controller is. >=20 > Cool. It's a relief to know that we've missed something obvious. > Could you please explain things more? >=20 > We call the owner's trust controller the "Registrar", or sometimes the > Join-Registrar/Coordinator. I don't mind calling it a trust controller= , but > maybe your term has a different meaning. There's a point that close followers of Anima may know and that others don't. There is a topic intentionally missed out of the BRSKI document, which is how the registrar decides whether a particular device, let's say device X12345, is allowed to join the secure domain in question. This point is skated over in the draft; in fact there is a text glitch in section 5.2 where it should be stated, already known to the authors. (Sorry, but we didn't find that text glitch soon enough to fix it before the IETF Last Call.) The actual authorization mechanism - "X12345 is allowed to join" - is not part of BRSKI. It is, as Randy rightly implies, not the business of the manufacturer. The MASA is used only to verify that X12345 is in fact X12345. It's part of the trust model, not the authorization model. If I had my wishes, the MASA would be optional, with a local voucher store in the registrar as the alternative. But that wasn't the WG consensus. Brian From nobody Tue Oct 2 13:06:46 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CCB91310AB; Tue, 2 Oct 2018 13:06:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=joelhalpern.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iQtVikfWfYFS; Tue, 2 Oct 2018 13:06:37 -0700 (PDT) Received: from mailb2.tigertech.net (mailb2.tigertech.net [208.80.4.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4974130FF0; Tue, 2 Oct 2018 13:06:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailb2.tigertech.net (Postfix) with ESMTP id 96A1A1C040A; Tue, 2 Oct 2018 13:06:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joelhalpern.com; s=2.tigertech; t=1538510797; bh=hevd1REdMoVykcFAStM2DCVxDMn/oeww/1WH7NXP5dA=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=bSK1L2kgKsE91gkVFyUwGIrb6pWIdOdCU75sXZERVhdBWQY9DcmPgZm/x8JkVZWYT 1CZVrToCA/3BaHPuB7ICM8vpxAIVc2tec2EF5kXqVKkhZY45FYxsPSttLYRSU1ZH05 NY53qCoRcWsJcvo8AVBy5QWg4FlMj3NeJisXjHJA= X-Virus-Scanned: Debian amavisd-new at b2.tigertech.net Received: from Joels-MacBook-Pro.local (209-255-163-147.ip.mcleodusa.net [209.255.163.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mailb2.tigertech.net (Postfix) with ESMTPSA id DA29F1C00E2; Tue, 2 Oct 2018 13:06:35 -0700 (PDT) To: Brian E Carpenter , Michael Richardson , Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, Christian Huitema , Eliot Lear , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> From: "Joel M. Halpern" Message-ID: Date: Tue, 2 Oct 2018 16:06:34 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 20:06:40 -0000 Off-list: It sounds from you rnote like either: 1) Anima admission process is seriously underspecified in a way that affects itneroperability, or 2) BRSKI is actually irrelevant to ANIMA, and should be reviewed and advanced (if desired) by some other working group. I doubt either is your intention. And statements such as Eliot's ill-formed comment that no one would do that do not help the case for the Anima WG having thought this through. Yours, Joel On 10/2/18 3:46 PM, Brian E Carpenter wrote: > On 2018-10-03 08:00, Michael Richardson wrote: >> >> lear> I think we've lost sight of what we're talking about.  We're talking >> lear> about a completely automated method for a local trust anchor to be >> lear> installed on a device, and a kick to EST for the device to receive a >> lear> local credential.  For that to happen there needs to be a trusted >> lear> introduction, and the device manufacturer or its agent is in the best >> lear> position to do that. >> >> Randy Bush wrote: >> > no. the owner's trust controller is. >> >> Cool. It's a relief to know that we've missed something obvious. >> Could you please explain things more? >> >> We call the owner's trust controller the "Registrar", or sometimes the >> Join-Registrar/Coordinator. I don't mind calling it a trust controller, but >> maybe your term has a different meaning. > > There's a point that close followers of Anima may know and that others > don't. There is a topic intentionally missed out of the BRSKI document, > which is how the registrar decides whether a particular device, let's > say device X12345, is allowed to join the secure domain in question. > > This point is skated over in the draft; in fact there is a text glitch > in section 5.2 where it should be stated, already known to the authors. > (Sorry, but we didn't find that text glitch soon enough to fix it before > the IETF Last Call.) > > The actual authorization mechanism - "X12345 is allowed to join" - is > not part of BRSKI. It is, as Randy rightly implies, not the business > of the manufacturer. > > The MASA is used only to verify that X12345 is in fact X12345. It's > part of the trust model, not the authorization model. > > If I had my wishes, the MASA would be optional, with a local voucher > store in the registrar as the alternative. But that wasn't the WG > consensus. > > Brian > > _______________________________________________ > Anima mailing list > Anima@ietf.org > https://www.ietf.org/mailman/listinfo/anima > From nobody Tue Oct 2 13:20:04 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2229E131110 for ; Tue, 2 Oct 2018 13:19:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IHLvRvqdswiZ for ; Tue, 2 Oct 2018 13:19:54 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DF0313112E for ; Tue, 2 Oct 2018 13:19:52 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id o63-v6so1387196yba.2 for ; Tue, 02 Oct 2018 13:19:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=gNcZI4A4jGUAgvXuXZcGiDSHOvkTK6za+K6iBmm8b6E=; b=AL+nQntQcPA+ozbZhm3251HeDrxN1qN851aj+gPC5ujeOFbxxcOOr+aAL4+U/XEm4o DWGlAT9bsCG67bCguzVRpbfrKhi9xgzwc6Uq/0T9GDxFwX9g4oXUWxCyOQtB3p9rSQYR aR8LK980MX6LxH5q51uJ3oNsldBt0OFEAmKM2f/mfw/dY9ifjNHUfJ6kHtlC5X+WqQ82 57XA80jlujtPSaHibIxyp5oDeBmHI3OWDlpVhfpAnINiXgVl3+6QSipUiwA6nlnNHd2k HDohRIyrqvMXnaci3bjbZXUXCX+nBra/TS0zeg8QOTcejJ6/UXJnC/fX1bnk8kJPL3PN MebA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=gNcZI4A4jGUAgvXuXZcGiDSHOvkTK6za+K6iBmm8b6E=; b=MvESlLCo/TvukjqukTno0/9I6tR0SHa3ixt/dLTUJR1Uz7VkGd4nc/vdf3QHz3YkN7 cGUFvnDGE4hWo8QN9aditdWEaLtNwnqilO/ECkNFJZ+gvfUV2MHF5d2yp12QZGEnMBoV nu6+4e5q5jSGZYpAEqqCye9W6ePjzipnyMiVJhPGR1nSz2iyo9OBuWakrhI8ELjXbXhr mkLfC2gmYx12ZCFeHMkQZIqcCTPe298t6SjpNINBVO11iePWPIXGhROG6t/Y9yV59FvR //EyL71nEWNRYjQW7uqpJfWk+d2L6RqVXOOLoEuJ7tiB25trKshYHPrQ5tus6BY2va40 8DjA== X-Gm-Message-State: ABuFfoharKPrgijyK0sWefr+jqEU9jRnsX9OTRxxo+h0YXhcq6B9Yhc4 z7AXvBZSXr61OIXuoWAIs0iafg== X-Google-Smtp-Source: ACcGV63oB5/UJRSyB+dR4rjmstBY+c+rGQnWGjJx4lJvW2yLCd1Fi0/R3WeWfFvOCiByppLExS4r8Q== X-Received: by 2002:a25:c4c4:: with SMTP id u187-v6mr9975599ybf.413.1538511591274; Tue, 02 Oct 2018 13:19:51 -0700 (PDT) Received: from [10.0.100.12] (c-73-167-89-221.hsd1.nh.comcast.net. [73.167.89.221]) by smtp.gmail.com with ESMTPSA id h13-v6sm6371372ywc.100.2018.10.02.13.19.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 13:19:48 -0700 (PDT) From: Ted Lemon Message-Id: <8B8C96FF-69D2-4ED5-A961-068C975C6D4E@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E2A689A8-8703-4BAD-B5E3-DEE8EC6CCA69" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Tue, 2 Oct 2018 16:19:46 -0400 In-Reply-To: <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> Cc: Michael Richardson , Christian Huitema , Randy Bush , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org To: Eliot Lear References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> <35fdaa10-426d-d732-717d-37a25207250b@cisco.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 20:19:55 -0000 --Apple-Mail=_E2A689A8-8703-4BAD-B5E3-DEE8EC6CCA69 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Oct 2, 2018, at 3:29 PM, Eliot Lear wrote: > You really answered your own concern. Nobody would put up with such = an > approach that either intentionally bricked* a perfectly functional > device. No one would put up with it if they anticipated it. The problem is = that they might not anticipate it. It's the kind of risk that the end = user might simply not imagine. --Apple-Mail=_E2A689A8-8703-4BAD-B5E3-DEE8EC6CCA69 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Oct 2, 2018, at 3:29 PM, Eliot Lear <lear@cisco.com> wrote:
You really answered your own concern.  Nobody would put = up with such an
approach that either intentionally bricked* a perfectly = functional
device.

No one would put up with it if they anticipated it.   = The problem is that they might not anticipate it.   It's the kind = of risk that the end user might simply not imagine.

= --Apple-Mail=_E2A689A8-8703-4BAD-B5E3-DEE8EC6CCA69-- From nobody Tue Oct 2 15:44:54 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A701311BD; Tue, 2 Oct 2018 15:44:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rfif9sPjQodK; Tue, 2 Oct 2018 15:44:45 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E043D13119F; Tue, 2 Oct 2018 15:44:44 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 90FEB20090; Tue, 2 Oct 2018 18:44:42 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 811BD230F; Tue, 2 Oct 2018 18:44:42 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 7D78D230C; Tue, 2 Oct 2018 18:44:42 -0400 (EDT) From: Michael Richardson To: Ted Lemon cc: Christian Huitema , Eliot Lear , Randy Bush , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 22:44:47 -0000 --=-=-= Content-Type: text/plain Ted Lemon wrote: > The problem is that possibly billions of devices will be bricked and > landfilled before this becomes the norm. It is very sad. Maybe some will get firmware upgrades, but I doubt it. So we should hurry up and get to his out there, so we can learn how to do it correctly sooner. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluz9NoACgkQgItw+93Q 3WXW3ggAg+kQMcgoM0Tyxp/E+o9GWnuP+YNLdmVu+pk9QzXcXC1b8V5rlokCzlsZ DcylByUvh1DCQxbdSQeMs53ncWzybrsA0OaFDoiTnSbwuxBOhPfVC7Pz2tzWkK+8 IbDaiNN6LnPU6B/izImf1y48CjUBoq7eo/isWZ9lUqnZkm2Yoo11MTErmrX5rA4E CPnycxympdEeqcRfhxxMhBrisGq2y9DCOVbd+uaQtTB0QPHA1wz9GovvlnH6cMzT e2y2go6v/ZgHfr8/1mGF7qUErECP8rkI+6YqYNfgu8XsGj0lx8KRBR3wSCmgG7Jw bA2yJ2/lQHJyvn37Vqc0raZMCF0xiA== =TcLR -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 2 15:46:11 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E9031311AE; Tue, 2 Oct 2018 15:46:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f2rWZpDwzrRJ; Tue, 2 Oct 2018 15:46:08 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DDE313119F; Tue, 2 Oct 2018 15:46:08 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7TQV-0007oS-Rt; Tue, 02 Oct 2018 22:46:00 +0000 Date: Tue, 02 Oct 2018 15:45:59 -0700 Message-ID: From: Randy Bush To: Michael Richardson Cc: Ted Lemon , Christian Huitema , Eliot Lear , Security Directorate , anima@ietf.org, draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org In-Reply-To: <21256.1538520282@localhost> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <3590.1538507134@localhost> <21256.1538520282@localhost> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 22:46:10 -0000 > So we should hurry up and get to his out there, so we can learn how to > do it correctly sooner. definitely important to rush and not be distracted by warnings about the model being sorely broken. randy From nobody Tue Oct 2 15:53:15 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 136271311C0; Tue, 2 Oct 2018 15:53:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qQKT3yRnMO-M; Tue, 2 Oct 2018 15:53:04 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64E411311BD; Tue, 2 Oct 2018 15:53:04 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 8A7CD20090; Tue, 2 Oct 2018 18:53:02 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 4DB45230F; Tue, 2 Oct 2018 18:53:03 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 4A600230C; Tue, 2 Oct 2018 18:53:03 -0400 (EDT) From: Michael Richardson To: anima@ietf.org, Security Directorate In-Reply-To: <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 22:53:06 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: > If I had my wishes, the MASA would be optional, with a local voucher > store in the registrar as the alternative. But that wasn't the WG > consensus. So you speak of non-expiring nonceless vouchers with wildcard for the domain owner, that would come with the device? I.e. a bearer voucher/token on a QR code. We decided that such a thing was fraught with issues. So we painted around it, and declared that version out of scope for now, because we didn't think we were smart enough to figure out the security implications of it. (We did this in RFC8366, btw) In particular, we did not think it had a place in the medium to high-value devices that we expect ANIMA ACP BRSKI to deal with. [i.e. routers, VM hosts, NAS boxes... not light bulbs] I think that there are better ways to deal with a bearer voucher, and that a layer of intermediation would help with the issues possible with a bearer token. This may suit "ship and mostly forget" situation, but I also think it's squarely an IoT application, rather than appropriate for BFRs. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAluz9s4ACgkQgItw+93Q 3WXdLQf9GijHIAS02WZjDn3PduieBs3dvkC+jifm4j4415CDky/1Wp+jyWA4NVw2 fHPiDh+bTOTjsSzrQI8RVL5UAiZp01Wggp56W8ayuPUk3cBPtABHDQ/9oLvLwGc/ lo4OLVcvWVKTGs2T+tCpOQcUHlS4oKI1gRGU2ryYkkAuI1xwXGn6up7jsvHfFm+D xb0h4BuMuz4tLs/ErH0LwZk20VjXHntNlaIwagWtczeseukx78QmD6CdyzFW0IrB J5qMsxm7Cv6R5XZWFrnN5F+3/DXQP8hwj9xbbuIAOSB4Zj6dpL9xS2w4eOKfiKAU /Y+lmEtdWR/gA4lQ2vja8ReNju3OEw== =eJ1x -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 2 17:33:38 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B390131160; Tue, 2 Oct 2018 17:33:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqAevghqzOql; Tue, 2 Oct 2018 17:33:27 -0700 (PDT) Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFDB11310E0; Tue, 2 Oct 2018 17:33:27 -0700 (PDT) Received: by mail-pg1-x531.google.com with SMTP id n31-v6so712830pgm.7; Tue, 02 Oct 2018 17:33:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=lGHesTmntO24QfXW32IfliD4vnz12JRxKcYPYF2b0sY=; b=s//ZP/JYqpRgkxwSaZBdKX/zHsLv8gbuHbsK8e9LUzPrnlP7DUnR3p4oa/LmXIiNGU irgTlE0wuQmkeW0mQ12wTTJrwQBw0d7RX1B8SFMjSL7nFpvHF4UL+a7EhADXp/ldI5X7 CazI+dXeJ8/H20GpaZ6+EDTGA0uhTwxeeG0fb6Wt2101JMU5VFP+nh8hkSutoMFcO5VS ztKdBeQaZuPfXvV1abIGUlfecySyQ5RozKd9wzufZlmyGA+ehSMmbvLfQXxOENI10wk7 hnPZ4vUESVSJ5vRPqqF1btYC+Nniksxqtn1gHy00Ap1+1Qv1oMK2Y/NjMGZJZfsbSZs7 Xp4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=lGHesTmntO24QfXW32IfliD4vnz12JRxKcYPYF2b0sY=; b=ajnfkgE2dTQUgwfAwjMegxue+7Dn/PQv1WczB43eWIFYbuhpbjzHFis9M7BvP/xrsj e2yFcI9fBsTnY7aAt7duKTsVqMytahTXbmMIruFCivprmMXxzF86sDE9M1gXmqr5JAzD MKxPSO9uW4vdaacfTJUsOGcr3EETzRH1WG+96JRYENP1kWp4al3XNXWBY6pJ8HzYcnzd 7gHwXD4FzATnqDKiMinVKGOo9UJ+pYSip4vN++djtFpGxNtq3pCf/50WCDVJb2i/mOpJ d/10DIFMSJ1m7/AJNeVWCSJ5eKpco6v0Qpz942o/IqiH/jkgXq13uJBflEEe2VCv8rnM Y53A== X-Gm-Message-State: ABuFfog0KqiLD6LdEPwyxLnwbNgEnYANyWcYK5//HywcS8hdCG+bKrin AL++UYXtKxZYuyxrc+QjT9Vzdxfl X-Google-Smtp-Source: ACcGV60f2v0qyJQb4VUbBJ28XlFiOVUndAV1T2Hq+AJkGKBu2X0nK3iU8LUxInYsXioVTIjXO3dxxw== X-Received: by 2002:a63:2106:: with SMTP id h6-v6mr16232693pgh.161.1538526806849; Tue, 02 Oct 2018 17:33:26 -0700 (PDT) Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id p17-v6sm22837086pfk.186.2018.10.02.17.33.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 17:33:25 -0700 (PDT) To: "Joel M. Halpern" , Michael Richardson , Randy Bush Cc: draft-ietf-anima-bootstrapping-keyinfra.all@ietf.org, Christian Huitema , Eliot Lear , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> From: Brian E Carpenter Message-ID: Date: Wed, 3 Oct 2018 13:33:19 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 00:33:30 -0000 On 2018-10-03 09:06, Joel M. Halpern wrote: > Off-list: >=20 > It sounds from you rnote like either: > 1) Anima admission process is seriously underspecified in a way that=20 > affects itneroperability, or No, it's *intentionally* underspecified w.r.t. authorization. The registr= ar is part of a specific autonomic networking implementation, so I think it'= s OK that this is not standardized. Once there is established practice, it might be time to revisit this. =20 > 2) BRSKI is actually irrelevant to ANIMA, and should be reviewed and=20 > advanced (if desired) by some other working group. I think BRSKI has the misfortune of being potentially quite general, but it is in fact required by Anima as the basis for the initial secure substrate. > I doubt either is your intention. Indeed not. > And statements such as Eliot's ill-formed comment that no one would do = > that do not help the case for the Anima WG having thought this through.= I think it's been thought through but badly articulated. In that sense, the Last Call is doing its job. Brian >=20 > Yours, > Joel >=20 > On 10/2/18 3:46 PM, Brian E Carpenter wrote: >> On 2018-10-03 08:00, Michael Richardson wrote: >>> >>> lear> I think we've lost sight of what we're talking about.=C2=A0= We're talking >>> lear> about a completely automated method for a local trust anch= or to be >>> lear> installed on a device, and a kick to EST for the device to= receive a >>> lear> local credential.=C2=A0 For that to happen there needs to = be a trusted >>> lear> introduction, and the device manufacturer or its agent is = in the best >>> lear> position to do that. >>> >>> Randy Bush wrote: >>> > no. the owner's trust controller is. >>> >>> Cool. It's a relief to know that we've missed something obvious. >>> Could you please explain things more? >>> >>> We call the owner's trust controller the "Registrar", or sometimes th= e >>> Join-Registrar/Coordinator. I don't mind calling it a trust controll= er, but >>> maybe your term has a different meaning. >> >> There's a point that close followers of Anima may know and that others= >> don't. There is a topic intentionally missed out of the BRSKI document= , >> which is how the registrar decides whether a particular device, let's >> say device X12345, is allowed to join the secure domain in question. >> >> This point is skated over in the draft; in fact there is a text glitch= >> in section 5.2 where it should be stated, already known to the authors= =2E >> (Sorry, but we didn't find that text glitch soon enough to fix it befo= re >> the IETF Last Call.) >> >> The actual authorization mechanism - "X12345 is allowed to join" - is >> not part of BRSKI. It is, as Randy rightly implies, not the business >> of the manufacturer. >> >> The MASA is used only to verify that X12345 is in fact X12345. It's >> part of the trust model, not the authorization model. >> >> If I had my wishes, the MASA would be optional, with a local voucher >> store in the registrar as the alternative. But that wasn't the WG >> consensus. >> >> Brian >> >> _______________________________________________ >> Anima mailing list >> Anima@ietf.org >> https://www.ietf.org/mailman/listinfo/anima >> > . >=20 From nobody Tue Oct 2 17:46:20 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F538131161; Tue, 2 Oct 2018 17:46:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a18_4sl5p5ky; Tue, 2 Oct 2018 17:46:16 -0700 (PDT) Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB45D131160; Tue, 2 Oct 2018 17:46:15 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id w14-v6so2556557plp.6; Tue, 02 Oct 2018 17:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=14+vZkBR0q65GO8kRo7KL5vDp5jlXDx0kwvB33wsH64=; b=gQfAcsnc9YD9Lbl9FShiLWx+/MXfiwWPz9ifBTulWer9Gaz0hXdY3Gys/dH+vWd9iS /eMRWoUnl6PCWLXAFuOxwZRqt7wi1ik/zqiyca43I9Fp8pxIaYyhjPebDfglQO2zdNab hUerckumv5HpD0bziG+T47nSeY5L+sttq6yHwgZrJiWqUSbDW1m0xc+6yPRr/WYt0/M7 TFDRmW3VKzs1lshZnRKIHc4DGS3ye51HXDi6PALIhKh+8JIf8FeMfwQI1OnW/DL77nU9 REcg4BiIT2RsC9r43sQzPKgeo6Gxgq7UvjxEJvucwRID/qlsHSbR34I+r+Ub+mo61xVK V4EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=14+vZkBR0q65GO8kRo7KL5vDp5jlXDx0kwvB33wsH64=; b=L6MGFJbL1OYI/D7pMf21OEixLPBi0BaN8hHSHV2usslEhKJiV6l/OijpDOZ4u68q3C HKQN7LdLXZOe19gnWMlh9XHVbkUiK1fKsyMA+AGRaoWNWTntQFCAv9pTR1SeqEX/P3k7 qeF8xfc2Wf0JSbRV8lmdcU+Y0yJYHdOWbYC/4ilKErVBHTPB89VlgW1s552FAs1d60Cc cAhzNHOLXVNYdOuFUdjgWnX6VG2Q0cplUKXpiMGCeMw99v3MiHO85Gf9dy/AJXedGJhX z/Oqnu4g3Hx6WKEJvUDmhND6vv+AmNKJJZxUNef/G1JWzHNRsFTpnCWI4yEJPUcOe0V5 x42w== X-Gm-Message-State: ABuFfogPXl4LxJLg8zk+32B8TNnQwMrUQEF+1hfU3dT+wFxoiZh1d4VZ L4Yh/QzK8aZ4dW4F5c2r6CqBgwH3 X-Google-Smtp-Source: ACcGV62ztK5YmRSKBb/bccG6Vzu+IVXdNmwpk4MQaLh33on3bpCicp5DTxM4I6hc0dYX0TAqmh4gJw== X-Received: by 2002:a17:902:f096:: with SMTP id go22mr19254125plb.235.1538527574985; Tue, 02 Oct 2018 17:46:14 -0700 (PDT) Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id f15-v6sm22080442pgv.66.2018.10.02.17.46.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 17:46:14 -0700 (PDT) To: Michael Richardson , anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> From: Brian E Carpenter Message-ID: Date: Wed, 3 Oct 2018 13:46:09 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <23133.1538520783@localhost> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 00:46:19 -0000 On 2018-10-03 11:53, Michael Richardson wrote: > > Brian E Carpenter wrote: > > If I had my wishes, the MASA would be optional, with a local voucher > > store in the registrar as the alternative. But that wasn't the WG > > consensus. > > So you speak of non-expiring nonceless vouchers with wildcard for the domain > owner, that would come with the device? I.e. a bearer voucher/token on a QR code. > > We decided that such a thing was fraught with issues. > > So we painted around it, and declared that version out of scope for now, > because we didn't think we were smart enough to figure out the security > implications of it. (We did this in RFC8366, btw) > > In particular, we did not think it had a place in the medium to high-value > devices that we expect ANIMA ACP BRSKI to deal with. > [i.e. routers, VM hosts, NAS boxes... not light bulbs] There are issues with not doing it too. I think the thing right now is that the draft doesn't explain itself properly, hence this discussion. I'm still gnawing on my original bone: if I was running a highly secure, personnel-safety-critical network, like the particle accelerator control network I used to run for a living, I *would not* allow it to rely on masa.vendor.com, and it would be physically impossible to do so because there would be no physical link anyway. I would get my vouchers some other way. This is not light bulbs either. I believe this can be fixed by clearer scoping of the document, and by renaming the "lower security" section as "alternative trust models" or something. Brian > I think that there are better ways to deal with a bearer voucher, > and that a layer of intermediation would help with the issues possible > with a bearer token. This may suit "ship and mostly forget" situation, > but I also think it's squarely an IoT application, rather than appropriate > for BFRs. > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > > > _______________________________________________ > Anima mailing list > Anima@ietf.org > https://www.ietf.org/mailman/listinfo/anima > From nobody Tue Oct 2 17:53:16 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1107313116D; Tue, 2 Oct 2018 17:53:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bcGdxg4LoDpH; Tue, 2 Oct 2018 17:53:03 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A25D131161; Tue, 2 Oct 2018 17:53:03 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1g7VPL-0002tW-Cr; Wed, 03 Oct 2018 00:52:56 +0000 Date: Tue, 02 Oct 2018 17:52:54 -0700 Message-ID: From: Randy Bush To: Brian E Carpenter Cc: Christian Huitema , Eliot Lear , anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/25.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 00:53:05 -0000 > I think it's been thought through but badly articulated. In that sense, > the Last Call is doing its job. does that mean that i can stop trying for a narten medal, go back to work, and christian will wake me up again when my two scenarios have clear answers; one hopes ones with which i can live? also, please tell me that i do not need to stick my nose into the rest of anima in order to let the user unequivocally own what they buy. i have my own rabbit holes to pursue in the ietf. randy From nobody Tue Oct 2 18:06:54 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D92F131186; Tue, 2 Oct 2018 18:06:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QyqI2iBFYGJi; Tue, 2 Oct 2018 18:06:51 -0700 (PDT) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5500131160; Tue, 2 Oct 2018 18:06:50 -0700 (PDT) X-AuditID: 12074423-449ff70000003967-47-5bb416275ee0 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-6.mit.edu (Symantec Messaging Gateway) with SMTP id FC.B9.14695.82614BB5; Tue, 2 Oct 2018 21:06:48 -0400 (EDT) Received: from outgoing-exchange-3.mit.edu (OUTGOING-EXCHANGE-3.MIT.EDU [18.9.28.13]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id w9316kaN016955; Tue, 2 Oct 2018 21:06:46 -0400 Received: from w92exedge4.exchange.mit.edu (W92EXEDGE4.EXCHANGE.MIT.EDU [18.7.73.16]) by outgoing-exchange-3.mit.edu (8.13.8/8.12.4) with ESMTP id w9316Tjm020646; Tue, 2 Oct 2018 21:06:34 -0400 Received: from W92EXHUB12.exchange.mit.edu (18.7.73.21) by w92exedge4.exchange.mit.edu (18.7.73.16) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 2 Oct 2018 21:06:12 -0400 Received: from OC11EXPO28.exchange.mit.edu ([169.254.1.191]) by W92EXHUB12.exchange.mit.edu ([18.7.73.21]) with mapi id 14.03.0352.000; Tue, 2 Oct 2018 21:06:36 -0400 From: Uri Blumenthal To: Brian E Carpenter CC: "anima@ietf.org" , Eliot Lear , "Security Directorate" , "randy@psg.com" Thread-Topic: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 Thread-Index: AQHUWhyykvn3lDncMkaktwy1V6dY16UMEvCAgAASvACAAAOzAIAAaeeAgAAMuYCAAAWrAIAASoeAgAAFeQCAAAPSAA== Date: Wed, 3 Oct 2018 01:06:35 +0000 Message-ID: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Content-Type: multipart/signed; boundary="Apple-Mail-2355C6F5-6A50-4EF0-A770-4BF45955DEF9"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA02Te0hTURzHO/fe3Z2JN2/zsZMW1M3A10zRYlRERIVRfxT1RySRN3fmVtuU e7fQCjJ6a4WaxVykzkfQyh5qmdJDV1EqmD0FwWBimQ7Diohmr3t3e/jf93e+n/P9nsO9B5La JjoWWuwOLNh5K0eHUVpN9AJ9QkxrdpqvZpHBXzdAGI4+u0cYvvw8ThneHRkjDJMeP7VSlVU5 dUOV1e4eUmc1NHwjss5WnQcbqW1hy43YatmDhUUrcsLMgdZusuCFvvDcKS9dDC4nlQANRGwm qugYpktAGNSy9QR64PpAKMN9gM40TpLK8AigMU/HH6wNoGMPTgJl8AIUfP6aksNolkOTw80h HcVmoIMlvSoZIlkPQO86nxKyEcliNNVXARTIhMpfBQlF70ITwaGQpth4NHqzmpQ1wy5FD6ub KKWtnUJ9dwK0bGjYJPR5tDzUBtgY9LXnSmgzyerQ4EgNoVwvCvmf9dKKjkE/O/y0cqJzAFVf vaFSGmah7qoRqgzEuKftd0/n3NM4N4CSkYLOeIDCJ6OLngCp6GXIFeyiFb0YBR59/MPMR5Wl fnUtgF4w12jbq7fxFquIc/ViLm+3Y0G/JNVmcaRio7MZyN9dvXrBbTB2er0PsBBw4UxOTUu2 VsXvEYtsPjAbElw0E26TlmbuzDcWmXnRvENwWrHoA/FS1/D1y/0glrLn2zEXxZzmJY4x8kV7 sZD/F4uDFKdjyg/XZ2vZPN6Bd2NcgIW/7hwIOcQkR7dma2cJOA8XmixWx3+bgBofQDBcCvdG SQwjFvA20ZKn+D0gA753HXeR8OjbARepDZ0jVsfkyHGsjJqd9n9pob9cvY4dBzrpopFMhEyF S2/gX964VEVIVQed1+UqB//fii0GiXCTqXvhD11DmWbJV1PC3Fct6rZRvu3HYZ6PuGRp+uZd UyUKmReKI8B3077BgfGEXD2b/oHIP/XSfbfCWVb96VZghfXEL+5A4El/cWU8rLVY6+PqrqbN KNnQee1xcHtpYs8MvJbYktJdcWhr+5FVU/Mmpob2o6GuppObqS+NbzhKNPPpSaQg8r8BU/wH ksADAAA= Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 01:06:54 -0000 --Apple-Mail-2355C6F5-6A50-4EF0-A770-4BF45955DEF9 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Based on this exchange, and the arguments presented here that I observed so f= ar, I'm with Randy. I have not seen adequate answers to his concerns (which I= MHO are reasonable). P.S. Feel free to trim the CC: list when/if responding. P.P.S. In one of my prior incarnations many years ago, we designed a somewha= t similar system, and called it "Zero-Touch Provisioning". It was a very big= company, so we did not consider the possibility of it/us going out of busin= ess (and leaving the customers stranded). But if Randy's arguments were pres= ented to our team then, we'd probably accepted them and tried to address... Sent from my test iPhone On Oct 2, 2018, at 20:53, Randy Bush wrote: >> I think it's been thought through but badly articulated. In that sense, >> the Last Call is doing its job. >=20 > does that mean that i can stop trying for a narten medal, go back to > work, and christian will wake me up again when my two scenarios have > clear answers; one hopes ones with which i can live? >=20 > also, please tell me that i do not need to stick my nose into the rest > of anima in order to let the user unequivocally own what they buy. i > have my own rabbit holes to pursue in the ietf. >=20 > randy >=20 > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview --Apple-Mail-2355C6F5-6A50-4EF0-A770-4BF45955DEF9 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCGsw ggQkMIICjKADAgECAgRbkXGgMA0GCSqGSIb3DQEBDAUAMBoxGDAWBgNVBAMMD0ZvcmVzdCBDQSBS U0EgNDAeFw0xODA5MDYxODI3NDRaFw0yMTA5MDYxODI3NDRaMA4xDDAKBgNVBAMMA1VyaTCCAaIw DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANJi8+lfrSCcWThbn0vQzXsW7AYTyTZSo/pv/274 xD/t1rpn/X/vegP2lSfr+SRJ4oJ+51MFJvRl/sAveroDN8gGrFyYaCg5ZsOMqksCmLha4Ttgk04L I/aqrPGuzF1OVgjhi6WrnFr80KS6sy3MWzYIYV6G1FycKEup5snMr1B1WWzFKOwSslnJwvCuHu2W Tc5OzJKPtxMcDIS9y6VOZTzsJUFe0bRiw0LICDBcB3fgKCvYMcDfke0pw13I4O7wEG40s9E6rTIj Q0H1LVk69pSo1ikzpikl5W8pXUQQrSmjHqhFn/Q+PwSzHSOralN0p1UMziUv57lgvvZbTaH1ooqq MZBuTed0xLye3w+h9+/iqDY4B7lFqbegzseBh7/Q6KdtfpkwwI7xSpZEME/V77KAMw+ipb+Itbij Bi3r/t81fDW8eitIAbVtalpFROlYIaZnIIohOZRyVjn2unZ+lj3jDKsDq53g+oleo+Ruszlt8nju 6uKhzE7bdX1xJuvCtwIDAQABo34wfDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFIDAWBgNV HREEDzANgQt1cmlAbWl0LmVkdTAdBgNVHQ4EFgQU2p+nwSyQFM6byFBhc7oIZephJbcwJQYDVR0l BB4wHAYIKwYBBQUHAwQGCisGAQQBgjcKAwQGBFUdJQAwDQYJKoZIhvcNAQEMBQADggGBAH/zzG9P gU+ogFbc75JpUK0amUUtmtSsGDe4599GolCDiuPHrnbCGcaNc9aQjRaP3Q3aU7BB3aOjwssjQSN0 tsfZD8p+XPny/odhDSwS/25jCg0dVasd8q+Jd1S1g34RGUqPQ+5ofTrBSEkHBdLdJOnxBGo9GRzA yiDg34r6zK6BXNYv2GdqRk+GGGvL/w3CDR+ih36ZDBxw/EO19oH/aV4+mVlcRI6aoj4KMb+h4zMY S8jLDArIZSce4EWzJqxKVcX6Q7CE/0Br/7R8Ixs+vt5YKPUVpEbFM6koH624GDQYKM2kzXBnwYgS /jvl02KUx6uNmIgo+ufK2l7sc83vRLxBTJKhT0/USVkwu9uzg2zHJeGBZ4pmDhkIVkGcamW7KPYZ dgOz8zAOy8Ntk7GebPn85XuPcQS9UntdO61X1EyEXg4Ixl/qapidfJQfdCqEeZZXpaV3WKWE8u1l fNB00mC0/xhG3bikQxl3O20nyPjXvl6VZFzglsPRy1Xh5L//rzCCBD8wggKnoAMCAQICBFuRckIw DQYJKoZIhvcNAQEMBQAwGjEYMBYGA1UEAwwPRm9yZXN0IENBIFJTQSA0MB4XDTE4MDkwNjE4MzAy NloXDTIxMDkwNjE4MzAyNlowDjEMMAoGA1UEAwwDVXJpMIIBojANBgkqhkiG9w0BAQEFAAOCAY8A MIIBigKCAYEAtZvms8stf9xj5w7pjYzgmHe7TH0eX/q3buMBqdLufhFuqCizZPhXJmSbue8WHm8H HO7SHQPUqIqbPOMIQfAL8nwWhuTfsN5nrtFW77eiNsEexRNkbhw/U6RzamCGl6xQmUxOD0nabEmd Xdces+rjtzlvjpNHI7xrR32ee4JuGTjwAWlAHPtBC8TqiOR/ysR2K2umk5BkjCEWV9kDfGklfKmu IhuCzzpTvN3AnLMX9kP9IY6E9B8OsLOhkOFBbAMzyqkXibtPWluqOnYW3V3MVc9H1ir6sGLF5onW lHLEorI51WuHlfVO8WJRYwhrzQIIAWAYheZaH2wdb87Kw6o4JbHDLTDJHHrBDwfqa5OtFTeQNWCD JPdHa4xfFpjnMTzP18POa5C6QN5XBpTFsfccWyEdt+ykGB2FMzhB3GgMVRfWPgo8TgxVwU9MHt8s vmxj8KMUd7afSJBOjMIRPZ6gi8Vja9SR9+Hj/YWgpKZMHhI7irJVpWF++7hhfxxDbgDBAgMBAAGj gZgwgZUwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwFgYDVR0RBA8wDYELdXJpQG1pdC5l ZHUwHQYDVR0OBBYEFK3WLENy4CH330dGZEWchN+L1r28MD4GA1UdJQQ3MDUGCCsGAQUFBwMCBggr BgEFBQcDAwYKKwYBBAGCNwoDDAYJKoZIhvcvAQEFBggrBgEFBQcDBDANBgkqhkiG9w0BAQwFAAOC AYEACYbThcFo+JTQNP5UacMtYogWU/yOx5GBLSNNa5cpvoRrOJc9CUDfzfnrd7IhDLXvnFUYNt3i oyU13LKRoPsp/YYuZ2CBI1om9g27SSqqEcOom0eojIKkPNw+sJzYVl7Dz2I7f9DHN6nEC9BeT8Do rjuq67UOlZZw0YvlvCmtMI4xJ7CUM8NrphoeRN18OnbwmkHWIYnYwdxipTJ8oLWi5EbKaUEYyLlC JWd6o9vH8cFNzsViPUl9POxBtX++o5KxtW7/JQwrQt3uFubF6rHQag6HDeXcXSyI0DmL8MrfVtHi Ma2bN+7z8N9Wnuvx8v0qlqfwd+uhmP7OvD32PuzjQxuGyPd43DZazlMhY9IRpSSCPhdbxzS3YwKr jnTZlKGwPiYCmiQ0XSEW3K64Exe4t+jrkBReocr9ccslB4d4XhxQPdAvUdI43xGMbnFea7pyTDyP b0z1vMrYt6dAguU0QTgRZsPFoIldK70ILvncq9amhxuQ4Uw+u2WUXiYba2R1MYICoTCCAp0CAQEw IjAaMRgwFgYDVQQDDA9Gb3Jlc3QgQ0EgUlNBIDQCBFuRckIwDQYJYIZIAWUDBAIBBQCggdEwGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTgxMDAzMDEwNjM1WjAvBgkq hkiG9w0BCQQxIgQg4VLrFXEeWOe17LkjPvvmg0+alLdEe35YVe8gPb/q3rMwMQYJKwYBBAGCNxAE MSQwIjAaMRgwFgYDVQQDDA9Gb3Jlc3QgQ0EgUlNBIDQCBFuRcaAwMwYLKoZIhvcNAQkQAgsxJKAi MBoxGDAWBgNVBAMMD0ZvcmVzdCBDQSBSU0EgNAIEW5FxoDANBgkqhkiG9w0BAQEFAASCAYAxPcek 2uPhr7ZdhJzBEa3/YaPtVoagn0Zmk9ZUQakxltvvtN+oogpkrxzuzq/dI0PRSS5NpNggWyYAKrwc dvG7cELDOn0W7WggJgLNXPU0rniE4YER18UcyLyek+djaM79HYxxP8RP1XHsM45dpUxmab2+JRcq 7tykE4P1WLL7inlNPTtWveZRWrDqZCCsiiHpCOL8DXeNdg5QsqtBwSOZKYWC42BOjrWv4upXncZ+ txhVOcnkXXOcW9+FOnhfrVMpbZxVRehG2kCerY+iP2FguRbCmIjghGjitNQMq3VyarXCbCb457cU o8JGsI880jszm2CQMAUEBWdv6yn+RT3wurpSgnv5aAggMzAA3Yi8DyFiGS3L/6sRrQNGjuPO3kkJ 5ABW3/CuaqgD6j2wys0ZR6aw1G/l0PaP0NDHtD9eY501OS38Yu9GI5OzDeu/J+Qb89pBU71fSUGg X8bVncRvrGcpmUCjr5qSLGcHex/xLs+5Qqq8uCKzcCT+YcIzKjUAAAAAAAA= --Apple-Mail-2355C6F5-6A50-4EF0-A770-4BF45955DEF9-- From nobody Tue Oct 2 19:35:30 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24007131126; Tue, 2 Oct 2018 19:35:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yoPV4Z8nkaFP; Tue, 2 Oct 2018 19:35:27 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFE54131181; Tue, 2 Oct 2018 19:35:26 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id A5EDA20090; Tue, 2 Oct 2018 22:35:20 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 6CEDB230F; Tue, 2 Oct 2018 22:35:21 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 68F86230C; Tue, 2 Oct 2018 22:35:21 -0400 (EDT) From: Michael Richardson To: Brian E Carpenter cc: anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 02:35:29 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: > I'm still gnawing on my original bone: if I was running a highly > secure, personnel-safety-critical network, like the particle > accelerator control network I used to run for a living, I *would not* > allow it to rely on masa.vendor.com, and it would be physically > impossible to do so because there would be no physical link anyway. I > would get my vouchers some other way. This is not light bulbs either. So possibilities that I see: 1) you run a half-mind Registrar that is on the secure side of your air-gap, and it has a USB interface (or 9-track tape drive... statscan.gc.ca used to run unidirectional UUCP over 9-track tapes walked across the machine room air-gap) on which it can place voucher requests, and receive vouchers from other-half-mind Registrar. This lets you use nonced vouchers, potentially with expiry dates. Maybe very long expiry dates. Or maybe your personnel-safety-critical equipment has a best-before date, and so it's acceptable for you to have vouchers only until that date. Also recall that we permit the Registrar to ask for, and get, voucher renewals at any time, so the connected ("other-half-mind") Registrar could always keep a live set of vouchers. 2) you use NETCONF's mechanism with vouchers that you obtain another way, and you place them on USB key/CDROM/QR-code. 3) you continue to configure such a network with craft-serial console, initiating the EST connection via some other credential. > I believe this can be fixed by clearer scoping of the document, and by > renaming the "lower security" section as "alternative trust models" or > something. I accept that the document could have better text here. At one point we discussed an operational considerations document. Is that really what you are asking for? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlu0KugACgkQgItw+93Q 3WU0cwf+Myuo9lklKAMTegD/17ZJpItF/CcvO9adBkxVQ0U8HvNGAyM+n3GdDMJX 4tjV5HlJkyR/O5ZQjqZ6aCt4bQgIYGNfRb7vtoNNo9v7m1JhMjEcq9itmWPWsAoa 9ll0x9p1lemLbTEDf2pGq4y+peOYQb0y77bKJVTj5Tb4ulcN6HJBnVtrGR/g1ctD Nu2huF2yW0RY4osFIcrLrV5YcmcXl41SdTYTCM/rFOW+56Uv/q9TmmHfo2ipMCIt fZXA10C9uTyDqN9hFyU1YuA/f5fvpg+ABPKapVfEqi79RmEwJhSPWY3FXkAiCaQ8 MnT6XjGXVK7IZdk2Q+iaVHKorQvGzg== =HNZG -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Oct 2 20:50:51 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8519613118E; Tue, 2 Oct 2018 20:50:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L_mzmb38hz9v; Tue, 2 Oct 2018 20:50:41 -0700 (PDT) Received: from mail-pg1-x542.google.com (mail-pg1-x542.google.com [IPv6:2607:f8b0:4864:20::542]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F2B0130FF0; Tue, 2 Oct 2018 20:50:41 -0700 (PDT) Received: by mail-pg1-x542.google.com with SMTP id i4-v6so898457pgq.9; Tue, 02 Oct 2018 20:50:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=YCO26Ru5U8yCAVo8WxdeaOUQz0M8ImyUxZpvSp1rKWM=; b=qQgvxv+RwzUp/4kMAQzZIr1DrG9coydRTPJRv/Rmak/Bt2IsC65zZ6Hr2VEMikjStR Ob9DLHKjeO4aLbwNVZ1EIj2aeI+kPUW/I7X9ra1Y7ZyKUEZQo6NVa/cGsyt8WZuqMmYI FJfiIX4ZGyV2HzBiF39zRAzzNbziP9aIfZyMdYjUdvp7HIjZo5nsGKOwKHr9aXmVxxLM CKyOzAIdt89i0cQHR+P+Slwtt8L+VrpjgmCghsPo8BXM7sWE0FB65qy/22GChFBVBitE Z/hAVEBwZkTWsmTB/IOelOLx+dExaQACkjhK5uyKx2nal8nkXZrbfGz04QUWpPl/TnEn gXcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=YCO26Ru5U8yCAVo8WxdeaOUQz0M8ImyUxZpvSp1rKWM=; b=uS6S3N9yBKezooNwzVTDpueRZo9T8O5EJE+9Yw0ctqAN7nbGf60qfMKRzQ3LDgdQKx 7IcfxAEpqn4LE+FopOM7VLWUR/1t65puxxQzo2fvasBuDC/coRODPKRlFHPPyTjaOK5S LdUErJHbzw/+RL33hNEIu0KtFJijcbRSr4NXFQObdSgpdKxDmPF3QN7BYdY8ohr30n75 CkLKl7laN1raZbhqc8NMuomtbirwPIRhD1e+k46Xewg/u8h3tzQPhkGz/h53KGh1AyEh NDJp25z9FvO3dHI+soyd0/X7fhatcmTBYFfLhXf7p58f4StcVTU8lp4yH5cjcu0Sr5KD aRbA== X-Gm-Message-State: ABuFfoilHXISDLlnHFQCa++BAIUylqHBcdt4+/49aFoUKomxyxCmqGYW 25GUTAzQ9KcYELwbfOxU+rnthU/U X-Google-Smtp-Source: ACcGV60mSz+w+e9/6DV8JE5INgFSBQ8wDlGsdEE2S9CxYC/2ozvq/M/hZbLhzT12+8UReFJOtJq5jw== X-Received: by 2002:a63:214d:: with SMTP id s13-v6mr11908202pgm.148.1538538640119; Tue, 02 Oct 2018 20:50:40 -0700 (PDT) Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id d2-v6sm82042pfd.100.2018.10.02.20.50.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Oct 2018 20:50:38 -0700 (PDT) To: Michael Richardson Cc: anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> <10809.1538534121@localhost> From: Brian E Carpenter Message-ID: Date: Wed, 3 Oct 2018 16:50:33 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <10809.1538534121@localhost> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 03:50:44 -0000 On 2018-10-03 15:35, Michael Richardson wrote: > > Brian E Carpenter wrote: > > I'm still gnawing on my original bone: if I was running a highly > > secure, personnel-safety-critical network, like the particle > > accelerator control network I used to run for a living, I *would not* > > allow it to rely on masa.vendor.com, and it would be physically > > impossible to do so because there would be no physical link anyway. I > > would get my vouchers some other way. This is not light bulbs either. > > So possibilities that I see: > > 1) you run a half-mind Registrar that is on the secure side of your air-gap, and it has > a USB interface (or 9-track tape drive... statscan.gc.ca used to run > unidirectional UUCP over 9-track tapes walked across the machine room air-gap) > on which it can place voucher requests, and receive vouchers from > other-half-mind Registrar. > > This lets you use nonced vouchers, potentially with expiry dates. > Maybe very long expiry dates. Or maybe your personnel-safety-critical > equipment has a best-before date, and so it's acceptable for you to have > vouchers only until that date. > > Also recall that we permit the Registrar to ask for, and get, voucher > renewals at any time, so the connected ("other-half-mind") Registrar could > always keep a live set of vouchers. Yes, that sort of solution would work. > 2) you use NETCONF's mechanism with vouchers that you obtain another way, and > you place them on USB key/CDROM/QR-code. You could. But that makes me a bit nervous too. It's not far from seeing a yellow sticky in the ops room saying "sys pw muggle3scop#" or whatever. People who want airgap security are very cautious about USB keys these days. > 3) you continue to configure such a network with craft-serial console, > initiating the EST connection via some other credential. It still doesn't scale. > > > I believe this can be fixed by clearer scoping of the document, and by > > renaming the "lower security" section as "alternative trust models" or > > something. > > I accept that the document could have better text here. > At one point we discussed an operational considerations document. > Is that really what you are asking for? Later, maybe, but to get this draft out of the door I think we can do a simpler fix. As Christian pointed out, there isn't really a distinct security analysis, so I think we need to say: This is the recommencded trust model, based on an on-line MASA. If you don't like that trust model, here are the alternatives: . Brian From nobody Tue Oct 2 21:01:35 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D21C130FF0; Tue, 2 Oct 2018 21:01:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outlook.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id imksIQYSGeG4; Tue, 2 Oct 2018 21:01:30 -0700 (PDT) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-oln040092011090.outbound.protection.outlook.com [40.92.11.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 798961311C5; Tue, 2 Oct 2018 21:01:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BGkR84zzArM4//ykD1dUgE2anDBQNgb7lD2PGy2PKe8=; b=IZm9fbz1565oXAzW4U1oDo74eqX2yE+govzklVNX+OZEyE1hbXx579rHPXUBFH42DNUJhRtsCyjxgGAdi2c1JBZLq9vFg87waGAMD6kbAhAxXiQTOD92+tVhXFYhho9kHwTeew7dhfxgI0WOojLunzWzJlym1y85MQ3TH6vvOf+piWunAOu+QF+5SePbukC+su3QJg+UB+z2Ryw2C7urAPuKL6/wBuQZBNmcz1392UiDzuNr0Oy80EMso1gpvITgDeBJfVoqaxwhY8O0BIpuh/twXcj/Cf/XBAeMNS9JKcT4TWtwfJbBxQUqh6ij3zJmeN2WjHldDbMe33BrHHQvoA== Received: from CO1NAM04FT025.eop-NAM04.prod.protection.outlook.com (10.152.90.55) by CO1NAM04HT053.eop-NAM04.prod.protection.outlook.com (10.152.91.127) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.1185.13; Wed, 3 Oct 2018 04:01:25 +0000 Received: from CY4PR04MB1031.namprd04.prod.outlook.com (10.152.90.51) by CO1NAM04FT025.mail.protection.outlook.com (10.152.90.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.20.1185.13 via Frontend Transport; Wed, 3 Oct 2018 04:01:25 +0000 Received: from CY4PR04MB1031.namprd04.prod.outlook.com ([fe80::d8f4:7e4c:6dd4:7330]) by CY4PR04MB1031.namprd04.prod.outlook.com ([fe80::d8f4:7e4c:6dd4:7330%4]) with mapi id 15.20.1185.024; Wed, 3 Oct 2018 04:01:25 +0000 From: Charlie Kaufman To: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-regext-org.all@ietf.org" Thread-Topic: Secdir review of draft-ietf-regext-10 Thread-Index: AQHUWs2O7c9sPdfll0Kw2a17trwLwg== Date: Wed, 3 Oct 2018 04:01:25 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-incomingtopheadermarker: OriginalChecksum:FE6A6290D358872AEB5C7E4EC0610F01C83B328CEDE6432AE95DEF3CA337519C; UpperCasedChecksum:FF97EDB0E4B9E7F11153A1EBC21568947BA5873F4C401861AF776AD3E749DFB9; SizeAsReceived:7076; Count:43 x-tmn: [DVTN2yoNe3ajs0gEMyxOJrSlo0geUFD3t47Wh9kcTgxO2RUuCOhHZIlF6lp1CBRr] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CO1NAM04HT053; 6:KHR2nEaCY9CZPlSpZO8jpvNeEydPZ7XNDM0BRm60Dqz5b2x+LQQMcZT7wlGHMxS9etJTCh10bQ2XugRqvU1CCC6EMso1nnqrF2dlI20KTeq5AiyyM8YlwVBv8MKN4r5xGek6z+OvOhsjn9zK9fFVUsaOgbmRwnW9RwvVhgCqQv8/AsWAL50mkIFarwc2xRYSo1Kc3mAsqR/cKznycP5Zq3Jgh76Q4WHTInMmDLQhbcFun9zsKUzmiq9/o8gfVk3lpKWs8/beZy+oS/i0QdraWMzTkR8VpC5jsczS9L5AhgcMQfJMQKrrZLoau8t5L2yeKnjXl821YXkOzjiwut01QExs4dCB44ilWZ9XjFPyn8UTpy1ieNP2eAR6ZGFyB8oOpdtP6Yvwhd9LCuDwoZ/MyyFUGYghfncCCUxGfzQ7qD1P8aB2V0BGVeOAw/rRsetd8mmKp9dnmsXXHA8ElJna0Q==; 5:5aUBLKOaHYdvwgLYHVh4CiADlViddF32lBPkDJ5OyOmV6P4jFm5FjZpggeDkD5ypCjM/nrxXjTuBriJ5AO6on0l8Gerr4lP2bE2HHVg8vyPy327M7e8Oql3iJzDnqg5eC51HSKsAfnKzF3zfI0D01Ku3OEs6T0s5krMg1x6ekoo=; 7:vr7by7kG/eCQpUAwAp04Fr4vPUBbhUZLf784h2O3E9vlTaf02P2IPtJ7J4EAKqd6ZFNezxpYzWnhbXclatQbzjlpm4YYv50hdUmhKYim8zDJP1nJEbhp0pdRG9Cr2FrjdPSYKmx/Lnw9d7YMJGM1OImxwwef+23CJG8C0tuN+rWWkvug4+NgaOCRWydUc3faeJVn9evPDly8M08FLK/8aNgg/mj+6/o+E5rsUgMb2MPtE7F1qkGouVGa31UCJGVF x-incomingheadercount: 43 x-eopattributedmessage: 0 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1601125500)(1603101475)(1701031045); SRVR:CO1NAM04HT053; x-ms-traffictypediagnostic: CO1NAM04HT053: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(4566010)(82015058); SRVR:CO1NAM04HT053; BCL:0; PCL:0; RULEID:; SRVR:CO1NAM04HT053; x-forefront-prvs: 0814A2C7A3 x-forefront-antispam-report: SFV:NSPM; SFS:(7070007)(189003)(199004)(14444005)(25786009)(5660300001)(97736004)(486006)(81156014)(56003)(110136005)(99286004)(19627405001)(476003)(6436002)(8936002)(87572001)(102836004)(20460500001)(2900100001)(104016004)(68736007)(33656002)(14454004)(82202002)(86362001)(450100002)(6346003)(71190400001)(2201001)(426003)(54896002)(71200400001)(55016002)(74316002)(46003)(105004)(2501003)(8676002)(256004)(105586002)(5250100002)(106356001)(7696005); DIR:OUT; SFP:1901; SCL:1; SRVR:CO1NAM04HT053; H:CY4PR04MB1031.namprd04.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: outlook.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=charliekaufman@outlook.com; x-microsoft-antispam-message-info: QsNRHnkFVgNvdV9OYfDQADxbwRC9CPwv+3HiDtGNshoRbomLOJvumPJUlKpvJluKs9+SPCvgNM1M37x94FGQ2e+Z0y2Pk4i7EY0gZxzagNQAqKD6ixsdkpYnm6ci/driW4mMsAKI0qMTpXvk0V3Fe8PWWAYKxApX3BoUyYJB03AD0Enb3x3C/92uC9S8ALhuBhF1rCLSEmBvkC8xD0nGeUEzbJDNagA25NSWwb6lfCA= Content-Type: multipart/alternative; boundary="_000_CY4PR04MB10310B46003EAD868BA2C5FDDFE90CY4PR04MB1031namp_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 9a4e3081-9524-43cf-bfc3-dcaef82d5da1 X-MS-Exchange-CrossTenant-Network-Message-Id: 579110d0-a290-4c32-a663-08d628e4e3c1 X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 9a4e3081-9524-43cf-bfc3-dcaef82d5da1 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Oct 2018 04:01:25.7526 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1NAM04HT053 Archived-At: Subject: [secdir] Secdir review of draft-ietf-regext-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 04:01:34 -0000 --_000_CY4PR04MB10310B46003EAD868BA2C5FDDFE90CY4PR04MB1031namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments. This specification defines a syntax for extending the Extensible Provisioni= ng Protocol (EPP) [RFC 5730] to support a new object type representing orga= nizations. It does not change any aspect of the security of the protocol, a= nd I believe it therefore does not require any sort of detailed security re= view. There was one line that I found curious. It might be a typo, or there might= be some arcane explanation: The last paragraph of section 4.2 reads: "Server operators SHOULD confirm that a client is authorized to perform a t= ransform command on a given object. Any attempt to transform an object by a= n unauthorized client MUST be rejected, and the server MUST return a 2201 r= esponse code to the client to note that the client lacks privileges to exec= ute the requested command." Given that unauthorized requests MUST be rejected, it seems curious that se= rver operators only SHOULD confirm that the requestor is authorized. I don'= t know how else the server operator could know to reject unauthorized reque= sts. Perhaps this relates to the question of whether a queued request is re= jected before it is queued or only as it is eventually processed. But this is truly a nit, and even if wrong I don't believe it would ever ca= use an implementation to be incorrect. --Charlie --_000_CY4PR04MB10310B46003EAD868BA2C5FDDFE90CY4PR04MB1031namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I have reviewed this document as part of the security directorate's ongo= ing effort to review all IETF documents being processed by the IESG.  = These comments were written primarily for the benefit of the security area = directors.  Document editors and WG chairs should treat these comments just like any other last call comments.


This specification defines a syntax for extending the Extensible Provisi= oning Protocol (EPP) [RFC 5730] to support a new object type representing o= rganizations. It does not change any aspect of the security of the protocol= , and I believe it therefore does not require any sort of detailed security review.


There was one line that I found curious. It might be a typo, or there mi= ght be some arcane explanation:


The last paragraph of section 4.2 reads:

"Server operators SHOULD confirm that a client is authorized to per= form a transform command on a given object. Any attempt to transform an obj= ect by an unauthorized client MUST be rejected, and the server MUST return = a 2201 response code to the client to note that the client lacks privileges to execute the requested command.&qu= ot;


Given that unauthorized requests MUST be rejected, it seems curious that= server operators only SHOULD confirm that the requestor is authorized. I d= on't know how else the server operator could know to reject unauthorized re= quests. Perhaps this relates to the question of whether a queued request is rejected before it is queued o= r only as it is eventually processed.

But this is truly a nit, and even if wrong I don't believe it would ever= cause an implementation to be incorrect.


 --Charlie


--_000_CY4PR04MB10310B46003EAD868BA2C5FDDFE90CY4PR04MB1031namp_-- From nobody Tue Oct 2 23:20:43 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C83611311F3; Tue, 2 Oct 2018 23:20:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dg6q1sUvlpL2; Tue, 2 Oct 2018 23:20:34 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AB44131090; Tue, 2 Oct 2018 23:20:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2978; q=dns/txt; s=iport; t=1538547634; x=1539757234; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=eOaOYtcbBOkdP8kRdvMpNLSbP9CZyPKPnwRObdcxV+Q=; b=dP69qYsjRJveChM718BtqyhRIUtuo8P4W6wUNOYWiDQcRg4vtxNZBrWp atslxeekblAmUX4L35z5T2ysBgxgkj3Ls6D5VfIEbvwW/H58TXvDrPto8 koOCZqDUO50nxpDEXthJ/L2ACck6KKbgAZ5pyuqMp8Ohwyv90ZsZR/Te/ I=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B7AAC/XrRb/xbLJq1aGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGERW0SKIN0iHSNHi2YVggDG4RRAoQ4OBQBAwEBAgEBAm0?= =?us-ascii?q?cDEIOAYRoAQUjVhALGCoCAlcGAQwIAQGDHQGCAaUQgS6KAQ+CbYgtggCBEie?= =?us-ascii?q?CPS6Hf4JXAp1DCYQBgWhfiWwGF4IUhnqGUJVHgVkhgVUzGggbFYMnCYJEgmG?= =?us-ascii?q?LKD0whVGJCwEB?= X-IronPort-AV: E=Sophos; i="5.54,334,1534809600"; d="asc'?scan'208"; a="6902152" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 03 Oct 2018 06:20:31 +0000 Received: from [10.61.165.23] ([10.61.165.23]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTP id w936KVGt002841; Wed, 3 Oct 2018 06:20:31 GMT To: Michael Richardson , Brian E Carpenter Cc: anima@ietf.org, Security Directorate References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> <10809.1538534121@localhost> From: Eliot Lear Openpgp: preference=signencrypt Autocrypt: addr=lear@cisco.com; prefer-encrypt=mutual; keydata= xsBNBFMe1UQBCADdYOS5APDpIpF2ohAxB+nxg1GpAYr8iKwGIb86Wp9NkK5+QwbW9H035clT lpVLciExtN8E3MCTPOIm7aITPlruixAVwlBY3g7U9eRppSw9O2H/7bie2GOnYxqmsw4v1yNZ 9NcMLlD8raY0UcQ5r698c8JD4xUTLqybZXaK2sPeJkxzT+IwupRSQ+vXEvFFGhERQ88zo5Ca Sa1Gw/Rv54oH0Dq2XYkO41rhxQ60BKZLZuQK1d9+1y3I+An3AJeD3AA31fJZD3H8YRKOBgqe ILPILbw1mM7gCtCjfvFCt6AFCwEsjITGx55ceoQ+t5B5XGYJEppMWsIFrwZsfbL+gP31ABEB AAHNJUVsaW90IExlYXIgPGxlYXJAb2Zjb3Vyc2VpbXJpZ2h0LmNvbT7CwJEEEwECADsCGwMC HgECF4ACGQEWIQSY0L2QRh2wkqeyYR2HtmtG2dJ6MwUCWxJwMwULCQgHAgYVCAkKCwIEFgID AQAKCRCHtmtG2dJ6MyMyCACXvtFjAYGMtOkD9MD4nI3ifFpkrj8xTMbXjrv5hdqmzRmQ0wqA 1U/OlZux+P/NaVMiZNZc8zw0nsx/INAqDOVd4/tLWF+ywTkeRFR0VnaUxLwCReZAZOaRS+md +52u/6ddoFja2RnjZ43qbbuvVUARQVIyMJz+GbR6mEZQHR0psD7dDYZDyrpivCxm8zHQwmB6 AZUlO7OJgljDvVPVDCabg/ZnJw1qS0OzSiNb0MySk1D5A7FdwDgeKxuMYUOOoVVTTMWNWcME UkRX9LxElswEt0PQWiz/j3FYXTxiFfl/1vKcHx4pM+E5C5mhTbrdFUFLJC3Y5fLID7stK/Ch aEaBzsBNBFMe1UQBCAC0WV7Ydbv95xYGPhthTdChBIpPtl7JPCV/c6/3iEmvjpfGuFNaK4Ma cj9le20EA5A1BH7PgLGoHOiPM65NysRpZ96RRVX3TNfLmhGMFr5hPOGNdq+xcGHVutmwPV9U 7bKeUNRiPFx3YdEkExddqV2E8FltT0x2FSKe2xszPPHB6gVtMckX5buI9p1K3fbVhXdvEkcY Y/jB0JEJGyhS5aEbct5cHUvDAkT81/YFK5Jfg8RRwu1q1t1YuIJSOWAZQ9J9oUsg6D9RpClU +tIFBoe3iTp1AUfJcypucGKgLYKtpu/aygcpQONHYkYW5003mPsrajFhReVF5veycMbHs4u5 ABEBAAHCwF8EGAECAAkFAlMe1UQCGwwACgkQh7ZrRtnSejOSuQgA27p2rYB7Kh20dym6V8c6 2pWpBHHTgxr/32zevxHSiXl6xvUCg5T8WUwfUk8OvgDcBErK/blDAMXQzSg3sp450JhR8RnX HXF5Zz2T04X7HnlIVJGwf2CjnwyEAJCqMzaCmI+g3Imvg/8L4nyBFvhlFHDv+kIvMiujyycj PAu7xxKplBs1/IEwmDoAMjneFmawvfeQnwdMhSKK8PjKSuzGU5uUmxj3GBfRqvTM0qpmhMPF OmDhJSmH55HLAky2MlmqJYXJPt/9EfSEhFiua1M6gLiuNEuPkp+8jcnHQqKr0IeHt8UqcwLt 2mGfIyl0FVdF9hvWPjNRzGbgqoT1Di03RQ== Message-ID: <83c2e4dd-e60a-158b-50aa-7e243216854a@cisco.com> Date: Wed, 3 Oct 2018 08:20:30 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <10809.1538534121@localhost> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ht557MXmAIP3cp9Z7MaEbmzUKdMaS9uHT" X-Outbound-SMTP-Client: 10.61.165.23, [10.61.165.23] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 06:20:36 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ht557MXmAIP3cp9Z7MaEbmzUKdMaS9uHT Content-Type: multipart/mixed; boundary="akldOHhjlJQHzntTE9sams1QCEqA43Kr4"; protected-headers="v1" From: Eliot Lear To: Michael Richardson , Brian E Carpenter Cc: anima@ietf.org, Security Directorate Message-ID: <83c2e4dd-e60a-158b-50aa-7e243216854a@cisco.com> Subject: Re: [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> <10809.1538534121@localhost> In-Reply-To: <10809.1538534121@localhost> --akldOHhjlJQHzntTE9sams1QCEqA43Kr4 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Hi Michael: On 03.10.18 04:35, Michael Richardson wrote: > 1) you run a half-mind Registrar that is on the secure side of your air= -gap, and it has > a USB interface (or 9-track tape drive... statscan.gc.ca used to run= > unidirectional UUCP over 9-track tapes walked across the machine roo= m air-gap) > on which it can place voucher requests, and receive vouchers from > other-half-mind Registrar. > > This lets you use nonced vouchers, potentially with expiry dates. > Maybe very long expiry dates. Or maybe your personnel-safety-critic= al > equipment has a best-before date, and so it's acceptable for you to = have > vouchers only until that date. One approach I would like would be to get the voucher size down to the point where it could reasonably fit into a QR code.=C2=A0 Then it's a sca= n.=C2=A0 I see that as future work. Eliot --akldOHhjlJQHzntTE9sams1QCEqA43Kr4-- --ht557MXmAIP3cp9Z7MaEbmzUKdMaS9uHT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlu0X64ACgkQh7ZrRtnS ejMNWwf/et8+opX0MiBrnsBybbqO+LPLJnGaByW21P9iZQJJ52wKHReZ0MN5fSRZ lhschuNBJl6mVclNVs3CUoIn41eTyD0cGTY106eMDESab9HABlrdTQ2eMcWBy/cW r+HQ2zzhJbugf3qpLZ/W4mzRf6+DiolCyuytSQkmP+4MmJz6ijld9+ol8ssyC2EA XieGsm3hZ9dPGDUIu/Y7ndRzCAp8e6ZVpZogoJfr/9/sqS6u/ADYHsLHfixg86Wj CamlvAN4s1US52l1mkjcykeoL0Gt9Y/Y8evXLj58+r9fg/6TDSPiK6nfI8s4CaTG FJnwUXxQ/8PVJ9n2I5PPwhhE80XT7A== =k3vp -----END PGP SIGNATURE----- --ht557MXmAIP3cp9Z7MaEbmzUKdMaS9uHT-- From nobody Wed Oct 3 07:28:17 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81D1D1312B3; Wed, 3 Oct 2018 07:28:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nVOR3RLtQ2SP; Wed, 3 Oct 2018 07:28:13 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 463ED13129E; Wed, 3 Oct 2018 07:28:13 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 55F3620090; Wed, 3 Oct 2018 10:28:11 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 24EA62352; Wed, 3 Oct 2018 10:28:12 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 21B44234D; Wed, 3 Oct 2018 10:28:12 -0400 (EDT) From: Michael Richardson To: Brian E Carpenter cc: anima@ietf.org, Security Directorate In-Reply-To: References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> <10809.1538534121@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 14:28:16 -0000 --=-=-= Content-Type: text/plain Brian E Carpenter wrote: >> 2) you use NETCONF's mechanism with vouchers that you obtain another >> way, and you place them on USB key/CDROM/QR-code. > You could. But that makes me a bit nervous too. It's not far from > seeing a yellow sticky in the ops room saying "sys pw muggle3scop#" or > whatever. People who want airgap security are very cautious about USB > keys these days. I agree, it's a bit similar. Except that the voucher is a signed entity, and disclosing it causes privacy issues (people know what you have), rather than being p0wned. It can easily go on a CDROM or something else you do trust. A QR code is also possible, assuming your personnel-safety-critical device has a camera. [oh. Now I'm thinking about 2001, Space Odyssey. I'm seeing Dave Borman with a giant QR code tattoed on him, much like we proposed doing with the RSA algorithm back during the cryptowars of the 1990s ] {and the issues with USB devices are squarely a problem of GUIs accepting input devices without validation. It's fixable} >> 3) you continue to configure such a network with craft-serial console, >> initiating the EST connection via some other credential. > It still doesn't scale. And, worse, I think, it's prone to human error, which is exactly what we want personnel-safety-critical devices not to suffer from. >> > I believe this can be fixed by clearer scoping of the document, and >> by > renaming the "lower security" section as "alternative trust >> models" or > something. >> >> I accept that the document could have better text here. At one point >> we discussed an operational considerations document. Is that really >> what you are asking for? > Later, maybe, but to get this draft out of the door I think we can do a > simpler fix. As Christian pointed out, there isn't really a distinct > security analysis, so I think we need to say: This is the > recommencded trust model, based on an on-line MASA. If you don't like > that trust model, here are the alternatives: . okay. It's gonna take a gallon or two of caffeinated beverage. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlu00fsACgkQgItw+93Q 3WV0aAgAvRTI8tkNi1xBzu9Pf1muZ6k/958le5RQL1QNQNfpBGZhal4Rkhd6JXvq ch9JpZHb3799S0Ze1CDsCeE6+V6HgK0RJI+RLySi32FFyGc9+g/HojhmSRkfoiaQ qUTxVEwzsD66vOuRFwyDV1+lcJBe5Bk7dSgdPODA4g7MK5cJ1ez8fgwwhtl9c3bf WJ6wRgkWh10xzMdE23rXRmS+XF8OfnIzS56zQOUSLdj6uzMwOefj+B2vJdqnThN+ VoNOSZFsHVpcTO3XoWFJdXSdzftoDzDQn9sJS0sx2ONNSePqeWzOAfdiUcnQiG1r Z2nfizHU1cio+k/1J4QoMqGo7PLQnQ== =T8dg -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Oct 3 07:37:39 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DDE91312B2; Wed, 3 Oct 2018 07:37:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D1uxOavxtriz; Wed, 3 Oct 2018 07:37:36 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7A66131280; Wed, 3 Oct 2018 07:37:35 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 816C720090; Wed, 3 Oct 2018 10:37:32 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 502CC2352; Wed, 3 Oct 2018 10:37:33 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 4D5A4234D; Wed, 3 Oct 2018 10:37:33 -0400 (EDT) From: Michael Richardson To: Eliot Lear cc: Brian E Carpenter , anima@ietf.org, Security Directorate In-Reply-To: <83c2e4dd-e60a-158b-50aa-7e243216854a@cisco.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> <23133.1538520783@localhost> <10809.1538534121@localhost> <83c2e4dd-e60a-158b-50aa-7e243216854a@cisco.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 14:37:38 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eliot Lear wrote: >> This lets you use nonced vouchers, potentially with expiry dates. >> Maybe very long expiry dates. Or maybe your personnel-safety-critic= al >> equipment has a best-before date, and so it's acceptable for you to >> have vouchers only until that date. > One approach I would like would be to get the voucher size down to the > point where it could reasonably fit into a QR code.=C2=A0 Then it's a= scan.=C2=A0 > I see that as future work. current constrained voucher: dooku-[projects/pandora/highway](2.4.1) mcr 10028 %ls -l tmp/voucher_00-D0-E5-F2-10-03.vch =2Drw-r--r-- 1 mcr mcr 800 Oct 2 23:06 tmp/voucher_00-D0-E5-F2-10-03.vch Note that this does not include the key that did the signing (the MASA key), and I think that this pins a certificate rather than a Raw Public Key, so it could be smaller. (I have to check what I put in that one) It's okay not to include the signing key inside, as the pledge already has it. The Registrar ("owner's trust controller") would like to have that key to audit the signature, but that can be done outside of the voucher. It converts to QR code just fine: http://www.sandelman.ca/tmp/qr1.png Probably needs to have some URI or some such to tell things what is inside. However, not many devices we care about (whether routers or lightbulbs) have cameras. If there is some smartphone interaction, then that's a different thing, and DPP could work, provided we get the APIs that we need = to make it deployable. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlu01CwACgkQgItw+93Q 3WXDJwgAp/bA/u/XMgC1lsdJmcCmcHlzR6iWU52XwKIhZgApVTwQJfPTZuE0aGT7 cuGup/8A6h5KstrxNChXO8avwJc/BtqrOuA3CsMTY1n2mDj/HfGViZMTAzN8BVfJ EuAeOfNRVZN07NovTnw5I3KG3MMKV0v1rmyZ+cQbpZ2PPdbJnjx/y13B5X2Evk8F jRrC9RmRAnBCX67Hiv8LDDjKaGlwHXEvrWifuigb2Pn0Ske/n7lhwjEOxvALewvs KPYexHSm+7O26WotdmPCGkCgHJMyE9kntugG37m2LLl7ccnOfhEHWJzY07ZLJqm0 egku0YnVH6KeFYmAdlta/7mCKHuBDQ== =y07n -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Oct 3 08:19:12 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 14DA21312D3; Wed, 3 Oct 2018 08:18:55 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Samuel Weiler To: Cc: draft-ietf-tictoc-1588v2-yang.all@ietf.org, ietf@ietf.org, tictoc@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153857993505.8974.13448340837663409232@ietfa.amsl.com> Date: Wed, 03 Oct 2018 08:18:55 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-tictoc-1588v2-yang-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2018 15:18:55 -0000 Reviewer: Samuel Weiler Review result: Has Issues I wonder whether there should be a requirement to use authentication when making updates. As the doc says: Write operations (e.g., edit-config) to these data nodes without proper protection can have a negative effect on network operations. I'm sure someone will argue "if this is used in a closed network, we can avoid the use of authentication". Prudence suggests that "closed" networks don't remain that way forever, and defense-in-depth is advisable. Let's add a MUST or at least a SHOULD. From nobody Wed Oct 3 19:50:21 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C828C130DD6; Wed, 3 Oct 2018 19:50:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6h6K8cJkbo7V; Wed, 3 Oct 2018 19:50:10 -0700 (PDT) Received: from dmz-mailsec-scanner-1.mit.edu (dmz-mailsec-scanner-1.mit.edu [18.9.25.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12A04130DD5; Wed, 3 Oct 2018 19:50:09 -0700 (PDT) X-AuditID: 1209190c-b81ff70000004d4b-93-5bb57fdf31e3 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-1.mit.edu (Symantec Messaging Gateway) with SMTP id 39.8C.19787.0EF75BB5; Wed, 3 Oct 2018 22:50:08 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id w942o1HG020501; Wed, 3 Oct 2018 22:50:02 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w942nsnu029563 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 3 Oct 2018 22:49:56 -0400 Date: Wed, 3 Oct 2018 21:49:53 -0500 From: Benjamin Kaduk To: Samuel Weiler Cc: secdir@ietf.org, draft-ietf-tictoc-1588v2-yang.all@ietf.org, ietf@ietf.org, tictoc@ietf.org Message-ID: <20181004024953.GK56675@kduck.kaduk.org> References: <153857993505.8974.13448340837663409232@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <153857993505.8974.13448340837663409232@ietfa.amsl.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrFIsWRmVeSWpSXmKPExsUixG6nrvugfmu0wd92K4sbzW/YLZ5tnM9i 8WHhQxaLv8097A4sHkuW/GQKYIzisklJzcksSy3St0vgymhtPsBasIOzoqdzA0sD4w72LkZO DgkBE4kPR9cD2VwcQgKLmSS2zJwI5WxglPj79yEThHOFSaL1+QkWkBYWARWJhQsegtlsQHZD 92VmEFtEQEPiyL0ZrCA2s0CGxJHrp8DiwgIeEhdvnQIaxMHBC7RuSUMkiCkk4CzxZlY8SAWv gKDEyZlPWCA6tSRu/HsJVs0sIC2x/B8HSJhTwEXi3K2XYDeLCihL7O07xD6BUWAWku5ZSLpn IXQvYGRexSibklulm5uYmVOcmqxbnJyYl5dapGuol5tZopeaUrqJERSsnJI8OxjPvPE6xCjA wajEw9vxbku0EGtiWXFl7iFGSQ4mJVHe4Mqt0UJ8SfkplRmJxRnxRaU5qcWHGCU4mJVEeNPj gHK8KYmVValF+TApaQ4WJXHeCS2Lo4UE0hNLUrNTUwtSi2CyMhwcShK8c+qAGgWLUtNTK9Iy c0oQ0kwcnCDDeYCG7wKp4S0uSMwtzkyHyJ9i1OVoe3p9BrMQS15+XqqUOG8TSJEASFFGaR7c HFCSkcjeX/OKURzoLWHeiyBVPMAEBTfpFdASJqAl8jlbQJaUJCKkpBoYd+3T7v5xfGqup2d1 hurqvVuyn3fechUO2rho2hM9aR+dk7919FfvXjGpNTv6Wu8fqxcJ8vcKs6ZG6l+fJ5EoufhI j7xP9P7O3NQ3lsevSufIzKnQ0zP7tuBS1oWYdcaOF9YecHrEfCRpXoWF57IvjNvXvjmbp7mq 9uDd2j3flW6IBHHf4wk+rsRSnJFoqMVcVJwIAMbG2CsNAwAA Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-tictoc-1588v2-yang-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 02:50:12 -0000 On Wed, Oct 03, 2018 at 08:18:55AM -0700, Samuel Weiler wrote: > Reviewer: Samuel Weiler > Review result: Has Issues > > I wonder whether there should be a requirement to use authentication when > making updates. As the doc says: The NETCONF and RESTCONF secure transport layers already handle the authentication requirements. E.g., RFC 8040 Section 2.5: The RESTCONF server MUST authenticate client access to any protected resource. If the RESTCONF client is not authenticated, the server SHOULD send an HTTP response with a "401 Unauthorized" status-line, as defined in Section 3.1 of [RFC7235]. The error-tag value "access-denied" is used in this case. But thank you for doing the review, and you're right that this is important! -Ben > Write operations (e.g., edit-config) to these data nodes without > proper protection can have a negative effect on network operations. > > I'm sure someone will argue "if this is used in a closed network, we can avoid > the use of authentication". Prudence suggests that "closed" networks don't > remain that way forever, and defense-in-depth is advisable. Let's add a MUST > or at least a SHOULD. > > From nobody Wed Oct 3 20:05:57 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F41C130DD8; Wed, 3 Oct 2018 20:05:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0neFKX3YX0ZD; Wed, 3 Oct 2018 20:05:54 -0700 (PDT) Received: from cnnic.cn (smtp13.cnnic.cn [218.241.118.13]) by ietfa.amsl.com (Postfix) with ESMTP id 3FFA5130DD5; Wed, 3 Oct 2018 20:05:50 -0700 (PDT) Received: by ajax-webmail-ocmail02.zx.nicx.cn (Coremail) ; Thu, 4 Oct 2018 11:05:48 +0800 (GMT+08:00) X-Originating-IP: [159.226.7.2] Date: Thu, 4 Oct 2018 11:05:48 +0800 (GMT+08:00) X-CM-HeaderCharset: UTF-8 From: "Linlin Zhou" To: "Charlie Kaufman" Cc: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-regext-org.all@ietf.org" X-Priority: 3 X-Mailer: Coremail Webmail Server Version XT3.0.8 dev build 20171117(fcd8b4ed) Copyright (c) 2002-2018 www.mailtech.cn cnnic In-Reply-To: References: X-SendMailWithSms: false Content-Type: multipart/alternative; boundary="----=_Part_17539_32766054.1538622348351" MIME-Version: 1.0 Message-ID: <2279b7dc.132c.1663d09dc40.Coremail.zhoulinlin@cnnic.cn> X-Coremail-Locale: zh_CN X-CM-TRANSID: AQAAf0BJUPyMg7VbM4AcAA--.2168W X-CM-SenderInfo: p2kr3zplqox0w6fq0xffof0/1tbiAQAIBiVCN4lulgAAsu X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3iIAIbVAYjsxI4VWxJw CS07vEb4IE77IF4wCS07vE1I0E4x80FVAKz4kxMIAIbVAFxVCaYxvI4VCIwcAKzIAtYxBI daVFxhVjvjDU= Archived-At: Subject: Re: [secdir] Secdir review of draft-ietf-regext-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 03:05:56 -0000 ------=_Part_17539_32766054.1538622348351 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 SGkgQ2hhcmxpZSwKClRoYW5rcyBmb3IgeW91ciByZXZpZXcuCgpNYXliZSBJIGNhbiBnaXZlIHNv bWUgYXJjYW5lIGV4cGxhbmF0aW9ucyBmb3IgdGhlc2Ugd29yZHMuCgpBY2NvcmRpbmcgdG8gUkZD NTczMCwgRVBQIGNhbiB1c2UgYXV0aGVudGljYXRpb24gaW5mb3JtYXRpb24gYXNzb2NpYXRlZCB3 aXRoIG9iamVjdHMgdG8gY29uZmlybSBvYmplY3QtdHJhbnNmZXIgYXV0aG9yaXR5LiBXaXRoIGFu IDxvYmo6YXV0aEluZm8+IGVsZW1lbnQsIHRoZSBzZXJ2ZXIgb3BlcmF0b3JzIGNhbiBjb25maXJt IHRoZSBhdXRob3JpemVkIG9yIHVuYXV0aG9yaXplZCByZXF1ZXN0cy4KClRoZSBvcmlnaW5hbCBk ZXNpZ24gb2YgdGhpcyBkcmFmdCBoYXMgPG9yZzphdXRoSW5mbz4gdGhhdCBpcyBhc3NvY2lhdGVk IHdpdGggb3JnIG9iamVjdCB0byBmYWNpbGl0YXRlIHRyYW5zZmVyIG9wZXJhdGlvbnMuIEFmdGVy IHNvbWUgZGlzY3Vzc2lvbnMsIHRoaXMgZWxlbWVudCB3YXMgcmVtb3ZlZCBmb3Igc29tZSByZWFz b24gaW4gdGhlIFhNTCBzY2hlbWEgYW5kIGVsZW1lbnQgZGVzY3JpcHRpb25zLiBHaXZlbiB0aGF0 IHRoZSBlbGVtZW50IHdhcyByZW1vdmVkLCBpdCBpcyBpbmRlZWQgaW5hcHByb3ByaWF0ZSB0byBo YXZlIHRoZXNlIHdvcmRzIGhlcmUgdG8gbWFrZSByZWFkZXJzIGNvbmZ1c2VkLiBJdCBpcyBvdXIg bmVnbGVjdC4gU28gd2Ugc3VnZ2VzdCBkZWxldGluZyB0aGVzZSB3b3Jkcy4KCiAKClJlZ2FyZHMs CgpMaW5saW4KCgotLS0tLeWOn+Wni+mCruS7ti0tLS0tCuWPkeS7tuS6ujoiQ2hhcmxpZSBLYXVm bWFuIiA8Y2hhcmxpZWthdWZtYW5Ab3V0bG9vay5jb20+CuWPkemAgeaXtumXtDoyMDE4LTEwLTAz IDEyOjAxOjI1ICjmmJ/mnJ/kuIkpCuaUtuS7tuS6ujogInNlY2RpckBpZXRmLm9yZyIgPHNlY2Rp ckBpZXRmLm9yZz4sICJpZXNnQGlldGYub3JnIiA8aWVzZ0BpZXRmLm9yZz4sICJkcmFmdC1pZXRm LXJlZ2V4dC1vcmcuYWxsQGlldGYub3JnIiA8ZHJhZnQtaWV0Zi1yZWdleHQtb3JnLmFsbEBpZXRm Lm9yZz4K5oqE6YCBOgrkuLvpopg6IFNlY2RpciByZXZpZXcgb2YgZHJhZnQtaWV0Zi1yZWdleHQt MTAKCgoKSSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJp dHkgZGlyZWN0b3JhdGUncyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1l bnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgSUVTRy4gIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3Jp dHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVj dG9ycy4gIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2Ug Y29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuCgoKCgpUaGlz IHNwZWNpZmljYXRpb24gZGVmaW5lcyBhIHN5bnRheCBmb3IgZXh0ZW5kaW5nIHRoZSBFeHRlbnNp YmxlIFByb3Zpc2lvbmluZyBQcm90b2NvbCAoRVBQKSBbUkZDIDU3MzBdIHRvIHN1cHBvcnQgYSBu ZXcgb2JqZWN0IHR5cGUgcmVwcmVzZW50aW5nIG9yZ2FuaXphdGlvbnMuIEl0IGRvZXMgbm90IGNo YW5nZSBhbnkgYXNwZWN0IG9mIHRoZSBzZWN1cml0eSBvZiB0aGUgcHJvdG9jb2wsIGFuZCBJIGJl bGlldmUgaXQgdGhlcmVmb3JlIGRvZXMgbm90IHJlcXVpcmUgYW55IHNvcnQgb2YgZGV0YWlsZWQg c2VjdXJpdHkgcmV2aWV3LgoKCgoKVGhlcmUgd2FzIG9uZSBsaW5lIHRoYXQgSSBmb3VuZCBjdXJp b3VzLiBJdCBtaWdodCBiZSBhIHR5cG8sIG9yIHRoZXJlIG1pZ2h0IGJlIHNvbWUgYXJjYW5lIGV4 cGxhbmF0aW9uOgoKCgoKVGhlIGxhc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gNC4yIHJlYWRzOgoK IlNlcnZlciBvcGVyYXRvcnMgU0hPVUxEIGNvbmZpcm0gdGhhdCBhIGNsaWVudCBpcyBhdXRob3Jp emVkIHRvIHBlcmZvcm0gYSB0cmFuc2Zvcm0gY29tbWFuZCBvbiBhIGdpdmVuIG9iamVjdC4gQW55 IGF0dGVtcHQgdG8gdHJhbnNmb3JtIGFuIG9iamVjdCBieSBhbiB1bmF1dGhvcml6ZWQgY2xpZW50 IE1VU1QgYmUgcmVqZWN0ZWQsIGFuZCB0aGUgc2VydmVyIE1VU1QgcmV0dXJuIGEgMjIwMSByZXNw b25zZSBjb2RlIHRvIHRoZSBjbGllbnQgdG8gbm90ZSB0aGF0IHRoZSBjbGllbnQgbGFja3MgcHJp dmlsZWdlcyB0byBleGVjdXRlIHRoZSByZXF1ZXN0ZWQgY29tbWFuZC4iCgoKCgpHaXZlbiB0aGF0 IHVuYXV0aG9yaXplZCByZXF1ZXN0cyBNVVNUIGJlIHJlamVjdGVkLCBpdCBzZWVtcyBjdXJpb3Vz IHRoYXQgc2VydmVyIG9wZXJhdG9ycyBvbmx5IFNIT1VMRCBjb25maXJtIHRoYXQgdGhlIHJlcXVl c3RvciBpcyBhdXRob3JpemVkLiBJIGRvbid0IGtub3cgaG93IGVsc2UgdGhlIHNlcnZlciBvcGVy YXRvciBjb3VsZCBrbm93IHRvIHJlamVjdCB1bmF1dGhvcml6ZWQgcmVxdWVzdHMuIFBlcmhhcHMg dGhpcyByZWxhdGVzIHRvIHRoZSBxdWVzdGlvbiBvZiB3aGV0aGVyIGEgcXVldWVkIHJlcXVlc3Qg aXMgcmVqZWN0ZWQgYmVmb3JlIGl0IGlzIHF1ZXVlZCBvciBvbmx5IGFzIGl0IGlzIGV2ZW50dWFs bHkgcHJvY2Vzc2VkLgoKQnV0IHRoaXMgaXMgdHJ1bHkgYSBuaXQsIGFuZCBldmVuIGlmIHdyb25n IEkgZG9uJ3QgYmVsaWV2ZSBpdCB3b3VsZCBldmVyIGNhdXNlIGFuIGltcGxlbWVudGF0aW9uIHRv IGJlIGluY29ycmVjdC4KCgoKCiAtLUNoYXJsaWUKCgo= ------=_Part_17539_32766054.1538622348351 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+CiA8bzpPZmZpY2VEb2N1bWVudFNldHRpbmdzPgogIDxv OkFsbG93UE5HLz4KIDwvbzpPZmZpY2VEb2N1bWVudFNldHRpbmdzPgo8L3htbD48IVtlbmRpZl0t LT4KCjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPgogPHc6V29yZERvY3VtZW50PgogIDx3OlZpZXc+ Tm9ybWFsPC93OlZpZXc+CiAgPHc6Wm9vbT4wPC93Olpvb20+CiAgPHc6VHJhY2tNb3Zlcy8+CiAg PHc6VHJhY2tGb3JtYXR0aW5nLz4KICA8dzpQdW5jdHVhdGlvbktlcm5pbmcvPgogIDx3OkRyYXdp bmdHcmlkVmVydGljYWxTcGFjaW5nPjEwIHB0PC93OkRyYXdpbmdHcmlkVmVydGljYWxTcGFjaW5n PgogIDx3OkRpc3BsYXlIb3Jpem9udGFsRHJhd2luZ0dyaWRFdmVyeT4wPC93OkRpc3BsYXlIb3Jp em9udGFsRHJhd2luZ0dyaWRFdmVyeT4KICA8dzpEaXNwbGF5VmVydGljYWxEcmF3aW5nR3JpZEV2 ZXJ5PjI8L3c6RGlzcGxheVZlcnRpY2FsRHJhd2luZ0dyaWRFdmVyeT4KICA8dzpWYWxpZGF0ZUFn YWluc3RTY2hlbWFzLz4KICA8dzpTYXZlSWZYTUxJbnZhbGlkPmZhbHNlPC93OlNhdmVJZlhNTElu dmFsaWQ+CiAgPHc6SWdub3JlTWl4ZWRDb250ZW50PmZhbHNlPC93Oklnbm9yZU1peGVkQ29udGVu dD4KICA8dzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0PmZhbHNlPC93OkFsd2F5c1Nob3dQbGFj ZWhvbGRlclRleHQ+CiAgPHc6RG9Ob3RQcm9tb3RlUUYvPgogIDx3OkxpZFRoZW1lT3RoZXI+RU4t VVM8L3c6TGlkVGhlbWVPdGhlcj4KICA8dzpMaWRUaGVtZUFzaWFuPlpILUNOPC93OkxpZFRoZW1l QXNpYW4+CiAgPHc6TGlkVGhlbWVDb21wbGV4U2NyaXB0PlgtTk9ORTwvdzpMaWRUaGVtZUNvbXBs ZXhTY3JpcHQ+CiAgPHc6Q29tcGF0aWJpbGl0eT4KICAgPHc6U3BhY2VGb3JVTC8+CiAgIDx3OkJh bGFuY2VTaW5nbGVCeXRlRG91YmxlQnl0ZVdpZHRoLz4KICAgPHc6RG9Ob3RMZWF2ZUJhY2tzbGFz aEFsb25lLz4KICAgPHc6VUxUcmFpbFNwYWNlLz4KICAgPHc6RG9Ob3RFeHBhbmRTaGlmdFJldHVy bi8+CiAgIDx3OkFkanVzdExpbmVIZWlnaHRJblRhYmxlLz4KICAgPHc6QnJlYWtXcmFwcGVkVGFi bGVzLz4KICAgPHc6U25hcFRvR3JpZEluQ2VsbC8+CiAgIDx3OldyYXBUZXh0V2l0aFB1bmN0Lz4K ICAgPHc6VXNlQXNpYW5CcmVha1J1bGVzLz4KICAgPHc6RG9udEdyb3dBdXRvZml0Lz4KICAgPHc6 U3BsaXRQZ0JyZWFrQW5kUGFyYU1hcmsvPgogICA8dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPgog ICA8dzpEb250RmxpcE1pcnJvckluZGVudHMvPgogICA8dzpPdmVycmlkZVRhYmxlU3R5bGVIcHMv PgogICA8dzpVc2VGRUxheW91dC8+CiAgPC93OkNvbXBhdGliaWxpdHk+CiAgPHc6Tm9MaW5lQnJl YWtzQWZ0ZXIgTGFuZz0iSkEiPiQoW3vCo8KlwrfigJjigJzjgIjjgIrjgIzjgI7jgJDjgJTjgJbj gJ3vuZnvuZvvuZ3vvITvvIjvvI7vvLvvvZvvv6Hvv6U8L3c6Tm9MaW5lQnJlYWtzQWZ0ZXI+CiAg PHc6Tm9MaW5lQnJlYWtzQmVmb3JlIExhbmc9IkpBIj4hJSksLjo7Jmd0Oz9dfcKiwqjCsMK3y4fL ieKAleKAluKAmeKAneKApuKAsOKAsuKAs+KAuuKEg+KItuOAgeOAguOAg+OAieOAi+OAjeOAj+OA keOAleOAl+OAnu+4tu+4uu+4vu+5gO+5hO+5mu+5nO+5nu+8ge+8gu+8he+8h++8ie+8jO+8ju+8 mu+8m++8n++8ve+9gO+9nO+9ne+9nu+/oDwvdzpOb0xpbmVCcmVha3NCZWZvcmU+CiAgPG06bWF0 aFByPgogICA8bTptYXRoRm9udCBtOnZhbD0iQ2FtYnJpYSBNYXRoIi8+CiAgIDxtOmJya0JpbiBt OnZhbD0iYmVmb3JlIi8+CiAgIDxtOmJya0JpblN1YiBtOnZhbD0iJiM0NTstIi8+CiAgIDxtOnNt YWxsRnJhYyBtOnZhbD0ib2ZmIi8+CiAgIDxtOmRpc3BEZWYvPgogICA8bTpsTWFyZ2luIG06dmFs PSIwIi8+CiAgIDxtOnJNYXJnaW4gbTp2YWw9IjAiLz4KICAgPG06ZGVmSmMgbTp2YWw9ImNlbnRl ckdyb3VwIi8+CiAgIDxtOndyYXBJbmRlbnQgbTp2YWw9IjE0NDAiLz4KICAgPG06aW50TGltIG06 dmFsPSJzdWJTdXAiLz4KICAgPG06bmFyeUxpbSBtOnZhbD0idW5kT3ZyIi8+CiAgPC9tOm1hdGhQ cj48L3c6V29yZERvY3VtZW50Pgo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4KIDx3OkxhdGVudFN0eWxlcyBEZWZMb2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIgogIERlZlNlbWlIaWRkZW49InRydWUiIERlZlFGb3JtYXQ9ImZhbHNlIiBE ZWZQcmlvcml0eT0iOTkiCiAgTGF0ZW50U3R5bGVDb3VudD0iMjc2Ij4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhp ZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0iZmFsc2Ui CiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyAx Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMyIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgUUZvcm1hdD0idHJ1ZSIgTmFt ZT0iaGVhZGluZyA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDUiLz4KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcg NiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA3Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDgiLz4KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgOSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iMzkiIE5hbWU9InRvYyAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSIzOSIgTmFtZT0idG9jIDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9InRvYyA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgTmFtZT0idG9jIDUiLz4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgNiIvPgogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9InRvYyA3Ii8+CiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgTmFtZT0idG9jIDgiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2Mg OSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzUiIFFGb3Jt YXQ9InRydWUiIE5hbWU9ImNhcHRpb24iLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjEwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iMSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMTEiIFNlbWlIaWRkZW49 ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1 YnRpdGxlIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMiIg U2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iU3Ryb25nIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSIyMCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iRW1waGFzaXMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjU5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJUYWJsZSBHcmlkIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iUGxhY2Vob2xkZXIgVGV4dCIvPgogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMSIgU2VtaUhpZGRlbj0iZmFs c2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iTm8gU3Bh Y2luZyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNl bWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNo YWRpbmciLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBT ZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBM aXN0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgU2Vt aUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgR3Jp ZCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIFNlbWlI aWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFk aW5nIDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBT ZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0g U2hhZGluZyAyIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 NSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVk aXVtIExpc3QgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJN ZWRpdW0gR3JpZCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0i TWVkaXVtIEdyaWQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 Ik1lZGl1bSBHcmlkIDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1l PSJEYXJrIExpc3QiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjcxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJD b2xvcmZ1bCBTaGFkaW5nIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI3MiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFt ZT0iQ29sb3JmdWwgTGlzdCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNzMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9IkNvbG9yZnVsIEdyaWQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBO YW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2Vk PSJmYWxzZSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCAxIi8+ CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRl bj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcg MiBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjUiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJSZXZpc2lvbiIvPgogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzQiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhp ZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ikxpc3QgUGFyYWdyYXBoIi8+ CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgU2VtaUhpZGRl bj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjMwIiBT ZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVl IiBOYW1lPSJJbnRlbnNlIFF1b3RlIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVu VXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAxIi8+CiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgU2VtaUhpZGRlbj0i ZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2Nl bnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIFNl bWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkRhcmsgTGlz dCBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NzEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNv bG9yZnVsIFNoYWRpbmcgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdo ZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPgogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNlbWlIaWRkZW49ImZhbHNlIgog ICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRpbmcgQWNjZW50IDIiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBMaXN0IEFjY2Vu dCAyIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgU2Vt aUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgR3Jp ZCBBY2NlbnQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1l ZGl1bSBTaGFkaW5nIDEgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAyIi8+CiAgPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIFNlbWlIaWRkZW49ImZhbHNl IgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDIi Lz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBTZW1pSGlk ZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAx IEFjY2VudCAyIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 OCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVk aXVtIEdyaWQgMiBBY2NlbnQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2Ui IE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVz ZWQ9ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRl V2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+CiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgU2VtaUhpZGRlbj0iZmFs c2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQg MiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIFNlbWlI aWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjYwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJM aWdodCBTaGFkaW5nIEFjY2VudCAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRl V2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCAzIi8+CiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRlbj0iZmFs c2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2Nl bnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIFNl bWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBM aXN0IDEgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1l PSJNZWRpdW0gTGlzdCAyIEFjY2VudCAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2NyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJm YWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDMiLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCAzIi8+ CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgU2VtaUhpZGRl bj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iRGFyayBMaXN0IEFjY2Vu dCAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgU2Vt aUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwg U2hhZGluZyBBY2NlbnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNzIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjczIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAzIi8+CiAgPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgNCIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNl IgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2Vt aUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjQiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVz ZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCA0Ii8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNCIvPgogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZh bHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50 IDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1p SGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3Jp ZCAyIEFjY2VudCA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0i TWVkaXVtIEdyaWQgMyBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzAiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNzEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA0Ii8+CiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0i ZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2Nl bnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNl bWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNo YWRpbmcgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjYxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1l PSJMaWdodCBMaXN0IEFjY2VudCA1Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2MiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA1Ii8+ CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRl bj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYi IFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1 bSBMaXN0IDIgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjY3IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBO YW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA1Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2OCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2Vk PSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhp ZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDUiLz4KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxz ZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDUiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5n IEFjY2VudCA1Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29s b3JmdWwgTGlzdCBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNzMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2Ui IE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVz ZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNiIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNl IgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDYiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAx IEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 NCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVk aXVtIFNoYWRpbmcgMiBBY2NlbnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjUiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFs c2UiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDYiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+CiAgPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAg IFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNiIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49 ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDYiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBT ZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0g R3JpZCAzIEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI3MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFt ZT0iRGFyayBMaXN0IEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI3MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCA2Ii8+ CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxOSIgU2VtaUhpZGRl bj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i U3VidGxlIEVtcGhhc2lzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSIyMSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iSW50ZW5zZSBFbXBoYXNpcyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBSZWZlcmVuY2UiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjMyIiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJJ bnRlbnNlIFJlZmVyZW5jZSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjM3IiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJU T0MgSGVhZGluZyIvPgogPC93OkxhdGVudFN0eWxlcz4KPC94bWw+PCFbZW5kaWZdLS0+Cgo8IS0t W2lmIGd0ZSBtc28gMTBdPgo8c3R5bGU+CiAvKiBTdHlsZSBEZWZpbml0aW9ucyAqLwp0YWJsZS5N c29Ob3JtYWxUYWJsZQoJe21zby1zdHlsZS1uYW1lOuaZrumAmuihqOagvDsKCW1zby10c3R5bGUt cm93YmFuZC1zaXplOjA7Cgltc28tdHN0eWxlLWNvbGJhbmQtc2l6ZTowOwoJbXNvLXN0eWxlLW5v c2hvdzp5ZXM7Cgltc28tc3R5bGUtcHJpb3JpdHk6OTk7Cgltc28tc3R5bGUtcGFyZW50OiIiOwoJ bXNvLXBhZGRpbmctYWx0OjBjbSA1LjRwdCAwY20gNS40cHQ7Cgltc28tcGFyYS1tYXJnaW46MGNt OwoJbXNvLXBhcmEtbWFyZ2luLWJvdHRvbTouMDAwMXB0OwoJbXNvLXBhZ2luYXRpb246d2lkb3ct b3JwaGFuOwoJZm9udC1zaXplOjEyLjBwdDsKCWZvbnQtZmFtaWx5OkNhbWJyaWE7Cgltc28tYXNj aWktZm9udC1mYW1pbHk6Q2FtYnJpYTsKCW1zby1hc2NpaS10aGVtZS1mb250Om1pbm9yLWxhdGlu OwoJbXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbWJyaWE7Cgltc28taGFuc2ktdGhlbWUtZm9udDpt aW5vci1sYXRpbjsKCW1zby1mb250LWtlcm5pbmc6MS4wcHQ7fQo8L3N0eWxlPgo8IVtlbmRpZl0t LT4KCgoKPCEtLVN0YXJ0RnJhZ21lbnQtLT4KCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLVVTIj5IaSBDaGFybGllLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+VGhhbmtzIGZvciB5b3VyIHJldmlldy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPk1h eWJlIEkgY2FuIGdpdmUgc29tZSBhcmNhbmUgZXhwbGFuYXRpb25zIGZvciB0aGVzZSB3b3Jkcy48 L3NwYW4+PC9wPjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5BY2NvcmRp bmcgdG8gUkZDNTczMCwgRVBQIGNhbiB1c2UKYXV0aGVudGljYXRpb24gaW5mb3JtYXRpb24gYXNz b2NpYXRlZCB3aXRoIG9iamVjdHMgdG8gY29uZmlybSBvYmplY3QtdHJhbnNmZXIKYXV0aG9yaXR5 LiBXaXRoIGFuICZsdDtvYmo6YXV0aEluZm8mZ3Q7IGVsZW1lbnQsIHRoZSBzZXJ2ZXIgb3BlcmF0 b3JzIGNhbgpjb25maXJtIHRoZSBhdXRob3JpemVkIG9yIHVuYXV0aG9yaXplZCByZXF1ZXN0cy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t VVMiPlRoZSBvcmlnaW5hbCBkZXNpZ24gb2YgdGhpcyBkcmFmdCBoYXMKJmx0O29yZzphdXRoSW5m byZndDsgdGhhdCBpcyBhc3NvY2lhdGVkIHdpdGggb3JnIG9iamVjdCB0byBmYWNpbGl0YXRlIHRy YW5zZmVyCm9wZXJhdGlvbnMuIEFmdGVyIHNvbWUgZGlzY3Vzc2lvbnMsIHRoaXMgZWxlbWVudCB3 YXMgcmVtb3ZlZCBmb3Igc29tZSByZWFzb24gaW4KdGhlIFhNTCBzY2hlbWEgYW5kIGVsZW1lbnQg ZGVzY3JpcHRpb25zLiBHaXZlbiB0aGF0IHRoZSBlbGVtZW50IHdhcyByZW1vdmVkLCBpdAppcyBp bmRlZWQgaW5hcHByb3ByaWF0ZSB0byBoYXZlIHRoZXNlIHdvcmRzIGhlcmUgdG8gbWFrZSByZWFk ZXJzIGNvbmZ1c2VkLiBJdAppcyBvdXIgbmVnbGVjdC4gU28gd2Ugc3VnZ2VzdCBkZWxldGluZyB0 aGVzZSB3b3Jkcy4gPG86cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPlJlZ2FyZHMsPG86cD48L286cD48L3NwYW4+PC9w PjxwIGNsYXNzPSJNc29Ob3JtYWwiPgoKCgoKCgo8IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4KIDxv Ok9mZmljZURvY3VtZW50U2V0dGluZ3M+CiAgPG86QWxsb3dQTkcvPgogPC9vOk9mZmljZURvY3Vt ZW50U2V0dGluZ3M+CjwveG1sPjwhW2VuZGlmXS0tPgoKPCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ CiA8dzpXb3JkRG9jdW1lbnQ+CiAgPHc6Vmlldz5Ob3JtYWw8L3c6Vmlldz4KICA8dzpab29tPjA8 L3c6Wm9vbT4KICA8dzpUcmFja01vdmVzLz4KICA8dzpUcmFja0Zvcm1hdHRpbmcvPgogIDx3OlB1 bmN0dWF0aW9uS2VybmluZy8+CiAgPHc6RHJhd2luZ0dyaWRWZXJ0aWNhbFNwYWNpbmc+MTAgcHQ8 L3c6RHJhd2luZ0dyaWRWZXJ0aWNhbFNwYWNpbmc+CiAgPHc6RGlzcGxheUhvcml6b250YWxEcmF3 aW5nR3JpZEV2ZXJ5PjA8L3c6RGlzcGxheUhvcml6b250YWxEcmF3aW5nR3JpZEV2ZXJ5PgogIDx3 OkRpc3BsYXlWZXJ0aWNhbERyYXdpbmdHcmlkRXZlcnk+MjwvdzpEaXNwbGF5VmVydGljYWxEcmF3 aW5nR3JpZEV2ZXJ5PgogIDx3OlZhbGlkYXRlQWdhaW5zdFNjaGVtYXMvPgogIDx3OlNhdmVJZlhN TEludmFsaWQ+ZmFsc2U8L3c6U2F2ZUlmWE1MSW52YWxpZD4KICA8dzpJZ25vcmVNaXhlZENvbnRl bnQ+ZmFsc2U8L3c6SWdub3JlTWl4ZWRDb250ZW50PgogIDx3OkFsd2F5c1Nob3dQbGFjZWhvbGRl clRleHQ+ZmFsc2U8L3c6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD4KICA8dzpEb05vdFByb21v dGVRRi8+CiAgPHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPgogIDx3Okxp ZFRoZW1lQXNpYW4+WkgtQ048L3c6TGlkVGhlbWVBc2lhbj4KICA8dzpMaWRUaGVtZUNvbXBsZXhT Y3JpcHQ+WC1OT05FPC93OkxpZFRoZW1lQ29tcGxleFNjcmlwdD4KICA8dzpDb21wYXRpYmlsaXR5 PgogICA8dzpTcGFjZUZvclVMLz4KICAgPHc6QmFsYW5jZVNpbmdsZUJ5dGVEb3VibGVCeXRlV2lk dGgvPgogICA8dzpEb05vdExlYXZlQmFja3NsYXNoQWxvbmUvPgogICA8dzpVTFRyYWlsU3BhY2Uv PgogICA8dzpEb05vdEV4cGFuZFNoaWZ0UmV0dXJuLz4KICAgPHc6QWRqdXN0TGluZUhlaWdodElu VGFibGUvPgogICA8dzpCcmVha1dyYXBwZWRUYWJsZXMvPgogICA8dzpTbmFwVG9HcmlkSW5DZWxs Lz4KICAgPHc6V3JhcFRleHRXaXRoUHVuY3QvPgogICA8dzpVc2VBc2lhbkJyZWFrUnVsZXMvPgog ICA8dzpEb250R3Jvd0F1dG9maXQvPgogICA8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+CiAg IDx3OkVuYWJsZU9wZW5UeXBlS2VybmluZy8+CiAgIDx3OkRvbnRGbGlwTWlycm9ySW5kZW50cy8+ CiAgIDx3Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+CiAgIDx3OlVzZUZFTGF5b3V0Lz4KICA8L3c6 Q29tcGF0aWJpbGl0eT4KICA8dzpOb0xpbmVCcmVha3NBZnRlciBMYW5nPSJKQSI+JChbe8KjwqXC t+KAmOKAnOOAiOOAiuOAjOOAjuOAkOOAlOOAluOAne+5me+5m++5ne+8hO+8iO+8ju+8u++9m++/ oe+/pTwvdzpOb0xpbmVCcmVha3NBZnRlcj4KICA8dzpOb0xpbmVCcmVha3NCZWZvcmUgTGFuZz0i SkEiPiElKSwuOjsmZ3Q7P119wqLCqMKwwrfLh8uJ4oCV4oCW4oCZ4oCd4oCm4oCw4oCy4oCz4oC6 4oSD4oi244CB44CC44CD44CJ44CL44CN44CP44CR44CV44CX44Ce77i277i677i+77mA77mE77ma 77mc77me77yB77yC77yF77yH77yJ77yM77yO77ya77yb77yf77y9772A772c772d772e77+gPC93 Ok5vTGluZUJyZWFrc0JlZm9yZT4KICA8bTptYXRoUHI+CiAgIDxtOm1hdGhGb250IG06dmFsPSJD YW1icmlhIE1hdGgiLz4KICAgPG06YnJrQmluIG06dmFsPSJiZWZvcmUiLz4KICAgPG06YnJrQmlu U3ViIG06dmFsPSImIzQ1Oy0iLz4KICAgPG06c21hbGxGcmFjIG06dmFsPSJvZmYiLz4KICAgPG06 ZGlzcERlZi8+CiAgIDxtOmxNYXJnaW4gbTp2YWw9IjAiLz4KICAgPG06ck1hcmdpbiBtOnZhbD0i MCIvPgogICA8bTpkZWZKYyBtOnZhbD0iY2VudGVyR3JvdXAiLz4KICAgPG06d3JhcEluZGVudCBt OnZhbD0iMTQ0MCIvPgogICA8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPgogICA8bTpuYXJ5TGlt IG06dmFsPSJ1bmRPdnIiLz4KICA8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+CjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPgogPHc6TGF0ZW50U3R5bGVzIERlZkxv Y2tlZFN0YXRlPSJmYWxzZSIgRGVmVW5oaWRlV2hlblVzZWQ9InRydWUiCiAgRGVmU2VtaUhpZGRl bj0idHJ1ZSIgRGVmUUZvcm1hdD0iZmFsc2UiIERlZlByaW9yaXR5PSI5OSIKICBMYXRlbnRTdHls ZUNvdW50PSIyNzYiPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0i dHJ1ZSIgTmFtZT0iTm9ybWFsIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBR Rm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDQiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRydWUiIE5hbWU9Imhl YWRpbmcgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg UUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFFGb3JtYXQ9InRy dWUiIE5hbWU9ImhlYWRpbmcgOCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+CiAgPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgTmFtZT0idG9jIDEiLz4KICA8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgMiIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9InRvYyAz Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgTmFtZT0i dG9jIDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBO YW1lPSJ0b2MgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MzkiIE5hbWU9InRvYyA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSIzOSIgTmFtZT0idG9jIDciLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM5IiBOYW1lPSJ0b2MgOCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9InRvYyA5Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSIzNSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMTAiIFNlbWlIaWRkZW49 ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlRp dGxlIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxIiBOYW1l PSJEZWZhdWx0IFBhcmFncmFwaCBGb250Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSIxMSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJm YWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4KICA8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRl V2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIwIiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJFbXBoYXNpcyIv PgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTkiIFNlbWlIaWRk ZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IlRhYmxlIEdyaWQiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBO YW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJObyBTcGFjaW5nIi8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdo ZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgU2hhZGluZyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IExpc3QiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBHcmlkIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5V c2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIiLz4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAxIi8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMiIvPgogIDx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIgogICBV bmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIi8+CiAgPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAg IFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMyIvPgogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIFNlbWlIaWRkZW49ImZhbHNlIgog ICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkRhcmsgTGlzdCIvPgogIDx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBV bmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmciLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0Ii8+CiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFsc2Ui CiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNlbWlIaWRkZW49ImZhbHNl IgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRpbmcgQWNjZW50IDEi Lz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBTZW1pSGlk ZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBMaXN0IEFj Y2VudCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIg U2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQg R3JpZCBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMSIvPgogIDx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 IlJldmlzaW9uIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz NCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0i dHJ1ZSIgTmFtZT0iTGlzdCBQYXJhZ3JhcGgiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjI5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJRdW90ZSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4KICA8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBTZW1pSGlkZGVuPSJm YWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2Vu dCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgU2Vt aUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdy aWQgMSBBY2NlbnQgMSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjY5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdo ZW5Vc2VkPSJmYWxzZSIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIFNlbWlIaWRkZW49 ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNj ZW50IDEiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBT ZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1 bCBHcmlkIEFjY2VudCAxIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFt ZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0i ZmFsc2UiIE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAyIi8+CiAgPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVu aGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPgog IDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIFNlbWlIaWRkZW49 ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIg QWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1 IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRp dW0gTGlzdCAxIEFjY2VudCAyIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNl ZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAyIi8+CiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgU2VtaUhpZGRlbj0iZmFs c2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQg MiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIFNlbWlI aWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkRhcmsgTGlzdCBB Y2NlbnQgMiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEi IFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9y ZnVsIFNoYWRpbmcgQWNjZW50IDIiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCAyIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5V c2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMiIvPgogIDx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNlbWlIaWRkZW49ImZhbHNlIgogICBV bmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRpbmcgQWNjZW50IDMiLz4KICA8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBTZW1pSGlkZGVuPSJm YWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCAz Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgU2VtaUhp ZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgR3JpZCBB Y2NlbnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMi IFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1 bSBTaGFkaW5nIDEgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNl IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdo ZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMyIvPgogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIFNlbWlIaWRkZW49ImZhbHNlIgog ICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDMiLz4K ICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBTZW1pSGlkZGVu PSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFj Y2VudCAzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIg U2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVt IEdyaWQgMiBBY2NlbnQgMyIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAzIi8+CiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgU2VtaUhpZGRlbj0iZmFsc2Ui CiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgMyIv PgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIFNlbWlIaWRk ZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkNvbG9yZnVsIEdyaWQg QWNjZW50IDMiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYw IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdo dCBTaGFkaW5nIEFjY2VudCA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2MSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIg TmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0i ZmFsc2UiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hl blVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA0Ii8+CiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgU2VtaUhpZGRlbj0iZmFsc2Ui CiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQg NCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIFNlbWlI aWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBMaXN0 IDEgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY2IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJN ZWRpdW0gTGlzdCAyIEFjY2VudCA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI2NyIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxz ZSIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVu VXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAg VW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA0Ii8+CiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgU2VtaUhpZGRlbj0i ZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA0 Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgU2VtaUhp ZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgU2hh ZGluZyBBY2NlbnQgNCIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNzIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDQiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjczIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZh bHNlIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCA0Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdo ZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgNSIvPgogIDx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEiIFNlbWlIaWRkZW49ImZhbHNlIgog ICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDUiLz4KICA8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBTZW1pSGlkZGVuPSJm YWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCA1 Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgU2VtaUhp ZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIFNoYWRp bmcgMSBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNjQiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9 Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCA1Ii8+CiAgPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlk ZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPgogIDx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIFNlbWlIaWRkZW49ImZhbHNl IgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDUi Lz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBTZW1pSGlk ZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gR3JpZCAy IEFjY2VudCA1Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 OSIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVk aXVtIEdyaWQgMyBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNzAiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2Ui IE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzEiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0i ZmFsc2UiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDUiLz4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+CiAgPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgU2VtaUhpZGRlbj0iZmFs c2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQg NSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIFNlbWlI aWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9IkxpZ2h0IFNoYWRp bmcgQWNjZW50IDYiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjYxIiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2MiIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIg TmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0i ZmFsc2UiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEgQWNjZW50IDYiLz4KICA8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5o aWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+CiAg PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgU2VtaUhpZGRlbj0i ZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIFNl bWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBM aXN0IDIgQWNjZW50IDYiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY3IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1l PSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgU2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJm YWxzZSIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVX aGVuVXNlZD0iZmFsc2UiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDYiLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDYiLz4KICA8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBTZW1pSGlkZGVuPSJm YWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFj Y2VudCA2Ii8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIg U2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgTmFtZT0iQ29sb3Jm dWwgTGlzdCBBY2NlbnQgNiIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNzMiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0iZmFsc2UiIE5h bWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDYiLz4KICA8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjE5IiBTZW1pSGlkZGVuPSJmYWxzZSIKICAgVW5oaWRlV2hlblVzZWQ9 ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdWJ0bGUgRW1waGFzaXMiLz4KICA8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIxIiBTZW1pSGlkZGVuPSJmYWxzZSIK ICAgVW5oaWRlV2hlblVzZWQ9ImZhbHNlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJJbnRlbnNlIEVt cGhhc2lzIi8+CiAgPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMSIg U2VtaUhpZGRlbj0iZmFsc2UiCiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iMzIiIFNlbWlIaWRkZW49ImZhbHNlIgogICBVbmhpZGVXaGVuVXNlZD0i ZmFsc2UiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUmVmZXJlbmNlIi8+CiAgPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMyIgU2VtaUhpZGRlbj0iZmFsc2Ui CiAgIFVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iQm9vayBUaXRs ZSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIE5hbWU9 IkJpYmxpb2dyYXBoeSIvPgogIDx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iMzkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlRPQyBIZWFkaW5nIi8+CiA8L3c6TGF0ZW50U3R5 bGVzPgo8L3htbD48IVtlbmRpZl0tLT4KCjwhLS1baWYgZ3RlIG1zbyAxMF0+CjxzdHlsZT4KIC8q IFN0eWxlIERlZmluaXRpb25zICovCnRhYmxlLk1zb05vcm1hbFRhYmxlCgl7bXNvLXN0eWxlLW5h bWU65pmu6YCa6KGo5qC8OwoJbXNvLXRzdHlsZS1yb3diYW5kLXNpemU6MDsKCW1zby10c3R5bGUt Y29sYmFuZC1zaXplOjA7Cgltc28tc3R5bGUtbm9zaG93OnllczsKCW1zby1zdHlsZS1wcmlvcml0 eTo5OTsKCW1zby1zdHlsZS1wYXJlbnQ6IiI7Cgltc28tcGFkZGluZy1hbHQ6MGNtIDUuNHB0IDBj bSA1LjRwdDsKCW1zby1wYXJhLW1hcmdpbjowY207Cgltc28tcGFyYS1tYXJnaW4tYm90dG9tOi4w MDAxcHQ7Cgltc28tcGFnaW5hdGlvbjp3aWRvdy1vcnBoYW47Cglmb250LXNpemU6MTIuMHB0OwoJ Zm9udC1mYW1pbHk6Q2FtYnJpYTsKCW1zby1hc2NpaS1mb250LWZhbWlseTpDYW1icmlhOwoJbXNv LWFzY2lpLXRoZW1lLWZvbnQ6bWlub3ItbGF0aW47Cgltc28taGFuc2ktZm9udC1mYW1pbHk6Q2Ft YnJpYTsKCW1zby1oYW5zaS10aGVtZS1mb250Om1pbm9yLWxhdGluOwoJbXNvLWZvbnQta2Vybmlu ZzoxLjBwdDt9Cjwvc3R5bGU+CjwhW2VuZGlmXS0tPgoKCgo8IS0tU3RhcnRGcmFnbWVudC0tPgoK CgoKCgoKCgoKCgoKCgo8IS0tRW5kRnJhZ21lbnQtLT48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiPkxpbmxpbjwvc3Bhbj48L3A+PGJyPjxibG9ja3F1b3RlIG5hbWU9 InJlcGx5Q29udGVudCIgY2xhc3M9IlJlZmVyZW5jZVF1b3RlIiBzdHlsZT0icGFkZGluZy1sZWZ0 OjVweDttYXJnaW4tbGVmdDo1cHg7Ym9yZGVyLWxlZnQ6I2I2YjZiNiAycHggc29saWQ7bWFyZ2lu LXJpZ2h0OjAiPi0tLS0t5Y6f5aeL6YKu5Lu2LS0tLS08YnI+CjxiPuWPkeS7tuS6ujo8L2I+PHNw YW4gaWQ9InJjX2Zyb20iPiJDaGFybGllIEthdWZtYW4iICZsdDtjaGFybGlla2F1Zm1hbkBvdXRs b29rLmNvbSZndDs8L3NwYW4+PGJyPgo8Yj7lj5HpgIHml7bpl7Q6PC9iPjxzcGFuIGlkPSJyY19z ZW50dGltZSI+MjAxOC0xMC0wMyAxMjowMToyNSAo5pif5pyf5LiJKTwvc3Bhbj48YnI+CjxiPuaU tuS7tuS6ujo8L2I+ICJzZWNkaXJAaWV0Zi5vcmciICZsdDtzZWNkaXJAaWV0Zi5vcmcmZ3Q7LCAi aWVzZ0BpZXRmLm9yZyIgJmx0O2llc2dAaWV0Zi5vcmcmZ3Q7LCAiZHJhZnQtaWV0Zi1yZWdleHQt b3JnLmFsbEBpZXRmLm9yZyIgJmx0O2RyYWZ0LWlldGYtcmVnZXh0LW9yZy5hbGxAaWV0Zi5vcmcm Z3Q7PGJyPgo8Yj7mioTpgIE6PC9iPiA8YnI+CjxiPuS4u+mimDo8L2I+IFNlY2RpciByZXZpZXcg b2YgZHJhZnQtaWV0Zi1yZWdleHQtMTA8YnI+PGJyPgoKCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIg c3R5bGU9ImRpc3BsYXk6bm9uZTsiPiBQIHttYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO30g PC9zdHlsZT4KCgo8ZGl2IHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTog Q2FsaWJyaSxIZWx2ZXRpY2Esc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyI+CjxwPkkgaGF2 ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9y YXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBw cm9jZXNzZWQgYnkgdGhlIElFU0cuJm5ic3A7IFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBw cmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4m bmJzcDsgRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzCiBzaG91bGQgdHJlYXQgdGhlc2Ug Y29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuPC9wPgo8cD48 YnI+CjwvcD4KPHA+VGhpcyBzcGVjaWZpY2F0aW9uIGRlZmluZXMgYSBzeW50YXggZm9yIGV4dGVu ZGluZyB0aGUgRXh0ZW5zaWJsZSBQcm92aXNpb25pbmcgUHJvdG9jb2wgKEVQUCkgW1JGQyA1NzMw XSB0byBzdXBwb3J0IGEgbmV3IG9iamVjdCB0eXBlIHJlcHJlc2VudGluZyBvcmdhbml6YXRpb25z LiBJdCBkb2VzIG5vdCBjaGFuZ2UgYW55IGFzcGVjdCBvZiB0aGUgc2VjdXJpdHkgb2YgdGhlIHBy b3RvY29sLCBhbmQgSSBiZWxpZXZlIGl0IHRoZXJlZm9yZSBkb2VzCiBub3QgcmVxdWlyZSBhbnkg c29ydCBvZiBkZXRhaWxlZCBzZWN1cml0eSByZXZpZXcuPC9wPgo8cD48YnI+CjwvcD4KPHA+VGhl cmUgd2FzIG9uZSBsaW5lIHRoYXQgSSBmb3VuZCBjdXJpb3VzLiBJdCBtaWdodCBiZSBhIHR5cG8s IG9yIHRoZXJlIG1pZ2h0IGJlIHNvbWUgYXJjYW5lIGV4cGxhbmF0aW9uOjwvcD4KPHA+PGJyPgo8 L3A+CjxwPlRoZSBsYXN0IHBhcmFncmFwaCBvZiBzZWN0aW9uIDQuMiByZWFkczo8L3A+CjxwPiJT ZXJ2ZXIgb3BlcmF0b3JzIFNIT1VMRCBjb25maXJtIHRoYXQgYSBjbGllbnQgaXMgYXV0aG9yaXpl ZCB0byBwZXJmb3JtIGEgdHJhbnNmb3JtIGNvbW1hbmQgb24gYSBnaXZlbiBvYmplY3QuIEFueSBh dHRlbXB0IHRvIHRyYW5zZm9ybSBhbiBvYmplY3QgYnkgYW4gdW5hdXRob3JpemVkIGNsaWVudCBN VVNUIGJlIHJlamVjdGVkLCBhbmQgdGhlIHNlcnZlciBNVVNUIHJldHVybiBhIDIyMDEgcmVzcG9u c2UgY29kZSB0byB0aGUgY2xpZW50IHRvCiBub3RlIHRoYXQgdGhlIGNsaWVudCBsYWNrcyBwcml2 aWxlZ2VzIHRvIGV4ZWN1dGUgdGhlIHJlcXVlc3RlZCBjb21tYW5kLiI8L3A+CjxwPjxicj4KPC9w Pgo8cD5HaXZlbiB0aGF0IHVuYXV0aG9yaXplZCByZXF1ZXN0cyBNVVNUIGJlIHJlamVjdGVkLCBp dCBzZWVtcyBjdXJpb3VzIHRoYXQgc2VydmVyIG9wZXJhdG9ycyBvbmx5IFNIT1VMRCBjb25maXJt IHRoYXQgdGhlIHJlcXVlc3RvciBpcyBhdXRob3JpemVkLiBJIGRvbid0IGtub3cgaG93IGVsc2Ug dGhlIHNlcnZlciBvcGVyYXRvciBjb3VsZCBrbm93IHRvIHJlamVjdCB1bmF1dGhvcml6ZWQgcmVx dWVzdHMuIFBlcmhhcHMgdGhpcyByZWxhdGVzIHRvCiB0aGUgcXVlc3Rpb24gb2Ygd2hldGhlciBh IHF1ZXVlZCByZXF1ZXN0IGlzIHJlamVjdGVkIGJlZm9yZSBpdCBpcyBxdWV1ZWQgb3Igb25seSBh cyBpdCBpcyBldmVudHVhbGx5IHByb2Nlc3NlZC48L3A+CjxwPkJ1dCB0aGlzIGlzIHRydWx5IGEg bml0LCBhbmQgZXZlbiBpZiB3cm9uZyBJIGRvbid0IGJlbGlldmUgaXQgd291bGQgZXZlciBjYXVz ZSBhbiBpbXBsZW1lbnRhdGlvbiB0byBiZSBpbmNvcnJlY3QuPC9wPgo8cD48YnI+CjwvcD4KPHA+ Jm5ic3A7LS1DaGFybGllPC9wPgo8L2Rpdj4KPGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAw KTsgZm9udC1mYW1pbHk6IENhbGlicmksSGVsdmV0aWNhLHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTog MTJwdDsiPgo8YnI+CjwvZGl2PgoKCjwvYmxvY2txdW90ZT4= ------=_Part_17539_32766054.1538622348351-- From nobody Thu Oct 4 02:15:24 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E17E6130E0A; Thu, 4 Oct 2018 02:15:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oxDsSRHxUsQ0; Thu, 4 Oct 2018 02:15:09 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD407130E01; Thu, 4 Oct 2018 02:15:09 -0700 (PDT) Received: from lhreml708-cah.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id D4EE56DE90C09; Thu, 4 Oct 2018 10:15:03 +0100 (IST) Received: from DGGEML422-HUB.china.huawei.com (10.1.199.39) by lhreml708-cah.china.huawei.com (10.201.108.49) with Microsoft SMTP Server (TLS) id 14.3.399.0; Thu, 4 Oct 2018 10:15:05 +0100 Received: from DGGEML532-MBS.china.huawei.com ([169.254.7.198]) by dggeml422-hub.china.huawei.com ([10.1.199.39]) with mapi id 14.03.0399.000; Thu, 4 Oct 2018 17:14:56 +0800 From: Jiangyuanlong To: Benjamin Kaduk , Samuel Weiler CC: "secdir@ietf.org" , "draft-ietf-tictoc-1588v2-yang.all@ietf.org" , "ietf@ietf.org" , "tictoc@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-tictoc-1588v2-yang-10 Thread-Index: AQHUWyxprlJobJE8SkG6p5wwETcTdaUN3WSAgADqBeA= Date: Thu, 4 Oct 2018 09:14:55 +0000 Message-ID: <3B0A1BED22CAD649A1B3E97BE5DDD68BBC21275C@dggeml532-mbs.china.huawei.com> References: <153857993505.8974.13448340837663409232@ietfa.amsl.com> <20181004024953.GK56675@kduck.kaduk.org> In-Reply-To: <20181004024953.GK56675@kduck.kaduk.org> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.45.124.168] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-tictoc-1588v2-yang-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 09:15:12 -0000 Ben and Samuel, Yes, the draft says:" The lowest NETCONF layer is the secure transport laye= r, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory- to-implement secure transport is TLS [RFC8446]." Thus authentication is = a mandatory part of this layer. BTW, the security considerations in this draft are fully in accordance with= "Guidelines for Authors and Reviewers of YANG Data Model Documents" https:= //tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-20#page-13 (which is now= in RFC Editor Queue), and all future YANG docs developed in the IETF are r= equested to follow its guidelines). Thanks, Yuanlong > -----Original Message----- > From: Benjamin Kaduk [mailto:kaduk@mit.edu] > Sent: Thursday, October 04, 2018 10:50 AM > To: Samuel Weiler > Cc: secdir@ietf.org; draft-ietf-tictoc-1588v2-yang.all@ietf.org; ietf@iet= f.org; > tictoc@ietf.org > Subject: Re: Secdir last call review of draft-ietf-tictoc-1588v2-yang-10 >=20 > On Wed, Oct 03, 2018 at 08:18:55AM -0700, Samuel Weiler wrote: > > Reviewer: Samuel Weiler > > Review result: Has Issues > > > > I wonder whether there should be a requirement to use authentication > when > > making updates. As the doc says: >=20 > The NETCONF and RESTCONF secure transport layers already handle the > authentication requirements. E.g., RFC 8040 Section 2.5: >=20 > The RESTCONF server MUST authenticate client access to any protected > resource. If the RESTCONF client is not authenticated, the server > SHOULD send an HTTP response with a "401 Unauthorized" status-line, > as defined in Section 3.1 of [RFC7235]. The error-tag value > "access-denied" is used in this case. >=20 > But thank you for doing the review, and you're right that this is > important! >=20 > -Ben >=20 > > Write operations (e.g., edit-config) to these data nodes without > > proper protection can have a negative effect on network operations. > > > > I'm sure someone will argue "if this is used in a closed network, we ca= n > avoid > > the use of authentication". Prudence suggests that "closed" networks > don't > > remain that way forever, and defense-in-depth is advisable. Let's add = a > MUST > > or at least a SHOULD. > > > > From nobody Thu Oct 4 06:02:26 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B61D4130E71; Thu, 4 Oct 2018 06:02:01 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Leif Johansson To: Cc: draft-ietf-regext-org-ext.all@ietf.org, ietf@ietf.org, regext@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153865812166.4399.12885195455337958701@ietfa.amsl.com> Date: Thu, 04 Oct 2018 06:02:01 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-regext-org-ext-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 13:02:02 -0000 Reviewer: Leif Johansson Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I have no issues From nobody Thu Oct 4 06:12:28 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CEC3B130E3C; Thu, 4 Oct 2018 06:12:12 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: Cc: iasa20@ietf.org, draft-ietf-iasa2-trust-rationale.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153865873277.4558.6110980379756897850@ietfa.amsl.com> Date: Thu, 04 Oct 2018 06:12:12 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-iasa2-trust-rationale-00 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 13:12:13 -0000 Reviewer: Tero Kivinen Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document is discussion document that does not even plan to be published as RFC, as the document says: This memo is provided only for discussion. There is no intention to publish this memo as an RFC. Thus this document actually misses security considerations section, but I agree that even when there could be some security issues in this document they do not affect any protocols directly. From nobody Thu Oct 4 06:15:40 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FACB130E55 for ; Thu, 4 Oct 2018 06:15:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu Message-ID: <153865893918.4465.16365618122073211522.idtracker@ietfa.amsl.com> Date: Thu, 04 Oct 2018 06:15:39 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 13:15:39 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2018-10-11 Reviewer LC end Draft John Bradley 2018-09-25 draft-ietf-dnsop-attrleaf-fix-04 Daniel Franke 2018-06-28 draft-ietf-netconf-rfc7895bis-06 Matthew Miller 2018-10-12 draft-ietf-httpbis-rand-access-live-03 Dacheng Zhang 2018-10-05 draft-ietf-iasa2-trust-update-00 For telechat 2018-10-25 Reviewer LC end Draft Catherine Meadows 2018-10-16 draft-ietf-extra-imap-replace-01 Last calls: Reviewer LC end Draft John Bradley 2018-06-18 draft-ietf-bfd-multipoint-active-tail-09 Daniel Gillmor 2018-06-25 draft-ietf-dnsop-session-signal-16 Daniel Gillmor 2018-03-19 draft-gutmann-scep-10 Phillip Hallam-Baker 2018-10-11 draft-ietf-softwire-yang-06 Phillip Hallam-Baker 2018-10-03 draft-ietf-detnet-use-cases-18 Steve Hanna 2018-10-10 draft-ietf-ospf-lls-interface-id-06 Steve Hanna 2018-10-03 draft-ietf-detnet-problem-statement-07 Christian Huitema 2018-10-09 draft-ietf-bess-mvpn-expl-track-10 Scott Kelly 2018-10-08 draft-ietf-ntp-bcp-07 Barry Leiba 2018-10-17 draft-ietf-isis-reverse-metric-13 Chris Lonvick 2018-10-17 draft-ietf-clue-signaling-13 Aanchal Malhotra 2018-10-17 draft-ietf-clue-protocol-17 David Mandelberg 2018-10-17 draft-ietf-bfcpbis-rfc4583bis-26 Daniel Migault 2018-10-12 draft-ietf-core-too-many-reqs-04 Adam Montville 2018-10-09 draft-ietf-rtgwg-multihomed-prefix-lfa-07 Russ Mundy 2017-09-14 draft-spinosa-urn-lex-13 Samuel Weiler 2018-05-21 draft-ietf-bfd-multipoint-18 Klaas Wierenga 2018-09-06 draft-ietf-softwire-mesh-multicast-23 Paul Wouters 2018-09-06 draft-ietf-dnsop-kskroll-sentinel-15 Liang Xia 2018-10-10 draft-campbell-sip-messaging-smime-03 Taylor Yu 2018-10-09 draft-murchison-tzdist-tzif-14 Early review requests: Reviewer Due Draft Daniel Franke 2018-01-31 draft-ietf-intarea-provisioning-domains-00 Next in the reviewer rotation: Kathleen Moriarty Russ Mundy Sandra Murphy Yoav Nir Magnus Nystrom Hilarie Orman Radia Perlman Derrell Piper Tim Polk Vincent Roca From nobody Thu Oct 4 08:16:09 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F4C6130DFB; Thu, 4 Oct 2018 08:15:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idYefu7GageJ; Thu, 4 Oct 2018 08:15:55 -0700 (PDT) Received: from ccs.nrl.navy.mil (mx0.ccs.nrl.navy.mil [IPv6:2001:480:20:118:118::211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFF67130E48; Thu, 4 Oct 2018 08:15:49 -0700 (PDT) Received: from [10.0.3.109] (fw5540.nrl.navy.mil [132.250.196.100]) by ccs.nrl.navy.mil (8.14.4/8.14.4) with ESMTP id w94FFjMd024319; Thu, 4 Oct 2018 11:15:46 -0400 User-Agent: Microsoft-MacOutlook/10.10.2.180910 Date: Thu, 04 Oct 2018 11:15:45 -0400 From: Catherine A Meadows To: The IESG , "secdir@ietf.org" , Message-ID: <9CBC0CD9-DAD9-489F-94A0-56CCE2843B92@nrl.navy.mil> Thread-Topic: SecDir Review of draft-ietf-extra-imap-replace-01 Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3621496546_1070543994" X-CCS-MailScanner: No viruses found. X-CCS-MailScanner-Info: See: http://www.nrl.navy.mil/ccs/support/email Archived-At: Subject: [secdir] SecDir Review of draft-ietf-extra-imap-replace-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 15:16:00 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3621496546_1070543994 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Reviewer:=C2=A0 Catherine Meadows Review Result: Ready With Nits =20 I have reviewed this document as part of the security directorate's=20 ongoing effort to review all IETF documents being processed by the=20 IESG.=C2=A0 These comments were written primarily for the benefit of the=20 security area directors.=C2=A0 Document editors and WG chairs should treat=20 these comments just like any other last call comments. =20 =20 This draft defines an extension to IMAP that allows a REPLACE command and e= xtends the UID command to UID REPLACE. Previously, replaces were done by using three commands in sequence:=C2=A0 APPEN= D, STORE, and EXPUNGE.=C2=A0 This was non-atomic, however, and failure of one of= the commands could leave messages in intermediate states that could be seen= and acted on by clients. =20 The Security Considerations section reads: =20 This document is believed to add no security problems beyond those that may= already exist with the base IMAP specification.=C2=A0=20 =20 I would actually go further than that: =C2=A0=C2=A0the REPLACE command may actually= prevent some potential security problems because it prevents some atomicity= failures that could possibly be exploited by an attacker. =20 If this is an appropriate for the Security Considerations Section I would u= rge the authors to include a statement to that effect after the sentence tha= t says the document adds no security problems.=C2=A0=20 =20 =20 =20 Catherine Meadows Naval Research Laboratory Code 5543 4555 Overlook Avenue Washington DC, 20375 phone: 202-767-3490 =20 =20 =20 =20 --B_3621496546_1070543994 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Reviewer:=C2=A0= Catherine Meadows

Review Result: Ready With Nits

 

I have reviewed this document as p= art of the security directorate's

<= span style=3D'font-size:11.0pt'>ongoing effort to review all IETF documents be= ing processed by the

IESG.=C2=A0 These comments were written primarily for the benef= it of the

security area directors.=C2=A0 Document editors and WG chairs should treat=

the= se comments just like any other last call comments.

 

<= p class=3DMsoNormal> 

This draft defines an ext= ension to IMAP that allows a REPLACE command and extends the UID command to = UID REPLACE.

Previously, replaces were done by using three commands in sequence:=C2= =A0 APPEND, STORE, and EXPUNGE.=C2=A0 This was non-atomic, however, and failure of= one of the commands could leave messages in intermediate states that could = be seen and acted on by clients.

 

<= span style=3D'font-size:11.0pt'>The Security Considerations section reads:

&nb= sp;

This d= ocument is believed to add no security problems beyond those that may alread= y exist with the base IMAP specification.=C2=A0

 

I would actually go further than t= hat: =C2=A0=C2=A0the REPLACE command may actually prevent some potential security pr= oblems because it prevents some atomicity failures that could possibly be ex= ploited by an attacker.

 

If this is an appropriate for the Security Consideratio= ns Section I would urge the authors to include a statement to that effect af= ter the sentence that says the document adds no security problems.=C2=A0

 =

&nbs= p;

&n= bsp;

Cathe= rine Meadows

Naval Research Laboratory

Code 5543

4555 Overlook Avenue

=

Washington DC, 20375<= /o:p>

phone: 202= -767-3490

 

 

 

 

--B_3621496546_1070543994-- From nobody Thu Oct 4 10:37:01 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CFE7F130DCF; Thu, 4 Oct 2018 10:36:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Barry Leiba To: Cc: lsr@ietf.org, ietf@ietf.org, draft-ietf-isis-reverse-metric.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153867461977.4554.2419440769241572592@ietfa.amsl.com> Date: Thu, 04 Oct 2018 10:36:59 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-isis-reverse-metric-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 17:37:00 -0000 Reviewer: Barry Leiba Review result: Ready This document is well written and seems ready to go. The only security issue I thought of as I read through it (attacking by spoofing a reverse metric) is covered in the Security Considerations section. I found one sentence to be slightly ambiguous, but only very slightly. In Section 3.5: A router MUST advertise a Reverse Metric TLV toward a neighbor only for the operational maintenance window period during which it wants a neighbor to temporarily update its IS-IS metric or Traffic Engineering parameters towards it. It begins to look like it's saying that a router MUST advertise this under certain conditions, and it took me a moment to get that it's actually *limiting* when it should be advertised (the "MUST" applies to the "only" clause). If you think my suggested replacement reads well, you might use it; if not, no problem: A router MUST limit the period during which it advertises a Reverse Metric TLV toward a neighbor only to the operational maintenance window period during which it wants that neighbor to temporarily update its IS-IS metric or Traffic Engineering parameters towards it. From nobody Thu Oct 4 10:43:29 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 589A7130DCF; Thu, 4 Oct 2018 10:43:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LkPRbkNfn65P; Thu, 4 Oct 2018 10:43:10 -0700 (PDT) Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8552C12F1A2; Thu, 4 Oct 2018 10:43:07 -0700 (PDT) Received: by mail-ed1-x52d.google.com with SMTP id g32-v6so9299197edg.13; Thu, 04 Oct 2018 10:43:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QZvNOXqgNjexi3oBlqYClOFv/nXqA++teTTtRV0AueQ=; b=WIPt0DkLn3LNrMpUV+mMOlRhkAHiGXT01r4Mwvbbm6/Ywo2XPUTSNn0S33PlQMgdqA 1bDoL5xuO7Wsd6V6yIsY/UqK3LT9rc1SEMV+V6joHLyKQf9wzjK3YIQ3XE6GOVY5j8WB Z+kzGKwUwuCwpRtdSTa80SsYIUm5vuBKzKhHk+/zavjxuQtiDoJfbbp9ktI/dLozxheB 7Z2qKpc4o2iK03izTDNM1xtaNzXYlArI2gIJgPbk4FCaq9adTGoV+jwxir0svtI95GUi JPV1xpzwIFkpqGToKKT/y9U+zxYkQjZNxKgiNjkUwBQi1ss5i2hraRnRV9+W+JKYezIW K2kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QZvNOXqgNjexi3oBlqYClOFv/nXqA++teTTtRV0AueQ=; b=KJH8sdXE5ywU7LHyQvY9MFoBvO5M7izJZV+sK6m1FNS7mRKszWq9RWLfPk0wb3Qqw6 gd6arxNagss7jk+4mCMrB+OLaBYwmWJXzwmKU4u+D+XKZPKuOr24ZL9pFwT9ebmde7qB UXRvsjVrVDLR1XlDG8WlPBPRjkEDULmnjYQVHJqHbznlit2MGQaX+l2jZsyV6GO4WF2H 8D+95eq3Ml8/m4TUYVbW/fz/UpgEvQilUlQAJmpcP16xMzDZ4+Q2+/P7oQNnzbajaQjB nf9RFG3VpeZ0Vjqs9HRvrqmGUM1n6+vs5nNkCrSHAAanTHIS9XbpN6qzMPZpTsUg5Y2x jptQ== X-Gm-Message-State: ABuFfoh5S+KBNYe/DiTbXUZVOV9/wMy1RlgZVYMyblZpbv2pNHtbGJ0o welVQ6CHWutLpYOvGP7BCfaMi5lwfV7u3ds7J6Y0Wch2 X-Google-Smtp-Source: ACcGV62yQ3/qF4FrCnwuoaTO+2eeGgKRxs8Ek/eF3pfPF3yAuY5MXVjG1Y5ung96saPNCEaqIi7QG68l7faL/KEJHJY= X-Received: by 2002:a50:9886:: with SMTP id j6-v6mr10015932edb.160.1538674986056; Thu, 04 Oct 2018 10:43:06 -0700 (PDT) MIME-Version: 1.0 References: <153867461977.4554.2419440769241572592@ietfa.amsl.com> In-Reply-To: <153867461977.4554.2419440769241572592@ietfa.amsl.com> From: Tony Przygienda Date: Thu, 4 Oct 2018 10:42:35 -0700 Message-ID: To: barryleiba@computer.org Cc: secdir@ietf.org, lsr@ietf.org, ietf@ietf.org, draft-ietf-isis-reverse-metric.all@ietf.org Content-Type: multipart/alternative; boundary="000000000000f8006505776aafe8" Archived-At: Subject: Re: [secdir] [Lsr] Secdir last call review of draft-ietf-isis-reverse-metric-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Oct 2018 17:43:14 -0000 --000000000000f8006505776aafe8 Content-Type: text/plain; charset="UTF-8" funny enough, https://tools.ietf.org/html/draft-shen-isis-spine-leaf-ext-06#page-12 by the overlaping author set seems already to circumvent this ;-) On Thu, Oct 4, 2018 at 10:37 AM Barry Leiba wrote: > Reviewer: Barry Leiba > Review result: Ready > > This document is well written and seems ready to go. The only security > issue I > thought of as I read through it (attacking by spoofing a reverse metric) is > covered in the Security Considerations section. > > I found one sentence to be slightly ambiguous, but only very slightly. In > Section 3.5: > > A router MUST advertise a Reverse Metric TLV toward a neighbor only > for the operational maintenance window period during which it wants a > neighbor to temporarily update its IS-IS metric or Traffic > Engineering parameters towards it. > > It begins to look like it's saying that a router MUST advertise this under > certain conditions, and it took me a moment to get that it's actually > *limiting* when it should be advertised (the "MUST" applies to the "only" > clause). If you think my suggested replacement reads well, you might use > it; > if not, no problem: > > A router MUST limit the period during which it advertises a Reverse > Metric > TLV toward a neighbor only to the operational maintenance window period > during which it wants that neighbor to temporarily update its IS-IS > metric > or Traffic Engineering parameters towards it. > > _______________________________________________ > Lsr mailing list > Lsr@ietf.org > https://www.ietf.org/mailman/listinfo/lsr > --000000000000f8006505776aafe8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
funny enough, https://tools.ietf.o= rg/html/draft-shen-isis-spine-leaf-ext-06#page-12 by the overlaping aut= hor set seems already to circumvent this ;-)

On Thu, Oct 4, 2018 at 10:37 AM Barry Lei= ba <barryleiba@computer.org> wrote:
Reviewer: Barry Leiba=
Review result: Ready

This document is well written and seems ready to go.=C2=A0 The only securit= y issue I
thought of as I read through it (attacking by spoofing a reverse metric) is=
covered in the Security Considerations section.

I found one sentence to be slightly ambiguous, but only very slightly.=C2= =A0 In
Section 3.5:

=C2=A0 =C2=A0A router MUST advertise a Reverse Metric TLV toward a neighbor= only
=C2=A0 =C2=A0for the operational maintenance window period during which it = wants a
=C2=A0 =C2=A0neighbor to temporarily update its IS-IS metric or Traffic
=C2=A0 =C2=A0Engineering parameters towards it.

It begins to look like it's saying that a router MUST advertise this un= der
certain conditions, and it took me a moment to get that it's actually *limiting* when it should be advertised (the "MUST" applies to th= e "only"
clause).=C2=A0 If you think my suggested replacement reads well, you might = use it;
if not, no problem:

=C2=A0 =C2=A0A router MUST limit the period during which it advertises a Re= verse Metric
=C2=A0 =C2=A0TLV toward a neighbor only to the operational maintenance wind= ow period
=C2=A0 =C2=A0during which it wants that neighbor to temporarily update its = IS-IS metric
=C2=A0 =C2=A0or Traffic Engineering parameters towards it.

_______________________________________________
Lsr mailing list
Lsr@ietf.org
https://www.ietf.org/mailman/listinfo/lsr
--000000000000f8006505776aafe8-- From nobody Thu Oct 4 21:33:37 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78AC0130DD2; Thu, 4 Oct 2018 21:33:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uaEGKXTWK_w2; Thu, 4 Oct 2018 21:33:18 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 978F21292F1; Thu, 4 Oct 2018 21:33:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2104; q=dns/txt; s=iport; t=1538713998; x=1539923598; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=4xnRPKKroOw9r38sa7SReSaBQyWgZLQRwqaq1CNlP1A=; b=c4FAOfNPIYxCRJ8yztunYEBk+Q7juD+hwdWQN7vCMRYBE1LRLh1UGUAO LLB5XT6uHb2osKQiLnn/lMGcubD8cJy3xCW4Vm2cCqljeZDxHO/6uWzLX A+kEMYhMszF5iJxWePPJXryRa5FC2qH5d92yK74dGiChpi5aRv/UWoDz3 U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AGAACd6LZb/4sNJK1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUQQBAQEBAQsBgVYvgWUoCot/ji+WXoF6CwEBhGwChCU?= =?us-ascii?q?hNA0NAQMBAQIBAQJtKIU5AQEBAQIBOj8FCwIBCBgeEDIlAgQOBYMhgXoIpWS?= =?us-ascii?q?KEostF4IAgREBJx+CTIRYJoMygiYCnV0JApA/EQaBTIdwhjWJBYw4AhEUgSU?= =?us-ascii?q?dOIFVcBVlAYJBkFVvjD8BJQSBBIEfAQE?= X-IronPort-AV: E=Sophos;i="5.54,342,1534809600"; d="scan'208";a="458639047" Received: from alln-core-6.cisco.com ([173.36.13.139]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Oct 2018 04:33:17 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id w954XHiN020627 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 5 Oct 2018 04:33:17 GMT Received: from xch-rcd-004.cisco.com (173.37.102.14) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 4 Oct 2018 23:33:16 -0500 Received: from xch-rcd-004.cisco.com ([173.37.102.14]) by XCH-RCD-004.cisco.com ([173.37.102.14]) with mapi id 15.00.1395.000; Thu, 4 Oct 2018 23:33:17 -0500 From: "Naiming Shen (naiming)" To: Barry Leiba CC: "secdir@ietf.org" , "lsr@ietf.org" , "ietf@ietf.org" , "draft-ietf-isis-reverse-metric.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-isis-reverse-metric-13 Thread-Index: AQHUXAje+bWdrZY7u0Scu2oV4YzO7KUQZNCA Date: Fri, 5 Oct 2018 04:33:17 +0000 Message-ID: References: <153867461977.4554.2419440769241572592@ietfa.amsl.com> In-Reply-To: <153867461977.4554.2419440769241572592@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.26.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <43912066BFEA9B43B3A7AB4ABEE8CB29@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.15, xch-aln-005.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-isis-reverse-metric-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Oct 2018 04:33:20 -0000 Hi Barry, Thanks for the review and your suggestion makes sense. The original wording is confusing. Also, as Tony has pointed out in the same thread, this senten= ce was the original intention when start of the draft, but it has been extende= d for other use cases described in section 1. How about this on top of your sugge= stions: For the use case in section 1.1, Node and Link Isolation, a router MUST = limit the period during which it advertises a Reverse Metric TLV toward a neig= hbor only to the operational maintenance window period during which it wants = that neighbor to temporarily update its IS-IS metric or Traffic Engineering p= arameters towards it. Best Regards, - Naiming > On Oct 4, 2018, at 10:36 AM, Barry Leiba wrote: >=20 > Reviewer: Barry Leiba > Review result: Ready >=20 > This document is well written and seems ready to go. The only security i= ssue I > thought of as I read through it (attacking by spoofing a reverse metric) = is > covered in the Security Considerations section. >=20 > I found one sentence to be slightly ambiguous, but only very slightly. I= n > Section 3.5: >=20 > A router MUST advertise a Reverse Metric TLV toward a neighbor only > for the operational maintenance window period during which it wants a > neighbor to temporarily update its IS-IS metric or Traffic > Engineering parameters towards it. >=20 > It begins to look like it's saying that a router MUST advertise this unde= r > certain conditions, and it took me a moment to get that it's actually > *limiting* when it should be advertised (the "MUST" applies to the "only" > clause). If you think my suggested replacement reads well, you might use= it; > if not, no problem: >=20 > A router MUST limit the period during which it advertises a Reverse Met= ric > TLV toward a neighbor only to the operational maintenance window period > during which it wants that neighbor to temporarily update its IS-IS met= ric > or Traffic Engineering parameters towards it. >=20 From nobody Thu Oct 4 21:36:50 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20C99130DC7; Thu, 4 Oct 2018 21:36:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cu45oGDzGRnK; Thu, 4 Oct 2018 21:36:47 -0700 (PDT) Received: from mail-io1-f43.google.com (mail-io1-f43.google.com [209.85.166.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18248130DCD; Thu, 4 Oct 2018 21:36:47 -0700 (PDT) Received: by mail-io1-f43.google.com with SMTP id p4-v6so9724086iom.3; Thu, 04 Oct 2018 21:36:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Ru6h1yE13yry3gJgaakJ8DtT3HTIiJbZm1zX1OwwF/U=; b=IuW3/jWt9g7VusxtSS1RZVxPE64EUPes5Q2ZdN3kQfYKhJiQ7I1RfOBDuE/rvxlbap TRSW+mtY6GQcM+TRa7GvmYIPpF1W/byw0pQXbHLIFNjW30qoi1hC7Ad2BFFJiagZOSAn Sy3UV3LD9/k2Ur+VOffUeu74YqFMhH365VuxGwS1Ww+RDm1uARnOfk/pMjPsC+bu2iye 7A0BpD4ve0FM2yxQUoD1jFn1cwKpVf2K7w0jIriD6qu1RQBBWeeGYXMBwP3XqnyhtsP4 T7FhcnahTOU48WOyQeFIqnZfOXc254ZWrLcK6zEHNnUW+bR2GvolO7KSXssb35ijekXk eXOw== X-Gm-Message-State: ABuFfojA0x1pygxlFLTqbMhl8lP5mlRolrxDx5FF1a9EVVVaigkYHQSM ITJtBSLwPUqft+wsrlNR5TJmz1CS/MPBVYihDzY= X-Google-Smtp-Source: ACcGV63gGIcr1zCjNXondIQ2mKenVoY5iBi+wP7nzfURYi4/+zsl6w/+gQAoyLvN0Xvxwsi2/PCCrgnc3mdGs/6pdw8= X-Received: by 2002:a6b:6209:: with SMTP id f9-v6mr6630458iog.11.1538714206137; Thu, 04 Oct 2018 21:36:46 -0700 (PDT) MIME-Version: 1.0 References: <153867461977.4554.2419440769241572592@ietfa.amsl.com> In-Reply-To: From: Barry Leiba Date: Fri, 5 Oct 2018 00:36:35 -0400 Message-ID: To: "Naiming Shen (naiming)" Cc: "draft-ietf-isis-reverse-metric.all@ietf.org" , "ietf@ietf.org" , "lsr@ietf.org" , "secdir@ietf.org" Content-Type: multipart/alternative; boundary="000000000000aaf8fe057773d14a" Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-isis-reverse-metric-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Oct 2018 04:36:49 -0000 --000000000000aaf8fe057773d14a Content-Type: text/plain; charset="UTF-8" Perfect; thanks. Barry On Fri, Oct 5, 2018 at 12:33 AM Naiming Shen (naiming) wrote: > > Hi Barry, > > Thanks for the review and your suggestion makes sense. The original wording > is confusing. Also, as Tony has pointed out in the same thread, this > sentence > was the original intention when start of the draft, but it has been > extended for > other use cases described in section 1. How about this on top of your > suggestions: > > For the use case in section 1.1, Node and Link Isolation, a router MUST > limit > the period during which it advertises a Reverse Metric TLV toward a > neighbor > only to the operational maintenance window period during which it wants > that > neighbor to temporarily update its IS-IS metric or Traffic Engineering > parameters > towards it. > > Best Regards, > - Naiming > > > On Oct 4, 2018, at 10:36 AM, Barry Leiba > wrote: > > > > Reviewer: Barry Leiba > > Review result: Ready > > > > This document is well written and seems ready to go. The only security > issue I > > thought of as I read through it (attacking by spoofing a reverse metric) > is > > covered in the Security Considerations section. > > > > I found one sentence to be slightly ambiguous, but only very slightly. > In > > Section 3.5: > > > > A router MUST advertise a Reverse Metric TLV toward a neighbor only > > for the operational maintenance window period during which it wants a > > neighbor to temporarily update its IS-IS metric or Traffic > > Engineering parameters towards it. > > > > It begins to look like it's saying that a router MUST advertise this > under > > certain conditions, and it took me a moment to get that it's actually > > *limiting* when it should be advertised (the "MUST" applies to the "only" > > clause). If you think my suggested replacement reads well, you might > use it; > > if not, no problem: > > > > A router MUST limit the period during which it advertises a Reverse > Metric > > TLV toward a neighbor only to the operational maintenance window period > > during which it wants that neighbor to temporarily update its IS-IS > metric > > or Traffic Engineering parameters towards it. > > > > -- Barry -- Barry Leiba (barryleiba@computer.org) http://internetmessagingtechnology.org/ --000000000000aaf8fe057773d14a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Perfect; thanks.

Barry

On Fri, Oct 5, 2018 at 12:33 AM Naiming Shen (naiming) <naiming@cisco.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">
Hi Barry,

Thanks for the review and your suggestion makes sense. The original wording=
is confusing. Also, as Tony has pointed out in the same thread, this senten= ce
was the original intention when start of the draft, but it has been extende= d for
other use cases described in section 1. How about this on top of your sugge= stions:

=C2=A0 =C2=A0For the use case in section 1.1, Node and Link Isolation, a ro= uter MUST limit
=C2=A0 =C2=A0the period during which it advertises a Reverse Metric TLV tow= ard a neighbor
=C2=A0 =C2=A0only to the operational maintenance window period during which= it wants that
=C2=A0 =C2=A0neighbor to temporarily update its IS-IS metric or Traffic Eng= ineering parameters
=C2=A0 =C2=A0towards it.

Best Regards,
- Naiming

> On Oct 4, 2018, at 10:36 AM, Barry Leiba <barryleiba@computer.org> wrote:<= br> >
> Reviewer: Barry Leiba
> Review result: Ready
>
> This document is well written and seems ready to go.=C2=A0 The only se= curity issue I
> thought of as I read through it (attacking by spoofing a reverse metri= c) is
> covered in the Security Considerations section.
>
> I found one sentence to be slightly ambiguous, but only very slightly.= =C2=A0 In
> Section 3.5:
>
>=C2=A0 =C2=A0A router MUST advertise a Reverse Metric TLV toward a neig= hbor only
>=C2=A0 =C2=A0for the operational maintenance window period during which= it wants a
>=C2=A0 =C2=A0neighbor to temporarily update its IS-IS metric or Traffic=
>=C2=A0 =C2=A0Engineering parameters towards it.
>
> It begins to look like it's saying that a router MUST advertise th= is under
> certain conditions, and it took me a moment to get that it's actua= lly
> *limiting* when it should be advertised (the "MUST" applies = to the "only"
> clause).=C2=A0 If you think my suggested replacement reads well, you m= ight use it;
> if not, no problem:
>
>=C2=A0 =C2=A0A router MUST limit the period during which it advertises = a Reverse Metric
>=C2=A0 =C2=A0TLV toward a neighbor only to the operational maintenance = window period
>=C2=A0 =C2=A0during which it wants that neighbor to temporarily update = its IS-IS metric
>=C2=A0 =C2=A0or Traffic Engineering parameters towards it.
>

--
Barry
--
Barry Leiba =C2=A0(barryleiba@computer.= org)
http://internetmessagingtechnology.org/
--000000000000aaf8fe057773d14a-- From nobody Fri Oct 5 06:14:22 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00507130E45; Fri, 5 Oct 2018 06:14:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oq9c559sWUrr; Fri, 5 Oct 2018 06:14:06 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id 171D5128CF3; Fri, 5 Oct 2018 06:14:06 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id E8E47660139; Fri, 5 Oct 2018 16:14:03 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hoWjr0ulOYZs; Fri, 5 Oct 2018 16:14:02 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id BF355660126; Fri, 5 Oct 2018 16:14:02 +0300 (EEST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <153865873277.4558.6110980379756897850@ietfa.amsl.com> Date: Fri, 5 Oct 2018 16:14:02 +0300 Cc: secdir@ietf.org, iasa20@ietf.org, draft-ietf-iasa2-trust-rationale.all@ietf.org, ietf@ietf.org Content-Transfer-Encoding: 7bit Message-Id: <52C1547E-1B27-47B2-AC12-77F24640CF7C@piuha.net> References: <153865873277.4558.6110980379756897850@ietfa.amsl.com> To: Tero Kivinen X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-iasa2-trust-rationale-00 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Oct 2018 13:14:08 -0000 Thanks for your review, Tero. Jari From nobody Fri Oct 5 13:03:13 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 753281274D0; Fri, 5 Oct 2018 13:03:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iUl3qzESzRt6; Fri, 5 Oct 2018 13:03:08 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3171B126BED; Fri, 5 Oct 2018 13:03:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19586; q=dns/txt; s=iport; t=1538769788; x=1539979388; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=tcTIQ3sROO5LNEj1gPk2H25pOHXfsf3JcO1xY8m+cfw=; b=c77b/ZnnRVE4t6T4t1oWnG1e1a9FD9cEud42ScA7hdzdX2BQl0JMd+DA 1PLzYbpq2xYgjW95WrVfkg+R7zajtezKdsCFnv3h/tiTqPb4EhHCrgR2t Rc44WSmXaMtoV7HjhmD+OI/jw21cMoDDGTCGnvYFPfirc+2wwL8cr8S58 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ALAAAhw7db/4UNJK1jDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVIDAQEBAQELAYFbKmZ/KAqDapQ7gWiBHZAmhUAUgWY?= =?us-ascii?q?LAQEYAQqEA0YCF4QYITUMDQEDAQECAQECbRwMhToCAQMBASFLCxACAQg/AwI?= =?us-ascii?q?CAiULFBECBAoEBYMhAYEdZA+kZYEuihmLMReCAIESJwwTghcHLoMbAQEDgTc?= =?us-ascii?q?QTYJLMYImAogzBzEWBYUDjwgOQwkChkqDEYRGgiMXgUxLhBqJQ4cFhRmJIQI?= =?us-ascii?q?RFIElHwI0gVVwFTsqAYJBCYIdFxFqAQyHUoUEOm+LeIEugR8BAQ?= X-IronPort-AV: E=Sophos;i="5.54,345,1534809600"; d="scan'208,217";a="459035646" Received: from alln-core-11.cisco.com ([173.36.13.133]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Oct 2018 20:02:56 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by alln-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id w95K2uWX016804 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 5 Oct 2018 20:02:56 GMT Received: from xch-aln-013.cisco.com (173.36.7.23) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 5 Oct 2018 15:02:55 -0500 Received: from xch-aln-013.cisco.com ([173.36.7.23]) by XCH-ALN-013.cisco.com ([173.36.7.23]) with mapi id 15.00.1395.000; Fri, 5 Oct 2018 15:02:55 -0500 From: "Max Pritikin (pritikin)" To: Uri Blumenthal CC: Brian E Carpenter , "randy@psg.com" , Eliot Lear , "anima@ietf.org" , Security Directorate Thread-Topic: [Anima] [secdir] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 Thread-Index: AQHUWrVmgB2wYYbock+QT5LGcM09j6URazOA Date: Fri, 5 Oct 2018 20:02:55 +0000 Message-ID: <7A4C6D47-A343-4319-8EDD-8403530B3BD3@cisco.com> References: <153826253306.18743.9250084704876465818@ietfa.amsl.com> <057bd957-06b4-824e-a7c8-214383819621@huitema.net> <1fd9c9d5-508f-901e-818c-3cc87725c331@cisco.com> <2555.1538506845@localhost> <6b2f2b80-5e9e-101f-4aac-f182f638f8b1@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.99.106.4] Content-Type: multipart/alternative; boundary="_000_7A4C6D47A34343198EDD8403530B3BD3ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.24, xch-rcd-014.cisco.com X-Outbound-Node: alln-core-11.cisco.com Archived-At: Subject: Re: [secdir] [Anima] Secdir last call review of draft-ietf-anima-bootstrapping-keyinfra-16 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Oct 2018 20:03:12 -0000 --_000_7A4C6D47A34343198EDD8403530B3BD3ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpHcmVhdCB0aHJlYWQgeW91IGFsbC4gU29tZSBrZXkgcG9pbnRzIGZvciByZXNwb25zZSBmb2xs b3cuIEFkZGl0aW9uYWxseSB3ZeKAmXJlIHdvcmtpbmcgdGhyb3VnaCBlYWNoIG51bWJlcmVkIGNv bW1lbnQgc3BlY2lmaWNhbGx5Lg0KDQpHZW5lcmFsbHkgbGV0cyBrZWVwIHRoZSBzY29wZSBvZiBC UlNLSSBpbiBtaW5kLiBJdCBpcyBhIG5ldyBwcm90b2NvbCBmb3IgYm9vdHN0cmFwcGluZyB2aWEg dm91Y2hlcnMuIEl0IGRvZXMgbm90IHByZWNsdWRlIHRoZSB1c2Ugb2YgYSBsb2NhbCBjb25zb2xl IGZvciBib290c3RyYXBwaW5nL2Fzc2VydGluZyBvd25lcnNoaXAuIFRoZSBjdXJyZW50IHZvdWNo ZXIgZm9ybWF0IGlzIGEgc3RhcnRpbmcgcG9pbnQgYW5kIHRoZXJlIGlzIGFscmVhZHkgd29yayBp biBwcm9ncmVzcyBmb3IgdmFyaW91cyBhZGRpdGlvbmFsIGZvcm1zIG9mIHZvdWNoZXJzIHRvIGFk ZHJlc3MgdGhlIG90aGVyIHVzZSBjYXNlcyBicm91Z2h0IHVwLg0KDQpSZTogQ2FuIHZvdWNoZXJz IGJlIGRpc3RyaWJ1dGVkIGRpcmVjdGx5IHJhdGhlciB0aGFuIHRocm91Z2ggdGhlIEJSU0tJLU1B U0Egc3ViLXByb3RvY29sDQoNClZvdWNoZXJzIGFyZSBzaWduZWQgbWVzc2FnZXMgYW5kIHRoZXJl IGFyZSBhIG51bWJlciBvZiBkaXN0cmlidXRpb24gbW9kZWxzIGF2YWlsYWJsZS4gVGhpcyBwcm90 b2NvbCBkZXNjcmliZXMgYSBwcmVkb21pbmF0ZWx5IG9ubGluZSBtb2RlbC4gVGhlIG5ldGNvbmYg emVyb3RvdWNoIGRyYWZ0IGRlc2NyaWJlcyBhIGRpZmZlcmVudCBtZXRob2QgdXNpbmcgdGhlIHNh bWUgdm91Y2hlcnMgd2l0aCBzbGlnaHRseSBkaWZmZXJlbnQgb3BlcmF0aW9uYWwgdHJhZGUtb2Zm cy4gVGhlIGludGVudGlvbiBpcyB0aGF0IGJldHdlZW4gdGhlc2UgYSBnb29kIGZvdW5kYXRpb24g aXMgc2V0IGZvciBhbGwgdXNlIGNhc2VzICh3aXRoIGEgZm9jdXMgb24gYW5pbWEgYW5kIG5ldGNv bmY7IHdoZXJlIHRoZXNlIGRvY3VtZW50cyB3ZXJlIHdvcmtpbmcgZ3JvdXAgaXRlbXMpLiBBcyBk ZXNjcmliZWQgYmVsb3cgdGhlIGN1cnJlbnQgbWV0aG9kIGFuZCBjdXJyZW50IEJSU0tJIGZsb3cg d29yayB3aXRoIGRpcmVjdCBkaXN0cmlidXRpb24gYXMgZW52aXNpb25lZCBieSBzb21lIG9mIHRo ZSBkaXNjdXNzaW9uIG9uIHRoaXMgdGhyZWFkIChlLmcuIG5vIE1BU0EpIGJ1dCB0aGF0IGlzIG5v dCBhIHByaW1hcnkgdXNlIGNhc2UuIFRoZSBleGlzdGluZyB3b3JrIG9uIG1vcmUgY29uc3RyYWlu ZWQgdm91Y2hlciBmb3JtYXRzIGNvdWxkIGhlbHAgdG8gZW5hYmxlIHRob3NlIGlkZWFzIGEgbW9y ZSBkaXJlY3QgdXNlIGNhc2VzIGJ1dCB3aWxsIG5vdCByZXF1aXJlIEJSU0tJIHByb3RvY29sIGV4 Y2hhbmdlcyB0byBjaGFuZ2UuDQoNClJlOiBEb2VzIEJSU0tJIGNoYW5nZSB0aGUgb3duZXJzaGlw IG1vZGVsIGZyb20gdGhlIG93bmVyIHRvIHRoZSBtYW51ZmFjdHVyZXI/DQoNCkFic29sdXRlbHkg bm90LiBCUlNLSSBkZWZpbmVzIGEgc2NhbGFibGUgbWV0aG9kIG9mIGJvb3RzdHJhcHBpbmcgcmVt b3RlIHNlY3VyZSBrZXkgaW5mcmFzdHJ1Y3R1cmVzIHZpYSB0aGUgZGlzdHJpYnV0aW9uIG9mIOKA nHZvdWNoZXJz4oCdIGZyb20gdGhlIHJlZ2lzdHJhciB0byB0aGUgZGV2aWNlLiBJdCBzcGVjaWZp Y2FsbHkgYXR0ZW1wdHMgdG8gZW5zdXJlIHRoZSByZWdpc3RyYXIgKG93bmVyKSBpcyBpbiBjb250 cm9sIG9mIGRlY2lzaW9ucyBhbmQgYXR0ZW1wdHMgdG8gbWluaW1pemUgc3VwcGx5IGNoYWluIGlu dGVncmF0aW9ucyAoZS5nLiBob3cgbXVjaCB0aGUgdmVuZG9yIGV2ZW4ga25vd3MgYWJvdXQgd2hv IGFjdHVhbGx5IG93bnMgYSBkZXZpY2UpLiBUaGUgc3RydWN0dXJlIGlzIHN1Y2ggdGhhdCBhIDNy ZCBwYXJ0eSBjb3VsZCBwcm92aWRlIGFsbCB0aGUgTWFudWZhY3R1cmVyIEF1dGhvcml6ZWQgU2ln bmluZyBBdXRob3JpdHkgKE1BU0EpIHJlc3BvbnNpYmlsaXRpZXMg4oCUIHRodXMgZW5hYmxpbmcg Y29tcGxldGUgdmVuZG9yIGluZGVwZW5kZW5jZSBmcm9tIGEgQlJTS0kgcHJvdG9jb2wgcGVyc3Bl Y3RpdmUuIEl0IHNwZWNpZmljYWxseSBzdXBwb3J0cyBtb2RlbHMgd2hlcmVpbiB0aGUgdm91Y2hl ciBpcyBkaXN0cmlidXRlZCBpbiBhZHZhbmNlLCBvbiBhIDJkIGJhcmNvZGUgb3IgaW4gc2FsZXMg bWF0ZXJpYWwgb3Igd2hhdGV2ZXIuIFRoZXJlIGlzIG5vIGV4cGVjdGF0aW9uIG9mIGEgc2VjdXJl IGNvbm5lY3Rpb24gYmV0d2VlbiB0aGUgZGV2aWNlIGFuZCB0aGUgdmVuZG9yIChiZXlvbmQgYW4g ZXhwZWN0YXRpb24gdGhhdCB2b3VjaGVycyBhcmUgc2lnbmVkKS4gVGhlIGdvYWwgaGVyZSBpcyB0 byBhbGxvdyB0aGUgdmVuZG9yIHRvIGhlbHAgcHJvdmlkZSBhIHNjYWxhYmxlIGRlcGxveW1lbnQg bW9kZWwuDQoNClJlOiBXaGF0IGFib3V0IHRyYW5zZmVyIG9mIG93bmVyc2hpcDsgcGFydGljdWxh cmx5IGlmIHRoZSBNQVNBIGlzIGFudGFnb25pc3RpYyB0byByZXNhbGU/DQoNCkJlY2F1c2UgdGhl cmUgaXMgbm8gZXhwZWN0YXRpb24gb2Ygc2FsZXMtY2hhbm5lbCBpbnRlZ3JhdGlvbiB0aGlzIGlz IHJlYWxseSBsaW1pdGVkIHRvIGRpc2N1c3Npb25zIG9mIGFudGFnb25pc3RpYyB2ZW5kb3JzLiBJ IGFwcGxhdWQgcHVyY2hhc2luZyBkZWNpc2lvbnMgdG8gYXZvaWQgc3VjaCB2ZW5kb3JzLiBTdWNo IHZlbmRvcnMgYXJlIG9ubHkgYWJsZSB0byByZWplY3QgemVybyB0b3VjaCBkZXBsb3ltZW50IOKA lCB0aGV5IGNhbuKAmXQgZWZmZWN0IGN1c3RvbWVycyB0aGF0IHVzZSBsZXNzIHNjYWxhYmxlIGRl cGxveW1lbnQgbW9kZWxzIHN1Y2ggYXMgY29uc29sZSBhY2Nlc3MuIEFsbCB2ZW5kb3JzIGhhdmUg dGhlIG9wdGlvbiBvZiBsZXZlcmFnaW5nIHNlY3VyaXR5IHRlY2hub2xvZ2llcyB0byBtYWtlIHJl c2FsZSBkaWZmaWN1bHQuLi4gdGhlIGV4aXN0ZW5jZSBvZiBCUlNLSSBvbmx5IGV4cG9zZXMgc3Vj aCBhdHRlbXB0cyBpbiB0aGUgc2FtZSB3YXkgdGhlIHNpZ25lZCBpbWFnZSBsb2FkaW5nIGhpZ2hs aWdodHMgc2ltaWxhciBhdHRlbXB0cyB0byBhdm9pZCAzcmQgcGFydHkgY29kZS4NCg0KQXMgcGVy IHRoZSBiYXNpYyB0cnVzdCBtb2RlbCB0aGUgcmVnaXN0cmFyIGNhbiBldmVuIHByb3ZpZGUgdGhl IG5ldyBvd25lciA5MCUgb2YgdGhlIGZ1bmN0aW9uYWxpdHkgZXZlbiBpbiB0aGUgZmFjZSBvZiBh biBhbnRhZ29uaXN0aWMgTUFTQTogVGhlIG93bmVyIGNhbiBvYnRhaW4gYSBub25jZS1sZXNzIHZv dWNoZXIgYWdhaW5zdCBhIGRldmljZSBzcGVjaWZpYyByZWdpc3RyYXIga2V5cGFpci4gVGhpcyB0 aGVuIHByb3ZpZGVzIHRoZW0gYSBwZXJtYW5lbnQgbWV0aG9kIG9mIGJvb3RzdHJhcHBpbmcgdGhl IGRldmljZSB0aGF0IHRoZXkgY2FuIHNhZmVseSBwcm92aWRlIHdpdGggdGhlIGRldmljZSBkdXJp bmcgcmVzYWxlLiBUaGlzIG1haW50YWlucyB0aGUgbWFqb3JpdHkgdmFsdWUgb2YgdGhlIHByb3Rv Y29sIHRvIHRoZSBuZXcgb3duZXIgd2hpbGUgY29tcGxldGVseSBjaXJjdW12ZW50aW5nIGFueSBm dXR1cmUgYW50YWdvbmlzbSBieSB0aGUgdmVuZG9yLiBUaGUgZGV2aWNlIGNhbiBiZSByZXNldCB0 byBmYWN0b3J5IGRlZmF1bHRzIGJlZm9yZSB0aGUgc2FsZS4NCg0KUmU6IFdoYXQgaGFwcGVucyBp ZiB0aGUgTUFTQSBzZXJ2aWNlIGlzIHVuYXZhaWxhYmxlPw0KDQpCUlNLSSBpcyBmb3IgdGhlIHRy YW5zZmVyIG9mIHRydXN0IHRvIHRoZSBjdXJyZW50IG93bmVyLiBUaGVyZSBpcyBubyBlZmZlY3Qg dG8gZGVwbG95ZWQgZGV2aWNlcy4NCkFzIGRpc2N1c3NlZCBpbiB0aGlzIHRocmVhZCB0aGVyZSBh cmUgZmFjaWxpdGllcyBmb3Igbm9uY2UtbGVzcyBwZXJtYW5lbnQgdm91Y2hlcnMgaW5jbHVkaW5n IG9uZXMgdGhhdCBjYW4gYmUgdXNlZCBmb3IgcmVzYWxlLiBBbiBvd25lciB0aGF0IGlzIHdvcnJp ZWQgYWJvdXQgcmUtZGVwbG95aW5nIGluIHRoZSBmdXR1cmUgc3RhdGUgY2FuIHRha2UgdGhpcyBh cHByb2FjaC4gRWl0aGVyIHVzaW5nIGEgY29tbW9uIHJlZ2lzdHJhciBvciBieSB1c2luZyBhIHJl Z2lzdHJhciBwZXIgZGV2aWNlIChkZXBlbmRpbmcgb24gaWYgdGhleSBwbGFuIHRvIHJlc2FsZSku DQoNClRoZXJlIHdpbGwgYWx3YXlzIGJlIGNhc2VzIHdoZXJlIGEgdmVuZG9yIGdvZXMgYXdheSBh bmQgYSBkZXZpY2UgaXMgdGhlcmVmb3JlIGxpbWl0ZWQuIEZvciBleGFtcGxlIHNlY3VyaXR5IHVw ZGF0ZXMgdG8gc2lnbmVkIGZpcm13YXJlIGNhbiBiZSBpbXBhY3RlZCBpZiB0aGUgdmVuZG9yIG5v IGxvbmdlciBwcm9kdWNlcyB0aGVtLiBCUlNLSSBkb2VzIG1ha2UgdGhpcyByZWFsaXR5IHdvcnNl Lg0KDQotIG1heA0KDQpPbiBPY3QgMiwgMjAxOCwgYXQgNzowNiBQTSwgVXJpIEJsdW1lbnRoYWwg PHVyaUBtaXQuZWR1PG1haWx0bzp1cmlAbWl0LmVkdT4+IHdyb3RlOg0KDQpCYXNlZCBvbiB0aGlz IGV4Y2hhbmdlLCBhbmQgdGhlIGFyZ3VtZW50cyBwcmVzZW50ZWQgaGVyZSB0aGF0IEkgb2JzZXJ2 ZWQgc28gZmFyLCBJJ20gd2l0aCBSYW5keS4gSSBoYXZlIG5vdCBzZWVuIGFkZXF1YXRlIGFuc3dl cnMgdG8gaGlzIGNvbmNlcm5zICh3aGljaCBJTUhPIGFyZSByZWFzb25hYmxlKS4NCg0KUC5TLiBG ZWVsIGZyZWUgdG8gdHJpbSB0aGUgQ0M6IGxpc3Qgd2hlbi9pZiByZXNwb25kaW5nLg0KDQpQLlAu Uy4gSW4gb25lIG9mIG15IHByaW9yIGluY2FybmF0aW9ucyBtYW55IHllYXJzIGFnbywgd2UgZGVz aWduZWQgYSBzb21ld2hhdCBzaW1pbGFyIHN5c3RlbSwgYW5kIGNhbGxlZCBpdCAiWmVyby1Ub3Vj aCBQcm92aXNpb25pbmciLiBJdCB3YXMgYSB2ZXJ5IGJpZyBjb21wYW55LCBzbyB3ZSBkaWQgbm90 IGNvbnNpZGVyIHRoZSBwb3NzaWJpbGl0eSBvZiBpdC91cyBnb2luZyBvdXQgb2YgYnVzaW5lc3Mg KGFuZCBsZWF2aW5nIHRoZSBjdXN0b21lcnMgc3RyYW5kZWQpLiBCdXQgaWYgUmFuZHkncyBhcmd1 bWVudHMgd2VyZSBwcmVzZW50ZWQgdG8gb3VyIHRlYW0gdGhlbiwgd2UnZCBwcm9iYWJseSBhY2Nl cHRlZCB0aGVtIGFuZCB0cmllZCB0byBhZGRyZXNzLi4uDQoNClNlbnQgZnJvbSBteSB0ZXN0IGlQ aG9uZQ0KDQpPbiBPY3QgMiwgMjAxOCwgYXQgMjA6NTMsIFJhbmR5IEJ1c2ggPHJhbmR5QHBzZy5j b208bWFpbHRvOnJhbmR5QHBzZy5jb20+PiB3cm90ZToNCg0KSSB0aGluayBpdCdzIGJlZW4gdGhv dWdodCB0aHJvdWdoIGJ1dCBiYWRseSBhcnRpY3VsYXRlZC4gSW4gdGhhdCBzZW5zZSwNCnRoZSBM YXN0IENhbGwgaXMgZG9pbmcgaXRzIGpvYi4NCg0KZG9lcyB0aGF0IG1lYW4gdGhhdCBpIGNhbiBz dG9wIHRyeWluZyBmb3IgYSBuYXJ0ZW4gbWVkYWwsIGdvIGJhY2sgdG8NCndvcmssIGFuZCBjaHJp c3RpYW4gd2lsbCB3YWtlIG1lIHVwIGFnYWluIHdoZW4gbXkgdHdvIHNjZW5hcmlvcyBoYXZlDQpj bGVhciBhbnN3ZXJzOyBvbmUgaG9wZXMgb25lcyB3aXRoIHdoaWNoIGkgY2FuIGxpdmU/DQoNCmFs c28sIHBsZWFzZSB0ZWxsIG1lIHRoYXQgaSBkbyBub3QgbmVlZCB0byBzdGljayBteSBub3NlIGlu dG8gdGhlIHJlc3QNCm9mIGFuaW1hIGluIG9yZGVyIHRvIGxldCB0aGUgdXNlciB1bmVxdWl2b2Nh bGx5IG93biB3aGF0IHRoZXkgYnV5LiAgaQ0KaGF2ZSBteSBvd24gcmFiYml0IGhvbGVzIHRvIHB1 cnN1ZSBpbiB0aGUgaWV0Zi4NCg0KcmFuZHkNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCnNlY2RpciBtYWlsaW5nIGxpc3QNCnNlY2RpckBpZXRmLm9y ZzxtYWlsdG86c2VjZGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9zZWNkaXINCndpa2k6IGh0dHA6Ly90b29scy5pZXRmLm9yZy9hcmVhL3NlYy90cmFj L3dpa2kvU2VjRGlyUmV2aWV3DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KQW5pbWEgbWFpbGluZyBsaXN0DQpBbmltYUBpZXRmLm9yZzxtYWlsdG86QW5p bWFAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FuaW1h DQoNCg== --_000_7A4C6D47A34343198EDD8403530B3BD3ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <3C29DCB5E58F6D44A4B98DCE3C3EA6A4@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgbGluZS1icmVhazogYWZ0 ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0K PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPkdyZWF0IHRocmVhZCB5b3UgYWxsLiBTb21lIGtleSBwb2lu dHMgZm9yIHJlc3BvbnNlIGZvbGxvdy4gQWRkaXRpb25hbGx5IHdl4oCZcmUgd29ya2luZyB0aHJv dWdoIGVhY2ggbnVtYmVyZWQgY29tbWVudCBzcGVjaWZpY2FsbHkuPC9kaXY+DQo8ZGl2IGNsYXNz PSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5HZW5lcmFsbHkgbGV0cyBr ZWVwIHRoZSBzY29wZSBvZiBCUlNLSSBpbiBtaW5kLiBJdCBpcyBhIG5ldyBwcm90b2NvbCBmb3Ig Ym9vdHN0cmFwcGluZyB2aWEgdm91Y2hlcnMuIEl0IGRvZXMgbm90IHByZWNsdWRlIHRoZSB1c2Ug b2YgYSBsb2NhbCBjb25zb2xlIGZvciBib290c3RyYXBwaW5nL2Fzc2VydGluZyBvd25lcnNoaXAu IFRoZSBjdXJyZW50IHZvdWNoZXIgZm9ybWF0IGlzIGEgc3RhcnRpbmcgcG9pbnQgYW5kIHRoZXJl DQogaXMgYWxyZWFkeSB3b3JrIGluIHByb2dyZXNzIGZvciB2YXJpb3VzIGFkZGl0aW9uYWwgZm9y bXMgb2Ygdm91Y2hlcnMgdG8gYWRkcmVzcyB0aGUgb3RoZXIgdXNlIGNhc2VzIGJyb3VnaHQgdXAu PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0i Ij48YiBjbGFzcz0iIj5SZTogQ2FuIHZvdWNoZXJzIGJlIGRpc3RyaWJ1dGVkIGRpcmVjdGx5IHJh dGhlciB0aGFuIHRocm91Z2ggdGhlIEJSU0tJLU1BU0Egc3ViLXByb3RvY29sPC9iPjwvZGl2Pg0K PGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+Vm91Y2hl cnMgYXJlIHNpZ25lZCBtZXNzYWdlcyBhbmQgdGhlcmUgYXJlIGEgbnVtYmVyIG9mIGRpc3RyaWJ1 dGlvbiBtb2RlbHMgYXZhaWxhYmxlLiBUaGlzIHByb3RvY29sIGRlc2NyaWJlcyBhIHByZWRvbWlu YXRlbHkgb25saW5lIG1vZGVsLiBUaGUgbmV0Y29uZiB6ZXJvdG91Y2ggZHJhZnQgZGVzY3JpYmVz IGEgZGlmZmVyZW50IG1ldGhvZCB1c2luZyB0aGUgc2FtZSB2b3VjaGVycyB3aXRoIHNsaWdodGx5 IGRpZmZlcmVudA0KIG9wZXJhdGlvbmFsIHRyYWRlLW9mZnMuIFRoZSBpbnRlbnRpb24gaXMgdGhh dCBiZXR3ZWVuIHRoZXNlIGEgZ29vZCBmb3VuZGF0aW9uIGlzIHNldCBmb3IgYWxsIHVzZSBjYXNl cyAod2l0aCBhIGZvY3VzIG9uIGFuaW1hIGFuZCBuZXRjb25mOyB3aGVyZSB0aGVzZSBkb2N1bWVu dHMgd2VyZSB3b3JraW5nIGdyb3VwIGl0ZW1zKS4gQXMgZGVzY3JpYmVkIGJlbG93IHRoZSBjdXJy ZW50IG1ldGhvZCBhbmQgY3VycmVudCBCUlNLSSBmbG93IHdvcmsgd2l0aA0KIGRpcmVjdCBkaXN0 cmlidXRpb24gYXMgZW52aXNpb25lZCBieSBzb21lIG9mIHRoZSBkaXNjdXNzaW9uIG9uIHRoaXMg dGhyZWFkIChlLmcuIG5vIE1BU0EpIGJ1dCB0aGF0IGlzIG5vdCBhIHByaW1hcnkgdXNlIGNhc2Uu IFRoZSBleGlzdGluZyB3b3JrIG9uIG1vcmUgY29uc3RyYWluZWQgdm91Y2hlciBmb3JtYXRzIGNv dWxkIGhlbHAgdG8gZW5hYmxlIHRob3NlIGlkZWFzIGEgbW9yZSBkaXJlY3QgdXNlIGNhc2VzIGJ1 dCB3aWxsIG5vdCByZXF1aXJlDQogQlJTS0kgcHJvdG9jb2wgZXhjaGFuZ2VzIHRvIGNoYW5nZS4m bmJzcDs8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNs YXNzPSIiPjxiIGNsYXNzPSIiPlJlOiBEb2VzIEJSU0tJIGNoYW5nZSB0aGUgb3duZXJzaGlwIG1v ZGVsIGZyb20gdGhlIG93bmVyIHRvIHRoZSBtYW51ZmFjdHVyZXI/PC9iPjwvZGl2Pg0KPGRpdiBj bGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+QWJzb2x1dGVseSBu b3QuIEJSU0tJIGRlZmluZXMgYSBzY2FsYWJsZSBtZXRob2Qgb2YgYm9vdHN0cmFwcGluZyByZW1v dGUgc2VjdXJlIGtleSBpbmZyYXN0cnVjdHVyZXMgdmlhIHRoZSBkaXN0cmlidXRpb24gb2Yg4oCc dm91Y2hlcnPigJ0gZnJvbSB0aGUgcmVnaXN0cmFyIHRvIHRoZSBkZXZpY2UuIEl0IHNwZWNpZmlj YWxseSBhdHRlbXB0cyB0byBlbnN1cmUgdGhlIHJlZ2lzdHJhciAob3duZXIpIGlzIGluIGNvbnRy b2wgb2YgZGVjaXNpb25zDQogYW5kIGF0dGVtcHRzIHRvIG1pbmltaXplIHN1cHBseSBjaGFpbiBp bnRlZ3JhdGlvbnMgKGUuZy4gaG93IG11Y2ggdGhlIHZlbmRvciBldmVuIGtub3dzIGFib3V0IHdo byBhY3R1YWxseSBvd25zIGEgZGV2aWNlKS4gVGhlIHN0cnVjdHVyZSBpcyBzdWNoIHRoYXQgYSAz cmQgcGFydHkgY291bGQgcHJvdmlkZSBhbGwgdGhlIE1hbnVmYWN0dXJlciBBdXRob3JpemVkIFNp Z25pbmcgQXV0aG9yaXR5IChNQVNBKSByZXNwb25zaWJpbGl0aWVzIOKAlCB0aHVzDQogZW5hYmxp bmcgY29tcGxldGUgdmVuZG9yIGluZGVwZW5kZW5jZSBmcm9tIGEgQlJTS0kgcHJvdG9jb2wgcGVy c3BlY3RpdmUuIEl0IHNwZWNpZmljYWxseSBzdXBwb3J0cyBtb2RlbHMgd2hlcmVpbiB0aGUgdm91 Y2hlciBpcyBkaXN0cmlidXRlZCBpbiBhZHZhbmNlLCBvbiBhIDJkIGJhcmNvZGUgb3IgaW4gc2Fs ZXMgbWF0ZXJpYWwgb3Igd2hhdGV2ZXIuIFRoZXJlIGlzIG5vIGV4cGVjdGF0aW9uIG9mIGEgc2Vj dXJlIGNvbm5lY3Rpb24gYmV0d2Vlbg0KIHRoZSBkZXZpY2UgYW5kIHRoZSB2ZW5kb3IgKGJleW9u ZCBhbiBleHBlY3RhdGlvbiB0aGF0IHZvdWNoZXJzIGFyZSBzaWduZWQpLiBUaGUgZ29hbCBoZXJl IGlzIHRvIGFsbG93IHRoZSB2ZW5kb3IgdG8gaGVscCBwcm92aWRlIGEgc2NhbGFibGUgZGVwbG95 bWVudCBtb2RlbC4mbmJzcDs8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9k aXY+DQo8ZGl2IGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0iIj48YiBjbGFzcz0iIj5SZTogV2hhdCBh Ym91dCB0cmFuc2ZlciBvZiBvd25lcnNoaXA7IHBhcnRpY3VsYXJseSBpZiB0aGUgTUFTQSBpcyBh bnRhZ29uaXN0aWMgdG8gcmVzYWxlPzwvYj48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNz PSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPkJlY2F1c2UgdGhlcmUgaXMgbm8gZXhwZWN0YXRp b24gb2Ygc2FsZXMtY2hhbm5lbCBpbnRlZ3JhdGlvbiB0aGlzIGlzIHJlYWxseSBsaW1pdGVkIHRv IGRpc2N1c3Npb25zIG9mIGFudGFnb25pc3RpYyB2ZW5kb3JzLiBJIGFwcGxhdWQgcHVyY2hhc2lu ZyBkZWNpc2lvbnMgdG8gYXZvaWQgc3VjaCB2ZW5kb3JzLiBTdWNoIHZlbmRvcnMgYXJlIG9ubHkg YWJsZSB0byByZWplY3QgemVybyB0b3VjaCBkZXBsb3ltZW50IOKAlCB0aGV5DQogY2Fu4oCZdCBl ZmZlY3QgY3VzdG9tZXJzIHRoYXQgdXNlIGxlc3Mgc2NhbGFibGUgZGVwbG95bWVudCBtb2RlbHMg c3VjaCBhcyBjb25zb2xlIGFjY2Vzcy4gQWxsIHZlbmRvcnMgaGF2ZSB0aGUgb3B0aW9uIG9mIGxl dmVyYWdpbmcgc2VjdXJpdHkgdGVjaG5vbG9naWVzIHRvIG1ha2UgcmVzYWxlIGRpZmZpY3VsdC4u LiB0aGUgZXhpc3RlbmNlIG9mIEJSU0tJIG9ubHkgZXhwb3NlcyBzdWNoIGF0dGVtcHRzIGluIHRo ZSBzYW1lIHdheSB0aGUgc2lnbmVkDQogaW1hZ2UgbG9hZGluZyBoaWdobGlnaHRzIHNpbWlsYXIg YXR0ZW1wdHMgdG8gYXZvaWQgM3JkIHBhcnR5IGNvZGUuJm5ic3A7PC9kaXY+DQo8ZGl2IGNsYXNz PSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5BcyBwZXIgdGhlIGJhc2lj IHRydXN0IG1vZGVsIHRoZSByZWdpc3RyYXIgY2FuIGV2ZW4gcHJvdmlkZSB0aGUgbmV3IG93bmVy IDkwJSBvZiB0aGUgZnVuY3Rpb25hbGl0eSBldmVuIGluIHRoZSBmYWNlIG9mIGFuIGFudGFnb25p c3RpYyBNQVNBOiBUaGUgb3duZXIgY2FuIG9idGFpbiBhIG5vbmNlLWxlc3Mgdm91Y2hlciBhZ2Fp bnN0IGEgZGV2aWNlIHNwZWNpZmljIHJlZ2lzdHJhciBrZXlwYWlyLiBUaGlzIHRoZW4gcHJvdmlk ZXMNCiB0aGVtIGEgcGVybWFuZW50IG1ldGhvZCBvZiBib290c3RyYXBwaW5nIHRoZSBkZXZpY2Ug dGhhdCB0aGV5IGNhbiBzYWZlbHkgcHJvdmlkZSB3aXRoIHRoZSBkZXZpY2UgZHVyaW5nIHJlc2Fs ZS4gVGhpcyBtYWludGFpbnMgdGhlIG1ham9yaXR5IHZhbHVlIG9mIHRoZSBwcm90b2NvbCB0byB0 aGUgbmV3IG93bmVyIHdoaWxlIGNvbXBsZXRlbHkgY2lyY3VtdmVudGluZyBhbnkgZnV0dXJlIGFu dGFnb25pc20gYnkgdGhlIHZlbmRvci4gVGhlIGRldmljZQ0KIGNhbiBiZSByZXNldCB0byBmYWN0 b3J5IGRlZmF1bHRzIGJlZm9yZSB0aGUgc2FsZS4mbmJzcDs8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBj bGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGIgY2xhc3M9IiI+ UmU6IFdoYXQgaGFwcGVucyBpZiB0aGUgTUFTQSBzZXJ2aWNlIGlzIHVuYXZhaWxhYmxlPyZuYnNw OzwvYj48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNs YXNzPSIiPkJSU0tJIGlzIGZvciB0aGUgdHJhbnNmZXIgb2YgdHJ1c3QgdG8gdGhlIGN1cnJlbnQg b3duZXIuIFRoZXJlIGlzIG5vIGVmZmVjdCB0byBkZXBsb3llZCBkZXZpY2VzLiZuYnNwOzwvZGl2 Pg0KPGRpdiBjbGFzcz0iIj5BcyBkaXNjdXNzZWQgaW4gdGhpcyB0aHJlYWQgdGhlcmUgYXJlIGZh Y2lsaXRpZXMgZm9yIG5vbmNlLWxlc3MgcGVybWFuZW50IHZvdWNoZXJzIGluY2x1ZGluZyBvbmVz IHRoYXQgY2FuIGJlIHVzZWQgZm9yIHJlc2FsZS4gQW4gb3duZXIgdGhhdCBpcyB3b3JyaWVkIGFi b3V0IHJlLWRlcGxveWluZyBpbiB0aGUgZnV0dXJlIHN0YXRlIGNhbiB0YWtlIHRoaXMgYXBwcm9h Y2guIEVpdGhlciB1c2luZyBhIGNvbW1vbiByZWdpc3RyYXINCiBvciBieSB1c2luZyBhIHJlZ2lz dHJhciBwZXIgZGV2aWNlIChkZXBlbmRpbmcgb24gaWYgdGhleSBwbGFuIHRvIHJlc2FsZSkuPC9k aXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5U aGVyZSB3aWxsIGFsd2F5cyBiZSBjYXNlcyB3aGVyZSBhIHZlbmRvciBnb2VzIGF3YXkgYW5kIGEg ZGV2aWNlIGlzIHRoZXJlZm9yZSBsaW1pdGVkLiBGb3IgZXhhbXBsZSBzZWN1cml0eSB1cGRhdGVz IHRvIHNpZ25lZCBmaXJtd2FyZSBjYW4gYmUgaW1wYWN0ZWQgaWYgdGhlIHZlbmRvciBubyBsb25n ZXIgcHJvZHVjZXMgdGhlbS4gQlJTS0kgZG9lcyBtYWtlIHRoaXMgcmVhbGl0eSB3b3JzZS4mbmJz cDs8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNz PSIiPi0gbWF4PC9kaXY+DQo8ZGl2IHN0eWxlPSIiPjxiciBjbGFzcz0iIj4NCjxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiIGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0iIj5PbiBPY3QgMiwgMjAxOCwgYXQg NzowNiBQTSwgVXJpIEJsdW1lbnRoYWwgJmx0OzxhIGhyZWY9Im1haWx0bzp1cmlAbWl0LmVkdSIg Y2xhc3M9IiI+dXJpQG1pdC5lZHU8L2E+Jmd0OyB3cm90ZTo8L2Rpdj4NCjxiciBjbGFzcz0iQXBw bGUtaW50ZXJjaGFuZ2UtbmV3bGluZSI+DQo8ZGl2IGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0iIj5C YXNlZCBvbiB0aGlzIGV4Y2hhbmdlLCBhbmQgdGhlIGFyZ3VtZW50cyBwcmVzZW50ZWQgaGVyZSB0 aGF0IEkgb2JzZXJ2ZWQgc28gZmFyLCBJJ20gd2l0aCBSYW5keS4gSSBoYXZlIG5vdCBzZWVuIGFk ZXF1YXRlIGFuc3dlcnMgdG8gaGlzIGNvbmNlcm5zICh3aGljaCBJTUhPIGFyZSByZWFzb25hYmxl KS48YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+DQpQLlMuIEZlZWwgZnJlZSB0byB0cmltIHRo ZSBDQzogbGlzdCB3aGVuL2lmIHJlc3BvbmRpbmcuPGJyIGNsYXNzPSIiPg0KPGJyIGNsYXNzPSIi Pg0KUC5QLlMuIEluIG9uZSBvZiBteSBwcmlvciBpbmNhcm5hdGlvbnMgbWFueSB5ZWFycyBhZ28s IHdlIGRlc2lnbmVkIGEgc29tZXdoYXQgc2ltaWxhciBzeXN0ZW0sIGFuZCBjYWxsZWQgaXQgJnF1 b3Q7WmVyby1Ub3VjaCBQcm92aXNpb25pbmcmcXVvdDsuIEl0IHdhcyBhIHZlcnkgYmlnIGNvbXBh bnksIHNvIHdlIGRpZCBub3QgY29uc2lkZXIgdGhlIHBvc3NpYmlsaXR5IG9mIGl0L3VzIGdvaW5n IG91dCBvZiBidXNpbmVzcyAoYW5kIGxlYXZpbmcgdGhlIGN1c3RvbWVycw0KIHN0cmFuZGVkKS4g QnV0IGlmIFJhbmR5J3MgYXJndW1lbnRzIHdlcmUgcHJlc2VudGVkIHRvIG91ciB0ZWFtIHRoZW4s IHdlJ2QgcHJvYmFibHkgYWNjZXB0ZWQgdGhlbSBhbmQgdHJpZWQgdG8gYWRkcmVzcy4uLjxiciBj bGFzcz0iIj4NCjxiciBjbGFzcz0iIj4NClNlbnQgZnJvbSBteSB0ZXN0IGlQaG9uZTxiciBjbGFz cz0iIj4NCjxiciBjbGFzcz0iIj4NCk9uIE9jdCAyLCAyMDE4LCBhdCAyMDo1MywgUmFuZHkgQnVz aCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJhbmR5QHBzZy5jb20iIGNsYXNzPSIiPnJhbmR5QHBzZy5j b208L2E+Jmd0OyB3cm90ZTo8YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+DQo8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIiBjbGFzcz0iIj4NCjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNsYXNzPSIi PkkgdGhpbmsgaXQncyBiZWVuIHRob3VnaHQgdGhyb3VnaCBidXQgYmFkbHkgYXJ0aWN1bGF0ZWQu IEluIHRoYXQgc2Vuc2UsPGJyIGNsYXNzPSIiPg0KdGhlIExhc3QgQ2FsbCBpcyBkb2luZyBpdHMg am9iLjxiciBjbGFzcz0iIj4NCjwvYmxvY2txdW90ZT4NCjxiciBjbGFzcz0iIj4NCmRvZXMgdGhh dCBtZWFuIHRoYXQgaSBjYW4gc3RvcCB0cnlpbmcgZm9yIGEgbmFydGVuIG1lZGFsLCBnbyBiYWNr IHRvPGJyIGNsYXNzPSIiPg0Kd29yaywgYW5kIGNocmlzdGlhbiB3aWxsIHdha2UgbWUgdXAgYWdh aW4gd2hlbiBteSB0d28gc2NlbmFyaW9zIGhhdmU8YnIgY2xhc3M9IiI+DQpjbGVhciBhbnN3ZXJz OyBvbmUgaG9wZXMgb25lcyB3aXRoIHdoaWNoIGkgY2FuIGxpdmU/PGJyIGNsYXNzPSIiPg0KPGJy IGNsYXNzPSIiPg0KYWxzbywgcGxlYXNlIHRlbGwgbWUgdGhhdCBpIGRvIG5vdCBuZWVkIHRvIHN0 aWNrIG15IG5vc2UgaW50byB0aGUgcmVzdDxiciBjbGFzcz0iIj4NCm9mIGFuaW1hIGluIG9yZGVy IHRvIGxldCB0aGUgdXNlciB1bmVxdWl2b2NhbGx5IG93biB3aGF0IHRoZXkgYnV5LiAmbmJzcDtp PGJyIGNsYXNzPSIiPg0KaGF2ZSBteSBvd24gcmFiYml0IGhvbGVzIHRvIHB1cnN1ZSBpbiB0aGUg aWV0Zi48YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+DQpyYW5keTxiciBjbGFzcz0iIj4NCjxi ciBjbGFzcz0iIj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fPGJyIGNsYXNzPSIiPg0Kc2VjZGlyIG1haWxpbmcgbGlzdDxiciBjbGFzcz0iIj4NCjxhIGhy ZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciIGNsYXNzPSIiPnNlY2RpckBpZXRmLm9yZzwvYT48 YnIgY2xhc3M9IiI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NlY2Rp cjxiciBjbGFzcz0iIj4NCndpa2k6IGh0dHA6Ly90b29scy5pZXRmLm9yZy9hcmVhL3NlYy90cmFj L3dpa2kvU2VjRGlyUmV2aWV3PGJyIGNsYXNzPSIiPg0KPC9ibG9ja3F1b3RlPg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnIgY2xhc3M9IiI+DQpBbmlt YSBtYWlsaW5nIGxpc3Q8YnIgY2xhc3M9IiI+DQo8YSBocmVmPSJtYWlsdG86QW5pbWFAaWV0Zi5v cmciIGNsYXNzPSIiPkFuaW1hQGlldGYub3JnPC9hPjxiciBjbGFzcz0iIj4NCmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYW5pbWE8YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8YnIgY2xhc3M9IiI+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_7A4C6D47A34343198EDD8403530B3BD3ciscocom_-- From nobody Fri Oct 5 21:40:49 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C9EFB130E57; Fri, 5 Oct 2018 21:40:34 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Christian Huitema To: Cc: draft-ietf-bess-mvpn-expl-track.all@ietf.org, ietf@ietf.org, bess@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153880083477.1014.16960817024421960255@ietfa.amsl.com> Date: Fri, 05 Oct 2018 21:40:34 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-bess-mvpn-expl-track-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Oct 2018 04:40:35 -0000 Reviewer: Christian Huitema Review result: Has Nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I have reviewed version 11 of draft-ietf-bess-mvpn-expl-track. From a security point of view this draft is almost ready, except for the small issue that no mitigation is proposed for the one vulnerability discussed in the security section. Multicast VPN (MVPN) operates by setting a routing tree between the ingress site and the egress sites. In MVPN, that tree is built by the network provider, and includes multicast nodes inside the network as well as the customer facing "provider edge" routers. Ingress nodes do not necessarily know how many egress nodes have joined the multicast tree at a given time. The purpose of Explicit Tracking is to provide that information. Explicit tracking procedures are defined by RFC 6513, RFC 6514, and RFC 6625. They rely on MVPN tunnel attributes to trigger the setup of Selective Provider Multicast Service Interface Auto-Discovery routes. The current draft complements these procedures to cover a number of cases not yet covered, in particular when the multicast groups for which information is desired are indentified by wild cards instead of the full combination of source and group identifiers. This is done by defining an additional flag (LIR-pF) in the tunnel attributes. The security considerations list only one issue: that abuse of wild card definitions in large networks could trigger a large amount of explicit tracking traffic, which might affect the performance of the control plane. Otherwise, this draft does not change the security properties of MVPN discussed in RFC 6513 and RFC 6514. That seems fair, but the draft then says that studying mitigations for the potential abuse is out of scope, which leaves me a bit puzzled. I can think of a variety of techniques to either spread the explicit tracking traffic over time, rate limit it, or aggregate it in intermediate nodes. Some of those techniques could probably be proposed as a basic mitigation. From nobody Sat Oct 6 09:46:48 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CE9C6130E0C; Sat, 6 Oct 2018 09:46:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Adam Montville To: Cc: draft-ietf-rtgwg-multihomed-prefix-lfa.all@ietf.org, ietf@ietf.org, rtgwg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153884440779.19283.3433013141521591146@ietfa.amsl.com> Date: Sat, 06 Oct 2018 09:46:47 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-rtgwg-multihomed-prefix-lfa-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Oct 2018 16:46:48 -0000 Reviewer: Adam Montville Review result: Ready This draft does not seem to introduce any security considerations beyond what has already been treated in RFC5286, provided the last claim in the security considerations of RFC5286 still hold (label information is to neighbors with a trusted LDP session). One suggestion I have is to rewrite the last sentence of the security considerations of this draft. At present that sentence ends up with, "...this does not introduce any new security issues *other than* as noted in the LFA base specification..." (emphasis added), which seems to suggest that the existing RFC has somehow introduced a new security issue to this draft. Perhaps something like, "This document does not change any of the discussed protocol specifications [insert list here], and the security considerations of the LFA base specification [RFC5286] therefore continue to apply." Or something like that. Kind regards, Adam From nobody Sat Oct 6 14:56:03 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 135B91277BB for ; Sat, 6 Oct 2018 14:55:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mandelberg.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tFkzqb0-zXgU for ; Sat, 6 Oct 2018 14:55:53 -0700 (PDT) Received: from smtp.rcn.com (smtp-fo2.rcn.cmh.synacor.com [69.168.97.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2924C12785F for ; Sat, 6 Oct 2018 14:55:52 -0700 (PDT) X_CMAE_Category: , , X-CNFS-Analysis: v=2.2 cv=Z5+uJzZA c=1 sm=1 tr=0 a=OXtaa+9CFT7WVSERtyqzJw==:117 a=OXtaa+9CFT7WVSERtyqzJw==:17 a=KGjhK52YXX0A:10 a=IkcTkHD0fZMA:10 a=NTnny0joGdQA:10 a=smKx5t2vBNcA:10 a=bmmO2AaSJ7QA:10 a=BTUBnpS-AAAA:8 a=iiazv-oawmH03g7Men8A:9 a=QEXdDO2ut3YA:10 a=pblkFgjdBCuYZ9-HdJ6i:22 X-CM-Score: 0 X-Scanned-by: Cloudmark Authority Engine X-Authed-Username: ZHNlb21uQHJjbi5jb20= Authentication-Results: smtp02.rcn.cmh.synacor.com smtp.mail=david@mandelberg.org; spf=softfail; sender-id=softfail Authentication-Results: smtp02.rcn.cmh.synacor.com header.from=david@mandelberg.org; sender-id=softfail Authentication-Results: smtp02.rcn.cmh.synacor.com header.DKIM-Signature=@mandelberg.org; dkim=pass Authentication-Results: smtp02.rcn.cmh.synacor.com smtp.user=dseomn@rcn.com; auth=pass (LOGIN) Received: from [209.6.43.168] ([209.6.43.168:46302] helo=uriel.mandelberg.org) by smtp.rcn.com (envelope-from ) (ecelerity 3.6.25.56547 r(Core:3.6.25.0)) with ESMTPSA (cipher=DHE-RSA-AES256-GCM-SHA384) id 98/51-27375-66F29BB5; Sat, 06 Oct 2018 17:55:50 -0400 Received: from [192.168.1.152] (DD-WRT [192.168.1.1]) by uriel.mandelberg.org (Postfix) with ESMTPSA id 4F69F1C6035; Sat, 6 Oct 2018 17:55:49 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mandelberg.org; s=201809; t=1538862949; bh=YcVTbeHkPrILnBjqy+jcAPtl/OAUD5UlZZl8Y4ycEdA=; h=To:From:Subject:Date:From; b=X5/SOoj7hbnjvMsTmTeSxaR3NUtW/QwqlePXXd3HpLczTY8yAGITgNsFYmT5CSjZT RqD7VdQblMh7KBNTDkrsj7uBCXDdJZ9QgrvvX3/4iSpuq3m/GWnbkrJ0ui6tBKz/Xt twRDPn5ngzqlP2quedH6xhAU5/V7ZR0eA86SXk1qKQpq1hAEXqTawFu6MZKW7H59Lk GkFZyltE0dn8So24LcE6F1GVc06ifC9+3zrJ8krAtq4D6EzcxeTBBz2kBpf/gJeeh5 G9YFzuPjmOnEcbmRtghUvmlUwkP0Srt88PufElB8xp48Q4B7CBS/qpcGLcli9TvNpL FEaSZRUWy2rrA== To: iesg@ietf.org, secdir@ietf.org, draft-ietf-bfcpbis-rfc4583bis.all@ietf.org From: David Mandelberg Message-ID: <4a613210-8ade-0cee-7abd-940ab79efe2b@mandelberg.org> Date: Sat, 6 Oct 2018 17:55:47 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [secdir] secdir review of draft-ietf-bfcpbis-rfc4583bis-26 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Oct 2018 21:55:55 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready. The Security Considerations section links to other documents that this document relies on for its security. I did not notice anything else security-relevant in this document. -- https://david.mandelberg.org/ From nobody Sun Oct 7 10:45:09 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B48D130DEB; Sun, 7 Oct 2018 10:45:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFxCoxaNtsQP; Sun, 7 Oct 2018 10:45:05 -0700 (PDT) Received: from mail-yw1-xc34.google.com (mail-yw1-xc34.google.com [IPv6:2607:f8b0:4864:20::c34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFBD9130DCF; Sun, 7 Oct 2018 10:45:02 -0700 (PDT) Received: by mail-yw1-xc34.google.com with SMTP id j202-v6so7185393ywa.13; Sun, 07 Oct 2018 10:45:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version; bh=SWkptPQUYCXdbRks+BrV7mCzz8Js9fOG0IvSEToTFbU=; b=ulwlKgaRwZRCwkl0hu9AGc+9OZQQ3vK512pVEnXK0TmkW5cfgE7Zlwdvl0L0wd8eyv wd32DSCJtkJm+t+yQGhnfffUqcyWUGuQ7ijIjjYMRh/F4G8mlL8DfKNuwR6bhlKQt8tg /5Y8ZoulmlaztwhlpP4hQdOe7nvcK/PNABkQC+wc+aZNF3BLQRUyYfi785E3zuCGAkQ+ jnU9n4TwxGjYXKFj+eeUL4/i1AHu0g400+LkBbdzL1MlIoJqY2jc1cJQ4wtybj8bF7JJ iFbTspeXFMcg3o7tsHkabkm7H1jrDHChIRp+1LNrP8bblRWY7KiVy+Ep6jqhv/EweBbw Tc6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version; bh=SWkptPQUYCXdbRks+BrV7mCzz8Js9fOG0IvSEToTFbU=; b=Dze3bLs5VrRet+zrKfJvL9QR7/ayeNw6KRKjQh/C3IoZslR4Likh3VA5W1ZLnccbSw IrhFTqK/ZYqCnDVzLwu6n0N63xJJAn+cCJx5DgpsPGzVgBPAS0SFneF8/9FrNL4nB8U5 WSanX4JkO2wkoYtfOFuQGqCtxSzz8Wr7xiBz8lXuFTS6WAttKSrZ2jYxSrLEdTv3AERr ZflWO3lkvcrEsm7pwo7zdoTU7b17ygaO5mcqrguHvhTsT22GgnFmchiPX91hRCpcwpSy 5lsEvZ0KgN/+xcDVKIVHuHzMW7LW4AVJFisQaJ2RYzjaWzl+L4O0yimoPETrWwPO/O2y T5aA== X-Gm-Message-State: ABuFfohi5HAVf4QMTJk91wZLWhUHo5YBvhTK7oidfn9UrlvRTxA/LCes LrYnjQ96gYEQ0ba6YVdVYw7Plch4 X-Google-Smtp-Source: ACcGV62uTAg9ioQZTCedQFQs7hvEatejMTX15JcsRm3EcnpoNkUnESkUMVRIs6IVv016uHOy0vr+dw== X-Received: by 2002:a0d:e587:: with SMTP id o129-v6mr6413973ywe.278.1538934301555; Sun, 07 Oct 2018 10:45:01 -0700 (PDT) Received: from Chriss-Air.attlocal.net ([2600:1700:12b0:adf0:cc2b:2e9c:57e:a56a]) by smtp.googlemail.com with ESMTPSA id 132-v6sm4960225ywt.2.2018.10.07.10.45.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 07 Oct 2018 10:45:01 -0700 (PDT) To: "iesg@ietf.org" , "secdir@ietf.org" , draft-ietf-clue-signaling.all@ietf.org From: Chris Lonvick Message-ID: <5BBA45C9.1080108@gmail.com> Date: Sun, 7 Oct 2018 12:43:37 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------080001090601090405070107" Archived-At: Subject: [secdir] SECDIR review of draft-ietf-clue-signaling-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Oct 2018 17:45:07 -0000 This is a multi-part message in MIME format. --------------080001090601090405070107 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is READY. The Security Considerations section is appropriate for the document. It looks like all of the CLUE documents may become RFCs at, or near the same time. If that is the case, the authors and shepherd may want to include a common statement that implementers should read the security considerations sections of each of the other associated documents. Regards, Chris --------------080001090601090405070107 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Hi,

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

The summary of the review is READY. The Security Considerations section is appropriate for the document.

It looks like all of the CLUE documents may become RFCs at, or near the same time. If that is the case, the authors and shepherd may want to include a common statement that implementers should read the security considerations sections of each of the other associated documents.

Regards,
Chris


--------------080001090601090405070107-- From nobody Sun Oct 7 11:26:13 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E66D130E04 for ; Sun, 7 Oct 2018 11:26:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.745 X-Spam-Level: X-Spam-Status: No, score=-4.745 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.456, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=A1wRAOVL; dkim=pass (1024-bit key) header.d=ericsson.com header.b=b+f3JG8w Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpuUwfFjhRFm for ; Sun, 7 Oct 2018 11:26:04 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44D93130E0E for ; Sun, 7 Oct 2018 11:26:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1538936759; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=IS+nGPgqzMvs35Cch5zSu5n2pxT9N7TGfcvzMLXNxLw=; b=A1wRAOVLkGBEGCdZW2Pb3ilVs2OXdnGBm/QU6dOSu7I26ns/hbSiuhLzcPJSyHRC llVNoQJw+CmBZBnH3YHwUDKfILrn01IGK7rZvh3ptdDup0WT6xZDesDL+JYZMxWt 81UiFLKI3OQr9BkCFoCTvIbaRnKouUEFp6wq6DydnXU=; X-AuditID: c1b4fb30-fe1ff700000055da-c6-5bba4fb7d62b Received: from ESESSMB501.ericsson.se (Unknown_Domain [153.88.183.119]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id CE.2F.21978.7BF4ABB5; Sun, 7 Oct 2018 20:25:59 +0200 (CEST) Received: from ESESSMB502.ericsson.se (153.88.183.163) by ESESSMB501.ericsson.se (153.88.183.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 7 Oct 2018 20:25:59 +0200 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB502.ericsson.se (153.88.183.163) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 7 Oct 2018 20:25:58 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MolO8gb4UC74EWPnqLaRp6pxQP2wgllWZ6jXGTxXh1g=; b=b+f3JG8wWDOvRg+z67heUO/vRrqH++s9KVRpS4lOSO7/le2tWHnqr+cRJHmlyLRH+as6fTu02Vy591smu/EDmtwdDDkn19mSMJLxtIyeIr2BTe9/Kgv5www7qIX4PkZKEATCC/t2723uDfmCwEfefPoi9oDqtdiQmq7BtU2pDzs= Received: from VI1PR07MB4782.eurprd07.prod.outlook.com (20.177.57.157) by VI1PR07MB1054.eurprd07.prod.outlook.com (10.161.111.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.8; Sun, 7 Oct 2018 18:25:57 +0000 Received: from VI1PR07MB4782.eurprd07.prod.outlook.com ([fe80::39f7:7dd7:dc40:4221]) by VI1PR07MB4782.eurprd07.prod.outlook.com ([fe80::39f7:7dd7:dc40:4221%6]) with mapi id 15.20.1228.011; Sun, 7 Oct 2018 18:25:57 +0000 From: Christer Holmberg To: David Mandelberg , "iesg@ietf.org" , "secdir@ietf.org" , "draft-ietf-bfcpbis-rfc4583bis.all@ietf.org" Thread-Topic: secdir review of draft-ietf-bfcpbis-rfc4583bis-26 Thread-Index: AQHUXb9dMo1TxkasdkSKdSNFDwuw+aUUGs7s Date: Sun, 7 Oct 2018 18:25:56 +0000 Message-ID: References: <4a613210-8ade-0cee-7abd-940ab79efe2b@mandelberg.org> In-Reply-To: <4a613210-8ade-0cee-7abd-940ab79efe2b@mandelberg.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [37.33.70.94] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR07MB1054; 6:NwD2J0KvXwJBwZLahJmVbG/wn6XYMiEULV2A0o2SDyM8mf7yc6pqFOmqGi/VdjLBUHp16Akx2TSkBJMQNWNFHAKDnmy0Fk5N2y7VU6ui0PU3+ZpsjJNH/O000uae0a6LKc9Ks+YG/Ds+MjlPqKxlRrR9xbPZ32jTbXpU2K5ya/a6dK/BXIoYmYeC2AKrs3jowx9eQnjCcVOsrC44OtgrqxXQ30F104Puxa/6td5bPSFzMPdKaxWhL7YlDzInXg5TBrOjE77iag2GLi7mDwh0rQHIK3FojoOudYY7FSsrATCYrTHEfi4ARcF/9NfnDJ96BEAN8cAtlp9R6Jm1iGPMOIBM2qR7BA5Y/DvZx+aTpNQw+qFZA95zyqvEFg/1f7xoAc4I0fOWw0zvo8I+2N5BrvVY1LIVPuVk+h/NSXAy9byWO6FoMVA+sOqN7E0gaF8jlgsIewBXzmF2aK2qO5vrHg==; 5:8d8J+54TTV+KY7kqNDabPMLgd/13Zo8anjeV7BQlJhvPDyaayeWDe428+/LjdLHNOx7WAfwlOISjY8mdH4AYEK2MqBRgfV6f9VuaRj6Dg+fDAUUCPSqHLvjdAqmvO3UiEvpTaLg2MO3D/0F3RY9swrlBZA+55ejyra+2dc9WSxs=; 7:T6nhfCCN7IBobMHyIcniGx544P1N3FzZKDxlEjt5ufloYfCpIK7op9RDzRiavDfxXIj+sZZ4BDLo8lDIk1+lkRR0tzg0xvpYqUnC+jk6IWfBT+9hOdo/Q+90sPj1tcHmE8w7+GtZes42jhwXvHh0hQKzwAE71c3FddjM9E5N1X37PVfgBAqAAKoHpDhPzx9qNsX1Bw3xn+55Bv8RvxJdCAiXR0TDySmxjEqJ8OOySttd+YQwOuUy6mVM1XgIxrGB x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 3920eb60-ba73-41ad-c618-08d62c82531a x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:VI1PR07MB1054; x-ms-traffictypediagnostic: VI1PR07MB1054: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(3231355)(944501410)(52105095)(93006095)(93001095)(10201501046)(149066)(150057)(6041310)(20161123560045)(20161123558120)(20161123562045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991055); SRVR:VI1PR07MB1054; BCL:0; PCL:0; RULEID:; SRVR:VI1PR07MB1054; x-forefront-prvs: 0818724663 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(376002)(136003)(396003)(346002)(366004)(189003)(199004)(25786009)(55016002)(53936002)(68736007)(6606003)(1015004)(966005)(6306002)(54896002)(236005)(9686003)(71190400001)(71200400001)(33656002)(256004)(14444005)(733005)(19627405001)(6436002)(6246003)(229853002)(8936002)(106356001)(5660300001)(105586002)(97736004)(2900100001)(74316002)(478600001)(476003)(81156014)(7696005)(44832011)(7736002)(5250100002)(486006)(11346002)(3846002)(606006)(81166006)(53546011)(2201001)(6506007)(76176011)(446003)(86362001)(102836004)(6116002)(8676002)(14454004)(2906002)(6346003)(2501003)(66066001)(186003)(110136005)(26005)(99286004)(316002)(15398625002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR07MB1054; H:VI1PR07MB4782.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=christer.holmberg@ericsson.com; x-microsoft-antispam-message-info: rDo055Ee1jcdDFS8D8nQPVgqM1jHn0Vrp/QCug1EPEGNLg5lYA3rSBU6ldKODGfziugwngkMx5CcRFD9ULiX9F8kfeN5EQooacyWZjKsWbICM7yA8xhVkE88DwDVw9dZBzNz3ZJfBkVZGhogpBWELiFyOhRqyz4VM4Y2UX5QzI4L3kptfxy8MRWt3e8i+izIM9GWgrf6ba2gTRJOFfA+ExoNZULaVvM6ZByMalUkCRyQ5mGxb5HYLlqJXupj1cu75ARAK0aCuWGu3+rSfosy36TINzmU4cGtjursi8H8hmGwjFbO2rYyMgM6zw4ncwgPP+B5m+/w8x7SIxSNIoUBryHuptr1DGwEi/GL55hmGs8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_VI1PR07MB4782AC3EF50857C1DC3F395693E50VI1PR07MB4782eurp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 3920eb60-ba73-41ad-c618-08d62c82531a X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Oct 2018 18:25:56.9897 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR07MB1054 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRSAe++9m1dp8bZmniytRhRoU5tCQ0VTBBeUk37ZDGrlRW06165p BoGEJGiakxQ3ChVlpPknLc2vRMskaTNM8wP7WEq2FD9WGmrN3O4C/z3nnOe85xx4aVLYzPOl 0zXZjE6jyhDzvShDUluupE3RkRzSfhvLxrumPGTPqnr5sqo/elK2VGulTlHy+vo1Qr6st1GJ hNIrMoXJSM9hdMFRl7zSSnvmCG1P+I2/3xeJfGQOLUKeNOAw6GgdIYqQFy3E/QhMlTMkF6wg 2Hj5leKCOgJGJypcFQqXkWAYfOXWygl467C4NSuCyc1xXhGiaT6WQbEj0JkX4WEEq2ujyDlx D46CzytNLhbhaFh7P084fRGWwvR6gjNN4SNQaB8jnCzAF+CxXe9ShDgGTHVaZ9oTx4JhfMj1 CsJ74fdgk0snsQ9MzlQT3G0Y6ruGSI69wTbt4HF8EBrqf1Ic+8FwdTFyrgn4hQc0f3rgbpDA UoXzYnqLz0K/geGcAQTLjY/cDwXAavks4lgNCx9a+RxHgM3S6Xb8obHESnHNPSS0NQy4Gw5A ycNlqgwFG7ctbtyaR+IsKGhlja7zd8MbwwzFKSGwaKkmOQ4EU+2cm4PhyS8z2p6vQR6NyJtl 2MuZqVJpEKNLv8KyWZogDZPdjLZ+Uu/TjZDnyDYb04cwjcQ7Be/OdCQLeaocNi+zDwFNikUC +7n2ZKEgRZV3k9FlXdRdz2DYPrSfpsQ+AllCi1KIU1XZjJphtIzuf5WgPX3zkYKIR3fLTafn KxdzNz0317Q/Wkz9flNBXY5QxWBH3MQd6QDKSQrvBkmNfFitlBjFanl075dvfM3Jq7diJo7d X5qokq+blyIFyuOJ5o+xhzsj7lHdi/72MQvDiztk0FnFRzN3hKnMpdO88zPX4gvqFl6rFYUj +8KENn3NrhYxxaapTgSQOlb1DycZDMRFAwAA Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-bfcpbis-rfc4583bis-26 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Oct 2018 18:26:06 -0000 --_000_VI1PR07MB4782AC3EF50857C1DC3F395693E50VI1PR07MB4782eurp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Thank You, David! Regards, Christer ________________________________ From: David Mandelberg Sent: Sunday, October 7, 2018 12:55 AM To: iesg@ietf.org; secdir@ietf.org; draft-ietf-bfcpbis-rfc4583bis.all@ietf.= org Subject: secdir review of draft-ietf-bfcpbis-rfc4583bis-26 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready. The Security Considerations section links to other documents that this document relies on for its security. I did not notice anything else security-relevant in this document. -- https://david.mandelberg.org/ [https://david.mandelberg.org/wp-content/uploads/2017/09/cropped-P1230630-r= aw-crop-square-full.jpg] David Mandelberg david.mandelberg.org My phone=92s flashlight has two LEDs that combine to white over larger dist= ances. Over very small distances though, they=92re kinda pretty. The items = in the pictures are: the flashlight itself, a dry tissue, a tissue soaked w= ith screen cleaning fluid, a plastic bottle cap with water droplets, the to= p of the screen cleaner bottle with fluid bubbles, paper with pencil marks,= and paper with pen ... --_000_VI1PR07MB4782AC3EF50857C1DC3F395693E50VI1PR07MB4782eurp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Thank You, David!


Regards,


Christer



From: David Mandelberg <= david@mandelberg.org>
Sent: Sunday, October 7, 2018 12:55 AM
To: iesg@ietf.org; secdir@ietf.org; draft-ietf-bfcpbis-rfc4583bis.al= l@ietf.org
Subject: secdir review of draft-ietf-bfcpbis-rfc4583bis-26
 
I have reviewed this document as part of the secur= ity directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat<= br> these comments just like any other last call comments.

The summary of the review is Ready.

The Security Considerations section links to other documents that this
document relies on for its security. I did not notice anything else
security-relevant in this document.

--
https://david.mandelberg.org/
david.mandelberg.org
My phone=92s flashlight has two LEDs that combine to white over larger dist= ances. Over very small distances though, they=92re kinda pretty. The items = in the pictures are: the flashlight itself, a dry tissue, a tissue soaked w= ith screen cleaning fluid, a plastic bottle cap with water droplets, the top of the screen cleaner bottle with = fluid bubbles, paper with pencil marks, and paper with pen ...


--_000_VI1PR07MB4782AC3EF50857C1DC3F395693E50VI1PR07MB4782eurp_-- From nobody Sun Oct 7 17:30:58 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BD04D1277CC; Sun, 7 Oct 2018 17:30:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Daniel Migault To: Cc: draft-ietf-core-too-many-reqs.all@ietf.org, ietf@ietf.org, core@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153895864367.4396.18138201518799857673@ietfa.amsl.com> Date: Sun, 07 Oct 2018 17:30:43 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-core-too-many-reqs-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2018 00:30:44 -0000 Reviewer: Daniel Migault Review result: Has Nits Hi, Reviewer: Daniel Migault Review result: Has Nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document is clear and almost ready. Most of my comments concerns the "Security Considerations". Yours, Daniel 4. CoAP Client Behavior A client MUST NOT rely on a server being able to send the 4.29 Response Code in an overload situation because an overloaded server may not be able to reply to all requests at all. I believe the sentence may be rephrased. This is just a proposal. OLD may not be able to reply to all requests at all. NEW may not be able to reply (at all) to some requests. . 5. Security Considerations Replying to CoAP requests with a Response Code consumes resources from a server. For a server under attack it may be more appropriate to simply drop requests without responding. The gain from the response with Too Many Requests Response Code is almost the current response and all *similar* requests from that client during Max Age. I suspect that is likely a gain except when there is no responses from the server and client is not expect to send a request before Max Age. Simply dropping the requests may add the retry traffic, though it depends on the application. That said your text is correct. I am wondering if it would be good to illustrate your purpose. If a CoAP reply with the Too Many Requests Response Code is not authenticated and integrity protected, an attacker can attempt to Keranen Expires January 25, 2019 [Page 3] Internet-Draft Too Many Requests Response Code for CoAP July 2018 spoof a reply and make the client wait for an extended period of time before trying again. A similar attack may also consists in an attacker triggering multiple request or transactions with a spoofed IP so the server generates the reply to the legitimate IP. This could be used if an attacker cannot directly send the spoofed response to the legitimate client. The response code provides an information about the state (overloaded) of the server which can be used to infer additional information. This could potentially be used by an active attacker among other to confirm an attack is efficient, that a server is receiving multiple packet at a given time which may be used to identify some traffic patterns, identifying a bug a version... For a passive attacker, the response code may among other indicate an appropriated time to trigger a larger attack.... Because the code enable an attacker to gain some kind of control of the client, and reveals some information about the status of the server. I would suggest to mention that Too Many Response Code should not be considered outside unprotected channel. That is a server SHOULD NOT reply with a Too Many Requests Response Code unless the communication is encrypted. A client SHOULD ignore Too Many Response Code unless the communication is encrypted. The response seems to me small enough so reflection attacks may be out of scope. From nobody Mon Oct 8 01:02:59 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2723B12008A; Mon, 8 Oct 2018 01:02:50 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Liang Xia To: Cc: draft-campbell-sip-messaging-smime.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.85.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153898577006.31775.15728490877822751593@ietfa.amsl.com> Date: Mon, 08 Oct 2018 01:02:50 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-campbell-sip-messaging-smime-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2018 08:02:50 -0000 Reviewer: Liang Xia Review result: Ready In general, this draft is clear and well written. I have 2 comments as below: 1. For Section 6, is it required to protect the UA capabilities negotiation messages? Have you considered the possible downgrade attack, like: the adversary tampered the UA capabilities negotiation message to make the UA work without s/mime? 2. For Section 12, is there any general way to defend against the attacks from malicious or compromised intermediaries mentioned in this section? Maybe some guidances are helpful here. From nobody Mon Oct 8 09:53:40 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80D05130E9B; Mon, 8 Oct 2018 09:53:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jg3DcnP8BAPn; Mon, 8 Oct 2018 09:53:11 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7CC4130E45; Mon, 8 Oct 2018 09:53:07 -0700 (PDT) Received: from Jude (192.168.0.11) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 8 Oct 2018 09:48:24 -0700 From: Jim Schaad To: 'Daniel Migault' , CC: , , References: <153895864367.4396.18138201518799857673@ietfa.amsl.com> In-Reply-To: <153895864367.4396.18138201518799857673@ietfa.amsl.com> Date: Mon, 8 Oct 2018 09:52:58 -0700 Message-ID: <061801d45f27$602ef380$208cda80$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQHSfIc3LIj2hJ6wIQjT3ObuMBUElqUZVFMg Content-Language: en-us X-Originating-IP: [192.168.0.11] Archived-At: Subject: Re: [secdir] [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2018 16:53:25 -0000 > -----Original Message----- > From: core On Behalf Of Daniel Migault > Sent: Sunday, October 7, 2018 5:31 PM > To: secdir@ietf.org > Cc: draft-ietf-core-too-many-reqs.all@ietf.org; ietf@ietf.org; core@ietf.org > Subject: [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 > > Reviewer: Daniel Migault > Review result: Has Nits > > Hi, > > Reviewer: Daniel Migault > Review result: Has Nits > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area directors. > Document editors and WG chairs should treat these comments just like any > other last call comments. > > The document is clear and almost ready. Most of my comments concerns the > "Security Considerations". > > Yours, > Daniel > > 4. CoAP Client Behavior > > A client MUST NOT rely on a server being able to send the 4.29 > Response Code in an overload situation because an overloaded server > may not be able to reply to all requests at all. > > > > I believe the sentence may be rephrased. This is just a proposal. > OLD > may not be able to reply to all requests at all. > NEW > may not be able to reply (at all) to some requests. . > > > > 5. Security Considerations > > Replying to CoAP requests with a Response Code consumes resources > from a server. For a server under attack it may be more appropriate > to simply drop requests without responding. > > > The gain from the response with Too Many Requests Response Code is almost > the current response and all *similar* requests from that client during Max > Age. I suspect that is likely a gain except when there is no responses from the > server and client is not expect to send a request before Max Age. Simply > dropping the requests may add the retry traffic, though it depends on the > application. That said your text is correct. I am wondering if it would be good to > illustrate your purpose. > > If a CoAP reply with the Too Many Requests Response Code is not > authenticated and integrity protected, an attacker can attempt to > > Keranen Expires January 25, 2019 [Page 3] > > Internet-Draft Too Many Requests Response Code for CoAP July 2018 > > spoof a reply and make the client wait for an extended period of time > before trying again. > > > A similar attack may also consists in an attacker triggering multiple request or > transactions with a spoofed IP so the server generates the reply to the > legitimate IP. This could be used if an attacker cannot directly send the spoofed > response to the legitimate client. > > The response code provides an information about the state (overloaded) of the > server which can be used to infer additional information. This could potentially > be used by an active attacker among other to confirm an attack is efficient, > that a server is receiving multiple packet at a given time which may be used to > identify some traffic patterns, identifying a bug a version... For a passive > attacker, the response code may among other indicate an appropriated time to > trigger a larger attack.... > > Because the code enable an attacker to gain some kind of control of the client, > and reveals some information about the status of the server. I would suggest to > mention that Too Many Response Code should not be considered outside > unprotected channel. That is a server SHOULD NOT reply with a Too Many > Requests Response Code unless the communication is encrypted. A client > SHOULD ignore Too Many Response Code unless the communication is > encrypted. > > The response seems to me small enough so reflection attacks may be out of > scope. I do not believe that this is aimed to be any type of DOS prevention tool. I would disagree that this is a huge attack window. The client will filter the set of response that it is receiving to match only requests that it has made. Thus a general flood attack would not be useful unless it was targeting the same messages ids (and tokens) as requests from the client under attack. But then these would be seen by the server as duplicate messages and ignored w/o sending out a response. I am not sure that I would consider the fact that the server is currently "loaded" for some measure is a huge leak of information. I don't think I would care if that was leaked. Jim > > > _______________________________________________ > core mailing list > core@ietf.org > https://www.ietf.org/mailman/listinfo/core From nobody Mon Oct 8 10:54:44 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A75F3130F72; Mon, 8 Oct 2018 10:52:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539021132; bh=tS7WUfVIYS601E2OXn8DcfBxGcxNQ+Pz9fd+xpOwSNE=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Cc; b=Iu+IvPf+hAuV4haaaG7z5JK8yfe20kWQyRbDPbjK2l+gY0bnKtVmPur0Cggnw+exr gU6Ic04QZg3xgFD/l+mU2PSN+ExM08ORDIeh0QTW7X2UdAziIydbHCjolfSbyNikxb ctkSyrluMTNDxvrxofGFqHSUNkaJCu4bUva1CX4Y= X-Mailbox-Line: From new-work-bounces@ietf.org Mon Oct 8 10:52:12 2018 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 23036130EAC; Mon, 8 Oct 2018 10:52:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539021132; bh=YtRwvPG/PEGSDeyVhfdB4u2xMFZqVFgJUMrCLCEJEDI=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Cc; b=TEtpxJSHFY/a+LWf8vVXQ/cVkGbWYuBG/CAIqpLmDaRRdWYJtK4kU3r3nYbI9ifsb uJZO9dhe883MKzd3mZ2m1T6Tcluv7hi+R1rQid7EnWYgjKAr4rXoukeITJrjaET3hf VixQdWlt/fI2PtiZ+tePJExliAxnHfhQE+hIE4p4= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA1D130E52 for ; Mon, 8 Oct 2018 10:52:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CV0LIEt2b2iK for ; Mon, 8 Oct 2018 10:52:07 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2B8D130EBC for ; Mon, 8 Oct 2018 10:52:06 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id q40-v6so21886041qte.0 for ; Mon, 08 Oct 2018 10:52:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version:thread-index :content-language; bh=LiTeSQ1k2vBCEmXniAu7vXnfeC2htzk0E+QnPkOXrLM=; b=kRC3XB+PfwkF8V3uh0L/1ynkYf14FVpd4gqL48rOijNc9ErjQ78bYdgtUabtE1I4jr AEoFIdkl85v3fIs2bk6u8EY48pw4JGPYBt98e3wjBSQbhb7UFMrxrejz5gkAmjRTzwOc n1UNDinyd9aouiFih1FDx2Dx1nZV4uO3GXbS6ZROblfo2teeBVTFOuE70CzSRZTF0rSx 4r5hI5Yt9WCqSGtO7FfFQyP/UXFPkdwsFS6WxRnCS2h7drh/QWmXCx6S6r58DOPWmfrR iuFAuldzatP+sIDl/ScyOjBOGZiia5Jd69JvZwNfNkUNaDYrhC+OdddrBaB9v0YuoWEE CVwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :thread-index:content-language; bh=LiTeSQ1k2vBCEmXniAu7vXnfeC2htzk0E+QnPkOXrLM=; b=Nqj3kw7O8OjZeT4LpetXFkgb7S5XVI6mczC6/AFPpQ4L4T5K2gKq1Xvz9gKu7R9ZQ3 xB5j8+MRsHHVe0gCSACNI8m5+KdN2WtqdJ6exsRVDgKDEpbA35W6ORZBEzOJ8oActphG yRv62OEGg/LYgid+ZtVlGMXgZl8axXesLCShbnB02Lbwjlz+ro4XeXBz9LzqAetBW9Bq SLmS9pkMDjSWDO/euu9mgg0JpLAbxHOEyW6HCAuYQEwkUvALTKf7iCNA+04AHVH8jgdS jwtYw6ZS0+GvU60x4WCb/zUSg/DwEBUQ4a1TWokUJggnIKOKVcCwOL376AfOjAYh4w+c 4T4w== X-Gm-Message-State: ABuFfohxkWEsHLkLGeEAoDaJ27axpd2C3m5N4B7+kz0j2Dx46iLybX4+ BSWXmFbQLSPcsRwkYxKVd+o= X-Google-Smtp-Source: ACcGV61gYsOQgXlC8ccPghCYUv7C3ujWgHrMs4Qz+R2wpqIDa7WTBh129ezgVJpxl+rknfC3dc3PSg== X-Received: by 2002:ac8:3173:: with SMTP id h48-v6mr20914728qtb.125.1539021125958; Mon, 08 Oct 2018 10:52:05 -0700 (PDT) Received: from DESKTOPGUNUVB7 (pool-72-70-184-50.hrbgpa.fios.verizon.net. [72.70.184.50]) by smtp.gmail.com with ESMTPSA id j66-v6sm8659617qkf.1.2018.10.08.10.52.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Oct 2018 10:52:05 -0700 (PDT) From: "John DAmbrosia" To: Date: Mon, 8 Oct 2018 13:52:03 -0400 Message-ID: <062a01d45f2f$9f8963f0$de9c2bd0$@gmail.com> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdRfL57e+C/I3ETnSduigQKr/sOboQ== Content-Language: en-us Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Cc: "'Stanley, Dorothy'" , 'Paul Nikolich' Content-Type: multipart/mixed; boundary="===============0715063996245706013==" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 08 Oct 2018 10:54:44 -0700 Subject: [secdir] [new-work] IEEE 802 Nov 2018 PARs / ICAID Under Consideration X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Oct 2018 17:52:17 -0000 This is a multipart message in MIME format. --===============0715063996245706013== Content-Type: multipart/alternative; boundary="----=_NextPart_000_062B_01D45F0E.18783920" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_062B_01D45F0E.18783920 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit All, The following Project Authorization Requests (PARs) and Industry Connections Activity Initiation Document (ICAID) will be considered at the Nov 2018 IEEE 802 Plenary: * 802.1CMde - Amendment: Enhancements for Fronthaul Interface, Synchronization, and Synchronization Standards, PAR and CSD * 802.1DF - Standard: Time-Sensitive Networking Profile for Service Provider Networks, PAR and CSD * 802.1DG - Standard: Time-Sensitive Networking Profile for Automotive In-Vehicle Ethernet Communications, PAR and CSD * 802.3ca - Amendment: 25 Gb/s and 50 Gb/s Passive Optical Networks, PAR Modification & Extension, PAR Modification , PAR Extension and CSD Modification * 802.3cp - Amendment: Bidirectional 10 Gb/s, 25 Gb/s, and 50 Gb/s Optical Access PHYs , PAR and CSD * 802.3cs - Amendment: Increased-reach Ethernet optical subscriber access (Super-PON) , PAR and CSD * 802.3 Industry Connections: New Ethernet Applications, ICAID and Background * 802.11bc - Amendment: Enhanced Broadcast Service (eBCS), PAR and CSD * 802.11bd - Amendment: Next Generation V2X, PAR and CSD * 802.19 -Recommended Practice - Coexistence Methods for Sub-1 GHz Frequency Bands, PAR and CSD * 802.22 - Standard - Revision Project, PAR Extension * 802.22.3 - Standard - Spectrum Characterization and Occupancy Sensing, PAR Extension The PARs and ICAID can be found at http://www.ieee802.org/PARs.shtml along with the supporting IEEE 802 Criteria for Standards Development, or CSD, (which includes the 5 criteria, i.e. the explanations of how they fit the IEEE 802 criteria for initiating new work). Any comments on a proposed PAR / ICAID should be sent to the Working Group chair identified on the respective document to be received by 6:30 PM (Bangkok, Thailand, ICT), Tuesday, Nov 13 (11:30 am UTC, Nov 13, 2017) Regards, John D'Ambrosia Recording Secretary, IEEE 802 LMSC ------=_NextPart_000_062B_01D45F0E.18783920 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable IEEE 802 Nov 2018 PARs / ICAID Under Consideration

All,

The following = Project Authorization Requests (PARs) and = Industry Connections Activity Initiation Document = (ICAID) = will be considered at the Nov = 2018 IEEE 802 = Plenary:

·       802.1CMde - Amendment: Enhancements for = Fronthaul Interface, Synchronization, and = Synchronization Standards, = PAR = and CSD =

·       802.1DF - Standard: = Time-Sensitive Networking Profile for Service Provider = Networks, PAR = and CSD

·       802.1DG - Standard: = Time-Sensitive Networking Profile for Automotive = In-Vehicle Ethernet Communications, PAR = and CSD =

·       802.3ca - Amendment: 25 Gb/s = and 50 Gb/s Passive Optical Networks, PAR Modification & = Extension, PAR = Modification, PAR Extension and = CSD Modification

·       802.3cp - Amendment: = Bidirectional 10 Gb/s, 25 Gb/s, and 50 Gb/s Optical Access PHYs = , PAR and = CSD

·       802.3cs – Amendment: = Increased-reach Ethernet optical subscriber access (Super-PON) = , PAR and = CSD

·       802.3 Industry Connections: = New Ethernet Applications, ICAID = and Background

·       802.11bc - Amendment: = Enhanced Broadcast Service (eBCS), = PAR and = CSD

·       802.11bd - Amendment: Next = Generation V2X, PAR and = CSD

·       802.19 -Recommended Practice = -  Coexistence Methods for Sub-1 GHz Frequency = Bands, PAR and = CSD

·       802.22 - Standard - Revision = Project, PAR Extension

·       802.22.3 - Standard - = Spectrum Characterization and Occupancy Sensing, PAR Extension

The PARs and ICAID can = be found at http://www.ieee802.org/PARs.shtml along with the supporting IEEE = 802 Criteria for Standards Development, or CSD, (which includes the 5 = criteria, i.e. the explanations of how they fit the IEEE 802 criteria = for initiating new work).

Any comments on = a proposed PAR / ICAID should be sent to the Working Group chair identified on = the respective document to be = received by 6:30 PM (Bangkok, = Thailand, ICT), Tuesday, Nov 13 (11:30 am UTC, Nov 13, = 2017)

Regards,

John D’Ambrosia

Recording = Secretary, IEEE 802 LMSC

------=_NextPart_000_062B_01D45F0E.18783920-- --===============0715063996245706013== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work --===============0715063996245706013==-- From nobody Thu Oct 11 09:15:51 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C6C94130E1B for ; Thu, 11 Oct 2018 09:15:49 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: X-Test-IDTracker: no X-IETF-IDTracker: 6.86.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu Message-ID: <153927454981.14748.14714733607802826485.idtracker@ietfa.amsl.com> Date: Thu, 11 Oct 2018 09:15:49 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Oct 2018 16:15:50 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2018-10-11 Reviewer LC end Draft John Bradley 2018-09-25 draft-ietf-dnsop-attrleaf-fix-05 Daniel Franke 2018-06-28 draft-ietf-netconf-rfc7895bis-06 Tero Kivinen R2018-10-05 draft-ietf-iasa2-trust-rationale-03 Matthew Miller 2018-10-12 draft-ietf-httpbis-rand-access-live-03 Dacheng Zhang 2018-10-05 draft-ietf-iasa2-trust-update-02 For telechat 2018-10-25 Reviewer LC end Draft Phillip Hallam-Baker 2018-10-03 draft-ietf-detnet-use-cases-19 Steve Hanna 2018-10-10 draft-ietf-ospf-lls-interface-id-08 Taylor Yu 2018-10-09 draft-murchison-tzdist-tzif-14 Last calls: Reviewer LC end Draft John Bradley 2018-06-18 draft-ietf-bfd-multipoint-active-tail-09 Daniel Gillmor 2018-06-25 draft-ietf-dnsop-session-signal-16 Daniel Gillmor 2018-03-19 draft-gutmann-scep-10 Phillip Hallam-Baker 2018-10-11 draft-ietf-softwire-yang-06 Steve Hanna 2018-10-03 draft-ietf-detnet-problem-statement-07 Scott Kelly 2018-10-08 draft-ietf-ntp-bcp-07 Aanchal Malhotra 2018-10-17 draft-ietf-clue-protocol-17 David Mandelberg R2018-10-22 draft-ietf-netconf-zerotouch-25 Kathleen Moriarty 2018-10-19 draft-ietf-ntp-mac-05 Russ Mundy 2017-09-14 draft-spinosa-urn-lex-13 Samuel Weiler 2018-05-21 draft-ietf-bfd-multipoint-18 Klaas Wierenga 2018-09-06 draft-ietf-softwire-mesh-multicast-23 Paul Wouters 2018-09-06 draft-ietf-dnsop-kskroll-sentinel-15 Early review requests: Reviewer Due Draft Daniel Franke 2018-01-31 draft-ietf-intarea-provisioning-domains-00 Yoav Nir 2018-10-18 draft-ietf-idr-te-pm-bgp-13 Magnus Nystrom 2018-10-26 draft-ietf-nvo3-geneve-08 Next in the reviewer rotation: Magnus Nystrom Hilarie Orman Radia Perlman Derrell Piper Tim Polk Vincent Roca Kyle Rose Joseph Salowey Rich Salz Stefan Santesson From nobody Thu Oct 11 09:18:26 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0A8130EC5; Thu, 11 Oct 2018 09:18:10 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: Cc: iasa20@ietf.org, draft-ietf-iasa2-trust-rationale.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.86.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153927469008.14709.6382823868889057708@ietfa.amsl.com> Date: Thu, 11 Oct 2018 09:18:10 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-iasa2-trust-rationale-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Oct 2018 16:18:17 -0000 Reviewer: Tero Kivinen Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is rereview ot this document. The previous version said that this would not be published as RFC, and it didn't have security considerations section at all. This version removed that text, and now there is security considerations section saying there is no security implications. I still agree on that statement, but wanted to do rereview as the intended status changed dramatically. From nobody Thu Oct 11 09:34:12 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B13FF130EB8; Thu, 11 Oct 2018 09:33:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L1xUvzwUSzeH; Thu, 11 Oct 2018 09:33:54 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 5A6B2130E6B; Thu, 11 Oct 2018 09:33:54 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id C17CF6601A5; Thu, 11 Oct 2018 19:33:52 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xEkAD4rf7Mg4; Thu, 11 Oct 2018 19:33:51 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id AF9606600C5; Thu, 11 Oct 2018 19:33:51 +0300 (EEST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <153927469008.14709.6382823868889057708@ietfa.amsl.com> Date: Thu, 11 Oct 2018 19:33:51 +0300 Cc: secdir@ietf.org, iasa20@ietf.org, draft-ietf-iasa2-trust-rationale.all@ietf.org, ietf@ietf.org Content-Transfer-Encoding: 7bit Message-Id: <056F073B-3059-4F34-B9F4-9340A2580BE6@piuha.net> References: <153927469008.14709.6382823868889057708@ietfa.amsl.com> To: Tero Kivinen X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-iasa2-trust-rationale-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Oct 2018 16:33:57 -0000 Tero: Re-thanks for your re-review. --Jari From nobody Fri Oct 12 14:12:52 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC1CB124BE5 for ; Fri, 12 Oct 2018 14:12:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tfV-L-laA799 for ; Fri, 12 Oct 2018 14:12:49 -0700 (PDT) Received: from smtp90.iad3a.emailsrvr.com (smtp90.iad3a.emailsrvr.com [173.203.187.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67187126DBF for ; Fri, 12 Oct 2018 14:12:49 -0700 (PDT) Received: from smtp36.relay.iad3a.emailsrvr.com (localhost [127.0.0.1]) by smtp36.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 4D875551C; Fri, 12 Oct 2018 17:12:48 -0400 (EDT) Received: from app15.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140]) by smtp36.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 3896554A8; Fri, 12 Oct 2018 17:12:48 -0400 (EDT) X-Sender-Id: scott@hyperthought.com Received: from app15.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140]) by 0.0.0.0:25 (trex/5.7.12); Fri, 12 Oct 2018 17:12:48 -0400 Received: from hyperthought.com (localhost.localdomain [127.0.0.1]) by app15.wa-webapps.iad3a (Postfix) with ESMTP id 26942A0F21; Fri, 12 Oct 2018 17:12:48 -0400 (EDT) Received: by apps.rackspace.com (Authenticated sender: scott@hyperthought.com, from: scott@hyperthought.com) with HTTP; Fri, 12 Oct 2018 14:12:48 -0700 (PDT) X-Auth-ID: scott@hyperthought.com Date: Fri, 12 Oct 2018 14:12:48 -0700 (PDT) From: "Scott G. Kelly" To: "secdir@ietf.org" , "iesg@ietf.org" , draft-ietf-ntp-bcp.all@ietf.org MIME-Version: 1.0 Content-Type: text/plain;charset=UTF-8 Content-Transfer-Encoding: quoted-printable Importance: Normal X-Priority: 3 (Normal) X-Type: plain Message-ID: <1539378768.15629707@apps.rackspace.com> X-Mailer: webmail/15.4.3-RC Archived-At: Subject: [secdir] secdir review of draft-ietf-ntp-bcp-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Oct 2018 21:12:51 -0000 I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments.=0A=0AThe summary of the review is Ready with ni= ts.=0A=0AThis review is a few days late, I hope it is is still useful.=0A= =0AThis document describes best current practices for Network Time Protocol= (NTP).=0A=0ASection 5 describes available NTP security mechanisms, and the= n section 6 describes "NTP Security Best Practices". I went back and forth = several times, confused by the fact that section 5 includes recommendations= as well as brief descriptions of the mechanisms. I think giving a separate= overview of the existing security mechanisms is a good idea, but I'd sugge= st using this section for defining what's available, and moving the recomme= ndations into new subsections of section 6. =0A=0AThe current draft says, = =0A=0A ... The calculation of =0A = the MAC may always be based on an MD5 hash, and an AES-128-CMAC hash=0A = is expected to soon be allowed as well. If the NTP daemon is built=0A ag= ainst an OpenSSL library, NTP can also base the calculation of the=0A MAC= upon any other digest algorithm supported by each side's OpenSSL=0A libr= ary. =0A=0AShouldn't this doc be recommending use of something stronger tha= n the (non-HMAC) MD5 hash-based solutions given that stronger solutions are= available? If both sides can choose from whatever is supported by OpenSSL,= then HMAC and/or CMAC algorithms seem like much better choices.=0A From nobody Sat Oct 13 07:09:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFF4F130E55 for ; Sat, 13 Oct 2018 07:09:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mandelberg.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PgqiMsjytkms for ; Sat, 13 Oct 2018 07:09:36 -0700 (PDT) Received: from smtp.rcn.com (smtp.rcn.com [69.168.97.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E6E2130E08 for ; Sat, 13 Oct 2018 07:09:34 -0700 (PDT) X_CMAE_Category: , , X-CNFS-Analysis: v=2.2 cv=a91yzgaF c=1 sm=1 tr=0 a=OXtaa+9CFT7WVSERtyqzJw==:117 a=OXtaa+9CFT7WVSERtyqzJw==:17 a=KGjhK52YXX0A:10 a=IkcTkHD0fZMA:10 a=NTnny0joGdQA:10 a=smKx5t2vBNcA:10 a=bmmO2AaSJ7QA:10 a=48vgC7mUAAAA:8 a=BTUBnpS-AAAA:8 a=iiazv-oawmH03g7Men8A:9 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=pblkFgjdBCuYZ9-HdJ6i:22 X-CM-Score: 0 X-Scanned-by: Cloudmark Authority Engine X-Authed-Username: ZHNlb21uQHJjbi5jb20= Authentication-Results: smtp03.rcn.cmh.synacor.com smtp.mail=david@mandelberg.org; spf=softfail; sender-id=softfail Authentication-Results: smtp03.rcn.cmh.synacor.com header.from=david@mandelberg.org; sender-id=softfail Authentication-Results: smtp03.rcn.cmh.synacor.com header.DKIM-Signature=@mandelberg.org; dkim=pass Authentication-Results: smtp03.rcn.cmh.synacor.com smtp.user=dseomn@rcn.com; auth=pass (LOGIN) Received: from [209.6.43.168] ([209.6.43.168:48358] helo=uriel.mandelberg.org) by smtp.rcn.com (envelope-from ) (ecelerity 3.6.25.56547 r(Core:3.6.25.0)) with ESMTPSA (cipher=DHE-RSA-AES256-GCM-SHA384) id 02/8E-43928-89CF1CB5; Sat, 13 Oct 2018 10:09:28 -0400 Received: from [192.168.1.152] (DD-WRT [192.168.1.1]) by uriel.mandelberg.org (Postfix) with ESMTPSA id E72F81C603B; Sat, 13 Oct 2018 10:09:27 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mandelberg.org; s=201809; t=1539439768; bh=89OOX61Wj31X8Wv+cxPVKoD5h/g2HA0KOXxBcb/c4UA=; h=To:From:Subject:Date:From; b=XTuZ/fpwcfwJQwXlfQdEP3gkQLe8VQRJpxXdgHZgwmy4Ae2o5Vd8XMVoR46FujkjW r08QWWzjK/SXFmxhCBE9JzAJNzqZyHiJlogYCMbkQ0GHSnmqyA8HFdRs4//eLVdzxC 54+7dq61642PbK0UIHGjlF1g94Y6ijxs/ipLcCmGWtfjr+MPcuZYuP9u8TSbA8lfUt fLEcGLGCi/Uj7VdnMzI1p8laMUiDk8X6Z7DFJMXTd0nNLdygUXJuoy9C/zJq8oRhO6 jH4vto93Y1oq0YJlvf9QyA7KBrWAkqsxdT7aoRxhZiymBtuEAM86ozvAZbbVPqAFnJ BvBVVNYjqzSDg== To: draft-ietf-netconf-zerotouch.all@ietf.org, iesg@ietf.org, secdir@ietf.org From: David Mandelberg Message-ID: <70615034-9b7b-0b13-99c6-eb6b11d6c9b5@mandelberg.org> Date: Sat, 13 Oct 2018 10:09:25 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [secdir] secdir review of draft-ietf-netconf-zerotouch-25 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Oct 2018 14:09:38 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready. I previously reviewed -22[0] and -23[1]. All my comments have been resolved. [0] https://mailarchive.ietf.org/arch/msg/secdir/RNtvpWPTgB9KqRaOmYzLGEYsrHs [1] https://mailarchive.ietf.org/arch/msg/netconf/qDKm9Tr7nW-ctrKWbGCk17uAmV8 -- https://david.mandelberg.org/ From nobody Mon Oct 15 09:45:09 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F3EA130F00; Mon, 15 Oct 2018 09:36:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539621364; bh=COMdzL7HJrbY0hAzOY2iGUd5CptPQmOlzBzcW83OXM8=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=webfxGqfvhQO+7JaMYUBb2BNGGIA+bSzLhLsZGRvTHAnZk3IkdQ8nw24wWnAip8kI KsxC8mPixKrCZvuvq+xWWFQjmLg5K64jHv/FhVPzhhbh/yYY3zckofUUIkmd8OuKj/ v3PXueLOEVFQPhH8cRu2/08BPYB8B9ELgb4y1fdw= X-Mailbox-Line: From new-work-bounces@ietf.org Mon Oct 15 09:35:58 2018 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 12BFD130EFB; Mon, 15 Oct 2018 09:35:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539621355; bh=COMdzL7HJrbY0hAzOY2iGUd5CptPQmOlzBzcW83OXM8=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=Srg1vnkYZdjGRinf6oxr64895mcO9hXSUiHDaAoj93aZ5tJGuvt5QqTwPs89MgTk1 O3DqG7E7vPLyPBXsrJhStdqwSx9dzvBHXy32ppZmw4b7PMlTR5joyvbBrAeATSK5SS /LFe1BhJsTCVQi6THDGnL+cY0STqV2g7W9eHAHE4= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DAC8130EC6 for ; Mon, 15 Oct 2018 09:35:45 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <153962134557.18806.14542405894668818591.idtracker@ietfa.amsl.com> Date: Mon, 15 Oct 2018 09:35:45 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 15 Oct 2018 09:45:07 -0700 Subject: [secdir] [new-work] WG Review: CBOR Object Signing and Encryption (cose) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Oct 2018 16:36:11 -0000 A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2018-10-25. CBOR Object Signing and Encryption (cose) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Justin Richer Kepeng Li Assigned Area Director: Eric Rescorla Security Area Directors: Eric Rescorla Benjamin Kaduk Mailing list: Address: cose@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/cose Archive: https://mailarchive.ietf.org/arch/browse/cose/ Group page: https://datatracker.ietf.org/group/cose/ Charter: https://datatracker.ietf.org/doc/charter-ietf-cose/ CBOR Object Signing and Encryption (COSE, RFC 8152) describes how to create and process signatures, message authentication codes, and encryption using Concise Binary Object Representation (CBOR, RFC 7049) for serialization. COSE additionally describes a representation for cryptographic keys. COSE has been picked up and is being used both by a number of groups within the IETF (i.e. ACE, CORE, ANAMA, 6TiSCH and SUIT) as well as outside of the IETF (i.e. W3C and FIDO). There are a number of implementations, both open source and private, now in existence. The specification is now sufficiently mature that it makes sense to try and advance it to STD status. The standards progression work will focus on: 1. Should the document be split in two? One document for the structures and one document for the algorithm definitions. 2. What areas in the document need clarification before the document can be progressed? 3. What implementations exist and do they cover all of the major sections of the document? There are a small number of COSE related documents that will also be addressed by the working group dealing with additional attributes and algorithms that need to be reviewed and published. The first set of three are listed in the deliverables. A re-charter will be required to expand this list. The SUIT working group has identified a need for the use of hash-based signatures in the form of Leighton-Micali Signatures (LMS) (draft-mcgrew-hash-sigs). This signature form is resistant to quantum computing and is low-cost for validation. The SUIT working group additionally has identified a need for registering hash functions for indirect packaging. The W3C Web Authentication working group has identified a need for the ability to use algorithms which are currently part of TPMs which are widely deployed. At the time COSE was developed, there was a sense that X.509 certificates was not a feature that needed to be transferred from the JOSE key document (RFC 7517). Since that time a better sense of how certificates would be used both in the IoT sphere and with COSE outside of the IoT sphere has been developed. The need to be able to identify X.509 certificates is now a feature that needs to be provided. This will additionally require definition of a small number of hash functions for compact references to certificates. Key management and binding of keys to identities are out of scope for the working group. The COSE WG will not innovate in terms of cryptography. The specification of algorithms in COSE is limited to those in RFCs or active IETF WG documents. The working group will coordinate its progress with the ACE, SUIT and CORE working groups to ensure that we are fulfilling the needs of these constituencies to the extent relevant to their work. Other groups may be added to this list as the set of use cases is expanded, in consultation with the responsible Area Director. The WG will have five deliverables: 1. Republishing a version of RFC 8152 suitable for advancement to full standard. 2. Use of Hash-based Signature algorithms in COSE using draft-housley-suit-cose-hash-sig as a starting point. 3. Placement of X.509 certificates in COSE messages and keys using draft-schaad-cose-x509 as a starting point. 4. Define the algorithms needed for W3C Web Authentication for COSE using draft-jones-webauthn-cose-algorithms and draft-jones-webauthn-secp256k1 as a starting point. 5. Define a small set of hash functions. Milestones: TBD _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Tue Oct 16 12:58:44 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED978130E37; Tue, 16 Oct 2018 12:58:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AAN7aGu1Oeqw; Tue, 16 Oct 2018 12:58:41 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF327130E3D; Tue, 16 Oct 2018 12:58:40 -0700 (PDT) Received: from lhreml704-cah.china.huawei.com (unknown [172.18.7.106]) by Forcepoint Email with ESMTP id 4B077F57716D0; Tue, 16 Oct 2018 20:58:35 +0100 (IST) Received: from SJCEML703-CHM.china.huawei.com (10.208.112.39) by lhreml704-cah.china.huawei.com (10.201.108.45) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 16 Oct 2018 20:58:37 +0100 Received: from SJCEML521-MBX.china.huawei.com ([169.254.1.88]) by SJCEML703-CHM.china.huawei.com ([169.254.5.30]) with mapi id 14.03.0415.000; Tue, 16 Oct 2018 12:58:34 -0700 From: Uma Chunduri To: Adam Montville , "secdir@ietf.org" CC: "draft-ietf-rtgwg-multihomed-prefix-lfa.all@ietf.org" , "ietf@ietf.org" , "rtgwg@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-rtgwg-multihomed-prefix-lfa-07 Thread-Index: AQHUXZQy1K7cA/a5/kq8yIgEBcJOpKUiWWcQ Date: Tue, 16 Oct 2018 19:58:33 +0000 Message-ID: <25B4902B1192E84696414485F5726854136918C4@sjceml521-mbx.china.huawei.com> References: <153884440779.19283.3433013141521591146@ietfa.amsl.com> In-Reply-To: <153884440779.19283.3433013141521591146@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.212.246.3] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-rtgwg-multihomed-prefix-lfa-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 19:58:43 -0000 SGkgQWRhbSwNCg0KVGhhbmtzIGZvciB5b3VyIHJldmlldy4gIA0KDQpZb3VyIHN1Z2dlc3Rpb24g aGFzIGJlZW4gaW5jb3Jwb3JhdGVkIGluIDA4IHZlcnNpb24gcG9zdGVkICAgaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtcnRnd2ctbXVsdGlob21lZC1wcmVmaXgtbGZhLTA4 IC4NCi0tDQpVbWEgQy4gKE9uIGJlaGFsZiBvZiBjby1hdXRob3JzKQ0KDQoNCi0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBBZGFtIE1vbnR2aWxsZSBbbWFpbHRvOmFkYW0udy5tb250 dmlsbGVAZ21haWwuY29tXSANClNlbnQ6IFNhdHVyZGF5LCBPY3RvYmVyIDA2LCAyMDE4IDk6NDcg QU0NClRvOiBzZWNkaXJAaWV0Zi5vcmcNCkNjOiBkcmFmdC1pZXRmLXJ0Z3dnLW11bHRpaG9tZWQt cHJlZml4LWxmYS5hbGxAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IHJ0Z3dnQGlldGYub3JnDQpT dWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLXJ0Z3dnLW11bHRp aG9tZWQtcHJlZml4LWxmYS0wNw0KDQpSZXZpZXdlcjogQWRhbSBNb250dmlsbGUNClJldmlldyBy ZXN1bHQ6IFJlYWR5DQoNClRoaXMgZHJhZnQgZG9lcyBub3Qgc2VlbSB0byBpbnRyb2R1Y2UgYW55 IHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGJleW9uZCB3aGF0IGhhcyBhbHJlYWR5IGJlZW4gdHJl YXRlZCBpbiBSRkM1Mjg2LCBwcm92aWRlZCB0aGUgbGFzdCBjbGFpbSBpbiB0aGUgc2VjdXJpdHkg Y29uc2lkZXJhdGlvbnMgb2YgUkZDNTI4NiBzdGlsbCBob2xkIChsYWJlbCBpbmZvcm1hdGlvbiBp cyB0byBuZWlnaGJvcnMgd2l0aCBhIHRydXN0ZWQgTERQIHNlc3Npb24pLg0KDQpPbmUgc3VnZ2Vz dGlvbiBJIGhhdmUgaXMgdG8gcmV3cml0ZSB0aGUgbGFzdCBzZW50ZW5jZSBvZiB0aGUgc2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgb2YgdGhpcyBkcmFmdC4gQXQgcHJlc2VudCB0aGF0IHNlbnRlbmNl IGVuZHMgdXAgd2l0aCwgIi4uLnRoaXMgZG9lcyBub3QgaW50cm9kdWNlIGFueSBuZXcgc2VjdXJp dHkgaXNzdWVzICpvdGhlciB0aGFuKiBhcyBub3RlZCBpbiB0aGUgTEZBIGJhc2Ugc3BlY2lmaWNh dGlvbi4uLiIgKGVtcGhhc2lzIGFkZGVkKSwgd2hpY2ggc2VlbXMgdG8gc3VnZ2VzdCB0aGF0IHRo ZSBleGlzdGluZyBSRkMgaGFzIHNvbWVob3cgaW50cm9kdWNlZCBhIG5ldyBzZWN1cml0eSBpc3N1 ZSB0byB0aGlzIGRyYWZ0Lg0KDQpQZXJoYXBzIHNvbWV0aGluZyBsaWtlLCAiVGhpcyBkb2N1bWVu dCBkb2VzIG5vdCBjaGFuZ2UgYW55IG9mIHRoZSBkaXNjdXNzZWQgcHJvdG9jb2wgc3BlY2lmaWNh dGlvbnMgW2luc2VydCBsaXN0IGhlcmVdLCBhbmQgdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25z IG9mIHRoZSBMRkEgYmFzZSBzcGVjaWZpY2F0aW9uIFtSRkM1Mjg2XSB0aGVyZWZvcmUgY29udGlu dWUgdG8gYXBwbHkuIiBPciBzb21ldGhpbmcgbGlrZSB0aGF0Lg0KDQpLaW5kIHJlZ2FyZHMsDQoN CkFkYW0NCg0K From nobody Tue Oct 16 14:18:14 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 74641130E48; Tue, 16 Oct 2018 14:18:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Yoav Nir To: Cc: idr@ietf.org, ietf@ietf.org, draft-ietf-idr-te-pm-bgp.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153972468642.9298.14442375581871750001@ietfa.amsl.com> Date: Tue, 16 Oct 2018 14:18:06 -0700 Archived-At: Subject: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 21:18:07 -0000 Reviewer: Yoav Nir Review result: Has Nits This is an early review with a specific request to review the Security Considerations section. The draft adds a bunch of TLVs to be sent from routers regarding the link state of the link used for IGP. The draft references RFC 7752 which defined earlier TLVs used to carry NLRI (reachability) information. What I found difficult about both 7752 and this draft is the vagueness about who the consumer of this information is. The abstract of 7752 begins like this: "In a number of environments, a component external to a network is called upon to perform computations based on the network topology and current state of the connections within the network, including Traffic Engineering (TE) information." There is also a diagram with information flowing to a "consumer" and that's it. Is it an SDN controller? Some kind of application? OK. On to the Security Considerations section. It begins with a statement that this does not affect the security model of BGP. Although that is just claimed and not supported in text, it seems reasonable. I should note that this paragraph is copied from 7752. The second (and last) paragraph in the security considerations section talks about the new attributes. It mentions that security and authentication are assumed to be used just as in RFCs 7810 and 7471. With proper authentication this information is not sent except to the proper consumer. However, there is an important difference that I think needs to be addressed. 7810 and 7471 are about IS-IS and OSPF respectively. There routing protocols are typically used in closed environments, and the Security Considerations of 7810 state that explicitly. BGP (the subject of this document) is different in that it is typically used all over the Internet. Without further clarity about who and where the "consumer" is, it has to be assumed that the information might at least leak out. Another issue I have with this section is that the draft specifies how to send new information (the link state TLVs) from one node to another. This is information that was not sent before. When a change like that is made, I think the Security Considerations section should justify why it is OK to distribute this information. Typically you need to justify that leaking this information (to the intended recipient or to the rest of the world) does not (1) make it easier to attack some part of the system, or (2) distributes privacy-sensitive information, or (3) undermines some other confidentiality interest. I think it's fairly easy to make the argument that the information in these TLVs does not do any of the above, but the argument should be made. The last paragraph in the Security Considerations section of RFC 7752 has just such an argument. From nobody Tue Oct 16 16:52:25 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75E04130E63; Tue, 16 Oct 2018 16:52:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.564 X-Spam-Level: X-Spam-Status: No, score=-14.564 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YWA_zNzphYLm; Tue, 16 Oct 2018 16:52:06 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 443A5130E61; Tue, 16 Oct 2018 16:52:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=21660; q=dns/txt; s=iport; t=1539733926; x=1540943526; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=74Pi0eDt3HroqH+jIfrrHnfgCLLbR8cqLkjfKinK8sw=; b=mo7Qsq6RKWBag5ezlTiaQ2eA+9mJMWDFCNZsP4Bf7nYXZpfkvKCAFXj1 ygqvD1TTqG+/nK20tk9n8WP9Py26fu7hir39qpDk0slNZ5N/e94ar4RFG i7dWgz60aa0rnftS5cv8uQMBlTq4hoSrXh8ERhxURcUlrp/cfehSysAtE I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AEAACLeMZb/4MNJK1jGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBUQUBAQEBCwGBDHdmfygKg2uIF447iHSIS4VIgXoLAQGEbAI?= =?us-ascii?q?XhFAhNA0NAQMBAQIBAQJtKIU5AQEBAwEjCkwFBwQCAQgOAwQBASsCAgIfER0?= =?us-ascii?q?IAgQBDQUIgxmBHUwDDQilcYEuh3oNghiJBIErgR0XgUE/JmsBgxKCVoJOgl2?= =?us-ascii?q?CVwKOKIYNiUcuCQKJaYNNgxsfkB6NOYhOAhEUgSYdOIFVcBWDJ4ImF44Zb4p?= =?us-ascii?q?+gR8BAQ?= X-IronPort-AV: E=Sophos;i="5.54,389,1534809600"; d="scan'208,217";a="467381515" Received: from alln-core-1.cisco.com ([173.36.13.131]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Oct 2018 23:52:05 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by alln-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id w9GNq5xg030690 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 16 Oct 2018 23:52:05 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 16 Oct 2018 18:52:04 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Tue, 16 Oct 2018 18:52:04 -0500 From: "Les Ginsberg (ginsberg)" To: Yoav Nir , "secdir@ietf.org" CC: "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" Thread-Topic: Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppw Date: Tue, 16 Oct 2018 23:52:04 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> In-Reply-To: <153972468642.9298.14442375581871750001@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.154.160.224] Content-Type: multipart/alternative; boundary="_000_ec43e712e8024930831a206f8e843cbbXCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.12, xch-aln-002.cisco.com X-Outbound-Node: alln-core-1.cisco.com Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 23:52:10 -0000 --_000_ec43e712e8024930831a206f8e843cbbXCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW9hdiAtDQoNCg0KDQpUaGFueCBmb3IgdGhlIHJldmlldy4NCg0KDQoNCkknbGwgcHJlZmFjZSBt eSByZW1hcmtzIGJ5IHNheWluZyBJIGFtIGEgYmlnIGJlbGlldmVyIGluIG1vZHVsYXJpdHkuIElm IGEgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgYWxyZWFkeSBjb3ZlcmVkIGFuIGlzc3VlIEkgc3Ry b25nbHkgYmVsaWV2ZSB3ZSBhcmUgYmV0dGVyIG9mZiByZWZlcmVuY2luZyB0aGF0IGRvY3VtZW50 IHRoYW4gdHJ5aW5nIHRvIHJlcGVhdC9yZXN0YXRlIHdoYXQgdGhlIHJlZmVyZW5jZWQgZG9jdW1l bnQgaGFzIHNhaWQuDQoNClRoZXJlIGFyZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVu IHdoZW4gd2UgcmVwZWF0L3Jlc3RhdGU6DQoNCg0KDQoxKVdlIGFyZSByZWR1bmRhbnQNCg0KMilX ZSBpbnRyb2R1Y2UgYW1iaWd1aXR5DQoNCg0KDQpOZWl0aGVyIG9mIHRoZXNlIGlzIGRlc2lyYWJs ZS4NCg0KDQoNClJlc3BvbnNlcyBpbmxpbmUuDQoNCg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQoNCj4gRnJvbTogWW9hdiBOaXIgPHluaXIuaWV0ZkBnbWFpbC5jb20+DQoNCj4gU2Vu dDogVHVlc2RheSwgT2N0b2JlciAxNiwgMjAxOCAyOjE4IFBNDQoNCj4gVG86IHNlY2RpckBpZXRm Lm9yZw0KDQo+IENjOiBpZHJAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC5hbGxAaWV0Zi5vcmcNCg0KPiBTdWJqZWN0OiBTZWNkaXIgZWFybHkgcmV2aWV3 IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQo+DQoNCj4gUmV2aWV3ZXI6IFlvYXYg TmlyDQoNCj4gUmV2aWV3IHJlc3VsdDogSGFzIE5pdHMNCg0KPg0KDQo+IFRoaXMgaXMgYW4gZWFy bHkgcmV2aWV3IHdpdGggYSBzcGVjaWZpYyByZXF1ZXN0IHRvIHJldmlldyB0aGUgU2VjdXJpdHkN Cg0KPiBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KDQo+DQoNCj4gVGhlIGRyYWZ0IGFkZHMgYSBi dW5jaCBvZiBUTFZzIHRvIGJlIHNlbnQgZnJvbSByb3V0ZXJzIHJlZ2FyZGluZyB0aGUgbGluaw0K DQo+IHN0YXRlIG9mIHRoZSBsaW5rIHVzZWQgZm9yIElHUC4gVGhlIGRyYWZ0IHJlZmVyZW5jZXMg UkZDIDc3NTIgd2hpY2ggZGVmaW5lZA0KDQo+IGVhcmxpZXIgVExWcyB1c2VkIHRvIGNhcnJ5IE5M UkkgKHJlYWNoYWJpbGl0eSkgaW5mb3JtYXRpb24uDQoNCj4NCg0KPiBXaGF0IEkgZm91bmQgZGlm ZmljdWx0IGFib3V0IGJvdGggNzc1MiBhbmQgdGhpcyBkcmFmdCBpcyB0aGUgdmFndWVuZXNzIGFi b3V0DQoNCj4gd2hvIHRoZSBjb25zdW1lciBvZiB0aGlzIGluZm9ybWF0aW9uIGlzLiBUaGUgYWJz dHJhY3Qgb2YgNzc1MiBiZWdpbnMgbGlrZSB0aGlzOg0KDQo+ICJJbiBhIG51bWJlciBvZiBlbnZp cm9ubWVudHMsIGEgY29tcG9uZW50IGV4dGVybmFsIHRvIGEgbmV0d29yayBpcyBjYWxsZWQNCg0K PiB1cG9uIHRvIHBlcmZvcm0gY29tcHV0YXRpb25zIGJhc2VkIG9uIHRoZSBuZXR3b3JrIHRvcG9s b2d5IGFuZCBjdXJyZW50DQoNCj4gc3RhdGUgb2YgdGhlIGNvbm5lY3Rpb25zIHdpdGhpbiB0aGUg bmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJpbmcNCg0KPiAoVEUpIGluZm9ybWF0 aW9uLiIgVGhlcmUgaXMgYWxzbyBhIGRpYWdyYW0gd2l0aCBpbmZvcm1hdGlvbiBmbG93aW5nIHRv IGENCg0KPiAiY29uc3VtZXIiDQoNCj4gYW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0ROIGNvbnRy b2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj8NCg0KPg0KDQoNCg0KW0xlczpdIFRoZSBk aWFncmFtIHlvdSBhcmUgcmVmZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRvIGJlIGluIFJG QyA3NzUyIHNpbmNlIHRoZXJlIGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRyYWZ0Lg0KDQpX aGljaCBsZWFkcyBtZSB0byBzYXkgaWYgeW91IGZlZWwgdGhpcyBpcyBpbnN1ZmZpY2llbnQgdGhl biBpdCBuZWVkcyB0byBiZSB0YWtlbiB1cCBpbiB0aGUgY29udGV4dCBvZiBSRkMgNzc1MiAtIG5v dCB0aGlzIGRyYWZ0Lg0KDQoNCg0KSG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91IGFz IHdlbGwuDQoNCg0KDQo+IE9LLiBPbiB0byB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgc2Vj dGlvbi4gSXQgYmVnaW5zIHdpdGggYSBzdGF0ZW1lbnQgdGhhdA0KDQo+IHRoaXMgZG9lcyBub3Qg YWZmZWN0IHRoZSBzZWN1cml0eSBtb2RlbCBvZiBCR1AuICBBbHRob3VnaCB0aGF0IGlzIGp1c3Qg Y2xhaW1lZA0KDQo+IGFuZCBub3Qgc3VwcG9ydGVkIGluIHRleHQsIGl0IHNlZW1zIHJlYXNvbmFi bGUuIEkgc2hvdWxkIG5vdGUgdGhhdCB0aGlzDQoNCj4gcGFyYWdyYXBoIGlzIGNvcGllZCBmcm9t IDc3NTIuDQoNCj4NCg0KPiBUaGUgc2Vjb25kIChhbmQgbGFzdCkgcGFyYWdyYXBoIGluIHRoZSBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIHRhbGtzDQoNCj4gYWJvdXQgdGhlIG5ldyBh dHRyaWJ1dGVzLiBJdCBtZW50aW9ucyB0aGF0IHNlY3VyaXR5IGFuZCBhdXRoZW50aWNhdGlvbiBh cmUNCg0KPiBhc3N1bWVkIHRvIGJlIHVzZWQganVzdCBhcyBpbiBSRkNzIDc4MTAgYW5kIDc0NzEu IFdpdGggcHJvcGVyDQoNCj4gYXV0aGVudGljYXRpb24gdGhpcyBpbmZvcm1hdGlvbiBpcyBub3Qg c2VudCBleGNlcHQgdG8gdGhlIHByb3BlciBjb25zdW1lci4NCg0KPiBIb3dldmVyLCB0aGVyZSBp cyBhbiBpbXBvcnRhbnQgZGlmZmVyZW5jZSB0aGF0IEkgdGhpbmsgbmVlZHMgdG8gYmUNCg0KPiBh ZGRyZXNzZWQuIDc4MTAgYW5kIDc0NzEgYXJlIGFib3V0IElTLUlTIGFuZCBPU1BGIHJlc3BlY3Rp dmVseS4gVGhlcmUNCg0KPiByb3V0aW5nIHByb3RvY29scyBhcmUgdHlwaWNhbGx5IHVzZWQgaW4g Y2xvc2VkIGVudmlyb25tZW50cywgYW5kIHRoZSBTZWN1cml0eQ0KDQo+IENvbnNpZGVyYXRpb25z IG9mIDc4MTAgc3RhdGUgdGhhdCBleHBsaWNpdGx5LiBCR1AgKHRoZSBzdWJqZWN0IG9mIHRoaXMN Cg0KPiBkb2N1bWVudCkgaXMgZGlmZmVyZW50IGluIHRoYXQgaXQgaXMgdHlwaWNhbGx5IHVzZWQg YWxsIG92ZXIgdGhlIEludGVybmV0LiBXaXRob3V0DQoNCj4gZnVydGhlciBjbGFyaXR5IGFib3V0 IHdobyBhbmQgd2hlcmUgdGhlICJjb25zdW1lciIgaXMsIGl0IGhhcyB0byBiZSBhc3N1bWVkDQoN Cj4gdGhhdCB0aGUgaW5mb3JtYXRpb24gbWlnaHQgYXQgbGVhc3QgbGVhayBvdXQuDQoNCj4NCg0K W0xlczpdIEkgdGhpbmsgeW91IGhhdmUgbWlzaW50ZXJwcmV0ZWQgdGhpcyBwYXJhZ3JhcGguIChl bXBoYXNpcyBhZGRlZCBiZWxvdykNCg0KDQoNCiIgVGhlIElHUA0KDQogICBpbnN0YW5jZXMgb3Jp Z2luYXRpbmcgdGhlc2UgVExWcyBhcmUgYXNzdW1lZCB0byBoYXZlIGFsbCB0aGUgcmVxdWlyZWQN Cg0KICAgc2VjdXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbSAoYXMgZGVzY3JpYmVk IGluIFtSRkM3ODEwXSBhbmQNCg0KICAgW1JGQzc0NzFdKSBpbiBvcmRlciB0byBwcmV2ZW50IGFu eSBzZWN1cml0eSBpc3N1ZSB3aGVuIHByb3BhZ2F0aW5nDQoNCiAgIHRoZSBUTFZzIGludG8gQkdQ LUxTLiINCg0KDQoNCldoYXQgd2UgYXJlIHN0YXRpbmcgaGVyZSBpcyB0aGF0IHdoZW4gdGhlIElH UCBhZHZlcnRpc2VtZW50cyBhcmUgc2VudCB0aGUgc2VjdXJpdHkvYXV0aGVudGljYXRpb24gbWVj aGFuaXNtcyBzcGVjaWZpZWQgaW4gdGhlIElHUCBkcmFmdHMgYXBwbGllcy4NCg0KVGhpcyBpcyBO T1QgdHJ5aW5nIHRvIGFwcGx5IFJGQzc4MTAvUkZDNzQ3MSB0byB0aGUgbmV3IEJHUCBhZHZlcnRp c2VtZW50cy4NCg0KVGhlIHNlY3VyaXR5IGlzc3VlcyByZWxhdGVkIHRvIHRoZSBuZXcgQkdQIGFk dmVydGlzZW1lbnRzIGFyZSBkaXNjdXNzZWQgaW4gdGhlIHByZXZpb3VzIHBhcmFncmFwaC4NCg0K DQoNCj4gQW5vdGhlciBpc3N1ZSBJIGhhdmUgd2l0aCB0aGlzIHNlY3Rpb24gaXMgdGhhdCB0aGUg ZHJhZnQgc3BlY2lmaWVzIGhvdyB0byBzZW5kDQoNCj4gbmV3IGluZm9ybWF0aW9uICh0aGUgbGlu ayBzdGF0ZSBUTFZzKSBmcm9tIG9uZSBub2RlIHRvIGFub3RoZXIuIFRoaXMgaXMNCg0KPiBpbmZv cm1hdGlvbiB0aGF0IHdhcyBub3Qgc2VudCBiZWZvcmUuIFdoZW4gYSBjaGFuZ2UgbGlrZSB0aGF0 IGlzIG1hZGUsIEkNCg0KPiB0aGluayB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgc2VjdGlv biBzaG91bGQganVzdGlmeSB3aHkgaXQgaXMgT0sgdG8NCg0KPiBkaXN0cmlidXRlIHRoaXMgaW5m b3JtYXRpb24uIFR5cGljYWxseSB5b3UgbmVlZCB0byBqdXN0aWZ5IHRoYXQgbGVha2luZyB0aGlz DQoNCj4gaW5mb3JtYXRpb24gKHRvIHRoZSBpbnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJl c3Qgb2YgdGhlIHdvcmxkKSBkb2VzIG5vdA0KDQo+ICgxKSBtYWtlIGl0IGVhc2llciB0byBhdHRh Y2sgc29tZSBwYXJ0IG9mIHRoZSBzeXN0ZW0sIG9yICgyKSBkaXN0cmlidXRlcw0KDQo+IHByaXZh Y3ktc2Vuc2l0aXZlIGluZm9ybWF0aW9uLCBvciAoMykgdW5kZXJtaW5lcyBzb21lIG90aGVyIGNv bmZpZGVudGlhbGl0eQ0KDQo+IGludGVyZXN0LiBJIHRoaW5rIGl0J3MgZmFpcmx5IGVhc3kgdG8g bWFrZSB0aGUgYXJndW1lbnQgdGhhdCB0aGUgaW5mb3JtYXRpb24gaW4NCg0KPiB0aGVzZSBUTFZz IGRvZXMgbm90IGRvIGFueSBvZiB0aGUgYWJvdmUsIGJ1dCB0aGUgYXJndW1lbnQgc2hvdWxkIGJl IG1hZGUuDQoNCj4gVGhlIGxhc3QgcGFyYWdyYXBoIGluIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0 aW9ucyBzZWN0aW9uIG9mIFJGQyA3NzUyIGhhcyBqdXN0DQoNCj4gc3VjaCBhbiBhcmd1bWVudC4N Cg0KDQoNCltMZXM6XSBTZWN1cml0eSBzZWN0aW9ucyBpbiBSRkM3ODEwL1JGQzc0NzEgZGlyZWN0 bHkgYWRkcmVzcyB0aGlzIHBvaW50Lg0KDQpXRSBjb3VsZCByZXBlYXQgc29tZSBvZiB0aGF0IGhl cmUg4oCTIGJ1dCBhcyBwZXIgbXkg4oCcb3BlbmluZyBzdGF0ZW1lbnTigJ0gSSBhbSByZWx1Y3Rh bnQgdG8gZG8gc28uDQoNCg0KDQpXaGF0IGRvIHlvdSB0aGluaz8NCg0KDQoNCiAgIExlcw0KDQoN Cg== --_000_ec43e712e8024930831a206f8e843cbbXCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNv UGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglt c28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiUGxh aW4gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IlBsYWluIFRleHQiOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDEx LjBpbjsNCgltYXJnaW46MS4waW4gMTI5Ljc1cHQgMS4waW4gMTI5LjdwdDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVO LVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5Zb2F2IC08bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+VGhhbnggZm9yIHRoZSByZXZpZXcuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPkknbGwgcHJlZmFjZSBteSByZW1hcmtzIGJ5IHNheWluZyBJIGFtIGEgYmlnIGJlbGlldmVy IGluIG1vZHVsYXJpdHkuIElmIGEgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgYWxyZWFkeSBjb3Zl cmVkIGFuIGlzc3VlIEkgc3Ryb25nbHkgYmVsaWV2ZSB3ZSBhcmUgYmV0dGVyIG9mZiByZWZlcmVu Y2luZyB0aGF0IGRvY3VtZW50IHRoYW4gdHJ5aW5nIHRvIHJlcGVhdC9yZXN0YXRlIHdoYXQgdGhl IHJlZmVyZW5jZWQNCiBkb2N1bWVudCBoYXMgc2FpZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPlRoZXJlIGFyZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVu IHdoZW4gd2UgcmVwZWF0L3Jlc3RhdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjEp V2UgYXJlIHJlZHVuZGFudDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ MilXZSBpbnRyb2R1Y2UgYW1iaWd1aXR5PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk5l aXRoZXIgb2YgdGhlc2UgaXMgZGVzaXJhYmxlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij5SZXNwb25zZXMgaW5saW5lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IC0t LS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0 OyBGcm9tOiBZb2F2IE5pciAmbHQ7eW5pci5pZXRmQGdtYWlsLmNvbSZndDs8L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFNlbnQ6IFR1ZXNkYXksIE9jdG9iZXIgMTYsIDIwMTggMjox OCBQTTwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgVG86IHNlY2RpckBpZXRmLm9y ZzwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgQ2M6IGlkckBpZXRmLm9yZzsgaWV0 ZkBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgU3ViamVjdDogU2VjZGlyIGVhcmx5IHJldmlldyBv ZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij4mZ3Q7IDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgUmV2aWV3ZXI6IFlvYXYg TmlyPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBSZXZpZXcgcmVzdWx0OiBIYXMg Tml0czwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgPC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyBUaGlzIGlzIGFuIGVhcmx5IHJldmlldyB3aXRoIGEgc3BlY2lmaWMg cmVxdWVzdCB0byByZXZpZXcgdGhlIFNlY3VyaXR5PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+Jmd0OyBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBUaGUgZHJhZnQgYWRk cyBhIGJ1bmNoIG9mIFRMVnMgdG8gYmUgc2VudCBmcm9tIHJvdXRlcnMgcmVnYXJkaW5nIHRoZSBs aW5rPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBzdGF0ZSBvZiB0aGUgbGluayB1 c2VkIGZvciBJR1AuIFRoZSBkcmFmdCByZWZlcmVuY2VzIFJGQyA3NzUyIHdoaWNoIGRlZmluZWQ8 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IGVhcmxpZXIgVExWcyB1c2VkIHRvIGNh cnJ5IE5MUkkgKHJlYWNoYWJpbGl0eSkgaW5mb3JtYXRpb24uPC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OyA8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IFdoYXQgSSBm b3VuZCBkaWZmaWN1bHQgYWJvdXQgYm90aCA3NzUyIGFuZCB0aGlzIGRyYWZ0IGlzIHRoZSB2YWd1 ZW5lc3MgYWJvdXQ8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHdobyB0aGUgY29u c3VtZXIgb2YgdGhpcyBpbmZvcm1hdGlvbiBpcy4gVGhlIGFic3RyYWN0IG9mIDc3NTIgYmVnaW5z IGxpa2UgdGhpczo8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICZxdW90O0luIGEg bnVtYmVyIG9mIGVudmlyb25tZW50cywgYSBjb21wb25lbnQgZXh0ZXJuYWwgdG8gYSBuZXR3b3Jr IGlzIGNhbGxlZDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgdXBvbiB0byBwZXJm b3JtIGNvbXB1dGF0aW9ucyBiYXNlZCBvbiB0aGUgbmV0d29yayB0b3BvbG9neSBhbmQgY3VycmVu dDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgc3RhdGUgb2YgdGhlIGNvbm5lY3Rp b25zIHdpdGhpbiB0aGUgbmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJpbmc8L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IChURSkgaW5mb3JtYXRpb24uJnF1b3Q7IFRo ZXJlIGlzIGFsc28gYSBkaWFncmFtIHdpdGggaW5mb3JtYXRpb24gZmxvd2luZyB0byBhPC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyAmcXVvdDtjb25zdW1lciZxdW90OzwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0ROIGNv bnRyb2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj88L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij4mZ3Q7IDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+W0xlczpdIFRoZSBkaWFncmFtIHlvdSBh cmUgcmVmZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRvIGJlIGluIFJGQyA3NzUyIHNpbmNl IHRoZXJlIGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRyYWZ0LjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+V2hpY2ggbGVhZHMgbWUgdG8gc2F5IGlmIHlvdSBmZWVs IHRoaXMgaXMgaW5zdWZmaWNpZW50IHRoZW4gaXQgbmVlZHMgdG8gYmUgdGFrZW4gdXAgaW4gdGhl IGNvbnRleHQgb2YgUkZDIDc3NTIgLSBub3QgdGhpcyBkcmFmdC48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+SG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91IGFzIHdlbGwuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgT0suIE9uIHRvIHRoZSBTZWN1cml0eSBD b25zaWRlcmF0aW9ucyBzZWN0aW9uLiBJdCBiZWdpbnMgd2l0aCBhIHN0YXRlbWVudCB0aGF0PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGlzIGRvZXMgbm90IGFmZmVjdCB0aGUg c2VjdXJpdHkgbW9kZWwgb2YgQkdQLiZuYnNwOyBBbHRob3VnaCB0aGF0IGlzIGp1c3QgY2xhaW1l ZDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYW5kIG5vdCBzdXBwb3J0ZWQgaW4g dGV4dCwgaXQgc2VlbXMgcmVhc29uYWJsZS4gSSBzaG91bGQgbm90ZSB0aGF0IHRoaXM8L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHBhcmFncmFwaCBpcyBjb3BpZWQgZnJvbSA3NzUy LjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgPC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+Jmd0OyBUaGUgc2Vjb25kIChhbmQgbGFzdCkgcGFyYWdyYXBoIGluIHRoZSBzZWN1 cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIHRhbGtzPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyBhYm91dCB0aGUgbmV3IGF0dHJpYnV0ZXMuIEl0IG1lbnRpb25zIHRoYXQgc2Vj dXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIGFyZTwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgYXNzdW1lZCB0byBiZSB1c2VkIGp1c3QgYXMgaW4gUkZDcyA3ODEwIGFuZCA3NDcxLiBX aXRoIHByb3BlcjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYXV0aGVudGljYXRp b24gdGhpcyBpbmZvcm1hdGlvbiBpcyBub3Qgc2VudCBleGNlcHQgdG8gdGhlIHByb3BlciBjb25z dW1lci48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IEhvd2V2ZXIsIHRoZXJlIGlz IGFuIGltcG9ydGFudCBkaWZmZXJlbmNlIHRoYXQgSSB0aGluayBuZWVkcyB0byBiZTwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgYWRkcmVzc2VkLiA3ODEwIGFuZCA3NDcxIGFyZSBh Ym91dCBJUy1JUyBhbmQgT1NQRiByZXNwZWN0aXZlbHkuIFRoZXJlPC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+Jmd0OyByb3V0aW5nIHByb3RvY29scyBhcmUgdHlwaWNhbGx5IHVzZWQgaW4g Y2xvc2VkIGVudmlyb25tZW50cywgYW5kIHRoZSBTZWN1cml0eTwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsgQ29uc2lkZXJhdGlvbnMgb2YgNzgxMCBzdGF0ZSB0aGF0IGV4cGxpY2l0 bHkuIEJHUCAodGhlIHN1YmplY3Qgb2YgdGhpczwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PiZndDsgZG9jdW1lbnQpIGlzIGRpZmZlcmVudCBpbiB0aGF0IGl0IGlzIHR5cGljYWxseSB1c2Vk IGFsbCBvdmVyIHRoZSBJbnRlcm5ldC4gV2l0aG91dDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPiZndDsgZnVydGhlciBjbGFyaXR5IGFib3V0IHdobyBhbmQgd2hlcmUgdGhlICZxdW90O2Nv bnN1bWVyJnF1b3Q7IGlzLCBpdCBoYXMgdG8gYmUgYXNzdW1lZDwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPiZndDsgdGhhdCB0aGUgaW5mb3JtYXRpb24gbWlnaHQgYXQgbGVhc3QgbGVhayBv dXQuPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+W0xlczpdIEkgdGhpbmsgeW91IGhhdmUgbWlzaW50 ZXJwcmV0ZWQgdGhpcyBwYXJhZ3JhcGguIChlbXBoYXNpcyBhZGRlZCBiZWxvdyk8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+JnF1b3Q7IFRoZSBJR1A8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBpbnN0YW5jZXMgb3JpZ2luYXRpbmcgdGhl c2UgVExWcyBhcmUgYXNzdW1lZCB0byBoYXZlIGFsbCB0aGUgcmVxdWlyZWQ8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZuYnNwOyZuYnNwOyBzZWN1cml0eSBhbmQgYXV0 aGVudGljYXRpb24gbWVjaGFuaXNtIChhcyBkZXNjcmliZWQgaW4gW1JGQzc4MTBdIGFuZDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jm5ic3A7Jm5ic3A7IFtSRkM3NDcx XSkgaW4gb3JkZXIgdG8gcHJldmVudCBhbnkgc2VjdXJpdHkgaXNzdWUgPGI+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZCI+d2hlbiBwcm9wYWdhdGluZzxvOnA+PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4mbmJzcDsm bmJzcDsgdGhlIFRMVnMgaW50byBCR1AtTFMuPC9zcGFuPjwvYj4mcXVvdDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+V2hhdCB3ZSBhcmUgc3RhdGluZyBoZXJlIGlzIHRoYXQgd2hlbiB0 aGUgSUdQIGFkdmVydGlzZW1lbnRzIGFyZSBzZW50IHRoZSBzZWN1cml0eS9hdXRoZW50aWNhdGlv biBtZWNoYW5pc21zIHNwZWNpZmllZCBpbiB0aGUgSUdQIGRyYWZ0cyBhcHBsaWVzLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGhpcyBpcyBOT1QgdHJ5aW5nIHRvIGFw cGx5IFJGQzc4MTAvUkZDNzQ3MSB0byB0aGUgbmV3IEJHUCBhZHZlcnRpc2VtZW50cy48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlRoZSBzZWN1cml0eSBpc3N1ZXMgcmVs YXRlZCB0byB0aGUgbmV3IEJHUCBhZHZlcnRpc2VtZW50cyBhcmUgZGlzY3Vzc2VkIGluIHRoZSBw cmV2aW91cyBwYXJhZ3JhcGguPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgQW5vdGhlciBpc3N1ZSBJIGhhdmUgd2l0aCB0aGlz IHNlY3Rpb24gaXMgdGhhdCB0aGUgZHJhZnQgc3BlY2lmaWVzIGhvdyB0byBzZW5kPC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBuZXcgaW5mb3JtYXRpb24gKHRoZSBsaW5rIHN0YXRl IFRMVnMpIGZyb20gb25lIG5vZGUgdG8gYW5vdGhlci4gVGhpcyBpczwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPiZndDsgaW5mb3JtYXRpb24gdGhhdCB3YXMgbm90IHNlbnQgYmVmb3JlLiBX aGVuIGEgY2hhbmdlIGxpa2UgdGhhdCBpcyBtYWRlLCBJPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Jmd0OyB0aGluayB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgc2VjdGlvbiBzaG91 bGQganVzdGlmeSB3aHkgaXQgaXMgT0sgdG88L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4m Z3Q7IGRpc3RyaWJ1dGUgdGhpcyBpbmZvcm1hdGlvbi4gVHlwaWNhbGx5IHlvdSBuZWVkIHRvIGp1 c3RpZnkgdGhhdCBsZWFraW5nIHRoaXM8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7 IGluZm9ybWF0aW9uICh0byB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IG9yIHRvIHRoZSByZXN0IG9m IHRoZSB3b3JsZCkgZG9lcyBub3Q8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7ICgx KSBtYWtlIGl0IGVhc2llciB0byBhdHRhY2sgc29tZSBwYXJ0IG9mIHRoZSBzeXN0ZW0sIG9yICgy KSBkaXN0cmlidXRlczwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPiZndDsgcHJpdmFjeS1z ZW5zaXRpdmUgaW5mb3JtYXRpb24sIG9yICgzKSB1bmRlcm1pbmVzIHNvbWUgb3RoZXIgY29uZmlk ZW50aWFsaXR5PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBpbnRlcmVzdC4gSSB0 aGluayBpdCdzIGZhaXJseSBlYXN5IHRvIG1ha2UgdGhlIGFyZ3VtZW50IHRoYXQgdGhlIGluZm9y bWF0aW9uIGluPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyB0aGVzZSBUTFZzIGRv ZXMgbm90IGRvIGFueSBvZiB0aGUgYWJvdmUsIGJ1dCB0aGUgYXJndW1lbnQgc2hvdWxkIGJlIG1h ZGUuPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+Jmd0OyBUaGUgbGFzdCBwYXJhZ3JhcGgg aW4gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2YgUkZDIDc3NTIgaGFzIGp1 c3Q8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4mZ3Q7IHN1Y2ggYW4gYXJndW1lbnQuPC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48Yj48aT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPltMZXM8L3Nw YW4+PC9pPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjpdIFNlY3VyaXR5IHNlY3Rpb25z IGluIFJGQzc4MTAvUkZDNzQ3MSBkaXJlY3RseSBhZGRyZXNzIHRoaXMgcG9pbnQuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj5XRSBjb3VsZCByZXBlYXQgc29tZSBvZiB0aGF0IGhlcmUg4oCTIGJ1dCBhcyBwZXIg bXkg4oCcb3BlbmluZyBzdGF0ZW1lbnTigJ0gSSBhbSByZWx1Y3RhbnQgdG8gZG8gc28uPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPldoYXQgZG8geW91IHRoaW5rPzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIHN0eWxlPSJj b2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgTGVzPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4N CjwvaHRtbD4NCg== --_000_ec43e712e8024930831a206f8e843cbbXCHALN001ciscocom_-- From nobody Wed Oct 17 01:28:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28524130E97 for ; Wed, 17 Oct 2018 01:28:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.363 X-Spam-Level: X-Spam-Status: No, score=-4.363 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KKlthBBEWEG for ; Wed, 17 Oct 2018 01:28:31 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D984130EA4 for ; Wed, 17 Oct 2018 01:28:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1539764906; x=1542356906; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=0SC1NrKOtNdcJPB3pCDe0nl15NYnAlXfhxXhDZWcPsA=; b=RpCYkOmV1D3q7EgX2WjpyTfANr5fmWo1X3Kw8N3o9np008tKB1yQQxZUYVUOKqFr fZQZ9XIZ9nUxyI+Sq0pwqo7uhkbsAlzmrYpUU/alIKwS8uka5B02IuKFCVqQ2vpc VWsaGwIw6AOpJr9sLkYv4WQDeE95o/EtbXU9E036xqU=; X-AuditID: c1b4fb2d-b37ff70000003a27-06-5bc6f2aa0cc2 Received: from ESESSMB505.ericsson.se (Unknown_Domain [153.88.183.123]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id EE.55.14887.AA2F6CB5; Wed, 17 Oct 2018 10:28:26 +0200 (CEST) Received: from ESESSMR502.ericsson.se (153.88.183.110) by ESESSMB505.ericsson.se (153.88.183.123) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 17 Oct 2018 10:28:26 +0200 Received: from ESESSMB502.ericsson.se (153.88.183.163) by ESESSMR502.ericsson.se (153.88.183.110) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 17 Oct 2018 10:28:26 +0200 Received: from [131.160.183.116] (153.88.183.153) by smtp.internal.ericsson.com (153.88.183.190) with Microsoft SMTP Server id 15.1.1466.3 via Frontend Transport; Wed, 17 Oct 2018 10:28:25 +0200 References: To: Daniel Harkins CC: "iesg@ietf.org" , "secdir@ietf.org" , , DetNet WG From: =?UTF-8?Q?J=c3=a1nos_Farkas?= X-Forwarded-Message-Id: Message-ID: Date: Wed, 17 Oct 2018 10:28:25 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------7CA1B052BC73CFD1832EC37D" Content-Language: en-US X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFIsWRmVeSWpSXmKPExsUyM2J7te6qT8eiDSYek7f4/Wk2i8XSf19Y LPbN2sRiMePPRGaLDwsfsjiweixZ8pPJ49nulywBTFFcNimpOZllqUX6dglcGYf2yxa8dql4 c2YnSwPjYdMuRk4OCQETiXdNL1i6GLk4hASOMkosv/WeCcL5xijx4sUlBOfM7LVQZccYJfbO mckM0i8sYC/RdWMCE4gtBGTfW/gZzBYR0JDo3LaYDaSBWWAao8SUm4/YQRJsQEV3L21ghlju LbFo8lFGEJsXKH7x33GwZhYBVYnLnZ/YQGxRgViJT1cWM0PUCEqcnPmEBcTmFHCQeLt+FVgv s0CYxJ4/R9kgbHGJW0/mQx2kJvG+4Q7jBEbhWUjaZyFpmYWkBcK2kJg5/zwjhC0v0bx1NjOE rSHROmcuO7L4Akb2VYyixanFxbnpRsZ6qUWZycXF+Xl6eaklmxiBMXZwy2/dHYyrXzseYhTg YFTi4Y38eCxaiDWxrLgy9xCjBAezkghv5mKgEG9KYmVValF+fFFpTmrxIUZpDhYlcV69VXui hATSE0tSs1NTC1KLYLJMHJxSDYwGSz0PsQU+itgVdK3Xxu75plZOl/RLy6w+N5k4b9RZ4Ccw 4e+0wIjPea4JHo8WSfyVuuB9n30P94NN289Mdlm7ZrFWzOrEPIcP3dO6T512T/35y+bxmamX dznO8Erw33j3VuMcGb2l5q809L/bXdX43N62ctL9d2ypr4JedijnrGuvZbkbwSCpxFKckWio xVxUnAgASQl7b60CAAA= Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-detnet-architecture-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2018 08:28:34 -0000 --------------7CA1B052BC73CFD1832EC37D Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit Hi Daniel, Thank you very much for your review! Please find below how we plan to update the draft to address your comments. Best regards, Janos On 9/25/2018 2:58 AM, Daniel Harkins wrote: > >   Hello, > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > The summary of the review is ready with issues. > > This draft describes an architecture for deterministic networking > that provides for delivery of packet flows with low packet loss and > with a maximum amount of latency. > > A nit first. The terminology seems a bit overblown. We have DetNet > Intermediate nodes that could be relay nodes or transit nodes; and a > DetNet system that is a DetNet aware system or transit node or > relay node; and DetNet edge nodes that are relay nodes; and DetNet > relay nodes that can be bridges, firewalls, or anything else that > participates in DetNet. Finally, to translate between 802.1 TSN and > DetNet we have a "relay system" that is an 802.1 term for a DetNet > intermediate node which, as we have seen, is a DetNet relay node. This > can be simplified considerably. The definition of DetNet relay node will be updated. "A DetNet relay node can be a bridge, a router, a firewall, or any other system" will be delated. OLD: A DetNet node including a service layer function that interconnects different DetNet transport layer paths to provide service protection. A DetNet relay node can be a bridge, a router, a firewall, or any other system that participates in the DetNet service layer. It typically incorporates DetNet transport layer functions as well, in which case it is collocated with a transit node. NEW: A DetNet node including a service layer function that interconnects different DetNet transport layer paths to provide service protection. A DetNet relay node operates at the service layer. It typically incorporates DetNet transport layer functions as well, in which case it is collocated with a DetNet transit node. > The Security Considerations is thin, especially for an architecture > draft that is going to be referred to by subsequent drafts which will > just say something along the lines of, "as an instance of the DetNet > FooBar, these Security Considerations are those from [ARCH]", where > ARCH is the RFC that comes out of this I-D. I think there needs to be > a description of the various points in the architecture that an attacker > could exploit, and if a point is not exploitable it should say so. For > instance: > > - is it possible for an attacker to launch a DoS attack by manipulating > member flows of a DetNet flow in order to force DetNet nodes to > consume buffers they allocated to deal with the DetNet flow? > > - If an end system is not DetNet aware there needs to be a DetNet edge > node to handle the encaps of the flow into the DetNet system. Can an > attacker in that case introduce packets that shouldn't be part of the > DetNet flow into the flow by getting the edge node to encaps them as > such? > > If there are any assumptions being made-- e.g. "insider attacks are not > being considered"-- they should be mentioned. > > regards, > > Dan. > > Security issues and considerations are addressed by the DetNet Security draft: https://datatracker.ietf.org/doc/draft-ietf-detnet-security. Reference will be added to the DetNet security document. --------------7CA1B052BC73CFD1832EC37D Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 8bit Hi Daniel,

Thank you very much for your review!

Please find below how we plan to update the draft to address your comments.

Best regards,
Janos


On 9/25/2018 2:58 AM, Daniel Harkins wrote:
 
  Hello,
  I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

  The summary of the review is ready with issues.

  This draft describes an architecture for deterministic networking
that provides for delivery of packet flows with low packet loss and
with a maximum amount of latency. 

  A nit first. The terminology seems a bit overblown. We have DetNet
Intermediate nodes that could be relay nodes or transit nodes; and a
DetNet system that is a DetNet aware system or transit node or
relay node; and DetNet edge nodes that are relay nodes; and DetNet
relay nodes that can be bridges, firewalls, or anything else that
participates in DetNet. Finally, to translate between 802.1 TSN and
DetNet we have a "relay system" that is an 802.1 term for a DetNet
intermediate node which, as we have seen, is a DetNet relay node. This
can be simplified considerably.
The definition of DetNet relay node will be updated.
"A DetNet relay node can be a bridge, a router, a firewall, or any other system" will be delated.

OLD:
A DetNet node including a service layer function that
interconnects different DetNet transport layer paths to
provide service protection. A DetNet relay node can be a
bridge, a router, a firewall, or any other system that
participates in the DetNet service layer. It typically
incorporates DetNet transport layer functions as well, in
which case it is collocated with a transit node.

NEW:
A DetNet node including a service layer function that
interconnects different DetNet transport layer paths to
provide service protection. A DetNet relay node operates
at the service layer. It typically incorporates DetNet
transport layer functions as well, in which case it is
collocated with a DetNet transit node.



  The Security Considerations is thin, especially for an architecture
draft that is going to be referred to by subsequent drafts which will
just say something along the lines of, "as an instance of the DetNet
FooBar, these Security Considerations are those from [ARCH]", where
ARCH is the RFC that comes out of this I-D. I think there needs to be
a description of the various points in the architecture that an attacker
could exploit, and if a point is not exploitable it should say so. For
instance:

  - is it possible for an attacker to launch a DoS attack by manipulating
    member flows of a DetNet flow in order to force DetNet nodes to
    consume buffers they allocated to deal with the DetNet flow?

  - If an end system is not DetNet aware there needs to be a DetNet edge
    node to handle the encaps of the flow into the DetNet system. Can an
    attacker in that case introduce packets that shouldn't be part of the
    DetNet flow into the flow by getting the edge node to encaps them as
    such?

If there are any assumptions being made-- e.g. "insider attacks are not
being considered"-- they should be mentioned. 

  regards,

  Dan.

Security issues and considerations are addressed by the DetNet Security draft: https://datatracker.ietf.org/doc/draft-ietf-detnet-security.
Reference will be added to the DetNet security document.
--------------7CA1B052BC73CFD1832EC37D-- From nobody Wed Oct 17 11:14:14 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A794F130E01; Wed, 17 Oct 2018 11:13:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WAyMLsdB93bt; Wed, 17 Oct 2018 11:13:56 -0700 (PDT) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 023E6130DEF; Wed, 17 Oct 2018 11:13:53 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id y144-v6so3146611wmd.4; Wed, 17 Oct 2018 11:13:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Hjz8lH7t8q+vWJyyP9M16xC0rGk2E5tEhPas+tppiA0=; b=s4gppmyOavNNwWiB1cSuOUzCaLgUhSvrk52A+goePytJyAeGA9Lol6HCiP+MyYGaXT KHU3+KyNNz11HcwMxS7y8npzEbeGRGt5T3cQzT8Z8/JaFBOu8uDynxMmQgI8CRiWNMW3 npNoQ03asDQcpqQcWwXhV1P+xEDzTqIEzDXK93ds2FAiUbDHk2DoGpHw4JXdUdA7CDfe xEcAvnmE9Qx0k+oV9RkpAXb3whzTEI0AlJrit4+mQ6/A5EOISYHRlPPlHXuhqDebdFq1 W3GYPHGn0SO4CR1IUsOg82+gKQVhqn/xDV/tcG2cvSyc+Aacv1BaglKS8i2O3CG0AYvx Eprw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Hjz8lH7t8q+vWJyyP9M16xC0rGk2E5tEhPas+tppiA0=; b=VZ4S0XH9PBsP48XMUPUxY2bUoFn3IRpFVX4XmnzEAbEWyfupAzOb7Cen7yl6pUlFlK 6cEL98a9DcNdxgrKpRh8sAuQQddY5P8bkfeGvwhBkakVkx8pggjKeqNHqa4MXUPkMWu7 tV8r58PNucOF3iWRR8ukBbla/mCjlMdsRPKsKu+kr/1dkSjo5iIylS5M2tOgK4HjUiF8 Z9bZ/5dhAHhQ6YwUv0WJrMf4xxwiL9J2QdDfKB1vW2oZdW34QtKotk/oz69TZwPxxYOa K4s8ZL/IY8kXDCZoFulVfgT8A7L8lQLBcZFWo7jIwOvbiEcLjKVzLB3qjgTecVX29Hx1 nUGQ== X-Gm-Message-State: ABuFfoiJbuofqtO5onsR7M6qMkAObSAhJf8DtY2SYi52rrWEAEqwHTgs MdNHC6AwOMpJv78EftwtRN0= X-Google-Smtp-Source: ACcGV6310RL9ndwrenvqsTAgOR2Bf3IxU7Yy1yeElVXLJpeaJ5pwvtSDXRQ1zXtnQi/8cT3kL/J+uw== X-Received: by 2002:a1c:ed07:: with SMTP id l7-v6mr3934304wmh.47.1539800031372; Wed, 17 Oct 2018 11:13:51 -0700 (PDT) Received: from [192.168.1.12] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id 199-v6sm1505928wme.39.2018.10.17.11.13.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 17 Oct 2018 11:13:50 -0700 (PDT) From: Yoav Nir Message-Id: <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_08A44EF3-9DA9-4B04-8A18-4A3E07AA7054" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Wed, 17 Oct 2018 21:13:47 +0300 In-Reply-To: Cc: "secdir@ietf.org" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" To: "Les Ginsberg (ginsberg)" References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2018 18:13:59 -0000 --Apple-Mail=_08A44EF3-9DA9-4B04-8A18-4A3E07AA7054 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, Les. I agree that my diagram comment is directed mostly at 7752. However, the = RFCs that we produce are intended to be readable by the general = technical community, not just the experts in the working group. For the = same reason that we are required to expand acronyms on first use, I = think it makes sense for a document that describes new information being = sent to identify the target. I will drop this point, though, because it = is a general comment rather than a secdir issue. I agree about not needing to repeat information that is already stated = elsewhere, but you do need to point to it, as you do with the general = security model of BGP (first paragraph), and as you do with the = paragraph describing how the transport of attributes is secured (second = paragraph). That part is fine.=20 RFC 7810 and 7471 describe the new information to be sent, but they are = about IS-IS and OSPF. The Security considerations section in 7810 = contains the following text: "It is anticipated that in most = deployments, the IS-IS protocol is used within an infrastructure = entirely under control of the same operator.=E2=80=9D and continues to = discuss MITM attacks if this is not the case. Can the same assumption = be made about BGP? That is the part that I think is missing. Either = state that where BGP-LS is used the assumption can be made, or justify = why there is no risk even when the information is propagated to = infrastructure that is not under control of a single operator. The = difference between BGP and either IS-IS or OSPF is not part of those = other documents, so IMO it should be stated here. Yoav > On 17 Oct 2018, at 2:52, Les Ginsberg (ginsberg) = wrote: >=20 > Yoav - > =20 > Thanx for the review. > =20 > I'll preface my remarks by saying I am a big believer in modularity. = If a referenced document has already covered an issue I strongly believe = we are better off referencing that document than trying to = repeat/restate what the referenced document has said. > There are only two things that can happen when we repeat/restate: > =20 > 1)We are redundant > 2)We introduce ambiguity > =20 > Neither of these is desirable. > =20 > Responses inline. > =20 > > -----Original Message----- > > From: Yoav Nir > > > Sent: Tuesday, October 16, 2018 2:18 PM > > To: secdir@ietf.org > > Cc: idr@ietf.org ; ietf@ietf.org = ; draft-ietf-idr-te-pm-bgp.all@ietf.org = > > Subject: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > > > > Reviewer: Yoav Nir > > Review result: Has Nits > > > > This is an early review with a specific request to review the = Security > > Considerations section. > > > > The draft adds a bunch of TLVs to be sent from routers regarding the = link > > state of the link used for IGP. The draft references RFC 7752 which = defined > > earlier TLVs used to carry NLRI (reachability) information. > > > > What I found difficult about both 7752 and this draft is the = vagueness about > > who the consumer of this information is. The abstract of 7752 begins = like this: > > "In a number of environments, a component external to a network is = called > > upon to perform computations based on the network topology and = current > > state of the connections within the network, including Traffic = Engineering > > (TE) information." There is also a diagram with information flowing = to a > > "consumer" > > and that's it. Is it an SDN controller? Some kind of application? > > > =20 > [Les:] The diagram you are referring to seems most likely to be in RFC = 7752 since there is no such diagram in this draft. > Which leads me to say if you feel this is insufficient then it needs = to be taken up in the context of RFC 7752 - not this draft. > =20 > Hopefully this makes sense to you as well. > =20 > > OK. On to the Security Considerations section. It begins with a = statement that > > this does not affect the security model of BGP. Although that is = just claimed > > and not supported in text, it seems reasonable. I should note that = this > > paragraph is copied from 7752. > > > > The second (and last) paragraph in the security considerations = section talks > > about the new attributes. It mentions that security and = authentication are > > assumed to be used just as in RFCs 7810 and 7471. With proper > > authentication this information is not sent except to the proper = consumer. > > However, there is an important difference that I think needs to be > > addressed. 7810 and 7471 are about IS-IS and OSPF respectively. = There > > routing protocols are typically used in closed environments, and the = Security > > Considerations of 7810 state that explicitly. BGP (the subject of = this > > document) is different in that it is typically used all over the = Internet. Without > > further clarity about who and where the "consumer" is, it has to be = assumed > > that the information might at least leak out. > >=20 > [Les:] I think you have misinterpreted this paragraph. (emphasis added = below) > =20 > " The IGP > instances originating these TLVs are assumed to have all the = required > security and authentication mechanism (as described in [RFC7810] = and > [RFC7471]) in order to prevent any security issue when propagating > the TLVs into BGP-LS." > =20 > What we are stating here is that when the IGP advertisements are sent = the security/authentication mechanisms specified in the IGP drafts = applies. > This is NOT trying to apply RFC7810/RFC7471 to the new BGP = advertisements. > The security issues related to the new BGP advertisements are = discussed in the previous paragraph. > =20 > > Another issue I have with this section is that the draft specifies = how to send > > new information (the link state TLVs) from one node to another. This = is > > information that was not sent before. When a change like that is = made, I > > think the Security Considerations section should justify why it is = OK to > > distribute this information. Typically you need to justify that = leaking this > > information (to the intended recipient or to the rest of the world) = does not > > (1) make it easier to attack some part of the system, or (2) = distributes > > privacy-sensitive information, or (3) undermines some other = confidentiality > > interest. I think it's fairly easy to make the argument that the = information in > > these TLVs does not do any of the above, but the argument should be = made. > > The last paragraph in the Security Considerations section of RFC = 7752 has just > > such an argument. > =20 > [Les:] Security sections in RFC7810/RFC7471 directly address this = point. > WE could repeat some of that here =E2=80=93 but as per my =E2=80=9Copeni= ng statement=E2=80=9D I am reluctant to do so. > =20 > What do you think? > =20 > Les --Apple-Mail=_08A44EF3-9DA9-4B04-8A18-4A3E07AA7054 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi, = Les.

I agree that my = diagram comment is directed mostly at 7752. However, the RFCs that we = produce are intended to be readable by the general technical community, = not just the experts in the working group. For the same reason that we = are required to expand acronyms on first use, I think it makes sense for = a document that describes new information being sent to identify the = target. I will drop this point, though, because it is a general comment = rather than a secdir issue.

I agree about not needing to repeat information that is = already stated elsewhere, but you do need to point to it, as you do with = the general security model of BGP (first paragraph), and as you do with = the paragraph describing how the transport of attributes is secured = (second paragraph). That part is fine. 

RFC 7810 and 7471 describe the new = information to be sent, but they are about IS-IS and OSPF. The Security = considerations section in 7810 contains the following text: "It is = anticipated that in most deployments, the IS-IS protocol is used within = an infrastructure entirely under control of the same operator.=E2=80=9D = and continues to discuss MITM attacks if this is not the case.  Can = the same assumption be made about BGP?  That is the part that I = think is missing. Either state that where BGP-LS is used the assumption = can be made, or justify why there is no risk even when the information = is propagated to infrastructure that is not under control of a single = operator.   The difference between BGP and either IS-IS or OSPF is = not part of those other documents, so IMO it should be stated = here.

Yoav

On 17 Oct 2018, at 2:52, Les Ginsberg (ginsberg) <ginsberg@cisco.com> = wrote:

Yoav = -
 
Thanx for = the review.
 
I'll preface my remarks by saying I am a big believer in = modularity. If a referenced document has already covered an issue I = strongly believe we are better off referencing that document than trying = to repeat/restate what the referenced document has said.
There are = only two things that can happen when we repeat/restate:
 
1)We are = redundant
2)We introduce ambiguity
 
Neither of these is desirable.
 
Responses = inline.
 
> -----Original Message-----
> From: Yoav Nir <ynir.ietf@gmail.com>
> Sent: Tuesday, October 16, 2018 2:18 PM
> To: secdir@ietf.org
> Subject: Secdir early review of = draft-ietf-idr-te-pm-bgp-13
>
> Reviewer: Yoav = Nir
> Review result: Has = Nits
>
> This is an early review with a = specific request to review the Security
> Considerations section.
>
> The draft adds = a bunch of TLVs to be sent from routers regarding the link
> state of the link used for IGP. = The draft references RFC 7752 which defined
> earlier TLVs used to carry NLRI (reachability) = information.
>
> What I found difficult about both = 7752 and this draft is the vagueness about
> who the consumer of this information is. The abstract of = 7752 begins like this:
> "In = a number of environments, a component external to a network is = called
> upon to perform = computations based on the network topology and current
> state of the connections within = the network, including Traffic Engineering
> (TE) information." There is also a diagram with = information flowing to a
> = "consumer"
> and that's it. Is it = an SDN controller? Some kind of application?
>
 
[Les:] = The diagram you are referring to seems most likely to be in RFC 7752 = since there is no such diagram in this draft.
Which = leads me to say if you feel this is insufficient then it needs to be = taken up in the context of RFC 7752 - not this draft.
 
Hopefully = this makes sense to you as well.
 
> OK. On to the Security = Considerations section. It begins with a statement that
> this does not affect the security = model of BGP.  Although that is just claimed
> and not supported in text, it = seems reasonable. I should note that this
> paragraph is copied from 7752.
>
> The second (and = last) paragraph in the security considerations section talks
> about the new attributes. It = mentions that security and authentication are
> assumed to be used just as in RFCs 7810 and 7471. With = proper
> authentication this = information is not sent except to the proper consumer.
> However, there is an important = difference that I think needs to be
> addressed. 7810 and 7471 are about IS-IS and OSPF = respectively. There
> = routing protocols are typically used in closed environments, and the = Security
> Considerations of = 7810 state that explicitly. BGP (the subject of this
> document) is different in that it = is typically used all over the Internet. Without
> further clarity about who and = where the "consumer" is, it has to be assumed
> that the information might at least leak out.
> 
[Les:] I = think you have misinterpreted this paragraph. (emphasis added below)
 
" The = IGP
   instances originating these TLVs are assumed to = have all the required
   security and authentication mechanism (as = described in [RFC7810] and
   [RFC7471]) in order to = prevent any security issue when propagating
   the TLVs into BGP-LS."
 
What we = are stating here is that when the IGP advertisements are sent the = security/authentication mechanisms specified in the IGP drafts = applies.
This is NOT trying to apply RFC7810/RFC7471 to the new BGP = advertisements.
The security issues related to the new BGP advertisements are = discussed in the previous paragraph.
 

> Another issue I have with this section is that the draft = specifies how to send
> new = information (the link state TLVs) from one node to another. This = is
> information that was = not sent before. When a change like that is made, I
> think the Security Considerations = section should justify why it is OK to
> distribute this information. Typically you need to = justify that leaking this
> = information (to the intended recipient or to the rest of the world) does = not
> (1) make it easier to = attack some part of the system, or (2) distributes
> privacy-sensitive information, or = (3) undermines some other confidentiality
> interest. I think it's fairly easy to make the argument = that the information in
> = these TLVs does not do any of the above, but the argument should be = made.
> The last paragraph in = the Security Considerations section of RFC 7752 has just
> such an argument.
 
[Les:] = Security sections in RFC7810/RFC7471 directly address this point.
WE could repeat some of that here =E2=80=93 but as = per my =E2=80=9Copening statement=E2=80=9D I am reluctant to do so.
 
What do you = think?
 
   = Les

= --Apple-Mail=_08A44EF3-9DA9-4B04-8A18-4A3E07AA7054-- From nobody Wed Oct 17 11:27:15 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E959130DEF; Wed, 17 Oct 2018 11:27:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Aanchal Malhotra To: Cc: clue@ietf.org, ietf@ietf.org, draft-ietf-clue-protocol.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153980082742.27596.4827797666040033929@ietfa.amsl.com> Date: Wed, 17 Oct 2018 11:27:07 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-clue-protocol-17 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2018 18:27:07 -0000 Reviewer: Aanchal Malhotra Review result: Not Ready Reviewer: Aanchal Malhotra. Review Result: Ready Two points: 1) The Security Considerations section of the draft-ietf-clue-protocol mostly references back to the I-D.ietf-clue-framework, I-D.ietf-clue-data-model-schema and I-D.ietf-clue-datachannel. So the fate of this document depends on the approval of all other CLUE related documents that it references. 2) Clarification: There is one new threat introduced in the security considerations section of this document whose proposed solution is not clear to me. Following is the text: "...In theory an implementation could choose not to announce all of the versions it supports if it wants to avoid such leakage, though at the expenses of interoperability. With respect to the above considerations, it is noted that the OPTIONS state is only reached after the CLUE data channel has been successfully set up. This ensures that only authenticated parties can exchange 'options' and related 'optionsResponse' messages and hence drastically reduces the attack surface which is exposed to malicious parties." Question: If a participant CP1 does not announce all of the versions it supports to CP2, does not that imply the same threat/attack from CP1 that you are trying to avoid from CP2? In other words, CP1 could force CP2 to use a non-up-to-date version of the protocol or the one that it knows how to break. Am I missing something here? From nobody Wed Oct 17 11:47:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78559130E11; Wed, 17 Oct 2018 11:47:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.88 X-Spam-Level: X-Spam-Status: No, score=-1.88 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VMdaPReyzaYq; Wed, 17 Oct 2018 11:47:41 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14920130DD7; Wed, 17 Oct 2018 11:47:38 -0700 (PDT) Received: from Svantevit.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w9HIlZVn022868 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 17 Oct 2018 13:47:36 -0500 (CDT) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Svantevit.local To: Aanchal Malhotra , secdir@ietf.org Cc: draft-ietf-clue-protocol.all@ietf.org References: <153980082742.27596.4827797666040033929@ietfa.amsl.com> From: Adam Roach Message-ID: <5504885e-289a-6569-0c1c-dfbdc92f386c@nostrum.com> Date: Wed, 17 Oct 2018 13:47:30 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 MIME-Version: 1.0 In-Reply-To: <153980082742.27596.4827797666040033929@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-clue-protocol-17 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2018 18:47:43 -0000 Dropping ietf@ and clue@ Thank you very much for your review, Aanchal. Your service on the secdir is very much appreciated. I have one request for clarification, below. On 10/17/18 1:27 PM, Aanchal Malhotra wrote: > Reviewer: Aanchal Malhotra > Review result: Not Ready > > Reviewer: Aanchal Malhotra. > Review Result: Ready The text above is ambiguous, and the information in the tracker is similarly confused (the metadata says "not ready," but the review text itself says "ready").  Can you please adjust the data in the tracker and send out a correction to your initial message that clarifies which result you intended? Thanks. /a From nobody Wed Oct 17 12:40:34 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64649130EED; Wed, 17 Oct 2018 12:40:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.563 X-Spam-Level: X-Spam-Status: No, score=-14.563 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4byzUBSnGCFD; Wed, 17 Oct 2018 12:40:16 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8F52130D7A; Wed, 17 Oct 2018 12:40:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=50104; q=dns/txt; s=iport; t=1539805215; x=1541014815; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=OOY0U36qQv6HX58pOvWhM5bNVwpid9Nr31xv99m5Wis=; b=Y2Hm9Js0VNsj582XPJfaabL++mIfxulOL2tfMHfA2GDXJg2REpRK8IUo Cbhzl64FQiv6Tm1QOKmV0efDInjvTvAYDyp43fAWeJx9g6mvvdBN02lzi tioS125caBYG/XHlwBPBz7IsWXjjLa4fJ8Tzu6ABHqtwu5IMrvDOrW8WF g=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AMAAA0j8db/51dJa1ZChoBAQEBAQI?= =?us-ascii?q?BAQEBBwIBAQEBgVEFAQEBAQsBgQ1IL2Z/KAqDa4gXjBqCDXqHfI4WgXoLAQG?= =?us-ascii?q?EbAIXhGUVDDQNDQEDAQECAQECbSiFOQEBAQECASMKPg4FBwQCAQgOAwQBASE?= =?us-ascii?q?BBgMCAgIfERQJCAIEDgUIDIMNgR1MAw0IpgmBLodzDYIYiQSBK4EdF4FBPyZ?= =?us-ascii?q?rAYJdNYJWgX1CDxCCTYJXAo4qhg6JSy4JAolvg06DHB+QIo0+iFYCERSBJh0?= =?us-ascii?q?4gVVwFYMngiYXjhlvimuBHwEB?= X-IronPort-AV: E=Sophos;i="5.54,393,1534809600"; d="scan'208,217";a="467950929" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Oct 2018 19:40:13 +0000 Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id w9HJeDsS005964 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 17 Oct 2018 19:40:13 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 17 Oct 2018 14:40:13 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Wed, 17 Oct 2018 14:40:13 -0500 From: "Les Ginsberg (ginsberg)" To: Yoav Nir CC: "secdir@ietf.org" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" Thread-Topic: Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoA== Date: Wed, 17 Oct 2018 19:40:12 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> In-Reply-To: <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_feec42a72bd64f31afbcb3b340dad52bXCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.11, xch-rcd-001.cisco.com X-Outbound-Node: rcdn-core-6.cisco.com Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2018 19:40:20 -0000 --_000_feec42a72bd64f31afbcb3b340dad52bXCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW9hdiDigJMNCg0KSSB0aGluayB3ZSBhcmUgY29udmVyZ2luZy4NCklubGluZS4NCg0KRnJvbTog WW9hdiBOaXIgPHluaXIuaWV0ZkBnbWFpbC5jb20+DQpTZW50OiBXZWRuZXNkYXksIE9jdG9iZXIg MTcsIDIwMTggMTE6MTQgQU0NClRvOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdA Y2lzY28uY29tPg0KQ2M6IHNlY2RpckBpZXRmLm9yZzsgaWRyQGlldGYub3JnOyBpZXRmQGlldGYu b3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnDQpTdWJqZWN0OiBSZTog U2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KSGks IExlcy4NCg0KSSBhZ3JlZSB0aGF0IG15IGRpYWdyYW0gY29tbWVudCBpcyBkaXJlY3RlZCBtb3N0 bHkgYXQgNzc1Mi4gSG93ZXZlciwgdGhlIFJGQ3MgdGhhdCB3ZSBwcm9kdWNlIGFyZSBpbnRlbmRl ZCB0byBiZSByZWFkYWJsZSBieSB0aGUgZ2VuZXJhbCB0ZWNobmljYWwgY29tbXVuaXR5LCBub3Qg anVzdCB0aGUgZXhwZXJ0cyBpbiB0aGUgd29ya2luZyBncm91cC4gRm9yIHRoZSBzYW1lIHJlYXNv biB0aGF0IHdlIGFyZSByZXF1aXJlZCB0byBleHBhbmQgYWNyb255bXMgb24gZmlyc3QgdXNlLCBJ IHRoaW5rIGl0IG1ha2VzIHNlbnNlIGZvciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVzIG5ldyBp bmZvcm1hdGlvbiBiZWluZyBzZW50IHRvIGlkZW50aWZ5IHRoZSB0YXJnZXQuIEkgd2lsbCBkcm9w IHRoaXMgcG9pbnQsIHRob3VnaCwgYmVjYXVzZSBpdCBpcyBhIGdlbmVyYWwgY29tbWVudCByYXRo ZXIgdGhhbiBhIHNlY2RpciBpc3N1ZS4NCg0KSSBhZ3JlZSBhYm91dCBub3QgbmVlZGluZyB0byBy ZXBlYXQgaW5mb3JtYXRpb24gdGhhdCBpcyBhbHJlYWR5IHN0YXRlZCBlbHNld2hlcmUsIGJ1dCB5 b3UgZG8gbmVlZCB0byBwb2ludCB0byBpdCwgYXMgeW91IGRvIHdpdGggdGhlIGdlbmVyYWwgc2Vj dXJpdHkgbW9kZWwgb2YgQkdQIChmaXJzdCBwYXJhZ3JhcGgpLCBhbmQgYXMgeW91IGRvIHdpdGgg dGhlIHBhcmFncmFwaCBkZXNjcmliaW5nIGhvdyB0aGUgdHJhbnNwb3J0IG9mIGF0dHJpYnV0ZXMg aXMgc2VjdXJlZCAoc2Vjb25kIHBhcmFncmFwaCkuIFRoYXQgcGFydCBpcyBmaW5lLg0KDQpSRkMg NzgxMCBhbmQgNzQ3MSBkZXNjcmliZSB0aGUgbmV3IGluZm9ybWF0aW9uIHRvIGJlIHNlbnQsIGJ1 dCB0aGV5IGFyZSBhYm91dCBJUy1JUyBhbmQgT1NQRi4gVGhlIFNlY3VyaXR5IGNvbnNpZGVyYXRp b25zIHNlY3Rpb24gaW4gNzgxMCBjb250YWlucyB0aGUgZm9sbG93aW5nIHRleHQ6ICJJdCBpcyBh bnRpY2lwYXRlZCB0aGF0IGluIG1vc3QgZGVwbG95bWVudHMsIHRoZSBJUy1JUyBwcm90b2NvbCBp cyB1c2VkIHdpdGhpbiBhbiBpbmZyYXN0cnVjdHVyZSBlbnRpcmVseSB1bmRlciBjb250cm9sIG9m IHRoZSBzYW1lIG9wZXJhdG9yLuKAnSBhbmQgY29udGludWVzIHRvIGRpc2N1c3MgTUlUTSBhdHRh Y2tzIGlmIHRoaXMgaXMgbm90IHRoZSBjYXNlLiAgQ2FuIHRoZSBzYW1lIGFzc3VtcHRpb24gYmUg bWFkZSBhYm91dCBCR1A/ICBUaGF0IGlzIHRoZSBwYXJ0IHRoYXQgSSB0aGluayBpcyBtaXNzaW5n LiBFaXRoZXIgc3RhdGUgdGhhdCB3aGVyZSBCR1AtTFMgaXMgdXNlZCB0aGUgYXNzdW1wdGlvbiBj YW4gYmUgbWFkZSwgb3IganVzdGlmeSB3aHkgdGhlcmUgaXMgbm8gcmlzayBldmVuIHdoZW4gdGhl IGluZm9ybWF0aW9uIGlzIHByb3BhZ2F0ZWQgdG8gaW5mcmFzdHJ1Y3R1cmUgdGhhdCBpcyBub3Qg dW5kZXIgY29udHJvbCBvZiBhIHNpbmdsZSBvcGVyYXRvci4gICBUaGUgZGlmZmVyZW5jZSBiZXR3 ZWVuIEJHUCBhbmQgZWl0aGVyIElTLUlTIG9yIE9TUEYgaXMgbm90IHBhcnQgb2YgdGhvc2Ugb3Ro ZXIgZG9jdW1lbnRzLCBzbyBJTU8gaXQgc2hvdWxkIGJlIHN0YXRlZCBoZXJlLg0KDQpbTGVzOl0g SSBhZ3JlZSB3aXRoIHRoaXMuDQpJZiB3ZSBsb29rIGF0IHRoZSBTZWN1cml0eSBzZWN0aW9uIG9m IFJGQyA3NzUyIHdlIHNlZSBhIG51bWJlciBvZiBpc3N1ZXMgZGlzY3Vzc2VkLiBJZiB3ZSB3ZXJl IHRvIGFkZCB0aGUgZm9sbG93aW5nIGludG8gdGhpcyBkb2N1bWVudCB3b3VsZCBpdCBzdWZmaWNl Pw0KDQrigJxTZWN1cml0eSBjb25zaWRlcmF0aW9ucyBmb3IgYWNxdWlyaW5nIGFuZCBkaXN0cmli dXRpbmcgQkdQLUxTIGluZm9ybWF0aW9uIGFyZSBkaXNjdXNzZWQgaW4gUkZDNzc1Mi7igJ0NCg0K SeKAmWQgbGlrZSB0byBwb2ludCBvdXQgdGhhdCB0aGlzIGRvY3VtZW50IGlzIGp1c3Qgb25lIG9m IG1hbnkgKGV4aXN0aW5nIGFuZCB5ZXQgdG8gYmUgd3JpdHRlbikgZXh0ZW5zaW9ucyB0byBSRkMg Nzc1Mi4gR2l2ZW4gdGhlIHdheSBCR1AtTFMgaGFzIGJlZW4gZGVmaW5lZCwgZXZlcnkgdGltZSB3 ZSBkZWZpbmUgbmV3IGluZm9ybWF0aW9uIHRvIGJlIGFkdmVydGlzZWQgYnkgYW4gSUdQIHdlIGhh dmUgdG8gd3JpdGUgYSBCR1AtTFMgZHJhZnQgZGVmaW5pbmcgaG93IHRoYXQgaW5mb3JtYXRpb24g aXMgdG8gYmUgYWR2ZXJ0aXNlZCBpbiBCR1AtTFMuIFNvIHRoaXMgaXNzdWUgaXMgZ29pbmcgdG8g Y29tZSB1cCBvdmVyIGFuZCBvdmVyLiBJIGhvcGUgd2hhdCB3ZSBhcmUgZG9pbmcgaW4gdGhpcyBk b2N1bWVudCBpcyBhIGdvb2QgbW9kZWwgZm9yIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIGluIGFs bCBvZiB0aGVzZSB0eXBlcyBvZiBkcmFmdHMgaWUuLA0KDQoxKVJlZmVyZW5jZSBSRkMgNzc1MiBT ZWN1cml0eSBkaXNjdXNzaW9uLg0KMilSZWZlcmVuY2UgdGhlIHJlbGV2YW50IElHUCBSRkMgU2Vj dXJpdHkgZGlzY3Vzc2lvbiB0byBjb3ZlciBzZWN1cml0eSBpc3N1ZXMgc3BlY2lmaWMgdG8gdGhl IGNsYXNzIG9mIGluZm9ybWF0aW9uIGNvdmVyZWQgYnkgdGhlIGRyYWZ0DQoNCldoYXQgd2UgbGFj ayBhdCB0aGUgbW9tZW50IGlzICMxIGFib3ZlLg0KDQpEb2VzIHRoaXMgd29yaz8NCg0KICAgTGVz DQoNCllvYXYNCg0KDQpPbiAxNyBPY3QgMjAxOCwgYXQgMjo1MiwgTGVzIEdpbnNiZXJnIChnaW5z YmVyZykgPGdpbnNiZXJnQGNpc2NvLmNvbTxtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tPj4gd3Jv dGU6DQoNCllvYXYgLQ0KDQpUaGFueCBmb3IgdGhlIHJldmlldy4NCg0KSSdsbCBwcmVmYWNlIG15 IHJlbWFya3MgYnkgc2F5aW5nIEkgYW0gYSBiaWcgYmVsaWV2ZXIgaW4gbW9kdWxhcml0eS4gSWYg YSByZWZlcmVuY2VkIGRvY3VtZW50IGhhcyBhbHJlYWR5IGNvdmVyZWQgYW4gaXNzdWUgSSBzdHJv bmdseSBiZWxpZXZlIHdlIGFyZSBiZXR0ZXIgb2ZmIHJlZmVyZW5jaW5nIHRoYXQgZG9jdW1lbnQg dGhhbiB0cnlpbmcgdG8gcmVwZWF0L3Jlc3RhdGUgd2hhdCB0aGUgcmVmZXJlbmNlZCBkb2N1bWVu dCBoYXMgc2FpZC4NClRoZXJlIGFyZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVuIHdo ZW4gd2UgcmVwZWF0L3Jlc3RhdGU6DQoNCjEpV2UgYXJlIHJlZHVuZGFudA0KMilXZSBpbnRyb2R1 Y2UgYW1iaWd1aXR5DQoNCk5laXRoZXIgb2YgdGhlc2UgaXMgZGVzaXJhYmxlLg0KDQpSZXNwb25z ZXMgaW5saW5lLg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IFlvYXYg TmlyIDx5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPj4NCj4g U2VudDogVHVlc2RheSwgT2N0b2JlciAxNiwgMjAxOCAyOjE4IFBNDQo+IFRvOiBzZWNkaXJAaWV0 Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz4NCj4gQ2M6IGlkckBpZXRmLm9yZzxtYWlsdG86 aWRyQGlldGYub3JnPjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IGRyYWZ0 LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC5hbGxAaWV0Zi5vcmc+DQo+IFN1YmplY3Q6IFNlY2RpciBlYXJseSByZXZpZXcgb2Yg ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQo+DQo+IFJldmlld2VyOiBZb2F2IE5pcg0KPiBS ZXZpZXcgcmVzdWx0OiBIYXMgTml0cw0KPg0KPiBUaGlzIGlzIGFuIGVhcmx5IHJldmlldyB3aXRo IGEgc3BlY2lmaWMgcmVxdWVzdCB0byByZXZpZXcgdGhlIFNlY3VyaXR5DQo+IENvbnNpZGVyYXRp b25zIHNlY3Rpb24uDQo+DQo+IFRoZSBkcmFmdCBhZGRzIGEgYnVuY2ggb2YgVExWcyB0byBiZSBz ZW50IGZyb20gcm91dGVycyByZWdhcmRpbmcgdGhlIGxpbmsNCj4gc3RhdGUgb2YgdGhlIGxpbmsg dXNlZCBmb3IgSUdQLiBUaGUgZHJhZnQgcmVmZXJlbmNlcyBSRkMgNzc1MiB3aGljaCBkZWZpbmVk DQo+IGVhcmxpZXIgVExWcyB1c2VkIHRvIGNhcnJ5IE5MUkkgKHJlYWNoYWJpbGl0eSkgaW5mb3Jt YXRpb24uDQo+DQo+IFdoYXQgSSBmb3VuZCBkaWZmaWN1bHQgYWJvdXQgYm90aCA3NzUyIGFuZCB0 aGlzIGRyYWZ0IGlzIHRoZSB2YWd1ZW5lc3MgYWJvdXQNCj4gd2hvIHRoZSBjb25zdW1lciBvZiB0 aGlzIGluZm9ybWF0aW9uIGlzLiBUaGUgYWJzdHJhY3Qgb2YgNzc1MiBiZWdpbnMgbGlrZSB0aGlz Og0KPiAiSW4gYSBudW1iZXIgb2YgZW52aXJvbm1lbnRzLCBhIGNvbXBvbmVudCBleHRlcm5hbCB0 byBhIG5ldHdvcmsgaXMgY2FsbGVkDQo+IHVwb24gdG8gcGVyZm9ybSBjb21wdXRhdGlvbnMgYmFz ZWQgb24gdGhlIG5ldHdvcmsgdG9wb2xvZ3kgYW5kIGN1cnJlbnQNCj4gc3RhdGUgb2YgdGhlIGNv bm5lY3Rpb25zIHdpdGhpbiB0aGUgbmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJp bmcNCj4gKFRFKSBpbmZvcm1hdGlvbi4iIFRoZXJlIGlzIGFsc28gYSBkaWFncmFtIHdpdGggaW5m b3JtYXRpb24gZmxvd2luZyB0byBhDQo+ICJjb25zdW1lciINCj4gYW5kIHRoYXQncyBpdC4gSXMg aXQgYW4gU0ROIGNvbnRyb2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj8NCj4NCg0KW0xl czpdIFRoZSBkaWFncmFtIHlvdSBhcmUgcmVmZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRv IGJlIGluIFJGQyA3NzUyIHNpbmNlIHRoZXJlIGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRy YWZ0Lg0KV2hpY2ggbGVhZHMgbWUgdG8gc2F5IGlmIHlvdSBmZWVsIHRoaXMgaXMgaW5zdWZmaWNp ZW50IHRoZW4gaXQgbmVlZHMgdG8gYmUgdGFrZW4gdXAgaW4gdGhlIGNvbnRleHQgb2YgUkZDIDc3 NTIgLSBub3QgdGhpcyBkcmFmdC4NCg0KSG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91 IGFzIHdlbGwuDQoNCj4gT0suIE9uIHRvIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0 aW9uLiBJdCBiZWdpbnMgd2l0aCBhIHN0YXRlbWVudCB0aGF0DQo+IHRoaXMgZG9lcyBub3QgYWZm ZWN0IHRoZSBzZWN1cml0eSBtb2RlbCBvZiBCR1AuICBBbHRob3VnaCB0aGF0IGlzIGp1c3QgY2xh aW1lZA0KPiBhbmQgbm90IHN1cHBvcnRlZCBpbiB0ZXh0LCBpdCBzZWVtcyByZWFzb25hYmxlLiBJ IHNob3VsZCBub3RlIHRoYXQgdGhpcw0KPiBwYXJhZ3JhcGggaXMgY29waWVkIGZyb20gNzc1Mi4N Cj4NCj4gVGhlIHNlY29uZCAoYW5kIGxhc3QpIHBhcmFncmFwaCBpbiB0aGUgc2VjdXJpdHkgY29u c2lkZXJhdGlvbnMgc2VjdGlvbiB0YWxrcw0KPiBhYm91dCB0aGUgbmV3IGF0dHJpYnV0ZXMuIEl0 IG1lbnRpb25zIHRoYXQgc2VjdXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIGFyZQ0KPiBhc3N1bWVk IHRvIGJlIHVzZWQganVzdCBhcyBpbiBSRkNzIDc4MTAgYW5kIDc0NzEuIFdpdGggcHJvcGVyDQo+ IGF1dGhlbnRpY2F0aW9uIHRoaXMgaW5mb3JtYXRpb24gaXMgbm90IHNlbnQgZXhjZXB0IHRvIHRo ZSBwcm9wZXIgY29uc3VtZXIuDQo+IEhvd2V2ZXIsIHRoZXJlIGlzIGFuIGltcG9ydGFudCBkaWZm ZXJlbmNlIHRoYXQgSSB0aGluayBuZWVkcyB0byBiZQ0KPiBhZGRyZXNzZWQuIDc4MTAgYW5kIDc0 NzEgYXJlIGFib3V0IElTLUlTIGFuZCBPU1BGIHJlc3BlY3RpdmVseS4gVGhlcmUNCj4gcm91dGlu ZyBwcm90b2NvbHMgYXJlIHR5cGljYWxseSB1c2VkIGluIGNsb3NlZCBlbnZpcm9ubWVudHMsIGFu ZCB0aGUgU2VjdXJpdHkNCj4gQ29uc2lkZXJhdGlvbnMgb2YgNzgxMCBzdGF0ZSB0aGF0IGV4cGxp Y2l0bHkuIEJHUCAodGhlIHN1YmplY3Qgb2YgdGhpcw0KPiBkb2N1bWVudCkgaXMgZGlmZmVyZW50 IGluIHRoYXQgaXQgaXMgdHlwaWNhbGx5IHVzZWQgYWxsIG92ZXIgdGhlIEludGVybmV0LiBXaXRo b3V0DQo+IGZ1cnRoZXIgY2xhcml0eSBhYm91dCB3aG8gYW5kIHdoZXJlIHRoZSAiY29uc3VtZXIi IGlzLCBpdCBoYXMgdG8gYmUgYXNzdW1lZA0KPiB0aGF0IHRoZSBpbmZvcm1hdGlvbiBtaWdodCBh dCBsZWFzdCBsZWFrIG91dC4NCj4NCltMZXM6XSBJIHRoaW5rIHlvdSBoYXZlIG1pc2ludGVycHJl dGVkIHRoaXMgcGFyYWdyYXBoLiAoZW1waGFzaXMgYWRkZWQgYmVsb3cpDQoNCiIgVGhlIElHUA0K ICAgaW5zdGFuY2VzIG9yaWdpbmF0aW5nIHRoZXNlIFRMVnMgYXJlIGFzc3VtZWQgdG8gaGF2ZSBh bGwgdGhlIHJlcXVpcmVkDQogICBzZWN1cml0eSBhbmQgYXV0aGVudGljYXRpb24gbWVjaGFuaXNt IChhcyBkZXNjcmliZWQgaW4gW1JGQzc4MTBdIGFuZA0KICAgW1JGQzc0NzFdKSBpbiBvcmRlciB0 byBwcmV2ZW50IGFueSBzZWN1cml0eSBpc3N1ZSB3aGVuIHByb3BhZ2F0aW5nDQogICB0aGUgVExW cyBpbnRvIEJHUC1MUy4iDQoNCldoYXQgd2UgYXJlIHN0YXRpbmcgaGVyZSBpcyB0aGF0IHdoZW4g dGhlIElHUCBhZHZlcnRpc2VtZW50cyBhcmUgc2VudCB0aGUgc2VjdXJpdHkvYXV0aGVudGljYXRp b24gbWVjaGFuaXNtcyBzcGVjaWZpZWQgaW4gdGhlIElHUCBkcmFmdHMgYXBwbGllcy4NClRoaXMg aXMgTk9UIHRyeWluZyB0byBhcHBseSBSRkM3ODEwL1JGQzc0NzEgdG8gdGhlIG5ldyBCR1AgYWR2 ZXJ0aXNlbWVudHMuDQpUaGUgc2VjdXJpdHkgaXNzdWVzIHJlbGF0ZWQgdG8gdGhlIG5ldyBCR1Ag YWR2ZXJ0aXNlbWVudHMgYXJlIGRpc2N1c3NlZCBpbiB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLg0K DQo+IEFub3RoZXIgaXNzdWUgSSBoYXZlIHdpdGggdGhpcyBzZWN0aW9uIGlzIHRoYXQgdGhlIGRy YWZ0IHNwZWNpZmllcyBob3cgdG8gc2VuZA0KPiBuZXcgaW5mb3JtYXRpb24gKHRoZSBsaW5rIHN0 YXRlIFRMVnMpIGZyb20gb25lIG5vZGUgdG8gYW5vdGhlci4gVGhpcyBpcw0KPiBpbmZvcm1hdGlv biB0aGF0IHdhcyBub3Qgc2VudCBiZWZvcmUuIFdoZW4gYSBjaGFuZ2UgbGlrZSB0aGF0IGlzIG1h ZGUsIEkNCj4gdGhpbmsgdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gc2hvdWxk IGp1c3RpZnkgd2h5IGl0IGlzIE9LIHRvDQo+IGRpc3RyaWJ1dGUgdGhpcyBpbmZvcm1hdGlvbi4g VHlwaWNhbGx5IHlvdSBuZWVkIHRvIGp1c3RpZnkgdGhhdCBsZWFraW5nIHRoaXMNCj4gaW5mb3Jt YXRpb24gKHRvIHRoZSBpbnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJlc3Qgb2YgdGhlIHdv cmxkKSBkb2VzIG5vdA0KPiAoMSkgbWFrZSBpdCBlYXNpZXIgdG8gYXR0YWNrIHNvbWUgcGFydCBv ZiB0aGUgc3lzdGVtLCBvciAoMikgZGlzdHJpYnV0ZXMNCj4gcHJpdmFjeS1zZW5zaXRpdmUgaW5m b3JtYXRpb24sIG9yICgzKSB1bmRlcm1pbmVzIHNvbWUgb3RoZXIgY29uZmlkZW50aWFsaXR5DQo+ IGludGVyZXN0LiBJIHRoaW5rIGl0J3MgZmFpcmx5IGVhc3kgdG8gbWFrZSB0aGUgYXJndW1lbnQg dGhhdCB0aGUgaW5mb3JtYXRpb24gaW4NCj4gdGhlc2UgVExWcyBkb2VzIG5vdCBkbyBhbnkgb2Yg dGhlIGFib3ZlLCBidXQgdGhlIGFyZ3VtZW50IHNob3VsZCBiZSBtYWRlLg0KPiBUaGUgbGFzdCBw YXJhZ3JhcGggaW4gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2YgUkZDIDc3 NTIgaGFzIGp1c3QNCj4gc3VjaCBhbiBhcmd1bWVudC4NCg0KW0xlczpdIFNlY3VyaXR5IHNlY3Rp b25zIGluIFJGQzc4MTAvUkZDNzQ3MSBkaXJlY3RseSBhZGRyZXNzIHRoaXMgcG9pbnQuDQpXRSBj b3VsZCByZXBlYXQgc29tZSBvZiB0aGF0IGhlcmUg4oCTIGJ1dCBhcyBwZXIgbXkg4oCcb3Blbmlu ZyBzdGF0ZW1lbnTigJ0gSSBhbSByZWx1Y3RhbnQgdG8gZG8gc28uDQoNCldoYXQgZG8geW91IHRo aW5rPw0KDQogICBMZXMNCg0K --_000_feec42a72bd64f31afbcb3b340dad52bXCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv UGxhaW5UZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29QbGFpblRleHQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1t YXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29u b3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNv LW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglm b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRl ZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5Q bGFpblRleHRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJQbGFpbiBUZXh0IENoYXIiOw0KCW1zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCI7DQoJZm9udC1m YW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDEx LjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwv eG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQg djpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hh cGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIg bGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvYXYg 4oCTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHRoaW5rIHdl IGFyZSBjb252ZXJnaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JbmxpbmUuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gWW9h diBOaXIgJmx0O3luaXIuaWV0ZkBnbWFpbC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gV2Vk bmVzZGF5LCBPY3RvYmVyIDE3LCAyMDE4IDExOjE0IEFNPGJyPg0KPGI+VG86PC9iPiBMZXMgR2lu c2JlcmcgKGdpbnNiZXJnKSAmbHQ7Z2luc2JlcmdAY2lzY28uY29tJmd0Ozxicj4NCjxiPkNjOjwv Yj4gc2VjZGlyQGlldGYub3JnOyBpZHJAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFNl Y2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGksIExlcy48bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgdGhhdCBteSBkaWFn cmFtIGNvbW1lbnQgaXMgZGlyZWN0ZWQgbW9zdGx5IGF0IDc3NTIuIEhvd2V2ZXIsIHRoZSBSRkNz IHRoYXQgd2UgcHJvZHVjZSBhcmUgaW50ZW5kZWQgdG8gYmUgcmVhZGFibGUgYnkgdGhlIGdlbmVy YWwgdGVjaG5pY2FsIGNvbW11bml0eSwgbm90IGp1c3QgdGhlIGV4cGVydHMgaW4gdGhlIHdvcmtp bmcgZ3JvdXAuIEZvciB0aGUgc2FtZSByZWFzb24gdGhhdCB3ZSBhcmUgcmVxdWlyZWQNCiB0byBl eHBhbmQgYWNyb255bXMgb24gZmlyc3QgdXNlLCBJIHRoaW5rIGl0IG1ha2VzIHNlbnNlIGZvciBh IGRvY3VtZW50IHRoYXQgZGVzY3JpYmVzIG5ldyBpbmZvcm1hdGlvbiBiZWluZyBzZW50IHRvIGlk ZW50aWZ5IHRoZSB0YXJnZXQuIEkgd2lsbCBkcm9wIHRoaXMgcG9pbnQsIHRob3VnaCwgYmVjYXVz ZSBpdCBpcyBhIGdlbmVyYWwgY29tbWVudCByYXRoZXIgdGhhbiBhIHNlY2RpciBpc3N1ZS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhZ3Jl ZSBhYm91dCBub3QgbmVlZGluZyB0byByZXBlYXQgaW5mb3JtYXRpb24gdGhhdCBpcyBhbHJlYWR5 IHN0YXRlZCBlbHNld2hlcmUsIGJ1dCB5b3UgZG8gbmVlZCB0byBwb2ludCB0byBpdCwgYXMgeW91 IGRvIHdpdGggdGhlIGdlbmVyYWwgc2VjdXJpdHkgbW9kZWwgb2YgQkdQIChmaXJzdCBwYXJhZ3Jh cGgpLCBhbmQgYXMgeW91IGRvIHdpdGggdGhlIHBhcmFncmFwaCBkZXNjcmliaW5nIGhvdyB0aGUg dHJhbnNwb3J0DQogb2YgYXR0cmlidXRlcyBpcyBzZWN1cmVkIChzZWNvbmQgcGFyYWdyYXBoKS4g VGhhdCBwYXJ0IGlzIGZpbmUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJGQyA3ODEwIGFuZCA3NDcxIGRlc2NyaWJlIHRoZSBuZXcg aW5mb3JtYXRpb24gdG8gYmUgc2VudCwgYnV0IHRoZXkgYXJlIGFib3V0IElTLUlTIGFuZCBPU1BG LiBUaGUgU2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBpbiA3ODEwIGNvbnRhaW5zIHRo ZSBmb2xsb3dpbmcgdGV4dDogJnF1b3Q7SXQgaXMgYW50aWNpcGF0ZWQgdGhhdCBpbiBtb3N0IGRl cGxveW1lbnRzLCB0aGUgSVMtSVMgcHJvdG9jb2wgaXMgdXNlZA0KIHdpdGhpbiBhbiBpbmZyYXN0 cnVjdHVyZSBlbnRpcmVseSB1bmRlciBjb250cm9sIG9mIHRoZSBzYW1lIG9wZXJhdG9yLuKAnSBh bmQgY29udGludWVzIHRvIGRpc2N1c3MgTUlUTSBhdHRhY2tzIGlmIHRoaXMgaXMgbm90IHRoZSBj YXNlLiAmbmJzcDtDYW4gdGhlIHNhbWUgYXNzdW1wdGlvbiBiZSBtYWRlIGFib3V0IEJHUD8gJm5i c3A7VGhhdCBpcyB0aGUgcGFydCB0aGF0IEkgdGhpbmsgaXMgbWlzc2luZy4gRWl0aGVyIHN0YXRl IHRoYXQgd2hlcmUgQkdQLUxTIGlzIHVzZWQNCiB0aGUgYXNzdW1wdGlvbiBjYW4gYmUgbWFkZSwg b3IganVzdGlmeSB3aHkgdGhlcmUgaXMgbm8gcmlzayBldmVuIHdoZW4gdGhlIGluZm9ybWF0aW9u IGlzIHByb3BhZ2F0ZWQgdG8gaW5mcmFzdHJ1Y3R1cmUgdGhhdCBpcyBub3QgdW5kZXIgY29udHJv bCBvZiBhIHNpbmdsZSBvcGVyYXRvci4gJm5ic3A7IFRoZSBkaWZmZXJlbmNlIGJldHdlZW4gQkdQ IGFuZCBlaXRoZXIgSVMtSVMgb3IgT1NQRiBpcyBub3QgcGFydCBvZiB0aG9zZSBvdGhlciBkb2N1 bWVudHMsDQogc28gSU1PIGl0IHNob3VsZCBiZSBzdGF0ZWQgaGVyZS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+W0xlczpdIEkgYWdyZWUgd2l0 aCB0aGlzLjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklmIHdlIGxvb2sgYXQgdGhl IFNlY3VyaXR5IHNlY3Rpb24gb2YgUkZDIDc3NTIgd2Ugc2VlIGEgbnVtYmVyIG9mIGlzc3VlcyBk aXNjdXNzZWQuIElmIHdlIHdlcmUgdG8gYWRkIHRoZSBmb2xsb3dpbmcgaW50byB0aGlzIGRvY3Vt ZW50IHdvdWxkIGl0IHN1ZmZpY2U/PG86cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+4oCcU2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgZm9yIGFjcXVpcmluZyBhbmQgZGlzdHJpYnV0aW5nIEJHUC1MUyBpbmZvcm1hdGlvbiBh cmUgZGlzY3Vzc2VkIGluIFJGQzc3NTIu4oCdPG86cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SeKAmWQgbGlrZSB0byBw b2ludCBvdXQgdGhhdCB0aGlzIGRvY3VtZW50IGlzIGp1c3Qgb25lIG9mIG1hbnkgKGV4aXN0aW5n IGFuZCB5ZXQgdG8gYmUgd3JpdHRlbikgZXh0ZW5zaW9ucyB0byBSRkMgNzc1Mi4gR2l2ZW4gdGhl IHdheSBCR1AtTFMgaGFzIGJlZW4gZGVmaW5lZCwNCiBldmVyeSB0aW1lIHdlIGRlZmluZSBuZXcg aW5mb3JtYXRpb24gdG8gYmUgYWR2ZXJ0aXNlZCBieSBhbiBJR1Agd2UgaGF2ZSB0byB3cml0ZSBh IEJHUC1MUyBkcmFmdCBkZWZpbmluZyBob3cgdGhhdCBpbmZvcm1hdGlvbiBpcyB0byBiZSBhZHZl cnRpc2VkIGluIEJHUC1MUy4gU28gdGhpcyBpc3N1ZSBpcyBnb2luZyB0byBjb21lIHVwIG92ZXIg YW5kIG92ZXIuIEkgaG9wZSB3aGF0IHdlIGFyZSBkb2luZyBpbiB0aGlzIGRvY3VtZW50IGlzIGEg Z29vZA0KIG1vZGVsIGZvciBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBpbiBhbGwgb2YgdGhlc2Ug dHlwZXMgb2YgZHJhZnRzIGllLiw8bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4xKVJlZmVyZW5jZSBSRkMgNzc1MiBT ZWN1cml0eSBkaXNjdXNzaW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjIpUmVm ZXJlbmNlIHRoZSByZWxldmFudCBJR1AgUkZDIFNlY3VyaXR5IGRpc2N1c3Npb24gdG8gY292ZXIg c2VjdXJpdHkgaXNzdWVzIHNwZWNpZmljIHRvIHRoZSBjbGFzcyBvZiBpbmZvcm1hdGlvbiBjb3Zl cmVkIGJ5IHRoZSBkcmFmdDxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPldoYXQgd2UgbGFjayBhdCB0aGUgbW9tZW50 IGlzICMxIGFib3ZlLjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkRvZXMgdGhpcyB3b3JrPzxvOnA+PC9vOnA+PC9z cGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Zb2F2 PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0K PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxNyBPY3Qg MjAxOCwgYXQgMjo1MiwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0OzxhIGhyZWY9Im1haWx0 bzpnaW5zYmVyZ0BjaXNjby5jb20iPmdpbnNiZXJnQGNpc2NvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Zb2F2IC08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ VGhhbnggZm9yIHRoZSByZXZpZXcuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkknbGwgcHJlZmFjZSBteSByZW1hcmtzIGJ5IHNheWluZyBJIGFtIGEgYmlnIGJl bGlldmVyIGluIG1vZHVsYXJpdHkuIElmIGEgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgYWxyZWFk eSBjb3ZlcmVkIGFuIGlzc3VlIEkgc3Ryb25nbHkgYmVsaWV2ZSB3ZSBhcmUgYmV0dGVyIG9mZiBy ZWZlcmVuY2luZw0KIHRoYXQgZG9jdW1lbnQgdGhhbiB0cnlpbmcgdG8gcmVwZWF0L3Jlc3RhdGUg d2hhdCB0aGUgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgc2FpZC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PlRoZXJlIGFyZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVuIHdoZW4gd2UgcmVwZWF0 L3Jlc3RhdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjEp V2UgYXJlIHJlZHVuZGFudDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+MilXZSBpbnRyb2R1Y2UgYW1iaWd1 aXR5PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk5laXRoZXIg b2YgdGhlc2UgaXMgZGVzaXJhYmxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5SZXNwb25zZXMgaW5saW5lLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mZ3Q7IEZyb206IFlvYXYgTmlyICZsdDs8YSBocmVmPSJtYWlsdG86eW5pci5p ZXRmQGdtYWlsLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eW5pci5pZXRmQGdtYWls LmNvbTwvc3Bhbj48L2E+Jmd0OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBTZW50OiBUdWVzZGF5 LCBPY3RvYmVyIDE2LCAyMDE4IDI6MTggUE08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgVG86PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzpzZWNkaXJAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNlY2RpckBp ZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IENjOjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86aWRy QGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZHJAaWV0Zi5vcmc8L3NwYW4+ PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmll dGZAaWV0Zi5vcmc8L3NwYW4+PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5h bGxAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC5hbGxAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBT dWJqZWN0OiBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0x MzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBS ZXZpZXdlcjogWW9hdiBOaXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgUmV2aWV3IHJlc3VsdDog SGFzIE5pdHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZndDsgVGhpcyBpcyBhbiBlYXJseSByZXZpZXcgd2l0aCBhIHNwZWNpZmljIHJlcXVlc3QgdG8g cmV2aWV3IHRoZSBTZWN1cml0eTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBDb25zaWRlcmF0aW9u cyBzZWN0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jmd0OyBUaGUgZHJhZnQgYWRkcyBhIGJ1bmNoIG9mIFRMVnMgdG8gYmUgc2VudCBmcm9tIHJv dXRlcnMgcmVnYXJkaW5nIHRoZSBsaW5rPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHN0YXRlIG9m IHRoZSBsaW5rIHVzZWQgZm9yIElHUC4gVGhlIGRyYWZ0IHJlZmVyZW5jZXMgUkZDIDc3NTIgd2hp Y2ggZGVmaW5lZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBlYXJsaWVyIFRMVnMgdXNlZCB0byBj YXJyeSBOTFJJIChyZWFjaGFiaWxpdHkpIGluZm9ybWF0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBXaGF0IEkgZm91bmQgZGlmZmljdWx0 IGFib3V0IGJvdGggNzc1MiBhbmQgdGhpcyBkcmFmdCBpcyB0aGUgdmFndWVuZXNzIGFib3V0PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHdobyB0aGUgY29uc3VtZXIgb2YgdGhpcyBpbmZvcm1hdGlv biBpcy4gVGhlIGFic3RyYWN0IG9mIDc3NTIgYmVnaW5zIGxpa2UgdGhpczo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZndDsgJnF1b3Q7SW4gYSBudW1iZXIgb2YgZW52aXJvbm1lbnRzLCBhIGNvbXBvbmVu dCBleHRlcm5hbCB0byBhIG5ldHdvcmsgaXMgY2FsbGVkPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7 IHVwb24gdG8gcGVyZm9ybSBjb21wdXRhdGlvbnMgYmFzZWQgb24gdGhlIG5ldHdvcmsgdG9wb2xv Z3kgYW5kIGN1cnJlbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgc3RhdGUgb2YgdGhlIGNvbm5l Y3Rpb25zIHdpdGhpbiB0aGUgbmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJpbmc8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgKFRFKSBpbmZvcm1hdGlvbi4mcXVvdDsgVGhlcmUgaXMg YWxzbyBhIGRpYWdyYW0gd2l0aCBpbmZvcm1hdGlvbiBmbG93aW5nIHRvIGE8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZndDsgJnF1b3Q7Y29uc3VtZXImcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsg YW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0ROIGNvbnRyb2xsZXI/IFNvbWUga2luZCBvZiBhcHBs aWNhdGlvbj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+W0xlczpdIFRoZSBkaWFncmFtIHlvdSBhcmUgcmVm ZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRvIGJlIGluIFJGQyA3NzUyIHNpbmNlIHRoZXJl IGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRyYWZ0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2hp Y2ggbGVhZHMgbWUgdG8gc2F5IGlmIHlvdSBmZWVsIHRoaXMgaXMgaW5zdWZmaWNpZW50IHRoZW4g aXQgbmVlZHMgdG8gYmUgdGFrZW4gdXAgaW4gdGhlIGNvbnRleHQgb2YgUkZDIDc3NTIgLSBub3Qg dGhpcyBkcmFmdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91IGFzIHdlbGwuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgT0suIE9uIHRvIHRoZSBTZWN1cml0 eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLiBJdCBiZWdpbnMgd2l0aCBhIHN0YXRlbWVudCB0aGF0 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHRoaXMgZG9lcyBub3QgYWZmZWN0IHRoZSBzZWN1cml0 eSBtb2RlbCBvZiBCR1AuJm5ic3A7IEFsdGhvdWdoIHRoYXQgaXMganVzdCBjbGFpbWVkPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mZ3Q7IGFuZCBub3Qgc3VwcG9ydGVkIGluIHRleHQsIGl0IHNlZW1zIHJl YXNvbmFibGUuIEkgc2hvdWxkIG5vdGUgdGhhdCB0aGlzPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7 IHBhcmFncmFwaCBpcyBjb3BpZWQgZnJvbSA3NzUyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBUaGUgc2Vjb25kIChhbmQgbGFzdCkgcGFyYWdy YXBoIGluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIHRhbGtzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mZ3Q7IGFib3V0IHRoZSBuZXcgYXR0cmlidXRlcy4gSXQgbWVudGlvbnMgdGhh dCBzZWN1cml0eSBhbmQgYXV0aGVudGljYXRpb24gYXJlPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7 IGFzc3VtZWQgdG8gYmUgdXNlZCBqdXN0IGFzIGluIFJGQ3MgNzgxMCBhbmQgNzQ3MS4gV2l0aCBw cm9wZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgYXV0aGVudGljYXRpb24gdGhpcyBpbmZvcm1h dGlvbiBpcyBub3Qgc2VudCBleGNlcHQgdG8gdGhlIHByb3BlciBjb25zdW1lci48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZndDsgSG93ZXZlciwgdGhlcmUgaXMgYW4gaW1wb3J0YW50IGRpZmZlcmVuY2Ug dGhhdCBJIHRoaW5rIG5lZWRzIHRvIGJlPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGFkZHJlc3Nl ZC4gNzgxMCBhbmQgNzQ3MSBhcmUgYWJvdXQgSVMtSVMgYW5kIE9TUEYgcmVzcGVjdGl2ZWx5LiBU aGVyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyByb3V0aW5nIHByb3RvY29scyBhcmUgdHlwaWNh bGx5IHVzZWQgaW4gY2xvc2VkIGVudmlyb25tZW50cywgYW5kIHRoZSBTZWN1cml0eTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jmd0OyBDb25zaWRlcmF0aW9ucyBvZiA3ODEwIHN0YXRlIHRoYXQgZXhwbGlj aXRseS4gQkdQICh0aGUgc3ViamVjdCBvZiB0aGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGRv Y3VtZW50KSBpcyBkaWZmZXJlbnQgaW4gdGhhdCBpdCBpcyB0eXBpY2FsbHkgdXNlZCBhbGwgb3Zl ciB0aGUgSW50ZXJuZXQuIFdpdGhvdXQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgZnVydGhlciBj bGFyaXR5IGFib3V0IHdobyBhbmQgd2hlcmUgdGhlICZxdW90O2NvbnN1bWVyJnF1b3Q7IGlzLCBp dCBoYXMgdG8gYmUgYXNzdW1lZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyB0aGF0IHRoZSBpbmZv cm1hdGlvbiBtaWdodCBhdCBsZWFzdCBsZWFrIG91dC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsm bmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPltMZXM6XSBJIHRoaW5rIHlvdSBoYXZlIG1pc2ludGVy cHJldGVkIHRoaXMgcGFyYWdyYXBoLiAoZW1waGFzaXMgYWRkZWQgYmVsb3cpPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90OyBUaGUgSUdQPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDsmbmJzcDsgaW5zdGFuY2VzIG9yaWdpbmF0aW5nIHRoZXNlIFRMVnMg YXJlIGFzc3VtZWQgdG8gaGF2ZSBhbGwgdGhlIHJlcXVpcmVkPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4m bmJzcDsmbmJzcDsgc2VjdXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbSAoYXMgZGVz Y3JpYmVkIGluIFtSRkM3ODEwXSBhbmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOyZuYnNwOyBb UkZDNzQ3MV0pIGluIG9yZGVyIHRvIHByZXZlbnQgYW55IHNlY3VyaXR5IGlzc3VlPHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPjxzcGFuIHN0eWxlPSJj b2xvcjpyZWQiPndoZW4gcHJvcGFnYXRpbmc8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpyZWQiPiZuYnNwOyZuYnNwOyB0aGUgVExWcyBpbnRvIEJHUC1MUy48L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPldoYXQgd2UgYXJlIHN0YXRpbmcgaGVyZSBpcyB0aGF0IHdoZW4gdGhlIElH UCBhZHZlcnRpc2VtZW50cyBhcmUgc2VudCB0aGUgc2VjdXJpdHkvYXV0aGVudGljYXRpb24gbWVj aGFuaXNtcyBzcGVjaWZpZWQgaW4gdGhlIElHUCBkcmFmdHMgYXBwbGllcy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPlRoaXMgaXMgTk9UIHRyeWluZyB0byBhcHBseSBSRkM3ODEwL1JGQzc0NzEgdG8gdGhl IG5ldyBCR1AgYWR2ZXJ0aXNlbWVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgc2VjdXJpdHkg aXNzdWVzIHJlbGF0ZWQgdG8gdGhlIG5ldyBCR1AgYWR2ZXJ0aXNlbWVudHMgYXJlIGRpc2N1c3Nl ZCBpbiB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mZ3Q7IEFub3RoZXIgaXNzdWUgSSBoYXZlIHdpdGggdGhpcyBzZWN0 aW9uIGlzIHRoYXQgdGhlIGRyYWZ0IHNwZWNpZmllcyBob3cgdG8gc2VuZDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jmd0OyBuZXcgaW5mb3JtYXRpb24gKHRoZSBsaW5rIHN0YXRlIFRMVnMpIGZyb20gb25l IG5vZGUgdG8gYW5vdGhlci4gVGhpcyBpczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBpbmZvcm1h dGlvbiB0aGF0IHdhcyBub3Qgc2VudCBiZWZvcmUuIFdoZW4gYSBjaGFuZ2UgbGlrZSB0aGF0IGlz IG1hZGUsIEk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgdGhpbmsgdGhlIFNlY3VyaXR5IENvbnNp ZGVyYXRpb25zIHNlY3Rpb24gc2hvdWxkIGp1c3RpZnkgd2h5IGl0IGlzIE9LIHRvPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mZ3Q7IGRpc3RyaWJ1dGUgdGhpcyBpbmZvcm1hdGlvbi4gVHlwaWNhbGx5IHlv dSBuZWVkIHRvIGp1c3RpZnkgdGhhdCBsZWFraW5nIHRoaXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZn dDsgaW5mb3JtYXRpb24gKHRvIHRoZSBpbnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJlc3Qg b2YgdGhlIHdvcmxkKSBkb2VzIG5vdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyAoMSkgbWFrZSBp dCBlYXNpZXIgdG8gYXR0YWNrIHNvbWUgcGFydCBvZiB0aGUgc3lzdGVtLCBvciAoMikgZGlzdHJp YnV0ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgcHJpdmFjeS1zZW5zaXRpdmUgaW5mb3JtYXRp b24sIG9yICgzKSB1bmRlcm1pbmVzIHNvbWUgb3RoZXIgY29uZmlkZW50aWFsaXR5PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mZ3Q7IGludGVyZXN0LiBJIHRoaW5rIGl0J3MgZmFpcmx5IGVhc3kgdG8gbWFr ZSB0aGUgYXJndW1lbnQgdGhhdCB0aGUgaW5mb3JtYXRpb24gaW48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZndDsgdGhlc2UgVExWcyBkb2VzIG5vdCBkbyBhbnkgb2YgdGhlIGFib3ZlLCBidXQgdGhlIGFy Z3VtZW50IHNob3VsZCBiZSBtYWRlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBUaGUgbGFzdCBw YXJhZ3JhcGggaW4gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2YgUkZDIDc3 NTIgaGFzIGp1c3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgc3VjaCBhbiBhcmd1bWVudC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+W0xlczwvc3Bh bj48L2k+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Ol0gU2VjdXJpdHkgc2VjdGlvbnMgaW4gUkZDNzgx MC9SRkM3NDcxIGRpcmVjdGx5IGFkZHJlc3MgdGhpcyBwb2ludC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PldFIGNvdWxkIHJlcGVhdCBzb21lIG9mIHRoYXQgaGVyZSDigJMgYnV0IGFzIHBlciBteSDigJxv cGVuaW5nIHN0YXRlbWVudOKAnSBJIGFtIHJlbHVjdGFudCB0byBkbyBzby48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2hhdCBkbyB5b3UgdGhpbms/PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOyZuYnNwOyBMZXM8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_feec42a72bd64f31afbcb3b340dad52bXCHALN001ciscocom_-- From nobody Thu Oct 18 09:19:56 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9652E12426A for ; Thu, 18 Oct 2018 09:19:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: X-Test-IDTracker: no X-IETF-IDTracker: 6.87.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu Message-ID: <153987959160.22176.3378276530236324459.idtracker@ietfa.amsl.com> Date: Thu, 18 Oct 2018 09:19:51 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Oct 2018 16:19:52 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2018-10-25 Reviewer LC end Draft Phillip Hallam-Baker 2018-10-03 draft-ietf-detnet-use-cases-19 Steve Hanna 2018-10-10 draft-ietf-ospf-lls-interface-id-08 Taylor Yu 2018-10-09 draft-murchison-tzdist-tzif-15 Last calls: Reviewer LC end Draft John Bradley 2018-09-25 draft-ietf-dnsop-attrleaf-fix-05 John Bradley 2018-06-18 draft-ietf-bfd-multipoint-active-tail-09 Daniel Franke 2018-06-28 draft-ietf-netconf-rfc7895bis-07 Daniel Gillmor 2018-06-25 draft-ietf-dnsop-session-signal-16 Daniel Gillmor 2018-03-19 draft-gutmann-scep-10 Phillip Hallam-Baker 2018-10-11 draft-ietf-softwire-yang-06 Steve Hanna 2018-10-03 draft-ietf-detnet-problem-statement-07 Matthew Miller 2018-10-12 draft-ietf-httpbis-rand-access-live-03 Kathleen Moriarty 2018-10-19 draft-ietf-ntp-mac-05 Russ Mundy 2017-09-14 draft-spinosa-urn-lex-13 Magnus Nystrom 2018-11-13 draft-op3ft-leaptofrogans-uri-scheme-03 Hilarie Orman 2018-11-01 draft-ietf-perc-srtp-ekt-diet-09 Radia Perlman 2018-11-01 draft-ietf-perc-double-10 Derrell Piper 2018-10-29 draft-ietf-pce-segment-routing-14 Vincent Roca 2018-10-29 draft-ietf-pce-gmpls-pcep-extensions-12 Kyle Rose 2018-10-26 draft-ietf-sipcore-originating-cdiv-parameter-05 Samuel Weiler 2018-05-21 draft-ietf-bfd-multipoint-18 Klaas Wierenga 2018-09-06 draft-ietf-softwire-mesh-multicast-23 Paul Wouters 2018-09-06 draft-ietf-dnsop-kskroll-sentinel-15 Dacheng Zhang 2018-10-05 draft-ietf-iasa2-trust-update-02 Early review requests: Reviewer Due Draft Daniel Franke 2018-01-31 draft-ietf-intarea-provisioning-domains-00 Magnus Nystrom 2018-10-26 draft-ietf-nvo3-geneve-08 Next in the reviewer rotation: Joseph Salowey Rich Salz Stefan Santesson Yaron Sheffer Rifaat Shekh-Yusef Melinda Shore Valery Smyslov Robert Sparks Takeshi Takahashi Tina Tsou From nobody Thu Oct 18 09:38:38 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DCF812F1AC; Thu, 18 Oct 2018 09:38:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OS5p-fzrBW6g; Thu, 18 Oct 2018 09:38:27 -0700 (PDT) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 060AC128CE4; Thu, 18 Oct 2018 09:38:27 -0700 (PDT) Received: by mail-wr1-x42a.google.com with SMTP id y16so34428647wrw.3; Thu, 18 Oct 2018 09:38:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=x3NMtovArgbGxLRrawBrUuXRVNH8pBjbccPJHwgATYE=; b=QyXGI6EjDPXERfmFCvEK6f50+yQztzQlZN9GAUmjJtm6EllLRRUFBbe5Mz1WEx6Dx9 zBo/ehxsrlU43KKEvII2wim/1FV1gSlzJrBdqR6darMSQuobY1m4BXRtsxq2fjOga0Pf PmAgVF97EonrMyC+L97RXlD44qCvJyWf98UFl9f2W+Ts6QmSIxsB2msE0d5eYtQTXAoO qnX+HrKPlhg5zZYKxxEB89aKkyLi8n9Jhw8xeaxb6DMqqepnlbH55lI9htewAACITXEp GDQRY/Opk8UM9NU50cspGlSIhWVHLzXGZBGNnVokppSvRKyXATxgDMZZe23k+pozPL/N nYuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=x3NMtovArgbGxLRrawBrUuXRVNH8pBjbccPJHwgATYE=; b=c0rxRAVbJ8E8tFe78K5UzBTwvPEJSpXb4REjSOfvc2VgYBIlDvNJzT1ETGVquEh8Ol xP8UAPTNz7HiM129q2QCnrHKM+6oW1VEMLEl6PJP/vDdJmUIDvaBH0nHlml2+YIFVvVU Z2vyHjS4KVebXbRKKvk5BpkusLRwjPOhDewrm0hCIL21frY4bpnAcj75575tbqiESNKt H2Uy6qZlYEAoIxc3czQlSuq8Zngp5sRH9qdGsatFypODkxbBF6M2IjTEZQWFmqwgXmr3 7p5gauvCFWSBKhx5Cga5k+9ErpyJRyGc8Libu0aRU75XJS1m196IbnBXLATWE1ZzAgZw G8Jg== X-Gm-Message-State: ABuFfojnP+7g3D+vgUrzBUtBPLUjN0Z/HNCmxO2mO3IeGfCg5fBCcEkW yQI66BLd8iooQCtHYfsKDIk= X-Google-Smtp-Source: ACcGV62HhiUQNcBKGbE6nV480GV0+oIm4KjrNVAWIS+httTL3WEYwIl1+4/oQMzsm6B4FP6aF5s0vg== X-Received: by 2002:a05:6000:11c1:: with SMTP id i1mr30179241wrx.310.1539880705230; Thu, 18 Oct 2018 09:38:25 -0700 (PDT) Received: from [192.168.1.12] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id j6-v6sm927168wmd.29.2018.10.18.09.38.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Oct 2018 09:38:24 -0700 (PDT) From: Yoav Nir Message-Id: <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C74AB073-0978-4BDB-88AC-592BDF660B23" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Thu, 18 Oct 2018 19:38:21 +0300 In-Reply-To: Cc: "secdir@ietf.org" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" To: "Les Ginsberg (ginsberg)" References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Oct 2018 16:38:32 -0000 --Apple-Mail=_C74AB073-0978-4BDB-88AC-592BDF660B23 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, Les. I think we are converging, but haven=E2=80=99t converged yet.=20 Here=E2=80=99s what is still missing for me: You are adding some new = TLVs to pass into BGP-LS. Let=E2=80=99s pick one at random =E2=80=94 = the Unidirectional Utilized Bandwidth =E2=80=94 as an example. You are = claiming two things about this TLV: That RFC 7752 already has text about sending other TLVs in BGP-LS. That RFC 7810 and 7471 have text about sending Unidirectional Utilized = Bandwidth in IS-IS and OSPF. Both of these are true, but I claim that even taken together they are = not enough. BGP runs in different environments than OSPF, so a statement = that sending Unidirectional Utilized Bandwidth in OSPF is safe is not = sufficient for proving it safe in BGP-LS. Similarly, the fact that the = =E2=80=9CPrefix Metric=E2=80=9D TLV is safe to send over BGP-LS is no = proof that sending Unidirectional Utilized Bandwidth is safe. I=E2=80=99m missing a paragraph making the claim that distributing = Unidirectional Utilized Bandwidth (and the other TLVs) over BGP-LS is = safe.=20 Hope this helps Yoav > On 17 Oct 2018, at 22:40, Les Ginsberg (ginsberg) = wrote: >=20 > Yoav =E2=80=93 > =20 > I think we are converging. > Inline. > =20 > From: Yoav Nir >=20 > Sent: Wednesday, October 17, 2018 11:14 AM > To: Les Ginsberg (ginsberg) > > Cc: secdir@ietf.org ; idr@ietf.org = ; ietf@ietf.org ; = draft-ietf-idr-te-pm-bgp.all@ietf.org = > Subject: Re: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > =20 > Hi, Les. > =20 > I agree that my diagram comment is directed mostly at 7752. However, = the RFCs that we produce are intended to be readable by the general = technical community, not just the experts in the working group. For the = same reason that we are required to expand acronyms on first use, I = think it makes sense for a document that describes new information being = sent to identify the target. I will drop this point, though, because it = is a general comment rather than a secdir issue. > =20 > I agree about not needing to repeat information that is already stated = elsewhere, but you do need to point to it, as you do with the general = security model of BGP (first paragraph), and as you do with the = paragraph describing how the transport of attributes is secured (second = paragraph). That part is fine.=20 > =20 > RFC 7810 and 7471 describe the new information to be sent, but they = are about IS-IS and OSPF. The Security considerations section in 7810 = contains the following text: "It is anticipated that in most = deployments, the IS-IS protocol is used within an infrastructure = entirely under control of the same operator.=E2=80=9D and continues to = discuss MITM attacks if this is not the case. Can the same assumption = be made about BGP? That is the part that I think is missing. Either = state that where BGP-LS is used the assumption can be made, or justify = why there is no risk even when the information is propagated to = infrastructure that is not under control of a single operator. The = difference between BGP and either IS-IS or OSPF is not part of those = other documents, so IMO it should be stated here. > =20 > [Les:] I agree with this. > If we look at the Security section of RFC 7752 we see a number of = issues discussed. If we were to add the following into this document = would it suffice? > =20 > =E2=80=9CSecurity considerations for acquiring and distributing BGP-LS = information are discussed in RFC7752.=E2=80=9D > =20 > I=E2=80=99d like to point out that this document is just one of many = (existing and yet to be written) extensions to RFC 7752. Given the way = BGP-LS has been defined, every time we define new information to be = advertised by an IGP we have to write a BGP-LS draft defining how that = information is to be advertised in BGP-LS. So this issue is going to = come up over and over. I hope what we are doing in this document is a = good model for Security Considerations in all of these types of drafts = ie., > =20 > 1)Reference RFC 7752 Security discussion. > 2)Reference the relevant IGP RFC Security discussion to cover security = issues specific to the class of information covered by the draft > =20 > What we lack at the moment is #1 above. > =20 > Does this work? > =20 > Les > =20 > Yoav >=20 >=20 > On 17 Oct 2018, at 2:52, Les Ginsberg (ginsberg) > wrote: > =20 > Yoav - > =20 > Thanx for the review. > =20 > I'll preface my remarks by saying I am a big believer in modularity. = If a referenced document has already covered an issue I strongly believe = we are better off referencing that document than trying to = repeat/restate what the referenced document has said. > There are only two things that can happen when we repeat/restate: > =20 > 1)We are redundant > 2)We introduce ambiguity > =20 > Neither of these is desirable. > =20 > Responses inline. > =20 > > -----Original Message----- > > From: Yoav Nir > > > Sent: Tuesday, October 16, 2018 2:18 PM > > To: secdir@ietf.org > > Cc: idr@ietf.org ; ietf@ietf.org = ; draft-ietf-idr-te-pm-bgp.all@ietf.org = > > Subject: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > >=20 > > Reviewer: Yoav Nir > > Review result: Has Nits > >=20 > > This is an early review with a specific request to review the = Security > > Considerations section. > >=20 > > The draft adds a bunch of TLVs to be sent from routers regarding the = link > > state of the link used for IGP. The draft references RFC 7752 which = defined > > earlier TLVs used to carry NLRI (reachability) information. > >=20 > > What I found difficult about both 7752 and this draft is the = vagueness about > > who the consumer of this information is. The abstract of 7752 begins = like this: > > "In a number of environments, a component external to a network is = called > > upon to perform computations based on the network topology and = current > > state of the connections within the network, including Traffic = Engineering > > (TE) information." There is also a diagram with information flowing = to a > > "consumer" > > and that's it. Is it an SDN controller? Some kind of application? > >=20 > =20 > [Les:] The diagram you are referring to seems most likely to be in RFC = 7752 since there is no such diagram in this draft. > Which leads me to say if you feel this is insufficient then it needs = to be taken up in the context of RFC 7752 - not this draft. > =20 > Hopefully this makes sense to you as well. > =20 > > OK. On to the Security Considerations section. It begins with a = statement that > > this does not affect the security model of BGP. Although that is = just claimed > > and not supported in text, it seems reasonable. I should note that = this > > paragraph is copied from 7752. > >=20 > > The second (and last) paragraph in the security considerations = section talks > > about the new attributes. It mentions that security and = authentication are > > assumed to be used just as in RFCs 7810 and 7471. With proper > > authentication this information is not sent except to the proper = consumer. > > However, there is an important difference that I think needs to be > > addressed. 7810 and 7471 are about IS-IS and OSPF respectively. = There > > routing protocols are typically used in closed environments, and the = Security > > Considerations of 7810 state that explicitly. BGP (the subject of = this > > document) is different in that it is typically used all over the = Internet. Without > > further clarity about who and where the "consumer" is, it has to be = assumed > > that the information might at least leak out. > >=20 > [Les:] I think you have misinterpreted this paragraph. (emphasis added = below) > =20 > " The IGP > instances originating these TLVs are assumed to have all the = required > security and authentication mechanism (as described in [RFC7810] = and > [RFC7471]) in order to prevent any security issue when propagating > the TLVs into BGP-LS." > =20 > What we are stating here is that when the IGP advertisements are sent = the security/authentication mechanisms specified in the IGP drafts = applies. > This is NOT trying to apply RFC7810/RFC7471 to the new BGP = advertisements. > The security issues related to the new BGP advertisements are = discussed in the previous paragraph. > =20 > > Another issue I have with this section is that the draft specifies = how to send > > new information (the link state TLVs) from one node to another. This = is > > information that was not sent before. When a change like that is = made, I > > think the Security Considerations section should justify why it is = OK to > > distribute this information. Typically you need to justify that = leaking this > > information (to the intended recipient or to the rest of the world) = does not > > (1) make it easier to attack some part of the system, or (2) = distributes > > privacy-sensitive information, or (3) undermines some other = confidentiality > > interest. I think it's fairly easy to make the argument that the = information in > > these TLVs does not do any of the above, but the argument should be = made. > > The last paragraph in the Security Considerations section of RFC = 7752 has just > > such an argument. > =20 > [Les:] Security sections in RFC7810/RFC7471 directly address this = point. > WE could repeat some of that here =E2=80=93 but as per my =E2=80=9Copeni= ng statement=E2=80=9D I am reluctant to do so. > =20 > What do you think? > =20 > Les > =20 --Apple-Mail=_C74AB073-0978-4BDB-88AC-592BDF660B23 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi, = Les.

I think we are = converging, but haven=E2=80=99t converged yet. 

Here=E2=80=99s what is = still missing for me: You are adding some new TLVs to pass into BGP-LS. = Let=E2=80=99s pick one at random =E2=80=94  the Unidirectional = Utilized Bandwidth =E2=80=94 as an example.  You are claiming two = things about this TLV:
  1. That RFC 7752 already has text about sending other TLVs in = BGP-LS.
  2. That RFC 7810 and 7471 have text about = sending Unidirectional Utilized Bandwidth in IS-IS and = OSPF.

Both = of these are true, but I claim that even taken together they are not = enough. BGP runs in different environments than OSPF, so a statement = that sending Unidirectional Utilized Bandwidth in OSPF is safe is not = sufficient for proving it safe in BGP-LS.  Similarly, the fact that = the =E2=80=9CPrefix Metric=E2=80=9D TLV is safe to send over BGP-LS is = no proof that sending Unidirectional Utilized Bandwidth is = safe.

I=E2=80=99= m missing a paragraph making the claim that distributing Unidirectional = Utilized Bandwidth (and the other TLVs) over BGP-LS is = safe. 

Hope= this helps

Yoav

On 17 Oct 2018, at 22:40, Les Ginsberg = (ginsberg) <ginsberg@cisco.com> wrote:

Yoav =E2=80=93
 
I think we are = converging.
Inline.
 
From: Yoav Nir <ynir.ietf@gmail.com> 
Sent: Wednesday, October 17, 2018 = 11:14 AM
To: Les Ginsberg (ginsberg) = <ginsberg@cisco.com>
Cc: secdir@ietf.org; idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org
Subject: Re: Secdir early review of = draft-ietf-idr-te-pm-bgp-13
 
Hi, Les.
 
I agree that my diagram comment is = directed mostly at 7752. However, the RFCs that we produce are intended = to be readable by the general technical community, not just the experts = in the working group. For the same reason that we are required to expand = acronyms on first use, I think it makes sense for a document that = describes new information being sent to identify the target. I will drop = this point, though, because it is a general comment rather than a secdir = issue.
 
I agree about not needing to repeat = information that is already stated elsewhere, but you do need to point = to it, as you do with the general security model of BGP (first = paragraph), and as you do with the paragraph describing how the = transport of attributes is secured (second paragraph). That part is = fine. 
 
RFC 7810 and 7471 describe the new = information to be sent, but they are about IS-IS and OSPF. The Security = considerations section in 7810 contains the following text: "It is = anticipated that in most deployments, the IS-IS protocol is used within = an infrastructure entirely under control of the same operator.=E2=80=9D = and continues to discuss MITM attacks if this is not the case.  Can = the same assumption be made about BGP?  That is the part that I = think is missing. Either state that where BGP-LS is used the assumption = can be made, or justify why there is no risk even when the information = is propagated to infrastructure that is not under control of a single = operator.   The difference between BGP and either IS-IS or OSPF is = not part of those other documents, so IMO it should be stated here.
 
[Les:] I agree with this.
If we look at the Security section of RFC 7752 we see a = number of issues discussed. If we were to add the following into this = document would it suffice?
 
=E2=80=9CSecurity considerations for acquiring and = distributing BGP-LS information are discussed in RFC7752.=E2=80=9D
 
I=E2=80=99d like to = point out that this document is just one of many (existing and yet to be = written) extensions to RFC 7752. Given the way BGP-LS has been defined, = every time we define new information to be advertised by an IGP we have = to write a BGP-LS draft defining how that information is to be = advertised in BGP-LS. So this issue is going to come up over and over. I = hope what we are doing in this document is a good model for Security = Considerations in all of these types of drafts ie.,
 
1)Reference RFC 7752 = Security discussion.
2)Reference the = relevant IGP RFC Security discussion to cover security issues specific = to the class of information covered by the draft
 
What we lack at the = moment is #1 above.
 
Does this work?
 
   Les
 
Yoav


On 17 Oct 2018, at 2:52, Les Ginsberg = (ginsberg) <ginsberg@cisco.com>= wrote:
 
Yoav -
 
Thanx for the review.
 
I'll preface my remarks by = saying I am a big believer in modularity. If a referenced document has = already covered an issue I strongly believe we are better off = referencing that document than trying to repeat/restate what the = referenced document has said.
There are only two things that can happen when we = repeat/restate:
 
1)We are redundant
2)We introduce ambiguity
 
Neither of these is = desirable.
 
Responses inline.
 
> -----Original = Message-----
> From: Yoav Nir = <ynir.ietf@gmail.com>
> Sent: Tuesday, = October 16, 2018 2:18 PM
> To: secdir@ietf.org
> Cc: idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org
> Subject: Secdir early = review of draft-ietf-idr-te-pm-bgp-13
> 
> Reviewer: Yoav = Nir
> Review result: = Has Nits
> 
> This is an = early review with a specific request to review the Security
> Considerations = section.
> 
> The draft adds = a bunch of TLVs to be sent from routers regarding the link
> state of the link = used for IGP. The draft references RFC 7752 which defined
> earlier TLVs used to = carry NLRI (reachability) information.
> 
> What I found = difficult about both 7752 and this draft is the vagueness about
> who the consumer of = this information is. The abstract of 7752 begins like this:
> "In a number of = environments, a component external to a network is called
> upon to perform = computations based on the network topology and current
> state of the = connections within the network, including Traffic Engineering
> (TE) information." = There is also a diagram with information flowing to a
> "consumer"
> and that's it. Is it = an SDN controller? Some kind of application?
> 
 
[Les:] The diagram you are = referring to seems most likely to be in RFC 7752 since there is no such = diagram in this draft.
Which leads me to say if you feel this is insufficient then = it needs to be taken up in the context of RFC 7752 - not this draft.
 
Hopefully this makes sense = to you as well.
 
> OK. On to the Security Considerations section. It begins = with a statement that
> this does not affect the security model of BGP.  = Although that is just claimed
> and not supported in text, it seems reasonable. I should = note that this
> paragraph is copied from 7752.
> 
> The second (and = last) paragraph in the security considerations section talks
> about the new = attributes. It mentions that security and authentication are
> assumed to be used = just as in RFCs 7810 and 7471. With proper
> authentication this = information is not sent except to the proper consumer.
> However, there is an = important difference that I think needs to be
> addressed. 7810 and = 7471 are about IS-IS and OSPF respectively. There
> routing protocols are = typically used in closed environments, and the Security
> Considerations of = 7810 state that explicitly. BGP (the subject of this
> document) is = different in that it is typically used all over the Internet. = Without
> further clarity = about who and where the "consumer" is, it has to be assumed
> that the information = might at least leak out.
> 
[Les:] I think you have misinterpreted this paragraph. = (emphasis added below)
 
" = The IGP
   = instances originating these TLVs are assumed to have all the = required
   = security and authentication mechanism (as described in [RFC7810] and
   [RFC7471]) in = order to prevent any security issue when propagating
   the TLVs into BGP-LS."
 
What we are stating here = is that when the IGP advertisements are sent the security/authentication = mechanisms specified in the IGP drafts applies.
This is NOT trying to = apply RFC7810/RFC7471 to the new BGP advertisements.
The security issues = related to the new BGP advertisements are discussed in the previous = paragraph.
 
> Another issue I have = with this section is that the draft specifies how to send
> new information (the = link state TLVs) from one node to another. This is
> information that was = not sent before. When a change like that is made, I
> think the Security = Considerations section should justify why it is OK to
> distribute this = information. Typically you need to justify that leaking this
> information (to the = intended recipient or to the rest of the world) does not
> (1) make it easier to = attack some part of the system, or (2) distributes
> privacy-sensitive = information, or (3) undermines some other confidentiality
> interest. I think = it's fairly easy to make the argument that the information in
> these TLVs does not = do any of the above, but the argument should be made.
> The last paragraph in = the Security Considerations section of RFC 7752 has just
> such an argument.
 
[Les:] Security sections in = RFC7810/RFC7471 directly address this point.
WE could repeat some of = that here =E2=80=93 but as per my =E2=80=9Copening statement=E2=80=9D I = am reluctant to do so.
 
What do you think?
 
   Les
 
= --Apple-Mail=_C74AB073-0978-4BDB-88AC-592BDF660B23-- From nobody Thu Oct 18 11:01:02 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6F8C130E02; Thu, 18 Oct 2018 11:00:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JbwGnvILObsV; Thu, 18 Oct 2018 11:00:40 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5ED16130E89; Thu, 18 Oct 2018 11:00:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=68656; q=dns/txt; s=iport; t=1539885639; x=1541095239; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=bo1+hOatPQBFP5cc1RRJzeyKVTH7z/skaT8JxIGkz+8=; b=Sja2zEOep6Wk9fXSnlqJiPxzfblk5NyflU1t6+modj7VCBCwzavmfEAj 8lca6UHV3IGsFUacbD6/5GzM3+KGEWp2GUTOo1I0mXcoFCXqbewdJ55j0 3bkk9f6y9mFwd2rESracGPFxlpfn8TURTmrn76InVBDSmjqwl+o1rcYDn 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AbAADiychb/49dJa1aChoBAQEBAQI?= =?us-ascii?q?BAQEBBwIBAQEBgVQCAQEBAQsBgQ1IL2Z/KAqDa5Qygg16h36QEQsBAYRsAhe?= =?us-ascii?q?EbBUMNwoNAQMBAQIBAQJtKIU5AQEBAQIBGgkKPg4FBwQCAQgOAwQBASEBBgM?= =?us-ascii?q?CAgIfERQJCAIEDgUIDIMNgR1MAw0IpnOBLod8DYIYiQWBK4EdF4FBPyZqAYJ?= =?us-ascii?q?dNYJWgX1CDxCCTYJXAo4thg+JTi4JAolzg06DHB+QJ41DiFoCERSBJjMigVV?= =?us-ascii?q?wFYMngiYXjhlvih6BHwEB?= X-IronPort-AV: E=Sophos;i="5.54,397,1534809600"; d="scan'208,217";a="250278552" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Oct 2018 18:00:15 +0000 Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id w9II0Dek012409 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 18 Oct 2018 18:00:14 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 18 Oct 2018 13:00:13 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Thu, 18 Oct 2018 13:00:13 -0500 From: "Les Ginsberg (ginsberg)" To: Yoav Nir CC: "secdir@ietf.org" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" Thread-Topic: Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8A= Date: Thu, 18 Oct 2018 18:00:13 +0000 Message-ID: <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> In-Reply-To: <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_92af26fef2da470d853f292c84f026a0XCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.11, xch-aln-001.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Oct 2018 18:00:53 -0000 --_000_92af26fef2da470d853f292c84f026a0XCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW9hdiDigJMNCg0KSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVy dGlzaW5nIHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2Ug aGF2ZSBhIHN0YXRlbWVudCBpbiB0aGUgSUdQIGRyYWZ0czoNCg0KRnJvbSBSRkM3ODEwDQoNCuKA nFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGluIHRoaXMgZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0 b3IgdG8NCiAgIGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRo LCBkZWxheSkgdGhhdCBjb3VsZCBiZQ0KICAgc2Vuc2l0aXZlIGFuZCB0aGF0IGFuIG9wZXJhdG9y IG1heSBub3Qgd2FudCB0byBkaXNjbG9zZS7igJ0NCg0KSW4gcmVnYXJkcyB0byB0aGUgcmlza3Mg YXNzb2NpYXRlZCB3aXRoIHNlbmRpbmcgaW5mb3JtYXRpb24gdmlhIEJHUC1MUyB3ZSBoYXZlIGEg bnVtYmVyIG9mIHN0YXRlbWVudHMgaW4gUkZDIDc3NTIg4oCTIG1vc3QgcmVsZXZhbnQgaXM6DQoN CuKAnEFkZGl0aW9uYWxseSwgaXQgbWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9m IGxpbmstc3RhdGUgYW5kDQogICBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhpcyBk b2N1bWVudCBjb25zdGl0dXRlcyBhIHJpc2sgdG8NCiAgIGNvbmZpZGVudGlhbGl0eSBvZiBtaXNz aW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmUNCiAgIGluZm9ybWF0aW9uIGFi b3V0IHRoZSBuZXR3b3JrLuKAnQ0KDQpTbyBsb25nIGFzIHRoZXJlIGFyZSByZWZlcmVuY2VzIHRv IGJvdGggdGhlIElHUCBSRkNzIGFuZCBSRkMgNzc1MiBJIGFtIHRoZXJlZm9yZSBoYXJkIHByZXNz ZWQgdG8gdW5kZXJzdGFuZCB3aGF0IGVsc2UgY291bGQgYmUgdXNlZnVsbHkgc2FpZC4NCkNlcnRh aW5seSB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBCR1AtTFMgdHJhbnNwb3J0IG1lY2hh bmlzbSBhcmUgbm90IGFsdGVyZWQgYnkgYWRkaW5nIHNvbWUgbmV3IFRMVnMg4oCTIGFuZCBzaW5j ZSB0aGUgSUdQIFJGQ3MgaGF2ZSBhbHJlYWR5IGNvdmVyZWQgcmlza3MgYXNzb2NpYXRlZCB3aXRo IHRoZSBzcGVjaWZpYyBjbGFzcyBvZiBpbmZvcm1hdGlvbiAobm90IHNpbXBseSB0aGUgcmlza3Mg YXNzb2NpYXRlZCB3aXRoIHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRv IGhhdmUgdG8gcHJvdmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkg YmUgc2FpZCB0aGF0IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuDQoN Cj8/Pw0KDQogICBMZXMNCg0KDQpGcm9tOiBZb2F2IE5pciA8eW5pci5pZXRmQGdtYWlsLmNvbT4N ClNlbnQ6IFRodXJzZGF5LCBPY3RvYmVyIDE4LCAyMDE4IDk6MzggQU0NClRvOiBMZXMgR2luc2Jl cmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdAY2lzY28uY29tPg0KQ2M6IHNlY2RpckBpZXRmLm9yZzsg aWRyQGlldGYub3JnOyBpZXRmQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnDQpTdWJqZWN0OiBSZTogU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRm LWlkci10ZS1wbS1iZ3AtMTMNCg0KSGksIExlcy4NCg0KSSB0aGluayB3ZSBhcmUgY29udmVyZ2lu ZywgYnV0IGhhdmVu4oCZdCBjb252ZXJnZWQgeWV0Lg0KDQpIZXJl4oCZcyB3aGF0IGlzIHN0aWxs IG1pc3NpbmcgZm9yIG1lOiBZb3UgYXJlIGFkZGluZyBzb21lIG5ldyBUTFZzIHRvIHBhc3MgaW50 byBCR1AtTFMuIExldOKAmXMgcGljayBvbmUgYXQgcmFuZG9tIOKAlCAgdGhlIFVuaWRpcmVjdGlv bmFsIFV0aWxpemVkIEJhbmR3aWR0aCDigJQgYXMgYW4gZXhhbXBsZS4gIFlvdSBhcmUgY2xhaW1p bmcgdHdvIHRoaW5ncyBhYm91dCB0aGlzIFRMVjoNCg0KICAxLiAgVGhhdCBSRkMgNzc1MiBhbHJl YWR5IGhhcyB0ZXh0IGFib3V0IHNlbmRpbmcgb3RoZXIgVExWcyBpbiBCR1AtTFMuDQogIDIuICBU aGF0IFJGQyA3ODEwIGFuZCA3NDcxIGhhdmUgdGV4dCBhYm91dCBzZW5kaW5nIFVuaWRpcmVjdGlv bmFsIFV0aWxpemVkIEJhbmR3aWR0aCBpbiBJUy1JUyBhbmQgT1NQRi4NCg0KQm90aCBvZiB0aGVz ZSBhcmUgdHJ1ZSwgYnV0IEkgY2xhaW0gdGhhdCBldmVuIHRha2VuIHRvZ2V0aGVyIHRoZXkgYXJl IG5vdCBlbm91Z2guIEJHUCBydW5zIGluIGRpZmZlcmVudCBlbnZpcm9ubWVudHMgdGhhbiBPU1BG LCBzbyBhIHN0YXRlbWVudCB0aGF0IHNlbmRpbmcgVW5pZGlyZWN0aW9uYWwgVXRpbGl6ZWQgQmFu ZHdpZHRoIGluIE9TUEYgaXMgc2FmZSBpcyBub3Qgc3VmZmljaWVudCBmb3IgcHJvdmluZyBpdCBz YWZlIGluIEJHUC1MUy4gIFNpbWlsYXJseSwgdGhlIGZhY3QgdGhhdCB0aGUg4oCcUHJlZml4IE1l dHJpY+KAnSBUTFYgaXMgc2FmZSB0byBzZW5kIG92ZXIgQkdQLUxTIGlzIG5vIHByb29mIHRoYXQg c2VuZGluZyBVbmlkaXJlY3Rpb25hbCBVdGlsaXplZCBCYW5kd2lkdGggaXMgc2FmZS4NCg0KSeKA mW0gbWlzc2luZyBhIHBhcmFncmFwaCBtYWtpbmcgdGhlIGNsYWltIHRoYXQgZGlzdHJpYnV0aW5n IFVuaWRpcmVjdGlvbmFsIFV0aWxpemVkIEJhbmR3aWR0aCAoYW5kIHRoZSBvdGhlciBUTFZzKSBv dmVyIEJHUC1MUyBpcyBzYWZlLg0KDQpIb3BlIHRoaXMgaGVscHMNCg0KWW9hdg0KDQoNCk9uIDE3 IE9jdCAyMDE4LCBhdCAyMjo0MCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNiZXJnQGNp c2NvLmNvbTxtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tPj4gd3JvdGU6DQoNCllvYXYg4oCTDQoN CkkgdGhpbmsgd2UgYXJlIGNvbnZlcmdpbmcuDQpJbmxpbmUuDQoNCkZyb206IFlvYXYgTmlyIDx5 bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPj4NClNlbnQ6IFdl ZG5lc2RheSwgT2N0b2JlciAxNywgMjAxOCAxMToxNCBBTQ0KVG86IExlcyBHaW5zYmVyZyAoZ2lu c2JlcmcpIDxnaW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbT4+DQpD Yzogc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+OyBpZHJAaWV0Zi5vcmc8 bWFpbHRvOmlkckBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+ OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRm LWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFNlY2RpciBlYXJseSBy ZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoNCkhpLCBMZXMuDQoNCkkgYWdy ZWUgdGhhdCBteSBkaWFncmFtIGNvbW1lbnQgaXMgZGlyZWN0ZWQgbW9zdGx5IGF0IDc3NTIuIEhv d2V2ZXIsIHRoZSBSRkNzIHRoYXQgd2UgcHJvZHVjZSBhcmUgaW50ZW5kZWQgdG8gYmUgcmVhZGFi bGUgYnkgdGhlIGdlbmVyYWwgdGVjaG5pY2FsIGNvbW11bml0eSwgbm90IGp1c3QgdGhlIGV4cGVy dHMgaW4gdGhlIHdvcmtpbmcgZ3JvdXAuIEZvciB0aGUgc2FtZSByZWFzb24gdGhhdCB3ZSBhcmUg cmVxdWlyZWQgdG8gZXhwYW5kIGFjcm9ueW1zIG9uIGZpcnN0IHVzZSwgSSB0aGluayBpdCBtYWtl cyBzZW5zZSBmb3IgYSBkb2N1bWVudCB0aGF0IGRlc2NyaWJlcyBuZXcgaW5mb3JtYXRpb24gYmVp bmcgc2VudCB0byBpZGVudGlmeSB0aGUgdGFyZ2V0LiBJIHdpbGwgZHJvcCB0aGlzIHBvaW50LCB0 aG91Z2gsIGJlY2F1c2UgaXQgaXMgYSBnZW5lcmFsIGNvbW1lbnQgcmF0aGVyIHRoYW4gYSBzZWNk aXIgaXNzdWUuDQoNCkkgYWdyZWUgYWJvdXQgbm90IG5lZWRpbmcgdG8gcmVwZWF0IGluZm9ybWF0 aW9uIHRoYXQgaXMgYWxyZWFkeSBzdGF0ZWQgZWxzZXdoZXJlLCBidXQgeW91IGRvIG5lZWQgdG8g cG9pbnQgdG8gaXQsIGFzIHlvdSBkbyB3aXRoIHRoZSBnZW5lcmFsIHNlY3VyaXR5IG1vZGVsIG9m IEJHUCAoZmlyc3QgcGFyYWdyYXBoKSwgYW5kIGFzIHlvdSBkbyB3aXRoIHRoZSBwYXJhZ3JhcGgg ZGVzY3JpYmluZyBob3cgdGhlIHRyYW5zcG9ydCBvZiBhdHRyaWJ1dGVzIGlzIHNlY3VyZWQgKHNl Y29uZCBwYXJhZ3JhcGgpLiBUaGF0IHBhcnQgaXMgZmluZS4NCg0KUkZDIDc4MTAgYW5kIDc0NzEg ZGVzY3JpYmUgdGhlIG5ldyBpbmZvcm1hdGlvbiB0byBiZSBzZW50LCBidXQgdGhleSBhcmUgYWJv dXQgSVMtSVMgYW5kIE9TUEYuIFRoZSBTZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIGlu IDc4MTAgY29udGFpbnMgdGhlIGZvbGxvd2luZyB0ZXh0OiAiSXQgaXMgYW50aWNpcGF0ZWQgdGhh dCBpbiBtb3N0IGRlcGxveW1lbnRzLCB0aGUgSVMtSVMgcHJvdG9jb2wgaXMgdXNlZCB3aXRoaW4g YW4gaW5mcmFzdHJ1Y3R1cmUgZW50aXJlbHkgdW5kZXIgY29udHJvbCBvZiB0aGUgc2FtZSBvcGVy YXRvci7igJ0gYW5kIGNvbnRpbnVlcyB0byBkaXNjdXNzIE1JVE0gYXR0YWNrcyBpZiB0aGlzIGlz IG5vdCB0aGUgY2FzZS4gIENhbiB0aGUgc2FtZSBhc3N1bXB0aW9uIGJlIG1hZGUgYWJvdXQgQkdQ PyAgVGhhdCBpcyB0aGUgcGFydCB0aGF0IEkgdGhpbmsgaXMgbWlzc2luZy4gRWl0aGVyIHN0YXRl IHRoYXQgd2hlcmUgQkdQLUxTIGlzIHVzZWQgdGhlIGFzc3VtcHRpb24gY2FuIGJlIG1hZGUsIG9y IGp1c3RpZnkgd2h5IHRoZXJlIGlzIG5vIHJpc2sgZXZlbiB3aGVuIHRoZSBpbmZvcm1hdGlvbiBp cyBwcm9wYWdhdGVkIHRvIGluZnJhc3RydWN0dXJlIHRoYXQgaXMgbm90IHVuZGVyIGNvbnRyb2wg b2YgYSBzaW5nbGUgb3BlcmF0b3IuICAgVGhlIGRpZmZlcmVuY2UgYmV0d2VlbiBCR1AgYW5kIGVp dGhlciBJUy1JUyBvciBPU1BGIGlzIG5vdCBwYXJ0IG9mIHRob3NlIG90aGVyIGRvY3VtZW50cywg c28gSU1PIGl0IHNob3VsZCBiZSBzdGF0ZWQgaGVyZS4NCg0KW0xlczpdIEkgYWdyZWUgd2l0aCB0 aGlzLg0KSWYgd2UgbG9vayBhdCB0aGUgU2VjdXJpdHkgc2VjdGlvbiBvZiBSRkMgNzc1MiB3ZSBz ZWUgYSBudW1iZXIgb2YgaXNzdWVzIGRpc2N1c3NlZC4gSWYgd2Ugd2VyZSB0byBhZGQgdGhlIGZv bGxvd2luZyBpbnRvIHRoaXMgZG9jdW1lbnQgd291bGQgaXQgc3VmZmljZT8NCg0K4oCcU2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgZm9yIGFjcXVpcmluZyBhbmQgZGlzdHJpYnV0aW5nIEJHUC1MUyBp bmZvcm1hdGlvbiBhcmUgZGlzY3Vzc2VkIGluIFJGQzc3NTIu4oCdDQoNCknigJlkIGxpa2UgdG8g cG9pbnQgb3V0IHRoYXQgdGhpcyBkb2N1bWVudCBpcyBqdXN0IG9uZSBvZiBtYW55IChleGlzdGlu ZyBhbmQgeWV0IHRvIGJlIHdyaXR0ZW4pIGV4dGVuc2lvbnMgdG8gUkZDIDc3NTIuIEdpdmVuIHRo ZSB3YXkgQkdQLUxTIGhhcyBiZWVuIGRlZmluZWQsIGV2ZXJ5IHRpbWUgd2UgZGVmaW5lIG5ldyBp bmZvcm1hdGlvbiB0byBiZSBhZHZlcnRpc2VkIGJ5IGFuIElHUCB3ZSBoYXZlIHRvIHdyaXRlIGEg QkdQLUxTIGRyYWZ0IGRlZmluaW5nIGhvdyB0aGF0IGluZm9ybWF0aW9uIGlzIHRvIGJlIGFkdmVy dGlzZWQgaW4gQkdQLUxTLiBTbyB0aGlzIGlzc3VlIGlzIGdvaW5nIHRvIGNvbWUgdXAgb3ZlciBh bmQgb3Zlci4gSSBob3BlIHdoYXQgd2UgYXJlIGRvaW5nIGluIHRoaXMgZG9jdW1lbnQgaXMgYSBn b29kIG1vZGVsIGZvciBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBpbiBhbGwgb2YgdGhlc2UgdHlw ZXMgb2YgZHJhZnRzIGllLiwNCg0KMSlSZWZlcmVuY2UgUkZDIDc3NTIgU2VjdXJpdHkgZGlzY3Vz c2lvbi4NCjIpUmVmZXJlbmNlIHRoZSByZWxldmFudCBJR1AgUkZDIFNlY3VyaXR5IGRpc2N1c3Np b24gdG8gY292ZXIgc2VjdXJpdHkgaXNzdWVzIHNwZWNpZmljIHRvIHRoZSBjbGFzcyBvZiBpbmZv cm1hdGlvbiBjb3ZlcmVkIGJ5IHRoZSBkcmFmdA0KDQpXaGF0IHdlIGxhY2sgYXQgdGhlIG1vbWVu dCBpcyAjMSBhYm92ZS4NCg0KRG9lcyB0aGlzIHdvcms/DQoNCiAgIExlcw0KDQpZb2F2DQoNCg0K DQpPbiAxNyBPY3QgMjAxOCwgYXQgMjo1MiwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNi ZXJnQGNpc2NvLmNvbTxtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tPj4gd3JvdGU6DQoNCllvYXYg LQ0KDQpUaGFueCBmb3IgdGhlIHJldmlldy4NCg0KSSdsbCBwcmVmYWNlIG15IHJlbWFya3MgYnkg c2F5aW5nIEkgYW0gYSBiaWcgYmVsaWV2ZXIgaW4gbW9kdWxhcml0eS4gSWYgYSByZWZlcmVuY2Vk IGRvY3VtZW50IGhhcyBhbHJlYWR5IGNvdmVyZWQgYW4gaXNzdWUgSSBzdHJvbmdseSBiZWxpZXZl IHdlIGFyZSBiZXR0ZXIgb2ZmIHJlZmVyZW5jaW5nIHRoYXQgZG9jdW1lbnQgdGhhbiB0cnlpbmcg dG8gcmVwZWF0L3Jlc3RhdGUgd2hhdCB0aGUgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgc2FpZC4N ClRoZXJlIGFyZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVuIHdoZW4gd2UgcmVwZWF0 L3Jlc3RhdGU6DQoNCjEpV2UgYXJlIHJlZHVuZGFudA0KMilXZSBpbnRyb2R1Y2UgYW1iaWd1aXR5 DQoNCk5laXRoZXIgb2YgdGhlc2UgaXMgZGVzaXJhYmxlLg0KDQpSZXNwb25zZXMgaW5saW5lLg0K DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IFlvYXYgTmlyIDx5bmlyLmll dGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPj4NCj4gU2VudDogVHVlc2Rh eSwgT2N0b2JlciAxNiwgMjAxOCAyOjE4IFBNDQo+IFRvOiBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRv OnNlY2RpckBpZXRmLm9yZz4NCj4gQ2M6IGlkckBpZXRmLm9yZzxtYWlsdG86aWRyQGlldGYub3Jn PjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IGRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxA aWV0Zi5vcmc+DQo+IFN1YmplY3Q6IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1p ZHItdGUtcG0tYmdwLTEzDQo+DQo+IFJldmlld2VyOiBZb2F2IE5pcg0KPiBSZXZpZXcgcmVzdWx0 OiBIYXMgTml0cw0KPg0KPiBUaGlzIGlzIGFuIGVhcmx5IHJldmlldyB3aXRoIGEgc3BlY2lmaWMg cmVxdWVzdCB0byByZXZpZXcgdGhlIFNlY3VyaXR5DQo+IENvbnNpZGVyYXRpb25zIHNlY3Rpb24u DQo+DQo+IFRoZSBkcmFmdCBhZGRzIGEgYnVuY2ggb2YgVExWcyB0byBiZSBzZW50IGZyb20gcm91 dGVycyByZWdhcmRpbmcgdGhlIGxpbmsNCj4gc3RhdGUgb2YgdGhlIGxpbmsgdXNlZCBmb3IgSUdQ LiBUaGUgZHJhZnQgcmVmZXJlbmNlcyBSRkMgNzc1MiB3aGljaCBkZWZpbmVkDQo+IGVhcmxpZXIg VExWcyB1c2VkIHRvIGNhcnJ5IE5MUkkgKHJlYWNoYWJpbGl0eSkgaW5mb3JtYXRpb24uDQo+DQo+ IFdoYXQgSSBmb3VuZCBkaWZmaWN1bHQgYWJvdXQgYm90aCA3NzUyIGFuZCB0aGlzIGRyYWZ0IGlz IHRoZSB2YWd1ZW5lc3MgYWJvdXQNCj4gd2hvIHRoZSBjb25zdW1lciBvZiB0aGlzIGluZm9ybWF0 aW9uIGlzLiBUaGUgYWJzdHJhY3Qgb2YgNzc1MiBiZWdpbnMgbGlrZSB0aGlzOg0KPiAiSW4gYSBu dW1iZXIgb2YgZW52aXJvbm1lbnRzLCBhIGNvbXBvbmVudCBleHRlcm5hbCB0byBhIG5ldHdvcmsg aXMgY2FsbGVkDQo+IHVwb24gdG8gcGVyZm9ybSBjb21wdXRhdGlvbnMgYmFzZWQgb24gdGhlIG5l dHdvcmsgdG9wb2xvZ3kgYW5kIGN1cnJlbnQNCj4gc3RhdGUgb2YgdGhlIGNvbm5lY3Rpb25zIHdp dGhpbiB0aGUgbmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJpbmcNCj4gKFRFKSBp bmZvcm1hdGlvbi4iIFRoZXJlIGlzIGFsc28gYSBkaWFncmFtIHdpdGggaW5mb3JtYXRpb24gZmxv d2luZyB0byBhDQo+ICJjb25zdW1lciINCj4gYW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0ROIGNv bnRyb2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj8NCj4NCg0KW0xlczpdIFRoZSBkaWFn cmFtIHlvdSBhcmUgcmVmZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRvIGJlIGluIFJGQyA3 NzUyIHNpbmNlIHRoZXJlIGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRyYWZ0Lg0KV2hpY2gg bGVhZHMgbWUgdG8gc2F5IGlmIHlvdSBmZWVsIHRoaXMgaXMgaW5zdWZmaWNpZW50IHRoZW4gaXQg bmVlZHMgdG8gYmUgdGFrZW4gdXAgaW4gdGhlIGNvbnRleHQgb2YgUkZDIDc3NTIgLSBub3QgdGhp cyBkcmFmdC4NCg0KSG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91IGFzIHdlbGwuDQoN Cj4gT0suIE9uIHRvIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLiBJdCBiZWdp bnMgd2l0aCBhIHN0YXRlbWVudCB0aGF0DQo+IHRoaXMgZG9lcyBub3QgYWZmZWN0IHRoZSBzZWN1 cml0eSBtb2RlbCBvZiBCR1AuICBBbHRob3VnaCB0aGF0IGlzIGp1c3QgY2xhaW1lZA0KPiBhbmQg bm90IHN1cHBvcnRlZCBpbiB0ZXh0LCBpdCBzZWVtcyByZWFzb25hYmxlLiBJIHNob3VsZCBub3Rl IHRoYXQgdGhpcw0KPiBwYXJhZ3JhcGggaXMgY29waWVkIGZyb20gNzc1Mi4NCj4NCj4gVGhlIHNl Y29uZCAoYW5kIGxhc3QpIHBhcmFncmFwaCBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMg c2VjdGlvbiB0YWxrcw0KPiBhYm91dCB0aGUgbmV3IGF0dHJpYnV0ZXMuIEl0IG1lbnRpb25zIHRo YXQgc2VjdXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIGFyZQ0KPiBhc3N1bWVkIHRvIGJlIHVzZWQg anVzdCBhcyBpbiBSRkNzIDc4MTAgYW5kIDc0NzEuIFdpdGggcHJvcGVyDQo+IGF1dGhlbnRpY2F0 aW9uIHRoaXMgaW5mb3JtYXRpb24gaXMgbm90IHNlbnQgZXhjZXB0IHRvIHRoZSBwcm9wZXIgY29u c3VtZXIuDQo+IEhvd2V2ZXIsIHRoZXJlIGlzIGFuIGltcG9ydGFudCBkaWZmZXJlbmNlIHRoYXQg SSB0aGluayBuZWVkcyB0byBiZQ0KPiBhZGRyZXNzZWQuIDc4MTAgYW5kIDc0NzEgYXJlIGFib3V0 IElTLUlTIGFuZCBPU1BGIHJlc3BlY3RpdmVseS4gVGhlcmUNCj4gcm91dGluZyBwcm90b2NvbHMg YXJlIHR5cGljYWxseSB1c2VkIGluIGNsb3NlZCBlbnZpcm9ubWVudHMsIGFuZCB0aGUgU2VjdXJp dHkNCj4gQ29uc2lkZXJhdGlvbnMgb2YgNzgxMCBzdGF0ZSB0aGF0IGV4cGxpY2l0bHkuIEJHUCAo dGhlIHN1YmplY3Qgb2YgdGhpcw0KPiBkb2N1bWVudCkgaXMgZGlmZmVyZW50IGluIHRoYXQgaXQg aXMgdHlwaWNhbGx5IHVzZWQgYWxsIG92ZXIgdGhlIEludGVybmV0LiBXaXRob3V0DQo+IGZ1cnRo ZXIgY2xhcml0eSBhYm91dCB3aG8gYW5kIHdoZXJlIHRoZSAiY29uc3VtZXIiIGlzLCBpdCBoYXMg dG8gYmUgYXNzdW1lZA0KPiB0aGF0IHRoZSBpbmZvcm1hdGlvbiBtaWdodCBhdCBsZWFzdCBsZWFr IG91dC4NCj4NCltMZXM6XSBJIHRoaW5rIHlvdSBoYXZlIG1pc2ludGVycHJldGVkIHRoaXMgcGFy YWdyYXBoLiAoZW1waGFzaXMgYWRkZWQgYmVsb3cpDQoNCiIgVGhlIElHUA0KICAgaW5zdGFuY2Vz IG9yaWdpbmF0aW5nIHRoZXNlIFRMVnMgYXJlIGFzc3VtZWQgdG8gaGF2ZSBhbGwgdGhlIHJlcXVp cmVkDQogICBzZWN1cml0eSBhbmQgYXV0aGVudGljYXRpb24gbWVjaGFuaXNtIChhcyBkZXNjcmli ZWQgaW4gW1JGQzc4MTBdIGFuZA0KICAgW1JGQzc0NzFdKSBpbiBvcmRlciB0byBwcmV2ZW50IGFu eSBzZWN1cml0eSBpc3N1ZSB3aGVuIHByb3BhZ2F0aW5nDQogICB0aGUgVExWcyBpbnRvIEJHUC1M Uy4iDQoNCldoYXQgd2UgYXJlIHN0YXRpbmcgaGVyZSBpcyB0aGF0IHdoZW4gdGhlIElHUCBhZHZl cnRpc2VtZW50cyBhcmUgc2VudCB0aGUgc2VjdXJpdHkvYXV0aGVudGljYXRpb24gbWVjaGFuaXNt cyBzcGVjaWZpZWQgaW4gdGhlIElHUCBkcmFmdHMgYXBwbGllcy4NClRoaXMgaXMgTk9UIHRyeWlu ZyB0byBhcHBseSBSRkM3ODEwL1JGQzc0NzEgdG8gdGhlIG5ldyBCR1AgYWR2ZXJ0aXNlbWVudHMu DQpUaGUgc2VjdXJpdHkgaXNzdWVzIHJlbGF0ZWQgdG8gdGhlIG5ldyBCR1AgYWR2ZXJ0aXNlbWVu dHMgYXJlIGRpc2N1c3NlZCBpbiB0aGUgcHJldmlvdXMgcGFyYWdyYXBoLg0KDQo+IEFub3RoZXIg aXNzdWUgSSBoYXZlIHdpdGggdGhpcyBzZWN0aW9uIGlzIHRoYXQgdGhlIGRyYWZ0IHNwZWNpZmll cyBob3cgdG8gc2VuZA0KPiBuZXcgaW5mb3JtYXRpb24gKHRoZSBsaW5rIHN0YXRlIFRMVnMpIGZy b20gb25lIG5vZGUgdG8gYW5vdGhlci4gVGhpcyBpcw0KPiBpbmZvcm1hdGlvbiB0aGF0IHdhcyBu b3Qgc2VudCBiZWZvcmUuIFdoZW4gYSBjaGFuZ2UgbGlrZSB0aGF0IGlzIG1hZGUsIEkNCj4gdGhp bmsgdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gc2hvdWxkIGp1c3RpZnkgd2h5 IGl0IGlzIE9LIHRvDQo+IGRpc3RyaWJ1dGUgdGhpcyBpbmZvcm1hdGlvbi4gVHlwaWNhbGx5IHlv dSBuZWVkIHRvIGp1c3RpZnkgdGhhdCBsZWFraW5nIHRoaXMNCj4gaW5mb3JtYXRpb24gKHRvIHRo ZSBpbnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJlc3Qgb2YgdGhlIHdvcmxkKSBkb2VzIG5v dA0KPiAoMSkgbWFrZSBpdCBlYXNpZXIgdG8gYXR0YWNrIHNvbWUgcGFydCBvZiB0aGUgc3lzdGVt LCBvciAoMikgZGlzdHJpYnV0ZXMNCj4gcHJpdmFjeS1zZW5zaXRpdmUgaW5mb3JtYXRpb24sIG9y ICgzKSB1bmRlcm1pbmVzIHNvbWUgb3RoZXIgY29uZmlkZW50aWFsaXR5DQo+IGludGVyZXN0LiBJ IHRoaW5rIGl0J3MgZmFpcmx5IGVhc3kgdG8gbWFrZSB0aGUgYXJndW1lbnQgdGhhdCB0aGUgaW5m b3JtYXRpb24gaW4NCj4gdGhlc2UgVExWcyBkb2VzIG5vdCBkbyBhbnkgb2YgdGhlIGFib3ZlLCBi dXQgdGhlIGFyZ3VtZW50IHNob3VsZCBiZSBtYWRlLg0KPiBUaGUgbGFzdCBwYXJhZ3JhcGggaW4g dGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2YgUkZDIDc3NTIgaGFzIGp1c3QN Cj4gc3VjaCBhbiBhcmd1bWVudC4NCg0KW0xlczpdIFNlY3VyaXR5IHNlY3Rpb25zIGluIFJGQzc4 MTAvUkZDNzQ3MSBkaXJlY3RseSBhZGRyZXNzIHRoaXMgcG9pbnQuDQpXRSBjb3VsZCByZXBlYXQg c29tZSBvZiB0aGF0IGhlcmUg4oCTIGJ1dCBhcyBwZXIgbXkg4oCcb3BlbmluZyBzdGF0ZW1lbnTi gJ0gSSBhbSByZWx1Y3RhbnQgdG8gZG8gc28uDQoNCldoYXQgZG8geW91IHRoaW5rPw0KDQogICBM ZXMNCg0KDQo= --_000_92af26fef2da470d853f292c84f026a0XCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtY29udmVy dGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjExNjg2 NjY5MjU7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjgyNzYzMzU3NDt9DQpvbA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPllvYXYg4oCTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5JbiByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcg dGhlIHNwZWNpZmljIGluZm9ybWF0aW9uIGNvdmVyZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEg c3RhdGVtZW50IGluIHRoZSBJR1AgZHJhZnRzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+RnJvbSBSRkM3ODEwPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj7igJxUaGUgc3ViLVRMVnMgaW50cm9kdWNlZCBpbiB0aGlzIGRvY3VtZW50 IGFsbG93IGFuIG9wZXJhdG9yIHRvPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBhZHZl cnRpc2Ugc3RhdGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQg Y291bGQgYmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHNlbnNpdGl2ZSBhbmQgdGhh dCBhbiBvcGVyYXRvciBtYXkgbm90IHdhbnQgdG8gZGlzY2xvc2Uu4oCdPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JbiByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3Nv Y2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhhdmUgYSBudW1i ZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCByZWxldmFudCBpczo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPuKAnEFkZGl0aW9uYWxseSwgaXQg bWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9mIGxpbmstc3RhdGUgYW5kPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4g dGhpcyBkb2N1bWVudCBjb25zdGl0dXRlcyBhIHJpc2sgdG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7Jm5ic3A7IGNvbmZpZGVudGlhbGl0eSBvZiBtaXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNp YWxseSBzZW5zaXRpdmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IGluZm9ybWF0aW9u IGFib3V0IHRoZSBuZXR3b3JrLuKAnTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+U28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJR1Ag UkZDcyBhbmQgUkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVyc3Rh bmQgd2hhdCBlbHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkNl cnRhaW5seSB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBCR1AtTFMgdHJhbnNwb3J0IG1l Y2hhbmlzbSBhcmUgbm90IGFsdGVyZWQgYnkgYWRkaW5nIHNvbWUgbmV3IFRMVnMg4oCTIGFuZCBz aW5jZSB0aGUgSUdQIFJGQ3MgaGF2ZSBhbHJlYWR5IGNvdmVyZWQgcmlza3MNCiBhc3NvY2lhdGVk IHdpdGggdGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20pIHlvdSBhcmUgZ29p bmcgdG8gaGF2ZSB0byBwcm92aWRlIG1vcmUgc3BlY2lmaWNzIG9uIHdoYXQgY2FuIG1lYW5pbmdm dWxseSBiZSBzYWlkIHRoYXQgaXMgbm90IGFscmVhZHkgY292ZXJlZCBpbiB0aGUgcmVmZXJlbmNl cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPj8/PzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1 ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAw aW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZy b206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBZb2F2IE5pciAmbHQ7eW5pci5pZXRmQGdt YWlsLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgT2N0b2JlciAxOCwgMjAx OCA5OjM4IEFNPGJyPg0KPGI+VG86PC9iPiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSAmbHQ7Z2lu c2JlcmdAY2lzY28uY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gc2VjZGlyQGlldGYub3JnOyBpZHJA aWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0 Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJh ZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGksIExlcy48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgdGhpbmsgd2UgYXJlIGNvbnZlcmdpbmcsIGJ1dCBoYXZlbuKAmXQgY29u dmVyZ2VkIHlldC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGVyZeKAmXMgd2hhdCBpcyBzdGlsbCBtaXNzaW5nIGZvciBtZTogWW91 IGFyZSBhZGRpbmcgc29tZSBuZXcgVExWcyB0byBwYXNzIGludG8gQkdQLUxTLiBMZXTigJlzIHBp Y2sgb25lIGF0IHJhbmRvbSDigJQgJm5ic3A7dGhlIFVuaWRpcmVjdGlvbmFsIFV0aWxpemVkIEJh bmR3aWR0aCDigJQgYXMgYW4gZXhhbXBsZS4gJm5ic3A7WW91IGFyZSBjbGFpbWluZyB0d28gdGhp bmdzIGFib3V0IHRoaXMgVExWOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPG9sIHN0 YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzEiPg0KVGhhdCBSRkMgNzc1MiBhbHJlYWR5IGhhcyB0ZXh0IGFib3V0IHNlbmRpbmcg b3RoZXIgVExWcyBpbiBCR1AtTFMuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KVGhhdCBSRkMgNzgxMCBhbmQgNzQ3MSBoYXZl IHRleHQgYWJvdXQgc2VuZGluZyBVbmlkaXJlY3Rpb25hbCBVdGlsaXplZCBCYW5kd2lkdGggaW4g SVMtSVMgYW5kIE9TUEYuPG86cD48L286cD48L2xpPjwvb2w+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5Cb3RoIG9mIHRoZXNlIGFyZSB0cnVlLCBidXQgSSBjbGFpbSB0aGF0IGV2ZW4g dGFrZW4gdG9nZXRoZXIgdGhleSBhcmUgbm90IGVub3VnaC4gQkdQIHJ1bnMgaW4gZGlmZmVyZW50 IGVudmlyb25tZW50cyB0aGFuIE9TUEYsIHNvIGEgc3RhdGVtZW50IHRoYXQgc2VuZGluZyBVbmlk aXJlY3Rpb25hbCBVdGlsaXplZCBCYW5kd2lkdGggaW4gT1NQRiBpcyBzYWZlIGlzIG5vdCBzdWZm aWNpZW50IGZvciBwcm92aW5nDQogaXQgc2FmZSBpbiBCR1AtTFMuICZuYnNwO1NpbWlsYXJseSwg dGhlIGZhY3QgdGhhdCB0aGUg4oCcUHJlZml4IE1ldHJpY+KAnSBUTFYgaXMgc2FmZSB0byBzZW5k IG92ZXIgQkdQLUxTIGlzIG5vIHByb29mIHRoYXQgc2VuZGluZyBVbmlkaXJlY3Rpb25hbCBVdGls aXplZCBCYW5kd2lkdGggaXMgc2FmZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0gbWlzc2luZyBhIHBhcmFncmFwaCBtYWtpbmcgdGhl IGNsYWltIHRoYXQgZGlzdHJpYnV0aW5nIFVuaWRpcmVjdGlvbmFsIFV0aWxpemVkIEJhbmR3aWR0 aCAoYW5kIHRoZSBvdGhlciBUTFZzKSBvdmVyIEJHUC1MUyBpcyBzYWZlLiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ib3BlIHRoaXMg aGVscHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+WW9hdjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiAxNyBPY3QgMjAxOCwgYXQgMjI6NDAsIExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpICZs dDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5naW5zYmVyZ0BjaXNjby5jb208 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Zb2F2IOKAkzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+SSB0aGluayB3ZSBhcmUgY29udmVyZ2luZy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+SW5saW5lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPllvYXYNCiBOaXIgJmx0OzxhIGhyZWY9Im1haWx0bzp5bmlyLmlldGZAZ21h aWwuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj55bmlyLmlldGZAZ21haWwuY29tPC9z cGFuPjwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5XZWRuZXNkYXksIE9jdG9iZXIgMTcsIDIwMTggMTE6MTQgQU08YnI+DQo8 Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PkxlcyBHaW5zYmVyZyAoZ2luc2JlcmcpICZsdDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lz Y28uY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5naW5zYmVyZ0BjaXNjby5jb208L3Nw YW4+PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNlY2RpckBpZXRmLm9yZzwvc3Bhbj48L2E+OzxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86 aWRyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZHJAaWV0Zi5vcmc8L3Nw YW4+PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PmlldGZAaWV0Zi5vcmc8L3NwYW4+PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogU2VjZGly IGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IaSwgTGVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhZ3JlZSB0aGF0IG15IGRpYWdy YW0gY29tbWVudCBpcyBkaXJlY3RlZCBtb3N0bHkgYXQgNzc1Mi4gSG93ZXZlciwgdGhlIFJGQ3Mg dGhhdCB3ZSBwcm9kdWNlIGFyZSBpbnRlbmRlZCB0byBiZSByZWFkYWJsZSBieSB0aGUgZ2VuZXJh bCB0ZWNobmljYWwgY29tbXVuaXR5LCBub3QganVzdCB0aGUgZXhwZXJ0cyBpbiB0aGUgd29ya2lu ZyBncm91cC4gRm9yIHRoZSBzYW1lIHJlYXNvbiB0aGF0IHdlIGFyZSByZXF1aXJlZA0KIHRvIGV4 cGFuZCBhY3JvbnltcyBvbiBmaXJzdCB1c2UsIEkgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgZm9yIGEg ZG9jdW1lbnQgdGhhdCBkZXNjcmliZXMgbmV3IGluZm9ybWF0aW9uIGJlaW5nIHNlbnQgdG8gaWRl bnRpZnkgdGhlIHRhcmdldC4gSSB3aWxsIGRyb3AgdGhpcyBwb2ludCwgdGhvdWdoLCBiZWNhdXNl IGl0IGlzIGEgZ2VuZXJhbCBjb21tZW50IHJhdGhlciB0aGFuIGEgc2VjZGlyIGlzc3VlLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIGFib3V0IG5vdCBuZWVkaW5nIHRvIHJlcGVh dCBpbmZvcm1hdGlvbiB0aGF0IGlzIGFscmVhZHkgc3RhdGVkIGVsc2V3aGVyZSwgYnV0IHlvdSBk byBuZWVkIHRvIHBvaW50IHRvIGl0LCBhcyB5b3UgZG8gd2l0aCB0aGUgZ2VuZXJhbCBzZWN1cml0 eSBtb2RlbCBvZiBCR1AgKGZpcnN0IHBhcmFncmFwaCksIGFuZCBhcyB5b3UgZG8gd2l0aCB0aGUg cGFyYWdyYXBoIGRlc2NyaWJpbmcgaG93IHRoZSB0cmFuc3BvcnQNCiBvZiBhdHRyaWJ1dGVzIGlz IHNlY3VyZWQgKHNlY29uZCBwYXJhZ3JhcGgpLiBUaGF0IHBhcnQgaXMgZmluZS4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UkZDIDc4MTAgYW5kIDc0NzEgZGVzY3JpYmUgdGhlIG5l dyBpbmZvcm1hdGlvbiB0byBiZSBzZW50LCBidXQgdGhleSBhcmUgYWJvdXQgSVMtSVMgYW5kIE9T UEYuIFRoZSBTZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIGluIDc4MTAgY29udGFpbnMg dGhlIGZvbGxvd2luZyB0ZXh0OiAmcXVvdDtJdCBpcyBhbnRpY2lwYXRlZCB0aGF0IGluIG1vc3Qg ZGVwbG95bWVudHMsIHRoZSBJUy1JUyBwcm90b2NvbCBpcyB1c2VkDQogd2l0aGluIGFuIGluZnJh c3RydWN0dXJlIGVudGlyZWx5IHVuZGVyIGNvbnRyb2wgb2YgdGhlIHNhbWUgb3BlcmF0b3Iu4oCd IGFuZCBjb250aW51ZXMgdG8gZGlzY3VzcyBNSVRNIGF0dGFja3MgaWYgdGhpcyBpcyBub3QgdGhl IGNhc2UuICZuYnNwO0NhbiB0aGUgc2FtZSBhc3N1bXB0aW9uIGJlIG1hZGUgYWJvdXQgQkdQPyAm bmJzcDtUaGF0IGlzIHRoZSBwYXJ0IHRoYXQgSSB0aGluayBpcyBtaXNzaW5nLiBFaXRoZXIgc3Rh dGUgdGhhdCB3aGVyZSBCR1AtTFMgaXMgdXNlZA0KIHRoZSBhc3N1bXB0aW9uIGNhbiBiZSBtYWRl LCBvciBqdXN0aWZ5IHdoeSB0aGVyZSBpcyBubyByaXNrIGV2ZW4gd2hlbiB0aGUgaW5mb3JtYXRp b24gaXMgcHJvcGFnYXRlZCB0byBpbmZyYXN0cnVjdHVyZSB0aGF0IGlzIG5vdCB1bmRlciBjb250 cm9sIG9mIGEgc2luZ2xlIG9wZXJhdG9yLiAmbmJzcDsgVGhlIGRpZmZlcmVuY2UgYmV0d2VlbiBC R1AgYW5kIGVpdGhlciBJUy1JUyBvciBPU1BGIGlzIG5vdCBwYXJ0IG9mIHRob3NlIG90aGVyIGRv Y3VtZW50cywNCiBzbyBJTU8gaXQgc2hvdWxkIGJlIHN0YXRlZCBoZXJlLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj5bTGVzOl0gSSBhZ3JlZSB3aXRoIHRoaXMuPC9zcGFuPjwvaT48L2I+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgd2UgbG9vayBhdCB0aGUgU2VjdXJpdHkg c2VjdGlvbiBvZiBSRkMgNzc1MiB3ZSBzZWUgYSBudW1iZXIgb2YgaXNzdWVzIGRpc2N1c3NlZC4g SWYgd2Ugd2VyZSB0byBhZGQgdGhlIGZvbGxvd2luZyBpbnRvIHRoaXMgZG9jdW1lbnQgd291bGQg aXQgc3VmZmljZT88L3NwYW4+PC9pPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij4mbmJzcDs8L3NwYW4+PC9pPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj7i gJxTZWN1cml0eSBjb25zaWRlcmF0aW9ucyBmb3IgYWNxdWlyaW5nIGFuZCBkaXN0cmlidXRpbmcg QkdQLUxTIGluZm9ybWF0aW9uIGFyZSBkaXNjdXNzZWQgaW4gUkZDNzc1Mi7igJ08L3NwYW4+PC9p PjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PC9pPjwv Yj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5J4oCZZCBsaWtlIHRvIHBvaW50IG91 dCB0aGF0IHRoaXMgZG9jdW1lbnQgaXMganVzdCBvbmUgb2YgbWFueSAoZXhpc3RpbmcgYW5kIHll dCB0byBiZSB3cml0dGVuKSBleHRlbnNpb25zIHRvIFJGQyA3NzUyLiBHaXZlbiB0aGUgd2F5IEJH UC1MUyBoYXMgYmVlbiBkZWZpbmVkLA0KIGV2ZXJ5IHRpbWUgd2UgZGVmaW5lIG5ldyBpbmZvcm1h dGlvbiB0byBiZSBhZHZlcnRpc2VkIGJ5IGFuIElHUCB3ZSBoYXZlIHRvIHdyaXRlIGEgQkdQLUxT IGRyYWZ0IGRlZmluaW5nIGhvdyB0aGF0IGluZm9ybWF0aW9uIGlzIHRvIGJlIGFkdmVydGlzZWQg aW4gQkdQLUxTLiBTbyB0aGlzIGlzc3VlIGlzIGdvaW5nIHRvIGNvbWUgdXAgb3ZlciBhbmQgb3Zl ci4gSSBob3BlIHdoYXQgd2UgYXJlIGRvaW5nIGluIHRoaXMgZG9jdW1lbnQgaXMgYSBnb29kDQog bW9kZWwgZm9yIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIGluIGFsbCBvZiB0aGVzZSB0eXBlcyBv ZiBkcmFmdHMgaWUuLDwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOzwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjEpUmVmZXJlbmNlIFJGQyA3NzUyIFNlY3VyaXR5IGRpc2N1c3Npb24uPC9zcGFuPjwvaT48L2I+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+MilSZWZlcmVuY2UgdGhlIHJlbGV2YW50 IElHUCBSRkMgU2VjdXJpdHkgZGlzY3Vzc2lvbiB0byBjb3ZlciBzZWN1cml0eSBpc3N1ZXMgc3Bl Y2lmaWMgdG8gdGhlIGNsYXNzIG9mIGluZm9ybWF0aW9uIGNvdmVyZWQgYnkgdGhlIGRyYWZ0PC9z cGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjwvaT48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+V2hhdCB3ZSBsYWNrIGF0 IHRoZSBtb21lbnQgaXMgIzEgYWJvdmUuPC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+RG9lcyB0aGlzIHdvcms/PC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllvYXY8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+ DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIDE3IE9jdCAyMDE4LCBhdCAyOjUyLCBMZXMgR2luc2JlcmcgKGdpbnNi ZXJnKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbSI+PHNwYW4gc3R5bGU9 ImNvbG9yOnB1cnBsZSI+Z2luc2JlcmdAY2lzY28uY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Zb2F2IC08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+VGhhbnggZm9yIHRoZSByZXZpZXcuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkknbGwgcHJlZmFjZSBt eSByZW1hcmtzIGJ5IHNheWluZyBJIGFtIGEgYmlnIGJlbGlldmVyIGluIG1vZHVsYXJpdHkuIElm IGEgcmVmZXJlbmNlZCBkb2N1bWVudCBoYXMgYWxyZWFkeSBjb3ZlcmVkIGFuIGlzc3VlIEkgc3Ry b25nbHkgYmVsaWV2ZSB3ZSBhcmUgYmV0dGVyIG9mZiByZWZlcmVuY2luZw0KIHRoYXQgZG9jdW1l bnQgdGhhbiB0cnlpbmcgdG8gcmVwZWF0L3Jlc3RhdGUgd2hhdCB0aGUgcmVmZXJlbmNlZCBkb2N1 bWVudCBoYXMgc2FpZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZXJlIGFy ZSBvbmx5IHR3byB0aGluZ3MgdGhhdCBjYW4gaGFwcGVuIHdoZW4gd2UgcmVwZWF0L3Jlc3RhdGU6 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjEpV2UgYXJlIHJlZHVuZGFudDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+MilXZSBpbnRyb2R1Y2UgYW1iaWd1aXR5PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi Pk5laXRoZXIgb2YgdGhlc2UgaXMgZGVzaXJhYmxlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SZXNwb25z ZXMgaW5saW5lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IEZyb206IFlvYXYgTmly ICZsdDs8YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0Ozwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBTZW50OiBUdWVzZGF5LCBPY3RvYmVyIDE2LCAy MDE4IDI6MTggUE08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgVG86PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzpzZWNkaXJAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNlY2RpckBp ZXRmLm9yZzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7 IENjOjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBo cmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZHJA aWV0Zi5vcmc8L3NwYW4+PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmlldGZAaWV0Zi5vcmc8L3NwYW4+PC9hPjs8c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L3NwYW4+PC9hPjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBTdWJqZWN0OiBTZWNkaXIgZWFybHkgcmV2aWV3 IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0 OyBSZXZpZXdlcjogWW9hdiBOaXI8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZn dDsgUmV2aWV3IHJlc3VsdDogSGFzIE5pdHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZndDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgVGhp cyBpcyBhbiBlYXJseSByZXZpZXcgd2l0aCBhIHNwZWNpZmljIHJlcXVlc3QgdG8gcmV2aWV3IHRo ZSBTZWN1cml0eTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBDb25zaWRl cmF0aW9ucyBzZWN0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBUaGUgZHJhZnQgYWRk cyBhIGJ1bmNoIG9mIFRMVnMgdG8gYmUgc2VudCBmcm9tIHJvdXRlcnMgcmVnYXJkaW5nIHRoZSBs aW5rPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHN0YXRlIG9mIHRoZSBs aW5rIHVzZWQgZm9yIElHUC4gVGhlIGRyYWZ0IHJlZmVyZW5jZXMgUkZDIDc3NTIgd2hpY2ggZGVm aW5lZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBlYXJsaWVyIFRMVnMg dXNlZCB0byBjYXJyeSBOTFJJIChyZWFjaGFiaWxpdHkpIGluZm9ybWF0aW9uLjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jmd0OyBXaGF0IEkgZm91bmQgZGlmZmljdWx0IGFib3V0IGJvdGggNzc1MiBh bmQgdGhpcyBkcmFmdCBpcyB0aGUgdmFndWVuZXNzIGFib3V0PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mZ3Q7IHdobyB0aGUgY29uc3VtZXIgb2YgdGhpcyBpbmZvcm1hdGlvbiBp cy4gVGhlIGFic3RyYWN0IG9mIDc3NTIgYmVnaW5zIGxpa2UgdGhpczo8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgJnF1b3Q7SW4gYSBudW1iZXIgb2YgZW52aXJvbm1lbnRz LCBhIGNvbXBvbmVudCBleHRlcm5hbCB0byBhIG5ldHdvcmsgaXMgY2FsbGVkPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHVwb24gdG8gcGVyZm9ybSBjb21wdXRhdGlvbnMg YmFzZWQgb24gdGhlIG5ldHdvcmsgdG9wb2xvZ3kgYW5kIGN1cnJlbnQ8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgc3RhdGUgb2YgdGhlIGNvbm5lY3Rpb25zIHdpdGhpbiB0 aGUgbmV0d29yaywgaW5jbHVkaW5nIFRyYWZmaWMgRW5naW5lZXJpbmc8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgKFRFKSBpbmZvcm1hdGlvbi4mcXVvdDsgVGhlcmUgaXMg YWxzbyBhIGRpYWdyYW0gd2l0aCBpbmZvcm1hdGlvbiBmbG93aW5nIHRvIGE8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgJnF1b3Q7Y29uc3VtZXImcXVvdDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgYW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0RO IGNvbnRyb2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj88L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZndDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+W0xlczpdIFRoZSBk aWFncmFtIHlvdSBhcmUgcmVmZXJyaW5nIHRvIHNlZW1zIG1vc3QgbGlrZWx5IHRvIGJlIGluIFJG QyA3NzUyIHNpbmNlIHRoZXJlIGlzIG5vIHN1Y2ggZGlhZ3JhbSBpbiB0aGlzIGRyYWZ0Ljwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2hpY2ggbGVhZHMgbWUgdG8gc2F5IGlmIHlv dSBmZWVsIHRoaXMgaXMgaW5zdWZmaWNpZW50IHRoZW4gaXQgbmVlZHMgdG8gYmUgdGFrZW4gdXAg aW4gdGhlIGNvbnRleHQgb2YgUkZDIDc3NTIgLSBub3QgdGhpcyBkcmFmdC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+SG9wZWZ1bGx5IHRoaXMgbWFrZXMgc2Vuc2UgdG8geW91IGFzIHdlbGwuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZndDsgT0suIE9uIHRvIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0 aW9uLiBJdCBiZWdpbnMgd2l0aCBhIHN0YXRlbWVudCB0aGF0PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mZ3Q7IHRoaXMgZG9lcyBub3QgYWZmZWN0IHRoZSBzZWN1cml0eSBtb2Rl bCBvZiBCR1AuJm5ic3A7IEFsdGhvdWdoIHRoYXQgaXMganVzdCBjbGFpbWVkPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGFuZCBub3Qgc3VwcG9ydGVkIGluIHRleHQsIGl0 IHNlZW1zIHJlYXNvbmFibGUuIEkgc2hvdWxkIG5vdGUgdGhhdCB0aGlzPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IHBhcmFncmFwaCBpcyBjb3BpZWQgZnJvbSA3NzUyLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBUaGUgc2Vjb25kIChhbmQgbGFzdCkgcGFyYWdyYXBo IGluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIHRhbGtzPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGFib3V0IHRoZSBuZXcgYXR0cmlidXRlcy4gSXQg bWVudGlvbnMgdGhhdCBzZWN1cml0eSBhbmQgYXV0aGVudGljYXRpb24gYXJlPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGFzc3VtZWQgdG8gYmUgdXNlZCBqdXN0IGFzIGlu IFJGQ3MgNzgxMCBhbmQgNzQ3MS4gV2l0aCBwcm9wZXI8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZndDsgYXV0aGVudGljYXRpb24gdGhpcyBpbmZvcm1hdGlvbiBpcyBub3Qgc2Vu dCBleGNlcHQgdG8gdGhlIHByb3BlciBjb25zdW1lci48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZndDsgSG93ZXZlciwgdGhlcmUgaXMgYW4gaW1wb3J0YW50IGRpZmZlcmVuY2Ug dGhhdCBJIHRoaW5rIG5lZWRzIHRvIGJlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mZ3Q7IGFkZHJlc3NlZC4gNzgxMCBhbmQgNzQ3MSBhcmUgYWJvdXQgSVMtSVMgYW5kIE9TUEYg cmVzcGVjdGl2ZWx5LiBUaGVyZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0 OyByb3V0aW5nIHByb3RvY29scyBhcmUgdHlwaWNhbGx5IHVzZWQgaW4gY2xvc2VkIGVudmlyb25t ZW50cywgYW5kIHRoZSBTZWN1cml0eTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jmd0OyBDb25zaWRlcmF0aW9ucyBvZiA3ODEwIHN0YXRlIHRoYXQgZXhwbGljaXRseS4gQkdQICh0 aGUgc3ViamVjdCBvZiB0aGlzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7 IGRvY3VtZW50KSBpcyBkaWZmZXJlbnQgaW4gdGhhdCBpdCBpcyB0eXBpY2FsbHkgdXNlZCBhbGwg b3ZlciB0aGUgSW50ZXJuZXQuIFdpdGhvdXQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZndDsgZnVydGhlciBjbGFyaXR5IGFib3V0IHdobyBhbmQgd2hlcmUgdGhlICZxdW90O2Nv bnN1bWVyJnF1b3Q7IGlzLCBpdCBoYXMgdG8gYmUgYXNzdW1lZDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jmd0OyB0aGF0IHRoZSBpbmZvcm1hdGlvbiBtaWdodCBhdCBsZWFzdCBs ZWFrIG91dC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsmbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPltMZXM6XSBJIHRoaW5rIHlvdSBoYXZlIG1p c2ludGVycHJldGVkIHRoaXMgcGFyYWdyYXBoLiAoZW1waGFzaXMgYWRkZWQgYmVsb3cpPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZxdW90OyBUaGUgSUdQPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDsmbmJzcDsgaW5zdGFuY2VzIG9yaWdpbmF0aW5nIHRoZXNlIFRMVnMgYXJlIGFz c3VtZWQgdG8gaGF2ZSBhbGwgdGhlIHJlcXVpcmVkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDsmbmJzcDsgc2VjdXJpdHkgYW5kIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlz bSAoYXMgZGVzY3JpYmVkIGluIFtSRkM3ODEwXSBhbmQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOyZuYnNwOyBbUkZDNzQ3MV0pIGluIG9yZGVyIHRvIHByZXZlbnQgYW55 IHNlY3VyaXR5IGlzc3VlPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQiPndoZW4gcHJvcGFnYXRpbmc8L3NwYW4+ PC9iPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPiZuYnNw OyZuYnNwOyB0aGUgVExWcyBpbnRvIEJHUC1MUy48L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ JnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgd2UgYXJlIHN0YXRpbmcgaGVyZSBpcyB0aGF0 IHdoZW4gdGhlIElHUCBhZHZlcnRpc2VtZW50cyBhcmUgc2VudCB0aGUgc2VjdXJpdHkvYXV0aGVu dGljYXRpb24gbWVjaGFuaXNtcyBzcGVjaWZpZWQgaW4gdGhlIElHUCBkcmFmdHMgYXBwbGllcy48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgaXMgTk9UIHRyeWluZyB0byBh cHBseSBSRkM3ODEwL1JGQzc0NzEgdG8gdGhlIG5ldyBCR1AgYWR2ZXJ0aXNlbWVudHMuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgc2VjdXJpdHkgaXNzdWVzIHJlbGF0ZWQg dG8gdGhlIG5ldyBCR1AgYWR2ZXJ0aXNlbWVudHMgYXJlIGRpc2N1c3NlZCBpbiB0aGUgcHJldmlv dXMgcGFyYWdyYXBoLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IEFub3RoZXIgaXNzdWUgSSBoYXZl IHdpdGggdGhpcyBzZWN0aW9uIGlzIHRoYXQgdGhlIGRyYWZ0IHNwZWNpZmllcyBob3cgdG8gc2Vu ZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBuZXcgaW5mb3JtYXRpb24g KHRoZSBsaW5rIHN0YXRlIFRMVnMpIGZyb20gb25lIG5vZGUgdG8gYW5vdGhlci4gVGhpcyBpczwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBpbmZvcm1hdGlvbiB0aGF0IHdh cyBub3Qgc2VudCBiZWZvcmUuIFdoZW4gYSBjaGFuZ2UgbGlrZSB0aGF0IGlzIG1hZGUsIEk8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgdGhpbmsgdGhlIFNlY3VyaXR5IENv bnNpZGVyYXRpb25zIHNlY3Rpb24gc2hvdWxkIGp1c3RpZnkgd2h5IGl0IGlzIE9LIHRvPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGRpc3RyaWJ1dGUgdGhpcyBpbmZvcm1h dGlvbi4gVHlwaWNhbGx5IHlvdSBuZWVkIHRvIGp1c3RpZnkgdGhhdCBsZWFraW5nIHRoaXM8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgaW5mb3JtYXRpb24gKHRvIHRoZSBp bnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJlc3Qgb2YgdGhlIHdvcmxkKSBkb2VzIG5vdDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyAoMSkgbWFrZSBpdCBlYXNpZXIg dG8gYXR0YWNrIHNvbWUgcGFydCBvZiB0aGUgc3lzdGVtLCBvciAoMikgZGlzdHJpYnV0ZXM8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgcHJpdmFjeS1zZW5zaXRpdmUgaW5m b3JtYXRpb24sIG9yICgzKSB1bmRlcm1pbmVzIHNvbWUgb3RoZXIgY29uZmlkZW50aWFsaXR5PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7IGludGVyZXN0LiBJIHRoaW5rIGl0 J3MgZmFpcmx5IGVhc3kgdG8gbWFrZSB0aGUgYXJndW1lbnQgdGhhdCB0aGUgaW5mb3JtYXRpb24g aW48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgdGhlc2UgVExWcyBkb2Vz IG5vdCBkbyBhbnkgb2YgdGhlIGFib3ZlLCBidXQgdGhlIGFyZ3VtZW50IHNob3VsZCBiZSBtYWRl Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OyBUaGUgbGFzdCBwYXJhZ3Jh cGggaW4gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gb2YgUkZDIDc3NTIgaGFz IGp1c3Q8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsgc3VjaCBhbiBhcmd1 bWVudC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+W0xlczwvc3Bhbj48L2k+PC9iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Ol0gU2VjdXJpdHkgc2VjdGlvbnMgaW4gUkZDNzgxMC9SRkM3NDcxIGRpcmVjdGx5 IGFkZHJlc3MgdGhpcyBwb2ludC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldF IGNvdWxkIHJlcGVhdCBzb21lIG9mIHRoYXQgaGVyZSDigJMgYnV0IGFzIHBlciBteSDigJxvcGVu aW5nIHN0YXRlbWVudOKAnSBJIGFtIHJlbHVjdGFudCB0byBkbyBzby48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+V2hhdCBkbyB5b3UgdGhpbms/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOyZuYnNwOyBMZXM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_92af26fef2da470d853f292c84f026a0XCHALN001ciscocom_-- From nobody Thu Oct 18 17:27:03 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 059CC129AB8; Thu, 18 Oct 2018 17:26:56 -0700 (PDT) X-Quarantine-ID: <0nrEwSkd_KCU> X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char 9C hex): Received: ...s kaduk@ATHENA.MIT.EDU)\n\t\234by outgoing.mit[...] X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0nrEwSkd_KCU; Thu, 18 Oct 2018 17:26:52 -0700 (PDT) Received: from dmz-mailsec-scanner-3.mit.edu (dmz-mailsec-scanner-3.mit.edu [18.9.25.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 830B2130DE7; Thu, 18 Oct 2018 17:26:51 -0700 (PDT) X-AuditID: 1209190e-fe5ff70000007a81-27-5bc924c8d647 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-3.mit.edu (Symantec Messaging Gateway) with SMTP id 8D.81.31361.9C429CB5; Thu, 18 Oct 2018 20:26:49 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-3.mit.edu (8.14.7/8.9.2) with ESMTP id w9J0Qldd020739; Thu, 18 Oct 2018 20:26:47 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) œby outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id w9J0Qg2g010254 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 18 Oct 2018 20:26:45 -0400 Date: Thu, 18 Oct 2018 19:26:42 -0500 From: Benjamin Kaduk To: "Les Ginsberg (ginsberg)" Cc: Yoav Nir , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Message-ID: <20181019002642.GX19309@kduck.kaduk.org> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrEKsWRmVeSWpSXmKPExsUixCmqrXtS5WS0wb4/IhbH1t5gtdjwZyO7 xavbz5gsnm2cz2LxYeFDFoulxz4wObB5TPm9kdVj56y77B5LlvxkCmCO4rJJSc3JLEst0rdL 4Mo4vaqi4HBcxbobn9gaGJf5dDFyckgImEjMeNPC2sXIxSEksIZJ4seCi2wgCSGBjYwS9/9U QCTuMkmc/nYSLMEioCox7eUbZhCbTUBFoqH7MpDNwSEiYCSx+Lk2SD2zwGdGifMbVzOCxIUF PCT23tEBKecFWtbw9T87xMxbTBJfPz5lh0gISpyc+YQFxGYWUJf4M+8S2ExmAWmJ5f84IMLy Es1bZ4Ot5RRwlWjY8gDMFhVQltjbd4h9AqPgLCSTZiGZNAth0iwkkxYwsqxilE3JrdLNTczM KU5N1i1OTszLSy3SNdbLzSzRS00p3cQIjgJJvh2Mkxq8DzEKcDAq8fAWHD0RLcSaWFZcmXuI UZKDSUmU10PxZLQQX1J+SmVGYnFGfFFpTmrxIUYJDmYlEd6v24HKeVMSK6tSi/JhUtIcLEri vBNaFkcLCaQnlqRmp6YWpBbBZGU4OJQkeI8oAw0VLEpNT61Iy8wpQUgzcXCCDOcBGh4DUsNb XJCYW5yZDpE/xWjJ0bHw/3Rmjran12cwc3SASCGWvPy8VClx3uUgDQIgDRmleXAzQUlNInt/ zStGcaAXhXmXgFTxABMi3NRXQAuZgBaeMAX5prgkESEl1cDoKDUrvPLi5rsH13pNFl02qcrB Q7H/a8/c/GnqHdH96eesvKw8zi5/qaiVcujfi11OAh8XFn2Z/cho7wahW8sXq/BJXVX6d0Do cuinqduk44IyuiSPV35XjlpVeKajIUjGca0714Vj8sJCPm5SbIFvDhX2hIrVKzbNMYrO9jwd Zllb5hlQ0KvEUpyRaKjFXFScCAC/Ki3DRQMAAA== Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 00:26:56 -0000 On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav – > > In regards to the risks associated with advertising the specific information covered in this draft we have a statement in the IGP drafts: > > From RFC7810 > > “The sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could be > sensitive and that an operator may not want to disclose.†> > In regards to the risks associated with sending information via BGP-LS we have a number of statements in RFC 7752 – most relevant is: > > “Additionally, it may be considered that the export of link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.†> > So long as there are references to both the IGP RFCs and RFC 7752 I am therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are not altered by adding some new TLVs – and since the IGP RFCs have already covered risks associated with the specific class of information (not simply the risks associated with the transport mechanism) you are going to have to provide more specifics on what can meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain than the one for which the previous analysis was performed. -Ben > > ??? > > Les > > > From: Yoav Nir > Sent: Thursday, October 18, 2018 9:38 AM > To: Les Ginsberg (ginsberg) > Cc: secdir@ietf.org; idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org > Subject: Re: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > > Hi, Les. > > I think we are converging, but haven’t converged yet. > > Here’s what is still missing for me: You are adding some new TLVs to pass into BGP-LS. Let’s pick one at random — the Unidirectional Utilized Bandwidth — as an example. You are claiming two things about this TLV: > > 1. That RFC 7752 already has text about sending other TLVs in BGP-LS. > 2. That RFC 7810 and 7471 have text about sending Unidirectional Utilized Bandwidth in IS-IS and OSPF. > > Both of these are true, but I claim that even taken together they are not enough. BGP runs in different environments than OSPF, so a statement that sending Unidirectional Utilized Bandwidth in OSPF is safe is not sufficient for proving it safe in BGP-LS. Similarly, the fact that the “Prefix Metric†TLV is safe to send over BGP-LS is no proof that sending Unidirectional Utilized Bandwidth is safe. > > I’m missing a paragraph making the claim that distributing Unidirectional Utilized Bandwidth (and the other TLVs) over BGP-LS is safe. > > Hope this helps > > Yoav > > > On 17 Oct 2018, at 22:40, Les Ginsberg (ginsberg) > wrote: > > Yoav – > > I think we are converging. > Inline. > > From: Yoav Nir > > Sent: Wednesday, October 17, 2018 11:14 AM > To: Les Ginsberg (ginsberg) > > Cc: secdir@ietf.org; idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org > Subject: Re: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > > Hi, Les. > > I agree that my diagram comment is directed mostly at 7752. However, the RFCs that we produce are intended to be readable by the general technical community, not just the experts in the working group. For the same reason that we are required to expand acronyms on first use, I think it makes sense for a document that describes new information being sent to identify the target. I will drop this point, though, because it is a general comment rather than a secdir issue. > > I agree about not needing to repeat information that is already stated elsewhere, but you do need to point to it, as you do with the general security model of BGP (first paragraph), and as you do with the paragraph describing how the transport of attributes is secured (second paragraph). That part is fine. > > RFC 7810 and 7471 describe the new information to be sent, but they are about IS-IS and OSPF. The Security considerations section in 7810 contains the following text: "It is anticipated that in most deployments, the IS-IS protocol is used within an infrastructure entirely under control of the same operator.†and continues to discuss MITM attacks if this is not the case. Can the same assumption be made about BGP? That is the part that I think is missing. Either state that where BGP-LS is used the assumption can be made, or justify why there is no risk even when the information is propagated to infrastructure that is not under control of a single operator. The difference between BGP and either IS-IS or OSPF is not part of those other documents, so IMO it should be stated here. > > [Les:] I agree with this. > If we look at the Security section of RFC 7752 we see a number of issues discussed. If we were to add the following into this document would it suffice? > > “Security considerations for acquiring and distributing BGP-LS information are discussed in RFC7752.†> > I’d like to point out that this document is just one of many (existing and yet to be written) extensions to RFC 7752. Given the way BGP-LS has been defined, every time we define new information to be advertised by an IGP we have to write a BGP-LS draft defining how that information is to be advertised in BGP-LS. So this issue is going to come up over and over. I hope what we are doing in this document is a good model for Security Considerations in all of these types of drafts ie., > > 1)Reference RFC 7752 Security discussion. > 2)Reference the relevant IGP RFC Security discussion to cover security issues specific to the class of information covered by the draft > > What we lack at the moment is #1 above. > > Does this work? > > Les > > Yoav > > > > On 17 Oct 2018, at 2:52, Les Ginsberg (ginsberg) > wrote: > > Yoav - > > Thanx for the review. > > I'll preface my remarks by saying I am a big believer in modularity. If a referenced document has already covered an issue I strongly believe we are better off referencing that document than trying to repeat/restate what the referenced document has said. > There are only two things that can happen when we repeat/restate: > > 1)We are redundant > 2)We introduce ambiguity > > Neither of these is desirable. > > Responses inline. > > > -----Original Message----- > > From: Yoav Nir > > > Sent: Tuesday, October 16, 2018 2:18 PM > > To: secdir@ietf.org > > Cc: idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org > > Subject: Secdir early review of draft-ietf-idr-te-pm-bgp-13 > > > > Reviewer: Yoav Nir > > Review result: Has Nits > > > > This is an early review with a specific request to review the Security > > Considerations section. > > > > The draft adds a bunch of TLVs to be sent from routers regarding the link > > state of the link used for IGP. The draft references RFC 7752 which defined > > earlier TLVs used to carry NLRI (reachability) information. > > > > What I found difficult about both 7752 and this draft is the vagueness about > > who the consumer of this information is. The abstract of 7752 begins like this: > > "In a number of environments, a component external to a network is called > > upon to perform computations based on the network topology and current > > state of the connections within the network, including Traffic Engineering > > (TE) information." There is also a diagram with information flowing to a > > "consumer" > > and that's it. Is it an SDN controller? Some kind of application? > > > > [Les:] The diagram you are referring to seems most likely to be in RFC 7752 since there is no such diagram in this draft. > Which leads me to say if you feel this is insufficient then it needs to be taken up in the context of RFC 7752 - not this draft. > > Hopefully this makes sense to you as well. > > > OK. On to the Security Considerations section. It begins with a statement that > > this does not affect the security model of BGP. Although that is just claimed > > and not supported in text, it seems reasonable. I should note that this > > paragraph is copied from 7752. > > > > The second (and last) paragraph in the security considerations section talks > > about the new attributes. It mentions that security and authentication are > > assumed to be used just as in RFCs 7810 and 7471. With proper > > authentication this information is not sent except to the proper consumer. > > However, there is an important difference that I think needs to be > > addressed. 7810 and 7471 are about IS-IS and OSPF respectively. There > > routing protocols are typically used in closed environments, and the Security > > Considerations of 7810 state that explicitly. BGP (the subject of this > > document) is different in that it is typically used all over the Internet. Without > > further clarity about who and where the "consumer" is, it has to be assumed > > that the information might at least leak out. > > > [Les:] I think you have misinterpreted this paragraph. (emphasis added below) > > " The IGP > instances originating these TLVs are assumed to have all the required > security and authentication mechanism (as described in [RFC7810] and > [RFC7471]) in order to prevent any security issue when propagating > the TLVs into BGP-LS." > > What we are stating here is that when the IGP advertisements are sent the security/authentication mechanisms specified in the IGP drafts applies. > This is NOT trying to apply RFC7810/RFC7471 to the new BGP advertisements. > The security issues related to the new BGP advertisements are discussed in the previous paragraph. > > > Another issue I have with this section is that the draft specifies how to send > > new information (the link state TLVs) from one node to another. This is > > information that was not sent before. When a change like that is made, I > > think the Security Considerations section should justify why it is OK to > > distribute this information. Typically you need to justify that leaking this > > information (to the intended recipient or to the rest of the world) does not > > (1) make it easier to attack some part of the system, or (2) distributes > > privacy-sensitive information, or (3) undermines some other confidentiality > > interest. I think it's fairly easy to make the argument that the information in > > these TLVs does not do any of the above, but the argument should be made. > > The last paragraph in the Security Considerations section of RFC 7752 has just > > such an argument. > > [Les:] Security sections in RFC7810/RFC7471 directly address this point. > WE could repeat some of that here – but as per my “opening statement†I am reluctant to do so. > > What do you think? > > Les > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Thu Oct 18 17:41:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D601130E99; Thu, 18 Oct 2018 17:41:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.564 X-Spam-Level: X-Spam-Status: No, score=-14.564 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HlMXevMoKLEJ; Thu, 18 Oct 2018 17:41:19 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 407CF130E69; Thu, 18 Oct 2018 17:41:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19074; q=dns/txt; s=iport; t=1539909679; x=1541119279; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=HLL+vkvA49oVxKhvDrhpRWxEBbVXfoGsMDOhCpG8pJw=; b=HlHw619dm62BSJwzKgLI1R6wBPjFgvSQ2x1qHdpRL60L8//TajwsgLHv eDSvRvZsq7AD3fgMIgLK9t7WXP7tgYvJdmea20rmh1XZRHwfQDZhopZ5o jENxt5s2uAyi9eGZRoVgr8uaweMKI7SIQ9eRMdLmoE8YtJ8sfULPXjl3e Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AnAAC8J8lb/49dJa1aCg4LAQEBAQE?= =?us-ascii?q?BAQEBAQEBBwEBAQEBAYFUAQEBAQEBCwGCBGZ/KAqDa5Qxgg16gkWFOZARCwE?= =?us-ascii?q?BGAuEA0YCF4RsFQw3Cg0BAwEBAgEBAm0cDIU5AQEBAQMBASERNwMLDAQCAQg?= =?us-ascii?q?RBAEBAQICIwMCAgIfBgsUAQgIAgQOBQgMgw2BaQMVD6c2gS6EMAKDTQ2CGIE?= =?us-ascii?q?Lh3qBK4EdF4FBPyZqAYJdNYJWRQEBAgGBM0IPgl2CVwKUPIkqJS4JAoZZgxq?= =?us-ascii?q?DToMcH4FPTIQmgxSGU4xOd4haAhEUgSYzIoFVcBU7gmwJgh0XiFuFBDpvAQG?= =?us-ascii?q?KMYEfAQE?= X-IronPort-AV: E=Sophos;i="5.54,397,1534809600"; d="scan'208";a="187643965" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 00:40:52 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id w9J0eqKP008939 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 00:40:52 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 18 Oct 2018 19:40:51 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Thu, 18 Oct 2018 19:40:51 -0500 From: "Les Ginsberg (ginsberg)" To: Benjamin Kaduk CC: Yoav Nir , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAP//rZdg Date: Fri, 19 Oct 2018 00:40:51 +0000 Message-ID: <2d123b3a118a4a9ca0023be33af8a067@XCH-ALN-001.cisco.com> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> In-Reply-To: <20181019002642.GX19309@kduck.kaduk.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 00:41:29 -0000 QmVuIC0NCg0KSW5saW5lLg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206 IEJlbmphbWluIEthZHVrIDxrYWR1a0BtaXQuZWR1Pg0KPiBTZW50OiBUaHVyc2RheSwgT2N0b2Jl ciAxOCwgMjAxOCA1OjI3IFBNDQo+IFRvOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSA8Z2luc2Jl cmdAY2lzY28uY29tPg0KPiBDYzogWW9hdiBOaXIgPHluaXIuaWV0ZkBnbWFpbC5jb20+OyBpZHJA aWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRyLQ0KPiB0ZS1wbS1iZ3AuYWxs QGlldGYub3JnOyBzZWNkaXJAaWV0Zi5vcmcNCj4gU3ViamVjdDogUmU6IFtzZWNkaXJdIFNlY2Rp ciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQo+IA0KPiBPbiBU aHUsIE9jdCAxOCwgMjAxOCBhdCAwNjowMDoxM1BNICswMDAwLCBMZXMgR2luc2JlcmcgKGdpbnNi ZXJnKSB3cm90ZToNCj4gPiBZb2F2IOKAkw0KPiA+DQo+ID4gSW4gcmVnYXJkcyB0byB0aGUgcmlz a3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5nIHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbg0K PiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBhIHN0YXRlbWVudCBpbiB0aGUgSUdQIGRy YWZ0czoNCj4gPg0KPiA+IEZyb20gUkZDNzgxMA0KPiA+DQo+ID4g4oCcVGhlIHN1Yi1UTFZzIGlu dHJvZHVjZWQgaW4gdGhpcyBkb2N1bWVudCBhbGxvdyBhbiBvcGVyYXRvciB0bw0KPiA+ICAgIGFk dmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRoLCBkZWxheSkgdGhh dCBjb3VsZCBiZQ0KPiA+ICAgIHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90 IHdhbnQgdG8gZGlzY2xvc2Uu4oCdDQo+ID4NCj4gPiBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBh c3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQLUxTIHdlDQo+IGhhdmUg YSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCByZWxldmFudCBpczoN Cj4gPg0KPiA+IOKAnEFkZGl0aW9uYWxseSwgaXQgbWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUg ZXhwb3J0IG9mIGxpbmstc3RhdGUgYW5kDQo+ID4gICAgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3Jp YmVkIGluIHRoaXMgZG9jdW1lbnQgY29uc3RpdHV0ZXMgYSByaXNrIHRvDQo+ID4gICAgY29uZmlk ZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3IgY29tbWVyY2lhbGx5IHNlbnNpdGl2ZQ0K PiA+ICAgIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrLuKAnQ0KPiA+DQo+ID4gU28gbG9u ZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJR1AgUkZDcyBhbmQgUkZDIDc3 NTIgSSBhbQ0KPiB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVyc3RhbmQgd2hhdCBlbHNl IGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuDQo+ID4gQ2VydGFpbmx5IHRoZSByaXNrcyBhc3NvY2lh dGVkIHdpdGggdGhlIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIGFyZSBub3QNCj4gYWx0ZXJl ZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDigJMgYW5kIHNpbmNlIHRoZSBJR1AgUkZDcyBoYXZl IGFscmVhZHkNCj4gY292ZXJlZCByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNpZmljIGNs YXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZQ0KPiByaXNrcyBhc3NvY2lhdGVkIHdp dGggdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20pIHlvdSBhcmUgZ29pbmcgdG8gaGF2ZSB0bw0KPiBw cm92aWRlIG1vcmUgc3BlY2lmaWNzIG9uIHdoYXQgY2FuIG1lYW5pbmdmdWxseSBiZSBzYWlkIHRo YXQgaXMgbm90IGFscmVhZHkNCj4gY292ZXJlZCBpbiB0aGUgcmVmZXJlbmNlcy4NCj4gDQo+IE15 IGFwb2xvZ2llcyBmb3IganVtcGluZyBpbiBpbiB0aGUgbWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQ IFJGQ3MgaGF2ZQ0KPiBjb3ZlcmVkIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYSBzcGVjaWZp YyBjbGFzcyBvZiBpbmZvcm1hdGlvbiwgKnVuZGVyIHRoZQ0KPiBhc3N1bXB0aW9uIHRoYXQgdGhl IHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xlIEFTIGFuZA0KPiBhZG1pbmlz dHJhdGl2ZSBkb21haW4qLiAgWW9hdiBpcyBwb2ludGluZyBvdXQgdGhhdCB0aGUgcmlza3MgZm9y IHRoYXQNCj4gaW5mb3JtYXRpb24gbWF5IGNoYW5nZSB3aGVuIHRoZSBkaXN0cmlidXRpb24gaXMg b3ZlciBhIGJyb2FkZXIgZG9tYWluIHRoYW4NCj4gdGhlIG9uZSBmb3Igd2hpY2ggdGhlIHByZXZp b3VzIGFuYWx5c2lzIHdhcyBwZXJmb3JtZWQuDQo+IA0KDQpbTGVzOl0gSUdQIFJGQ3MgdGFsayBi b3RoIGFib3V0IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydCAod2hpY2gg YXJlIGluZGVlZCBib3VuZCB0byBhIHNpbmdsZSBBUykgIGFuZCB0aGUgcmlza3MgYXNzb2NpYXRl ZCB3aXRoIHRoZSBwYXJ0aWN1bGFyIGNsYXNzIG9mIGluZm9ybWF0aW9uLg0KDQpSRkMgNzc1MiB0 YWxrcyBhYm91dCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGRpc3RyaWJ1dGlvbiB1c2luZyBC R1AtTFMgYXMgdGhlIHRyYW5zcG9ydCBhbmQgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUg Y2xhc3Mgb2YgaW5mb3JtYXRpb24uDQoNClBsZWFzZSByZWFkIGh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9yZmM3ODEwI3NlY3Rpb24tMTEgYW5kIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9yZmM3NzUyI3NlY3Rpb24tOCBpbiB0aGVpciBlbnRpcmV0eS4NCg0KVW5sZXNzIHlvdSB3YW50 IHRvIGFyZ3VlIHRoYXQgdGhlIHJpc2sgYXNzb2NpYXRlZCB3aXRoIGRpc3RyaWJ1dGluZyB0aGUg aW5mb3JtYXRpb24gZGVmaW5lZCBpbiB0aGlzIGRvY3VtZW50IGlzIHF1YWxpdGF0aXZlbHkgZGlm ZmVyZW50IHRoYW4gdGhlIHJpc2sgYXNzb2NpYXRlZCB3aXRoIChmb3IgZXhhbXBsZSkgIlVucmVz ZXJ2ZWQgQmFuZHdpZHRoIiBkZWZpbmVkIGluIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9y ZmM3NzUyI3NlY3Rpb24tMy4zLjIgIEkgaGF2ZSBubyBpZGVhIHdoYXQgdG8gc2F5LiBZb3UgYXJl IGdvaW5nIHRvIGhhdmUgdG8gaGVscCBtZSBoZXJlLg0KDQogICBMZXMNCg0KPiAtQmVuDQo+IA0K PiA+DQo+ID4gPz8/DQo+ID4NCj4gPiAgICBMZXMNCj4gPg0KPiA+DQo+ID4gRnJvbTogWW9hdiBO aXIgPHluaXIuaWV0ZkBnbWFpbC5jb20+DQo+ID4gU2VudDogVGh1cnNkYXksIE9jdG9iZXIgMTgs IDIwMTggOTozOCBBTQ0KPiA+IFRvOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdA Y2lzY28uY29tPg0KPiA+IENjOiBzZWNkaXJAaWV0Zi5vcmc7IGlkckBpZXRmLm9yZzsgaWV0ZkBp ZXRmLm9yZzsNCj4gPiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnDQo+ID4g U3ViamVjdDogUmU6IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwLTEzDQo+ID4NCj4gPiBIaSwgTGVzLg0KPiA+DQo+ID4gSSB0aGluayB3ZSBhcmUgY29udmVy Z2luZywgYnV0IGhhdmVu4oCZdCBjb252ZXJnZWQgeWV0Lg0KPiA+DQo+ID4gSGVyZeKAmXMgd2hh dCBpcyBzdGlsbCBtaXNzaW5nIGZvciBtZTogWW91IGFyZSBhZGRpbmcgc29tZSBuZXcgVExWcyB0 byBwYXNzDQo+IGludG8gQkdQLUxTLiBMZXTigJlzIHBpY2sgb25lIGF0IHJhbmRvbSDigJQgIHRo ZSBVbmlkaXJlY3Rpb25hbCBVdGlsaXplZA0KPiBCYW5kd2lkdGgg4oCUIGFzIGFuIGV4YW1wbGUu ICBZb3UgYXJlIGNsYWltaW5nIHR3byB0aGluZ3MgYWJvdXQgdGhpcyBUTFY6DQo+ID4NCj4gPiAg IDEuICBUaGF0IFJGQyA3NzUyIGFscmVhZHkgaGFzIHRleHQgYWJvdXQgc2VuZGluZyBvdGhlciBU TFZzIGluIEJHUC1MUy4NCj4gPiAgIDIuICBUaGF0IFJGQyA3ODEwIGFuZCA3NDcxIGhhdmUgdGV4 dCBhYm91dCBzZW5kaW5nIFVuaWRpcmVjdGlvbmFsIFV0aWxpemVkDQo+IEJhbmR3aWR0aCBpbiBJ Uy1JUyBhbmQgT1NQRi4NCj4gPg0KPiA+IEJvdGggb2YgdGhlc2UgYXJlIHRydWUsIGJ1dCBJIGNs YWltIHRoYXQgZXZlbiB0YWtlbiB0b2dldGhlciB0aGV5IGFyZSBub3QNCj4gZW5vdWdoLiBCR1Ag cnVucyBpbiBkaWZmZXJlbnQgZW52aXJvbm1lbnRzIHRoYW4gT1NQRiwgc28gYSBzdGF0ZW1lbnQg dGhhdA0KPiBzZW5kaW5nIFVuaWRpcmVjdGlvbmFsIFV0aWxpemVkIEJhbmR3aWR0aCBpbiBPU1BG IGlzIHNhZmUgaXMgbm90IHN1ZmZpY2llbnQgZm9yDQo+IHByb3ZpbmcgaXQgc2FmZSBpbiBCR1At TFMuICBTaW1pbGFybHksIHRoZSBmYWN0IHRoYXQgdGhlIOKAnFByZWZpeCBNZXRyaWPigJ0gVExW IGlzDQo+IHNhZmUgdG8gc2VuZCBvdmVyIEJHUC1MUyBpcyBubyBwcm9vZiB0aGF0IHNlbmRpbmcg VW5pZGlyZWN0aW9uYWwgVXRpbGl6ZWQNCj4gQmFuZHdpZHRoIGlzIHNhZmUuDQo+ID4NCj4gPiBJ 4oCZbSBtaXNzaW5nIGEgcGFyYWdyYXBoIG1ha2luZyB0aGUgY2xhaW0gdGhhdCBkaXN0cmlidXRp bmcgVW5pZGlyZWN0aW9uYWwNCj4gVXRpbGl6ZWQgQmFuZHdpZHRoIChhbmQgdGhlIG90aGVyIFRM VnMpIG92ZXIgQkdQLUxTIGlzIHNhZmUuDQo+ID4NCj4gPiBIb3BlIHRoaXMgaGVscHMNCj4gPg0K PiA+IFlvYXYNCj4gPg0KPiA+DQo+ID4gT24gMTcgT2N0IDIwMTgsIGF0IDIyOjQwLCBMZXMgR2lu c2JlcmcgKGdpbnNiZXJnKQ0KPiA8Z2luc2JlcmdAY2lzY28uY29tPG1haWx0bzpnaW5zYmVyZ0Bj aXNjby5jb20+PiB3cm90ZToNCj4gPg0KPiA+IFlvYXYg4oCTDQo+ID4NCj4gPiBJIHRoaW5rIHdl IGFyZSBjb252ZXJnaW5nLg0KPiA+IElubGluZS4NCj4gPg0KPiA+IEZyb206IFlvYXYgTmlyIDx5 bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPj4NCj4gPiBTZW50 OiBXZWRuZXNkYXksIE9jdG9iZXIgMTcsIDIwMTggMTE6MTQgQU0NCj4gPiBUbzogTGVzIEdpbnNi ZXJnIChnaW5zYmVyZykNCj4gPiA8Z2luc2JlcmdAY2lzY28uY29tPG1haWx0bzpnaW5zYmVyZ0Bj aXNjby5jb20+Pg0KPiA+IENjOiBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9y Zz47DQo+ID4gaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+Ow0KPiA+IGlldGZAaWV0 Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+Ow0KPiA+IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC4NCj4gPiBhbGxA aWV0Zi5vcmc+DQo+ID4gU3ViamVjdDogUmU6IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQt aWV0Zi1pZHItdGUtcG0tYmdwLTEzDQo+ID4NCj4gPiBIaSwgTGVzLg0KPiA+DQo+ID4gSSBhZ3Jl ZSB0aGF0IG15IGRpYWdyYW0gY29tbWVudCBpcyBkaXJlY3RlZCBtb3N0bHkgYXQgNzc1Mi4gSG93 ZXZlciwgdGhlDQo+IFJGQ3MgdGhhdCB3ZSBwcm9kdWNlIGFyZSBpbnRlbmRlZCB0byBiZSByZWFk YWJsZSBieSB0aGUgZ2VuZXJhbCB0ZWNobmljYWwNCj4gY29tbXVuaXR5LCBub3QganVzdCB0aGUg ZXhwZXJ0cyBpbiB0aGUgd29ya2luZyBncm91cC4gRm9yIHRoZSBzYW1lIHJlYXNvbg0KPiB0aGF0 IHdlIGFyZSByZXF1aXJlZCB0byBleHBhbmQgYWNyb255bXMgb24gZmlyc3QgdXNlLCBJIHRoaW5r IGl0IG1ha2VzIHNlbnNlDQo+IGZvciBhIGRvY3VtZW50IHRoYXQgZGVzY3JpYmVzIG5ldyBpbmZv cm1hdGlvbiBiZWluZyBzZW50IHRvIGlkZW50aWZ5IHRoZQ0KPiB0YXJnZXQuIEkgd2lsbCBkcm9w IHRoaXMgcG9pbnQsIHRob3VnaCwgYmVjYXVzZSBpdCBpcyBhIGdlbmVyYWwgY29tbWVudCByYXRo ZXINCj4gdGhhbiBhIHNlY2RpciBpc3N1ZS4NCj4gPg0KPiA+IEkgYWdyZWUgYWJvdXQgbm90IG5l ZWRpbmcgdG8gcmVwZWF0IGluZm9ybWF0aW9uIHRoYXQgaXMgYWxyZWFkeSBzdGF0ZWQNCj4gZWxz ZXdoZXJlLCBidXQgeW91IGRvIG5lZWQgdG8gcG9pbnQgdG8gaXQsIGFzIHlvdSBkbyB3aXRoIHRo ZSBnZW5lcmFsIHNlY3VyaXR5DQo+IG1vZGVsIG9mIEJHUCAoZmlyc3QgcGFyYWdyYXBoKSwgYW5k IGFzIHlvdSBkbyB3aXRoIHRoZSBwYXJhZ3JhcGggZGVzY3JpYmluZw0KPiBob3cgdGhlIHRyYW5z cG9ydCBvZiBhdHRyaWJ1dGVzIGlzIHNlY3VyZWQgKHNlY29uZCBwYXJhZ3JhcGgpLiBUaGF0IHBh cnQgaXMNCj4gZmluZS4NCj4gPg0KPiA+IFJGQyA3ODEwIGFuZCA3NDcxIGRlc2NyaWJlIHRoZSBu ZXcgaW5mb3JtYXRpb24gdG8gYmUgc2VudCwgYnV0IHRoZXkgYXJlDQo+IGFib3V0IElTLUlTIGFu ZCBPU1BGLiBUaGUgU2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBpbiA3ODEwIGNvbnRh aW5zDQo+IHRoZSBmb2xsb3dpbmcgdGV4dDogIkl0IGlzIGFudGljaXBhdGVkIHRoYXQgaW4gbW9z dCBkZXBsb3ltZW50cywgdGhlIElTLUlTDQo+IHByb3RvY29sIGlzIHVzZWQgd2l0aGluIGFuIGlu ZnJhc3RydWN0dXJlIGVudGlyZWx5IHVuZGVyIGNvbnRyb2wgb2YgdGhlIHNhbWUNCj4gb3BlcmF0 b3Iu4oCdIGFuZCBjb250aW51ZXMgdG8gZGlzY3VzcyBNSVRNIGF0dGFja3MgaWYgdGhpcyBpcyBu b3QgdGhlIGNhc2UuICBDYW4NCj4gdGhlIHNhbWUgYXNzdW1wdGlvbiBiZSBtYWRlIGFib3V0IEJH UD8gIFRoYXQgaXMgdGhlIHBhcnQgdGhhdCBJIHRoaW5rIGlzDQo+IG1pc3NpbmcuIEVpdGhlciBz dGF0ZSB0aGF0IHdoZXJlIEJHUC1MUyBpcyB1c2VkIHRoZSBhc3N1bXB0aW9uIGNhbiBiZSBtYWRl LA0KPiBvciBqdXN0aWZ5IHdoeSB0aGVyZSBpcyBubyByaXNrIGV2ZW4gd2hlbiB0aGUgaW5mb3Jt YXRpb24gaXMgcHJvcGFnYXRlZCB0bw0KPiBpbmZyYXN0cnVjdHVyZSB0aGF0IGlzIG5vdCB1bmRl ciBjb250cm9sIG9mIGEgc2luZ2xlIG9wZXJhdG9yLiAgIFRoZSBkaWZmZXJlbmNlDQo+IGJldHdl ZW4gQkdQIGFuZCBlaXRoZXIgSVMtSVMgb3IgT1NQRiBpcyBub3QgcGFydCBvZiB0aG9zZSBvdGhl ciBkb2N1bWVudHMsDQo+IHNvIElNTyBpdCBzaG91bGQgYmUgc3RhdGVkIGhlcmUuDQo+ID4NCj4g PiBbTGVzOl0gSSBhZ3JlZSB3aXRoIHRoaXMuDQo+ID4gSWYgd2UgbG9vayBhdCB0aGUgU2VjdXJp dHkgc2VjdGlvbiBvZiBSRkMgNzc1MiB3ZSBzZWUgYSBudW1iZXIgb2YgaXNzdWVzDQo+IGRpc2N1 c3NlZC4gSWYgd2Ugd2VyZSB0byBhZGQgdGhlIGZvbGxvd2luZyBpbnRvIHRoaXMgZG9jdW1lbnQg d291bGQgaXQNCj4gc3VmZmljZT8NCj4gPg0KPiA+IOKAnFNlY3VyaXR5IGNvbnNpZGVyYXRpb25z IGZvciBhY3F1aXJpbmcgYW5kIGRpc3RyaWJ1dGluZyBCR1AtTFMgaW5mb3JtYXRpb24NCj4gYXJl IGRpc2N1c3NlZCBpbiBSRkM3NzUyLuKAnQ0KPiA+DQo+ID4gSeKAmWQgbGlrZSB0byBwb2ludCBv dXQgdGhhdCB0aGlzIGRvY3VtZW50IGlzIGp1c3Qgb25lIG9mIG1hbnkgKGV4aXN0aW5nDQo+ID4g YW5kIHlldCB0byBiZSB3cml0dGVuKSBleHRlbnNpb25zIHRvIFJGQyA3NzUyLiBHaXZlbiB0aGUg d2F5IEJHUC1MUw0KPiA+IGhhcyBiZWVuIGRlZmluZWQsIGV2ZXJ5IHRpbWUgd2UgZGVmaW5lIG5l dyBpbmZvcm1hdGlvbiB0byBiZQ0KPiA+IGFkdmVydGlzZWQgYnkgYW4gSUdQIHdlIGhhdmUgdG8g d3JpdGUgYSBCR1AtTFMgZHJhZnQgZGVmaW5pbmcgaG93IHRoYXQNCj4gPiBpbmZvcm1hdGlvbiBp cyB0byBiZSBhZHZlcnRpc2VkIGluIEJHUC1MUy4gU28gdGhpcyBpc3N1ZSBpcyBnb2luZyB0bw0K PiA+IGNvbWUgdXAgb3ZlciBhbmQgb3Zlci4gSSBob3BlIHdoYXQgd2UgYXJlIGRvaW5nIGluIHRo aXMgZG9jdW1lbnQgaXMgYQ0KPiA+IGdvb2QgbW9kZWwgZm9yIFNlY3VyaXR5IENvbnNpZGVyYXRp b25zIGluIGFsbCBvZiB0aGVzZSB0eXBlcyBvZiBkcmFmdHMNCj4gPiBpZS4sDQo+ID4NCj4gPiAx KVJlZmVyZW5jZSBSRkMgNzc1MiBTZWN1cml0eSBkaXNjdXNzaW9uLg0KPiA+IDIpUmVmZXJlbmNl IHRoZSByZWxldmFudCBJR1AgUkZDIFNlY3VyaXR5IGRpc2N1c3Npb24gdG8gY292ZXIgc2VjdXJp dHkNCj4gPiBpc3N1ZXMgc3BlY2lmaWMgdG8gdGhlIGNsYXNzIG9mIGluZm9ybWF0aW9uIGNvdmVy ZWQgYnkgdGhlIGRyYWZ0DQo+ID4NCj4gPiBXaGF0IHdlIGxhY2sgYXQgdGhlIG1vbWVudCBpcyAj MSBhYm92ZS4NCj4gPg0KPiA+IERvZXMgdGhpcyB3b3JrPw0KPiA+DQo+ID4gICAgTGVzDQo+ID4N Cj4gPiBZb2F2DQo+ID4NCj4gPg0KPiA+DQo+ID4gT24gMTcgT2N0IDIwMTgsIGF0IDI6NTIsIExl cyBHaW5zYmVyZyAoZ2luc2JlcmcpDQo+IDxnaW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNi ZXJnQGNpc2NvLmNvbT4+IHdyb3RlOg0KPiA+DQo+ID4gWW9hdiAtDQo+ID4NCj4gPiBUaGFueCBm b3IgdGhlIHJldmlldy4NCj4gPg0KPiA+IEknbGwgcHJlZmFjZSBteSByZW1hcmtzIGJ5IHNheWlu ZyBJIGFtIGEgYmlnIGJlbGlldmVyIGluIG1vZHVsYXJpdHkuIElmIGENCj4gcmVmZXJlbmNlZCBk b2N1bWVudCBoYXMgYWxyZWFkeSBjb3ZlcmVkIGFuIGlzc3VlIEkgc3Ryb25nbHkgYmVsaWV2ZSB3 ZSBhcmUNCj4gYmV0dGVyIG9mZiByZWZlcmVuY2luZyB0aGF0IGRvY3VtZW50IHRoYW4gdHJ5aW5n IHRvIHJlcGVhdC9yZXN0YXRlIHdoYXQgdGhlDQo+IHJlZmVyZW5jZWQgZG9jdW1lbnQgaGFzIHNh aWQuDQo+ID4gVGhlcmUgYXJlIG9ubHkgdHdvIHRoaW5ncyB0aGF0IGNhbiBoYXBwZW4gd2hlbiB3 ZSByZXBlYXQvcmVzdGF0ZToNCj4gPg0KPiA+IDEpV2UgYXJlIHJlZHVuZGFudA0KPiA+IDIpV2Ug aW50cm9kdWNlIGFtYmlndWl0eQ0KPiA+DQo+ID4gTmVpdGhlciBvZiB0aGVzZSBpcyBkZXNpcmFi bGUuDQo+ID4NCj4gPiBSZXNwb25zZXMgaW5saW5lLg0KPiA+DQo+ID4gPiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPiA+ID4gRnJvbTogWW9hdiBOaXIgPHluaXIuaWV0ZkBnbWFpbC5jb208 bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+Pg0KPiA+ID4gU2VudDogVHVlc2RheSwgT2N0b2Jl ciAxNiwgMjAxOCAyOjE4IFBNDQo+ID4gPiBUbzogc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNk aXJAaWV0Zi5vcmc+DQo+ID4gPiBDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+ Ow0KPiA+ID4gaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47DQo+ID4gPiBkcmFm dC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZw0KPiA+ID4gcC5hbGxAaWV0Zi5vcmc+DQo+ID4gPiBTdWJqZWN0OiBTZWNkaXIgZWFy bHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KPiA+ID4NCj4gPiA+IFJl dmlld2VyOiBZb2F2IE5pcg0KPiA+ID4gUmV2aWV3IHJlc3VsdDogSGFzIE5pdHMNCj4gPiA+DQo+ ID4gPiBUaGlzIGlzIGFuIGVhcmx5IHJldmlldyB3aXRoIGEgc3BlY2lmaWMgcmVxdWVzdCB0byBy ZXZpZXcgdGhlDQo+ID4gPiBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KPiA+ID4N Cj4gPiA+IFRoZSBkcmFmdCBhZGRzIGEgYnVuY2ggb2YgVExWcyB0byBiZSBzZW50IGZyb20gcm91 dGVycyByZWdhcmRpbmcgdGhlDQo+ID4gPiBsaW5rIHN0YXRlIG9mIHRoZSBsaW5rIHVzZWQgZm9y IElHUC4gVGhlIGRyYWZ0IHJlZmVyZW5jZXMgUkZDIDc3NTINCj4gPiA+IHdoaWNoIGRlZmluZWQg ZWFybGllciBUTFZzIHVzZWQgdG8gY2FycnkgTkxSSSAocmVhY2hhYmlsaXR5KSBpbmZvcm1hdGlv bi4NCj4gPiA+DQo+ID4gPiBXaGF0IEkgZm91bmQgZGlmZmljdWx0IGFib3V0IGJvdGggNzc1MiBh bmQgdGhpcyBkcmFmdCBpcyB0aGUNCj4gPiA+IHZhZ3VlbmVzcyBhYm91dCB3aG8gdGhlIGNvbnN1 bWVyIG9mIHRoaXMgaW5mb3JtYXRpb24gaXMuIFRoZSBhYnN0cmFjdCBvZg0KPiA3NzUyIGJlZ2lu cyBsaWtlIHRoaXM6DQo+ID4gPiAiSW4gYSBudW1iZXIgb2YgZW52aXJvbm1lbnRzLCBhIGNvbXBv bmVudCBleHRlcm5hbCB0byBhIG5ldHdvcmsgaXMNCj4gPiA+IGNhbGxlZCB1cG9uIHRvIHBlcmZv cm0gY29tcHV0YXRpb25zIGJhc2VkIG9uIHRoZSBuZXR3b3JrIHRvcG9sb2d5DQo+ID4gPiBhbmQg Y3VycmVudCBzdGF0ZSBvZiB0aGUgY29ubmVjdGlvbnMgd2l0aGluIHRoZSBuZXR3b3JrLCBpbmNs dWRpbmcNCj4gPiA+IFRyYWZmaWMgRW5naW5lZXJpbmcNCj4gPiA+IChURSkgaW5mb3JtYXRpb24u IiBUaGVyZSBpcyBhbHNvIGEgZGlhZ3JhbSB3aXRoIGluZm9ybWF0aW9uIGZsb3dpbmcNCj4gPiA+ IHRvIGEgImNvbnN1bWVyIg0KPiA+ID4gYW5kIHRoYXQncyBpdC4gSXMgaXQgYW4gU0ROIGNvbnRy b2xsZXI/IFNvbWUga2luZCBvZiBhcHBsaWNhdGlvbj8NCj4gPiA+DQo+ID4NCj4gPiBbTGVzOl0g VGhlIGRpYWdyYW0geW91IGFyZSByZWZlcnJpbmcgdG8gc2VlbXMgbW9zdCBsaWtlbHkgdG8gYmUg aW4gUkZDIDc3NTINCj4gc2luY2UgdGhlcmUgaXMgbm8gc3VjaCBkaWFncmFtIGluIHRoaXMgZHJh ZnQuDQo+ID4gV2hpY2ggbGVhZHMgbWUgdG8gc2F5IGlmIHlvdSBmZWVsIHRoaXMgaXMgaW5zdWZm aWNpZW50IHRoZW4gaXQgbmVlZHMgdG8gYmUNCj4gdGFrZW4gdXAgaW4gdGhlIGNvbnRleHQgb2Yg UkZDIDc3NTIgLSBub3QgdGhpcyBkcmFmdC4NCj4gPg0KPiA+IEhvcGVmdWxseSB0aGlzIG1ha2Vz IHNlbnNlIHRvIHlvdSBhcyB3ZWxsLg0KPiA+DQo+ID4gPiBPSy4gT24gdG8gdGhlIFNlY3VyaXR5 IENvbnNpZGVyYXRpb25zIHNlY3Rpb24uIEl0IGJlZ2lucyB3aXRoIGENCj4gPiA+IHN0YXRlbWVu dCB0aGF0IHRoaXMgZG9lcyBub3QgYWZmZWN0IHRoZSBzZWN1cml0eSBtb2RlbCBvZiBCR1AuDQo+ ID4gPiBBbHRob3VnaCB0aGF0IGlzIGp1c3QgY2xhaW1lZCBhbmQgbm90IHN1cHBvcnRlZCBpbiB0 ZXh0LCBpdCBzZWVtcw0KPiA+ID4gcmVhc29uYWJsZS4gSSBzaG91bGQgbm90ZSB0aGF0IHRoaXMg cGFyYWdyYXBoIGlzIGNvcGllZCBmcm9tIDc3NTIuDQo+ID4gPg0KPiA+ID4gVGhlIHNlY29uZCAo YW5kIGxhc3QpIHBhcmFncmFwaCBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMNCj4gPiA+ IHNlY3Rpb24gdGFsa3MgYWJvdXQgdGhlIG5ldyBhdHRyaWJ1dGVzLiBJdCBtZW50aW9ucyB0aGF0 IHNlY3VyaXR5DQo+ID4gPiBhbmQgYXV0aGVudGljYXRpb24gYXJlIGFzc3VtZWQgdG8gYmUgdXNl ZCBqdXN0IGFzIGluIFJGQ3MgNzgxMCBhbmQNCj4gPiA+IDc0NzEuIFdpdGggcHJvcGVyIGF1dGhl bnRpY2F0aW9uIHRoaXMgaW5mb3JtYXRpb24gaXMgbm90IHNlbnQgZXhjZXB0IHRvDQo+IHRoZSBw cm9wZXIgY29uc3VtZXIuDQo+ID4gPiBIb3dldmVyLCB0aGVyZSBpcyBhbiBpbXBvcnRhbnQgZGlm ZmVyZW5jZSB0aGF0IEkgdGhpbmsgbmVlZHMgdG8gYmUNCj4gPiA+IGFkZHJlc3NlZC4gNzgxMCBh bmQgNzQ3MSBhcmUgYWJvdXQgSVMtSVMgYW5kIE9TUEYgcmVzcGVjdGl2ZWx5Lg0KPiA+ID4gVGhl cmUgcm91dGluZyBwcm90b2NvbHMgYXJlIHR5cGljYWxseSB1c2VkIGluIGNsb3NlZCBlbnZpcm9u bWVudHMsDQo+ID4gPiBhbmQgdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIG9mIDc4MTAgc3Rh dGUgdGhhdCBleHBsaWNpdGx5LiBCR1ANCj4gPiA+ICh0aGUgc3ViamVjdCBvZiB0aGlzDQo+ID4g PiBkb2N1bWVudCkgaXMgZGlmZmVyZW50IGluIHRoYXQgaXQgaXMgdHlwaWNhbGx5IHVzZWQgYWxs IG92ZXIgdGhlDQo+ID4gPiBJbnRlcm5ldC4gV2l0aG91dCBmdXJ0aGVyIGNsYXJpdHkgYWJvdXQg d2hvIGFuZCB3aGVyZSB0aGUgImNvbnN1bWVyIg0KPiA+ID4gaXMsIGl0IGhhcyB0byBiZSBhc3N1 bWVkIHRoYXQgdGhlIGluZm9ybWF0aW9uIG1pZ2h0IGF0IGxlYXN0IGxlYWsgb3V0Lg0KPiA+ID4N Cj4gPiBbTGVzOl0gSSB0aGluayB5b3UgaGF2ZSBtaXNpbnRlcnByZXRlZCB0aGlzIHBhcmFncmFw aC4gKGVtcGhhc2lzIGFkZGVkDQo+ID4gYmVsb3cpDQo+ID4NCj4gPiAiIFRoZSBJR1ANCj4gPiAg ICBpbnN0YW5jZXMgb3JpZ2luYXRpbmcgdGhlc2UgVExWcyBhcmUgYXNzdW1lZCB0byBoYXZlIGFs bCB0aGUgcmVxdWlyZWQNCj4gPiAgICBzZWN1cml0eSBhbmQgYXV0aGVudGljYXRpb24gbWVjaGFu aXNtIChhcyBkZXNjcmliZWQgaW4gW1JGQzc4MTBdIGFuZA0KPiA+ICAgIFtSRkM3NDcxXSkgaW4g b3JkZXIgdG8gcHJldmVudCBhbnkgc2VjdXJpdHkgaXNzdWUgd2hlbiBwcm9wYWdhdGluZw0KPiA+ ICAgIHRoZSBUTFZzIGludG8gQkdQLUxTLiINCj4gPg0KPiA+IFdoYXQgd2UgYXJlIHN0YXRpbmcg aGVyZSBpcyB0aGF0IHdoZW4gdGhlIElHUCBhZHZlcnRpc2VtZW50cyBhcmUgc2VudCB0aGUNCj4g c2VjdXJpdHkvYXV0aGVudGljYXRpb24gbWVjaGFuaXNtcyBzcGVjaWZpZWQgaW4gdGhlIElHUCBk cmFmdHMgYXBwbGllcy4NCj4gPiBUaGlzIGlzIE5PVCB0cnlpbmcgdG8gYXBwbHkgUkZDNzgxMC9S RkM3NDcxIHRvIHRoZSBuZXcgQkdQDQo+IGFkdmVydGlzZW1lbnRzLg0KPiA+IFRoZSBzZWN1cml0 eSBpc3N1ZXMgcmVsYXRlZCB0byB0aGUgbmV3IEJHUCBhZHZlcnRpc2VtZW50cyBhcmUgZGlzY3Vz c2VkIGluDQo+IHRoZSBwcmV2aW91cyBwYXJhZ3JhcGguDQo+ID4NCj4gPiA+IEFub3RoZXIgaXNz dWUgSSBoYXZlIHdpdGggdGhpcyBzZWN0aW9uIGlzIHRoYXQgdGhlIGRyYWZ0IHNwZWNpZmllcw0K PiA+ID4gaG93IHRvIHNlbmQgbmV3IGluZm9ybWF0aW9uICh0aGUgbGluayBzdGF0ZSBUTFZzKSBm cm9tIG9uZSBub2RlIHRvDQo+ID4gPiBhbm90aGVyLiBUaGlzIGlzIGluZm9ybWF0aW9uIHRoYXQg d2FzIG5vdCBzZW50IGJlZm9yZS4gV2hlbiBhIGNoYW5nZQ0KPiA+ID4gbGlrZSB0aGF0IGlzIG1h ZGUsIEkgdGhpbmsgdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24NCj4gPiA+IHNo b3VsZCBqdXN0aWZ5IHdoeSBpdCBpcyBPSyB0byBkaXN0cmlidXRlIHRoaXMgaW5mb3JtYXRpb24u DQo+ID4gPiBUeXBpY2FsbHkgeW91IG5lZWQgdG8ganVzdGlmeSB0aGF0IGxlYWtpbmcgdGhpcyBp bmZvcm1hdGlvbiAodG8gdGhlDQo+ID4gPiBpbnRlbmRlZCByZWNpcGllbnQgb3IgdG8gdGhlIHJl c3Qgb2YgdGhlIHdvcmxkKSBkb2VzIG5vdA0KPiA+ID4gKDEpIG1ha2UgaXQgZWFzaWVyIHRvIGF0 dGFjayBzb21lIHBhcnQgb2YgdGhlIHN5c3RlbSwgb3IgKDIpDQo+ID4gPiBkaXN0cmlidXRlcyBw cml2YWN5LXNlbnNpdGl2ZSBpbmZvcm1hdGlvbiwgb3IgKDMpIHVuZGVybWluZXMgc29tZQ0KPiA+ ID4gb3RoZXIgY29uZmlkZW50aWFsaXR5IGludGVyZXN0LiBJIHRoaW5rIGl0J3MgZmFpcmx5IGVh c3kgdG8gbWFrZSB0aGUNCj4gPiA+IGFyZ3VtZW50IHRoYXQgdGhlIGluZm9ybWF0aW9uIGluIHRo ZXNlIFRMVnMgZG9lcyBub3QgZG8gYW55IG9mIHRoZQ0KPiBhYm92ZSwgYnV0IHRoZSBhcmd1bWVu dCBzaG91bGQgYmUgbWFkZS4NCj4gPiA+IFRoZSBsYXN0IHBhcmFncmFwaCBpbiB0aGUgU2VjdXJp dHkgQ29uc2lkZXJhdGlvbnMgc2VjdGlvbiBvZiBSRkMNCj4gPiA+IDc3NTIgaGFzIGp1c3Qgc3Vj aCBhbiBhcmd1bWVudC4NCj4gPg0KPiA+IFtMZXM6XSBTZWN1cml0eSBzZWN0aW9ucyBpbiBSRkM3 ODEwL1JGQzc0NzEgZGlyZWN0bHkgYWRkcmVzcyB0aGlzIHBvaW50Lg0KPiA+IFdFIGNvdWxkIHJl cGVhdCBzb21lIG9mIHRoYXQgaGVyZSDigJMgYnV0IGFzIHBlciBteSDigJxvcGVuaW5nIHN0YXRl bWVudOKAnSBJDQo+IGFtIHJlbHVjdGFudCB0byBkbyBzby4NCj4gPg0KPiA+IFdoYXQgZG8geW91 IHRoaW5rPw0KPiA+DQo+ID4gICAgTGVzDQo+ID4NCj4gPg0KPiANCj4gPiBfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+IHNlY2RpciBtYWlsaW5nIGxp c3QNCj4gPiBzZWNkaXJAaWV0Zi5vcmcNCj4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3NlY2Rpcg0KPiA+IHdpa2k6IGh0dHA6Ly90b29scy5pZXRmLm9yZy9hcmVhL3Nl Yy90cmFjL3dpa2kvU2VjRGlyUmV2aWV3DQoNCg== From nobody Thu Oct 18 17:59:19 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D98B130E69; Thu, 18 Oct 2018 17:59:04 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char 9C hex): Received: ...s kaduk@ATHENA.MIT.EDU)\n\t\234by outgoing.mit[...] X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V49rv8ydJHl0; Thu, 18 Oct 2018 17:59:02 -0700 (PDT) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 686C0130E64; Thu, 18 Oct 2018 17:59:01 -0700 (PDT) X-AuditID: 12074424-4efff700000071e7-5a-5bc92c52291d Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-7.mit.edu (Symantec Messaging Gateway) with SMTP id 03.71.29159.35C29CB5; Thu, 18 Oct 2018 20:58:59 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.14.7/8.9.2) with ESMTP id w9J0wuaG018684; Thu, 18 Oct 2018 20:58:57 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) œby outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id w9J0wpE7018594 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 18 Oct 2018 20:58:54 -0400 Date: Thu, 18 Oct 2018 19:58:51 -0500 From: Benjamin Kaduk To: "Les Ginsberg (ginsberg)" Cc: Yoav Nir , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Message-ID: <20181019005851.GY19309@kduck.kaduk.org> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <2d123b3a118a4a9ca0023be33af8a067@XCH-ALN-001.cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <2d123b3a118a4a9ca0023be33af8a067@XCH-ALN-001.cisco.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrLKsWRmVeSWpSXmKPExsUixCmqrBusczLaoP2HisWxtTdYLTb82chu 8er2MyaLZxvns1h8WPiQxWLpsQ9MDmweU35vZPXYOesuu8eSJT+ZApijuGxSUnMyy1KL9O0S uDIebdMp+CFdMadtFmsD4yaxLkZODgkBE4nn646zdTFycQgJrGGSONz3lBXC2cgoceP/AnYI 5y6TxItlk5hAWlgEVCW2bz8MZrMJqEg0dF9m7mLk4BARMJJY/FwbpJ5Z4DOjxPmNqxlB4sIC HhJ77+iAlPMCbbtx8QgjxMwDzBL9fddYIRKCEidnPmEBsZkF1CX+zLsENpNZQFpi+T8OiLC8 RPPW2cwgNqeAq0T3wr+MILaogLLE3r5D7BMYBWchmTQLyaRZCJNmIZm0gJFlFaNsSm6Vbm5i Zk5xarJucXJiXl5qka65Xm5miV5qSukmRlAcsLuo7GDs7vE+xCjAwajEw3vi+IloIdbEsuLK 3EOMkhxMSqK8Beono4X4kvJTKjMSizPii0pzUosPMUpwMCuJ8H7dDlTOm5JYWZValA+TkuZg URLnndiyOFpIID2xJDU7NbUgtQgmK8PBoSTBm6sNNFSwKDU9tSItM6cEIc3EwQkynAdoeCRI DW9xQWJucWY6RP4UozFH29PrM5g5OkCkEEtefl6qlDivCEipAEhpRmke3DRQKpPI3l/zilEc 6Dlh3gKQKh5gGoSb9wpoFRPQqhOmIH8UlyQipKQaGOe4ODNsftn/L+v4/EuFVz7lrxBS2DzH 893+L/v2rJdXyewMuuVxpVpDhe/Q81VPO38v5rKpfrx3/rw6eYHYAM2Dz9kPW1t5L0mOZ2US XFOhFvBO7Bnf+dkvaq+z7kpQZrstaHDnoSsH97OLX5Piha8KhW1Onqu+rqkraN+/Y15sjU3N Tt/YHiuxFGckGmoxFxUnAgBwQWvaQAMAAA== Archived-At: Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 00:59:05 -0000 On Fri, Oct 19, 2018 at 12:40:51AM +0000, Les Ginsberg (ginsberg) wrote: > Ben - > > Inline. > > > -----Original Message----- > > From: Benjamin Kaduk > > Sent: Thursday, October 18, 2018 5:27 PM > > To: Les Ginsberg (ginsberg) > > Cc: Yoav Nir ; idr@ietf.org; ietf@ietf.org; draft-ietf-idr- > > te-pm-bgp.all@ietf.org; secdir@ietf.org > > Subject: Re: [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 > > > > On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > > > Yoav – > > > > > > In regards to the risks associated with advertising the specific information > > covered in this draft we have a statement in the IGP drafts: > > > > > > From RFC7810 > > > > > > “The sub-TLVs introduced in this document allow an operator to > > > advertise state information of links (bandwidth, delay) that could be > > > sensitive and that an operator may not want to disclose.†> > > > > > In regards to the risks associated with sending information via BGP-LS we > > have a number of statements in RFC 7752 – most relevant is: > > > > > > “Additionally, it may be considered that the export of link-state and > > > TE information as described in this document constitutes a risk to > > > confidentiality of mission-critical or commercially sensitive > > > information about the network.†> > > > > > So long as there are references to both the IGP RFCs and RFC 7752 I am > > therefore hard pressed to understand what else could be usefully said. > > > Certainly the risks associated with the BGP-LS transport mechanism are not > > altered by adding some new TLVs – and since the IGP RFCs have already > > covered risks associated with the specific class of information (not simply the > > risks associated with the transport mechanism) you are going to have to > > provide more specifics on what can meaningfully be said that is not already > > covered in the references. > > > > My apologies for jumping in in the middle, but IIUC the IGP RFCs have > > covered the risks associated with a specific class of information, *under the > > assumption that the transport mechanism is within a single AS and > > administrative domain*. Yoav is pointing out that the risks for that > > information may change when the distribution is over a broader domain than > > the one for which the previous analysis was performed. > > > > [Les:] IGP RFCs talk both about the risks associated with the transport (which are indeed bound to a single AS) and the risks associated with the particular class of information. > > RFC 7752 talks about the risks associated with distribution using BGP-LS as the transport and the risks associated with the class of information. > > Please read https://tools.ietf.org/html/rfc7810#section-11 and https://tools.ietf.org/html/rfc7752#section-8 in their entirety. > > Unless you want to argue that the risk associated with distributing the information defined in this document is qualitatively different than the risk associated with (for example) "Unreserved Bandwidth" defined in https://tools.ietf.org/html/rfc7752#section-3.3.2 I have no idea what to say. You are going to have to help me here. I'm not sure I can commit to that reading list until the document gets on a telechat (this week's is a pretty big one), but hopefully Yoav can work on a faster scale than me. Thank you for the specific references; it does seem like we can converge pretty quickly. -Ben From nobody Thu Oct 18 18:18:22 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37772130E42; Thu, 18 Oct 2018 18:18:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.946 X-Spam-Level: X-Spam-Status: No, score=0.946 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PumifZ-x52wg; Thu, 18 Oct 2018 18:18:06 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 466ED130E2F; Thu, 18 Oct 2018 18:18:06 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Benjamin Kaduk'" , "'Les Ginsberg \(ginsberg\)'" Cc: , , , "'Yoav Nir'" , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <2d123b3a118a4a9ca0023be33af8a067@XCH-ALN-001.cisco.com> <20181019005851.GY19309@kduck.kaduk.org> In-Reply-To: <20181019005851.GY19309@kduck.kaduk.org> Date: Thu, 18 Oct 2018 21:18:00 -0400 Message-ID: <000901d46749$940a6610$bc1f3230$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AGeXQkiAc24RyOjEUaV8A== Content-Language: en-us X-Antivirus: AVG (VPS 181018-8, 10/18/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 01:18:08 -0000 Ben: Thank you for helping this discussion.=20 Sue Hares=20 IDR co-chair -----Original Message----- From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Benjamin Kaduk Sent: Thursday, October 18, 2018 8:59 PM To: Les Ginsberg (ginsberg) Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = Yoav Nir; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 On Fri, Oct 19, 2018 at 12:40:51AM +0000, Les Ginsberg (ginsberg) wrote: > Ben - >=20 > Inline. >=20 > > -----Original Message----- > > From: Benjamin Kaduk > > Sent: Thursday, October 18, 2018 5:27 PM > > To: Les Ginsberg (ginsberg) > > Cc: Yoav Nir ; idr@ietf.org; ietf@ietf.org;=20 > > draft-ietf-idr- te-pm-bgp.all@ietf.org; secdir@ietf.org > > Subject: Re: [secdir] Secdir early review of=20 > > draft-ietf-idr-te-pm-bgp-13 > >=20 > > On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) = wrote: > > > Yoav =E2=80=93 > > > > > > In regards to the risks associated with advertising the specific=20 > > > information > > covered in this draft we have a statement in the IGP drafts: > > > > > > From RFC7810 > > > > > > =E2=80=9CThe sub-TLVs introduced in this document allow an = operator to > > > advertise state information of links (bandwidth, delay) that = could be > > > sensitive and that an operator may not want to = disclose.=E2=80=9D > > > > > > In regards to the risks associated with sending information via=20 > > > BGP-LS we > > have a number of statements in RFC 7752 =E2=80=93 most relevant is: > > > > > > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > > > TE information as described in this document constitutes a risk = to > > > confidentiality of mission-critical or commercially sensitive > > > information about the network.=E2=80=9D > > > > > > So long as there are references to both the IGP RFCs and RFC 7752=20 > > > I am > > therefore hard pressed to understand what else could be usefully = said. > > > Certainly the risks associated with the BGP-LS transport mechanism = > > > are not > > altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have=20 > > already covered risks associated with the specific class of=20 > > information (not simply the risks associated with the transport=20 > > mechanism) you are going to have to provide more specifics on what=20 > > can meaningfully be said that is not already covered in the = references. > >=20 > > My apologies for jumping in in the middle, but IIUC the IGP RFCs=20 > > have covered the risks associated with a specific class of=20 > > information, *under the assumption that the transport mechanism is=20 > > within a single AS and administrative domain*. Yoav is pointing out = > > that the risks for that information may change when the distribution = > > is over a broader domain than the one for which the previous = analysis was performed. > >=20 >=20 > [Les:] IGP RFCs talk both about the risks associated with the = transport (which are indeed bound to a single AS) and the risks = associated with the particular class of information. >=20 > RFC 7752 talks about the risks associated with distribution using = BGP-LS as the transport and the risks associated with the class of = information. >=20 > Please read https://tools.ietf.org/html/rfc7810#section-11 and = https://tools.ietf.org/html/rfc7752#section-8 in their entirety. >=20 > Unless you want to argue that the risk associated with distributing = the information defined in this document is qualitatively different than = the risk associated with (for example) "Unreserved Bandwidth" defined in = https://tools.ietf.org/html/rfc7752#section-3.3.2 I have no idea what = to say. You are going to have to help me here. I'm not sure I can commit to that reading list until the document gets = on a telechat (this week's is a pretty big one), but hopefully Yoav can = work on a faster scale than me. Thank you for the specific references; = it does seem like we can converge pretty quickly. -Ben _______________________________________________ Idr mailing list Idr@ietf.org https://www.ietf.org/mailman/listinfo/idr From nobody Thu Oct 18 23:52:31 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 357EA130DFC for ; Thu, 18 Oct 2018 23:52:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7_8qJ_ZcUz8s for ; Thu, 18 Oct 2018 23:52:12 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CFA8130E3D for ; Thu, 18 Oct 2018 23:51:56 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id j46-v6so37186285qtc.9 for ; Thu, 18 Oct 2018 23:51:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WwH8OjfuRv0fGBwN1/0v32KziOukAfoi2wieokKnTmU=; b=Ngq94Lo0ysAlb971FtGiWp1PswCF3Hc+gHb6yvAyy1HEy/MsC/f9AhytYgDl1CEuSe rKIM/7B0oPjfWu7X5CeDLd8g9n6RBQ4rhaXutzbsh8gIP2r8RmnMkEVV7jz9eJmfGbaX pKMV4fKlx17SxHIna1oVEhw2tPR353+psWF8D5mCN6K0PalVYqcFyP5Dg/oqFPgCTBel lfRoZvda2RKT8NFXPWnc+ac8ml+GtvoGhqB3kPFuk9WwXRz+giQhfQCN8l3Eo/ZiZlAf d5OpyWBxooh5YAyT7yVLPuwFhE6i1A39kKBILg7Cx0C69BGOt+IV00ubn7uy2uWTtzEs W7Qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WwH8OjfuRv0fGBwN1/0v32KziOukAfoi2wieokKnTmU=; b=azh3d+SD0RHN26lszBeYcvR8uLfL2mTPJcJjxWB5zTBsacxOx68TSgI1TL8diazHrv k5Eb72vPJVtHWH+RZrD7y6WEiOk2q9NtDTjNM9mLfsI/pFbJqU+uXDAdRbBG7WZKxgOo 0wQiLsxeYsaz0MtGFVU/SUe5gakHTn5CA3Gnp0ZiyDJSKD8uRVVSDAzdhJrMPOHiEul1 XUr4MitE4hk4H13AwG7VMvUdxpr0b++Hw1igR5d+5LB6m8c7e00YCh3/32uM33BtIRGk SqSSZLIiOS9VKaYmdmQgvznLMmgWHZUQvT0gtxvZ77BoUlJAZ9w+08No6UoXsvURlOC6 6DCw== X-Gm-Message-State: ABuFfoiGWWSpliilOaDiUD+ei6VGUkMO8BXjsEg/jUaG+N8k5L1YryLj FUG/NSSfysAeieLIiIJ1UTEdVczN9YBmmHaXclPXIQ== X-Google-Smtp-Source: ACcGV62XMKmVbYSzNY6KrU7dcGlz8ErXY6aJzjbPrzroeh8i0UYsD7YfBq1sDmc8RQo00oPOO6WDgjMf4orffXhfE0A= X-Received: by 2002:ac8:70b:: with SMTP id g11-v6mr31343118qth.219.1539931915154; Thu, 18 Oct 2018 23:51:55 -0700 (PDT) MIME-Version: 1.0 References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> In-Reply-To: <20181019002642.GX19309@kduck.kaduk.org> From: Robert Raszuk Date: Fri, 19 Oct 2018 08:51:46 +0200 Message-ID: To: kaduk@mit.edu Cc: "Les Ginsberg (ginsberg)" , idr@ietf.org, draft-ietf-idr-te-pm-bgp.all@ietf.org, ietf@ietf.org, ynir.ietf@gmail.com, secdir@ietf.org Content-Type: multipart/alternative; boundary="000000000000c80f3005788f567b" Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 06:52:14 -0000 --000000000000c80f3005788f567b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Benjamin, Not sure if you have spotted similar comment made to IDR regarding this topic, but your comment seems to indicate that here we are about to define ways to carry nicely scoped IGP information into BGP. Well that has already happened with RFC7752 and your comment or for that matter Yoav's remarks are indeed spot on but to the security discussion on RFC7752 and IMO not any follow up extensions of it. Sure - as observed by Sue - one may argue that providing more information about the network to the potential attacker makes the network weaker, but the cure for that is to prevent the leaks and reduce probability of intercepting new information by unauthorized parties. BGP-LS is already defined in a new SAFI what by itself does provide nice level of isolation. RFC7752 is pretty clear on that too and says: "BGP peerings are not automatic and require configuration; thus, it is the responsibility of the network operator to ensure that only trusted consumers are configured to receive such information." If someone would be still concerned about configuration mistakes and negotiating SAFI 71 or 72 to those who should not get this data I recommend we reissue the RFC7752 as -bis version and restrict the scope of the distribution even further by mandating default use of NO-EXPORT community with ability to overwrite it for the selective eBGP peers. Or perhaps we could progress Jim's One Administrative Domain draft (draft-uttaro-idr-oad-01). In either case while both of your comments are great they seems a bit late in the game here or at least targeting wrong document. Kind regards, Robert. On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: > On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > > Yoav =E2=80=93 > > > > In regards to the risks associated with advertising the specific > information covered in this draft we have a statement in the IGP drafts: > > > > From RFC7810 > > > > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > > advertise state information of links (bandwidth, delay) that could b= e > > sensitive and that an operator may not want to disclose.=E2=80=9D > > > > In regards to the risks associated with sending information via BGP-LS > we have a number of statements in RFC 7752 =E2=80=93 most relevant is: > > > > =E2=80=9CAdditionally, it may be considered that the export of link-sta= te and > > TE information as described in this document constitutes a risk to > > confidentiality of mission-critical or commercially sensitive > > information about the network.=E2=80=9D > > > > So long as there are references to both the IGP RFCs and RFC 7752 I am > therefore hard pressed to understand what else could be usefully said. > > Certainly the risks associated with the BGP-LS transport mechanism are > not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs have= already > covered risks associated with the specific class of information (not simp= ly > the risks associated with the transport mechanism) you are going to have = to > provide more specifics on what can meaningfully be said that is not alrea= dy > covered in the references. > > My apologies for jumping in in the middle, but IIUC the IGP RFCs have > covered the risks associated with a specific class of information, *under > the assumption that the transport mechanism is within a single AS and > administrative domain*. Yoav is pointing out that the risks for that > information may change when the distribution is over a broader domain tha= n > the one for which the previous analysis was performed. > > -Ben > --000000000000c80f3005788f567b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Benjamin,

=
Not sure if you have spotted similar comment made to IDR regardi= ng this topic, but your comment seems to indicate that here we are about to= define ways to carry nicely scoped IGP information into BGP. Well that has= already happened with RFC7752 and your comment or for that matter Yoav'= ;s remarks are indeed spot on but to the security discussion on RFC7752 and= IMO not any follow up extensions of it.=C2=A0

Sur= e - as observed by Sue - one may argue that providing more information abou= t the network to the potential attacker makes the network weaker, but the c= ure for that is to prevent the leaks and reduce probability of intercepting= new information by unauthorized parties.=C2=A0

BG= P-LS is already defined in a new SAFI what by itself does provide nice leve= l of isolation. RFC7752 is pretty clear on that too and says:=C2=A0

"BGP peerings are not automatic and require configur= ation; thus, it is the responsibility of the network operator to ensure tha= t only trusted consumers are configured to receive such information."<= /div>

If someone would be still concerned about configur= ation mistakes and negotiating SAFI 71 or 72 to those who should not get th= is data I recommend we reissue the RFC7752 as -bis version and restrict the= scope of the distribution even further by mandating default use of NO-EXPO= RT community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft (draft-= uttaro-idr-oad-01).=C2=A0

In either case while bot= h of your comments are great they seems a bit late in the game here or at l= east targeting wrong document.=C2=A0

Kind regards,=
Robert.


On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> wrote:
On Thu, Oct 18, 2018 at 06:00:13PM +0000,= Les Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In regards to the risks associated with advertising the specific infor= mation covered in this draft we have a statement in the IGP drafts:
>
> From RFC7810
>
> =E2=80=9CThe sub-TLVs introduced in this document allow an operator to=
>=C2=A0 =C2=A0 advertise state information of links (bandwidth, delay) t= hat could be
>=C2=A0 =C2=A0 sensitive and that an operator may not want to disclose.= =E2=80=9D
>
> In regards to the risks associated with sending information via BGP-LS= we have a number of statements in RFC 7752 =E2=80=93 most relevant is:
>
> =E2=80=9CAdditionally, it may be considered that the export of link-st= ate and
>=C2=A0 =C2=A0 TE information as described in this document constitutes = a risk to
>=C2=A0 =C2=A0 confidentiality of mission-critical or commercially sensi= tive
>=C2=A0 =C2=A0 information about the network.=E2=80=9D
>
> So long as there are references to both the IGP RFCs and RFC 7752 I am= therefore hard pressed to understand what else could be usefully said.
> Certainly the risks associated with the BGP-LS transport mechanism are= not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs have = already covered risks associated with the specific class of information (no= t simply the risks associated with the transport mechanism) you are going t= o have to provide more specifics on what can meaningfully be said that is n= ot already covered in the references.

My apologies for jumping in in the middle, but IIUC the IGP RFCs have
covered the risks associated with a specific class of information, *under the assumption that the transport mechanism is within a single AS and
administrative domain*.=C2=A0 Yoav is pointing out that the risks for that<= br> information may change when the distribution is over a broader domain than<= br> the one for which the previous analysis was performed.

-Ben
--000000000000c80f3005788f567b-- From nobody Fri Oct 19 06:26:12 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB418130F07; Fri, 19 Oct 2018 06:25:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GcsOIbM30UhF; Fri, 19 Oct 2018 06:25:46 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31F28130F34; Fri, 19 Oct 2018 06:25:46 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> In-Reply-To: Date: Fri, 19 Oct 2018 09:25:42 -0400 Message-ID: <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00A7_01D4678D.B53C3AE0" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpoyGmy2A= Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 13:25:58 -0000 This is a multipart message in MIME format. ------=_NextPart_000_00A7_01D4678D.B53C3AE0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_00A7_01D4678D.B53C3AE0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.=C2=A0 However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.=C2=A0=C2=A0 = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues.=C2=A0

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. = =C2=A0As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible. =C2=A0

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.=C2=A0 = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert = Raszuk
Sent: Friday, October 19, 2018 2:52 AM
To: = kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; = ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org
Subject: Re: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, = Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote:
> = Yoav =E2=80=93
>
> In regards to the risks associated with = advertising the specific information covered in this draft we have a = statement in the IGP drafts:
>
> From RFC7810
> =
> =E2=80=9CThe sub-TLVs introduced in this document allow an = operator to
>    advertise state information of links = (bandwidth, delay) that could be
>    sensitive and that = an operator may not want to disclose.=E2=80=9D
>
> In = regards to the risks associated with sending information via BGP-LS we = have a number of statements in RFC 7752 =E2=80=93 most relevant = is:
>
> =E2=80=9CAdditionally, it may be considered that = the export of link-state and
>    TE information as = described in this document constitutes a risk to
>    = confidentiality of mission-critical or commercially = sensitive
>    information about the = network.=E2=80=9D
>
> So long as there are references to = both the IGP RFCs and RFC 7752 I am therefore hard pressed to understand = what else could be usefully said.
> Certainly the risks associated = with the BGP-LS transport mechanism are not altered by adding some new = TLVs =E2=80=93 and since the IGP RFCs have already covered risks = associated with the specific class of information (not simply the risks = associated with the transport mechanism) you are going to have to = provide more specifics on what can meaningfully be said that is not = already covered in the references.

My apologies for jumping in in = the middle, but IIUC the IGP RFCs have
covered the risks associated = with a specific class of information, *under
the assumption that the = transport mechanism is within a single AS and
administrative = domain*.  Yoav is pointing out that the risks for = that
information may change when the distribution is over a broader = domain than
the one for which the previous analysis was = performed.

-Ben

------=_NextPart_000_00A7_01D4678D.B53C3AE0-- From nobody Fri Oct 19 07:51:48 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD4CF128D68; Fri, 19 Oct 2018 07:51:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PsGOXaqOtkFX; Fri, 19 Oct 2018 07:51:37 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60B1912958B; Fri, 19 Oct 2018 07:51:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=24562; q=dns/txt; s=iport; t=1539960697; x=1541170297; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=HwaKMPbCyxy1zAg8hiy4yHyjGte6Tps3SCFMVgtZOPQ=; b=Y6JZ2S2M0GXiuQmOWGyfM2Yp/Z+YCq1dQ79p90wjbvhsWCXJSGyRX2U6 3/mzSXmwlYj5gx6VWmxrS9fO+yDSY9df+kw7a0pbcDdG/YOFrwwVekP7n Bq4IJyIOTC1XvAgrVoweNvGG58KHGI56GhxhZUaNRa63o/K018IJBbsWZ Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ADAADo7slb/5xdJa1kDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVEEAQEBAQELAYENSC9mfygKg2uIGIwbgg2IeIhPhUi?= =?us-ascii?q?BegsBASOESQIXhG8hNA0NAQMBAQIBAQJtHAyFOQEBAQEDIwpFBxACAQgRBAE?= =?us-ascii?q?BAScDAgICHxEUCQgCBAENBQgMC4MDgR1MAxUPpnGBLodzDYITBYtPF4FBP4E?= =?us-ascii?q?RgmQuglZFAQECAYF1H4JNglcCjjKGEIlRLgkChlyCYYQJgxwfkCmMVHiIXwI?= =?us-ascii?q?RFIEmHTiBVXAVgyeCJheIXIUEOm8BAYokgR8BAQ?= X-IronPort-AV: E=Sophos;i="5.54,400,1534809600"; d="scan'208,217";a="458439793" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 14:51:35 +0000 Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by rcdn-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id w9JEpaGZ002770 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 14:51:36 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 19 Oct 2018 09:51:35 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Fri, 19 Oct 2018 09:51:35 -0500 From: "Les Ginsberg (ginsberg)" To: Robert Raszuk , "kaduk@mit.edu" CC: "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "ynir.ietf@gmail.com" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgAAtaFA= Date: Fri, 19 Oct 2018 14:51:35 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_c22b55313bc54157853d5668a146038cXCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.15, xch-rcd-005.cisco.com X-Outbound-Node: rcdn-core-5.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 14:51:40 -0000 --_000_c22b55313bc54157853d5668a146038cXCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Um9iZXJ04oCZcyBwb3N0IGFkZHJlc3NlcyBwb2ludHMgSSBhbHNvIHdhbnQgdG8gbWFrZS4NCg0K V2hhdCBpcyBiZWluZyBkb25lIGhlcmUgaXMgdG8gYWRkIGFkZGl0aW9uYWwgQkdQLUxTIGNvZGVw b2ludHMgdG8gYWR2ZXJ0aXNlIElHUCBpbmZvcm1hdGlvbiB0aGF0IHdhcyBub3QgZGVmaW5lZCBh dCB0aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbi4gV2UgaGF2ZW7igJl0IGNoYW5nZWQgdGhl ICBCR1AtTFMgdHJhbnNwb3J0IG1lY2hhbmlzbSDigJMgbm9yIGlzIHRoZSBpbmZvcm1hdGlvbiBi ZWluZyBhZHZlcnRpc2VkIGhlcmUgKHNvbWUgYWRkaXRpb25hbCBURSByZWxhdGVkIGxpbmsgYXR0 cmlidXRlIGluZm9ybWF0aW9uKSBxdWFsaXRhdGl2ZWx5IGRpZmZlcmVudCB0aGFuIGEgbnVtYmVy IG9mIGV4aXN0aW5nIFRMVnMgZGVmaW5lZCBpbiBSRkMgNzc1MiAoc2VlIGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM3NzUyI3NlY3Rpb24tMy4zLjIgKS4gSWYgdGhpcyBpbmZvcm1hdGlv biBoYWQgYWxyZWFkeSBiZWVuIGRlZmluZWQgaW4gdGhlIElHUHMgYXQgdGhlIHRpbWUgUkZDIDc3 NTIgd2FzIHdyaXR0ZW4gaXQgd291bGQgc2ltcGx5IGhhdmUgYmVlbiBpbmNsdWRlZCBhcyBhIHNl Y3Rpb24gb2YgUkZDIDc3NTIgYW5kIG5vIGFkZGl0aW9uYWwgY2hhbmdlcyB0byBSRkMgNzc1MiB3 b3VsZCBoYXZlIGJlZW4gcmVxdWlyZWQuDQoNCkluIHRoZW9yeSwgd2UgY291bGQgaGF2ZSBzaW1w bHkgdXBkYXRlZCBSRkMgNzc1MiByYXRoZXIgd3JpdGluZyBhIHNlcGFyYXRlIGRyYWZ0LCBidXQg cHJhY3RpY2FsbHkgdGhpcyB3b3VsZCBiZSBhIHBvb3Igc3RyYXRlZ3kgYXMgaXQgd291bGQgaW5j b3JyZWN0bHkgc3VnZ2VzdCB0aGF0IHNvbWUgY2hhbmdlIHdhcyBiZWluZyBtYWRlIHRvIHRoZSBl eGlzdGluZyB0ZXh0IGluIFJGQyA3NzUyLg0KDQpJIGFwcHJlY2lhdGUgdGhhdCBmcm9tIHRoZSBQ T1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91IGZvbGtzIGFyZSBub3QgYXMgaW50aW1hdGVseSBm YW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRyYWZ0cyBhbmQgdGhlIHJlbGF0aW9uc2hpcCBiZXR3 ZWVuIHRoZW0uIEl0IGlzIHRoZXJlZm9yZSB1bmRlcnN0YW5kYWJsZSB0aGF0IHlvdSBzdGFydCBs b29raW5nIGF0IHRoZSBuZXcgZHJhZnQgYXMgYSBzdGFuZGFsb25lIGRvY3VtZW50IOKAkyBhbmQg aW4gdGhhdCBjb250ZXh0IHlvdXIgY29tbWVudHMgYXJlIGFic29sdXRlbHkgY29ycmVjdC4gQnV0 IHRoZSBkb2N1bWVudCB5b3UgYXJlIHJldmlld2luZyBpcyBtb3N0IGFjY3VyYXRlbHkgc2VlbiBh cyBhbiDigJxhZGRlbmR1beKAnSB0byBSRkMgNzc1Mi4gVGhlIGlzc3VlcyB5b3UgcmFpc2UgaGF2 ZSBhbHJlYWR5IGJlZW4gYWRkcmVzc2VkIGluIFJGQyA3NzUyIGFuZCBpdCBpcyB0aGVyZWZvcmUg dmVyeSBhcHByb3ByaWF0ZSB0aGF0IHdlIGFkZHJlc3MgeW91ciBjb25jZXJucyBieSBpbmNsdWRp bmcgYSByZWZlcmVuY2UgdG8gdGhlIFJGQyA3NzUyIHNlY3VyaXR5IGRpc2N1c3Npb24uDQoNCkkg dGhpbmsgaXQgaXMgaW1wb3J0YW50IHRoYXQgeW91IG5vdGUgdGhpcyByZWxhdGlvbnNoaXAsIGJl Y2F1c2UgdGhlIG5hdHVyZSBvZiBCR1AtTFMgaXMgdGhhdCB3aGVuZXZlciBJR1AgZXh0ZW5zaW9u cyBhcmUgZGVmaW5lZCB0byBhZHZlcnRpc2UgbmV3IGluZm9ybWF0aW9uIGl0IGlzIG5lY2Vzc2Fy eSB0byBkZWZpbmUgY29ycmVzcG9uZGluZyBCR1AtTFMgY29kZXBvaW50cy4gVGhpcyBpcyBub3Qg dGhlIGZpcnN0IHN1Y2ggQkdQLUxTIGV4dGVuc2lvbiBkb2N1bWVudCDigJMgYW5kIGl0IGlzIHNh ZmUgdG8gc2F5IGl0IHdvbuKAmXQgYmUgdGhlIGxhc3QuIEl0IHdvdWxkIGJlIGhlbHBmdWwgdG8g YWxsIGlmIHdlIHJlYWNoZWQgYSBjb21tb24gdW5kZXJzdGFuZGluZyBvciB0aGlzIGRpc2N1c3Np b24gd2lsbCB0YWtlIHBsYWNlIGV2ZXJ5IHRpbWUgYSBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50 IGlzIGJlaW5nIHJldmlld2VkIOKAkyB3aGljaCB3aWxsIGNvc3QgdXMgYWxsIHRpbWUgbmVlZGxl c3NseS4NCg0KICAgTGVzDQoNCg0KRnJvbTogUm9iZXJ0IFJhc3p1ayA8cm9iZXJ0QHJhc3p1ay5u ZXQ+DQpTZW50OiBUaHVyc2RheSwgT2N0b2JlciAxOCwgMjAxOCAxMTo1MiBQTQ0KVG86IGthZHVr QG1pdC5lZHUNCkNjOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdAY2lzY28uY29t PjsgaWRyQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBp ZXRmQGlldGYub3JnOyB5bmlyLmlldGZAZ21haWwuY29tOyBzZWNkaXJAaWV0Zi5vcmcNClN1Ympl Y3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC0xMw0KDQpIZWxsbyBCZW5qYW1pbiwNCg0KTm90IHN1cmUgaWYgeW91IGhh dmUgc3BvdHRlZCBzaW1pbGFyIGNvbW1lbnQgbWFkZSB0byBJRFIgcmVnYXJkaW5nIHRoaXMgdG9w aWMsIGJ1dCB5b3VyIGNvbW1lbnQgc2VlbXMgdG8gaW5kaWNhdGUgdGhhdCBoZXJlIHdlIGFyZSBh Ym91dCB0byBkZWZpbmUgd2F5cyB0byBjYXJyeSBuaWNlbHkgc2NvcGVkIElHUCBpbmZvcm1hdGlv biBpbnRvIEJHUC4gV2VsbCB0aGF0IGhhcyBhbHJlYWR5IGhhcHBlbmVkIHdpdGggUkZDNzc1MiBh bmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1hdHRlciBZb2F2J3MgcmVtYXJrcyBhcmUgaW5k ZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0eSBkaXNjdXNzaW9uIG9uIFJGQzc3NTIgYW5k IElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNpb25zIG9mIGl0Lg0KDQpTdXJlIC0gYXMgb2Jz ZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0aGF0IHByb3ZpZGluZyBtb3JlIGluZm9ybWF0 aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBwb3RlbnRpYWwgYXR0YWNrZXIgbWFrZXMgdGhl IG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUgZm9yIHRoYXQgaXMgdG8gcHJldmVudCB0aGUg bGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBvZiBpbnRlcmNlcHRpbmcgbmV3IGluZm9ybWF0 aW9uIGJ5IHVuYXV0aG9yaXplZCBwYXJ0aWVzLg0KDQpCR1AtTFMgaXMgYWxyZWFkeSBkZWZpbmVk IGluIGEgbmV3IFNBRkkgd2hhdCBieSBpdHNlbGYgZG9lcyBwcm92aWRlIG5pY2UgbGV2ZWwgb2Yg aXNvbGF0aW9uLiBSRkM3NzUyIGlzIHByZXR0eSBjbGVhciBvbiB0aGF0IHRvbyBhbmQgc2F5czoN Cg0KIkJHUCBwZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQgcmVxdWlyZSBjb25maWd1cmF0 aW9uOyB0aHVzLCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdvcmsgb3BlcmF0 b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29uZmlndXJlZCB0 byByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uIg0KDQpJZiBzb21lb25lIHdvdWxkIGJlIHN0aWxs IGNvbmNlcm5lZCBhYm91dCBjb25maWd1cmF0aW9uIG1pc3Rha2VzIGFuZCBuZWdvdGlhdGluZyBT QUZJIDcxIG9yIDcyIHRvIHRob3NlIHdobyBzaG91bGQgbm90IGdldCB0aGlzIGRhdGEgSSByZWNv bW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZDNzc1MiBhcyAtYmlzIHZlcnNpb24gYW5kIHJlc3RyaWN0 IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJpYnV0aW9uIGV2ZW4gZnVydGhlciBieSBtYW5kYXRpbmcg ZGVmYXVsdCB1c2Ugb2YgTk8tRVhQT1JUIGNvbW11bml0eSB3aXRoIGFiaWxpdHkgdG8gb3Zlcndy aXRlIGl0IGZvciB0aGUgc2VsZWN0aXZlIGVCR1AgcGVlcnMuIE9yIHBlcmhhcHMgd2UgY291bGQg cHJvZ3Jlc3MgSmltJ3MgT25lIEFkbWluaXN0cmF0aXZlIERvbWFpbiBkcmFmdCAoZHJhZnQtdXR0 YXJvLWlkci1vYWQtMDEpLg0KDQpJbiBlaXRoZXIgY2FzZSB3aGlsZSBib3RoIG9mIHlvdXIgY29t bWVudHMgYXJlIGdyZWF0IHRoZXkgc2VlbXMgYSBiaXQgbGF0ZSBpbiB0aGUgZ2FtZSBoZXJlIG9y IGF0IGxlYXN0IHRhcmdldGluZyB3cm9uZyBkb2N1bWVudC4NCg0KS2luZCByZWdhcmRzLA0KUm9i ZXJ0Lg0KDQoNCk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6MjcgQU0gQmVuamFtaW4gS2FkdWsg PGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+PiB3cm90ZToNCk9uIFRodSwgT2N0 IDE4LCAyMDE4IGF0IDA2OjAwOjEzUE0gKzAwMDAsIExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpIHdy b3RlOg0KPiBZb2F2IOKAkw0KPg0KPiBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3NvY2lhdGVk IHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0aW9uIGNvdmVyZWQgaW4gdGhp cyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1AgZHJhZnRzOg0KPg0KPiBGcm9t IFJGQzc4MTANCj4NCj4g4oCcVGhlIHN1Yi1UTFZzIGludHJvZHVjZWQgaW4gdGhpcyBkb2N1bWVu dCBhbGxvdyBhbiBvcGVyYXRvciB0bw0KPiAgICBhZHZlcnRpc2Ugc3RhdGUgaW5mb3JtYXRpb24g b2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQgY291bGQgYmUNCj4gICAgc2Vuc2l0aXZl IGFuZCB0aGF0IGFuIG9wZXJhdG9yIG1heSBub3Qgd2FudCB0byBkaXNjbG9zZS7igJ0NCj4NCj4g SW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHNlbmRpbmcgaW5mb3JtYXRp b24gdmlhIEJHUC1MUyB3ZSBoYXZlIGEgbnVtYmVyIG9mIHN0YXRlbWVudHMgaW4gUkZDIDc3NTIg 4oCTIG1vc3QgcmVsZXZhbnQgaXM6DQo+DQo+IOKAnEFkZGl0aW9uYWxseSwgaXQgbWF5IGJlIGNv bnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9mIGxpbmstc3RhdGUgYW5kDQo+ICAgIFRFIGluZm9y bWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVzIGEgcmlzayB0 bw0KPiAgICBjb25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFs bHkgc2Vuc2l0aXZlDQo+ICAgIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrLuKAnQ0KPg0K PiBTbyBsb25nIGFzIHRoZXJlIGFyZSByZWZlcmVuY2VzIHRvIGJvdGggdGhlIElHUCBSRkNzIGFu ZCBSRkMgNzc1MiBJIGFtIHRoZXJlZm9yZSBoYXJkIHByZXNzZWQgdG8gdW5kZXJzdGFuZCB3aGF0 IGVsc2UgY291bGQgYmUgdXNlZnVsbHkgc2FpZC4NCj4gQ2VydGFpbmx5IHRoZSByaXNrcyBhc3Nv Y2lhdGVkIHdpdGggdGhlIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIGFyZSBub3QgYWx0ZXJl ZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDigJMgYW5kIHNpbmNlIHRoZSBJR1AgUkZDcyBoYXZl IGFscmVhZHkgY292ZXJlZCByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNpZmljIGNsYXNz IG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhl IHRyYW5zcG9ydCBtZWNoYW5pc20pIHlvdSBhcmUgZ29pbmcgdG8gaGF2ZSB0byBwcm92aWRlIG1v cmUgc3BlY2lmaWNzIG9uIHdoYXQgY2FuIG1lYW5pbmdmdWxseSBiZSBzYWlkIHRoYXQgaXMgbm90 IGFscmVhZHkgY292ZXJlZCBpbiB0aGUgcmVmZXJlbmNlcy4NCg0KTXkgYXBvbG9naWVzIGZvciBq dW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVDIHRoZSBJR1AgUkZDcyBoYXZlDQpjb3Zl cmVkIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYSBzcGVjaWZpYyBjbGFzcyBvZiBpbmZvcm1h dGlvbiwgKnVuZGVyDQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNt IGlzIHdpdGhpbiBhIHNpbmdsZSBBUyBhbmQNCmFkbWluaXN0cmF0aXZlIGRvbWFpbiouICBZb2F2 IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdA0KaW5mb3JtYXRpb24gbWF5 IGNoYW5nZSB3aGVuIHRoZSBkaXN0cmlidXRpb24gaXMgb3ZlciBhIGJyb2FkZXIgZG9tYWluIHRo YW4NCnRoZSBvbmUgZm9yIHdoaWNoIHRoZSBwcmV2aW91cyBhbmFseXNpcyB3YXMgcGVyZm9ybWVk Lg0KDQotQmVuDQo= --_000_c22b55313bc54157853d5668a146038cXCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Um9iZXJ04oCZcyBwb3N0IGFkZHJlc3Nl cyBwb2ludHMgSSBhbHNvIHdhbnQgdG8gbWFrZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPldoYXQgaXMgYmVpbmcgZG9uZSBoZXJlIGlzIHRvIGFkZCBhZGRpdGlv bmFsIEJHUC1MUyBjb2RlcG9pbnRzIHRvIGFkdmVydGlzZSBJR1AgaW5mb3JtYXRpb24gdGhhdCB3 YXMgbm90IGRlZmluZWQgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2FzIHdyaXR0ZW4uIFdlIGhhdmVu 4oCZdA0KIGNoYW5nZWQgdGhlICZuYnNwO0JHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIOKAkyBu b3IgaXMgdGhlIGluZm9ybWF0aW9uIGJlaW5nIGFkdmVydGlzZWQgaGVyZSAoc29tZSBhZGRpdGlv bmFsIFRFIHJlbGF0ZWQgbGluayBhdHRyaWJ1dGUgaW5mb3JtYXRpb24pIHF1YWxpdGF0aXZlbHkg ZGlmZmVyZW50IHRoYW4gYSBudW1iZXIgb2YgZXhpc3RpbmcgVExWcyBkZWZpbmVkIGluIFJGQyA3 NzUyIChzZWUNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NzUyI3Nl Y3Rpb24tMy4zLjIiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NzUyI3NlY3Rpb24t My4zLjI8L2E+ICkuIElmIHRoaXMgaW5mb3JtYXRpb24gaGFkIGFscmVhZHkgYmVlbiBkZWZpbmVk IGluIHRoZSBJR1BzIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuIGl0IHdvdWxkIHNp bXBseSBoYXZlIGJlZW4gaW5jbHVkZWQgYXMgYSBzZWN0aW9uIG9mDQogUkZDIDc3NTIgYW5kIG5v IGFkZGl0aW9uYWwgY2hhbmdlcyB0byBSRkMgNzc1MiB3b3VsZCBoYXZlIGJlZW4gcmVxdWlyZWQu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JbiB0aGVvcnksIHdl IGNvdWxkIGhhdmUgc2ltcGx5IHVwZGF0ZWQgUkZDIDc3NTIgcmF0aGVyIHdyaXRpbmcgYSBzZXBh cmF0ZSBkcmFmdCwgYnV0IHByYWN0aWNhbGx5IHRoaXMgd291bGQgYmUgYSBwb29yIHN0cmF0ZWd5 IGFzIGl0IHdvdWxkIGluY29ycmVjdGx5IHN1Z2dlc3QNCiB0aGF0IHNvbWUgY2hhbmdlIHdhcyBi ZWluZyBtYWRlIHRvIHRoZSBleGlzdGluZyB0ZXh0IGluIFJGQyA3NzUyLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhcHByZWNpYXRlIHRoYXQgZnJvbSB0aGUg UE9WIG9mIHRoZSBTZWN1cml0eSBBcmVhIHlvdSBmb2xrcyBhcmUgbm90IGFzIGludGltYXRlbHkg ZmFtaWxpYXIgd2l0aCB0aGUgcm91dGluZyBkcmFmdHMgYW5kIHRoZSByZWxhdGlvbnNoaXAgYmV0 d2VlbiB0aGVtLiBJdCBpcw0KIHRoZXJlZm9yZSB1bmRlcnN0YW5kYWJsZSB0aGF0IHlvdSBzdGFy dCBsb29raW5nIGF0IHRoZSBuZXcgZHJhZnQgYXMgYSBzdGFuZGFsb25lIGRvY3VtZW50IOKAkyBh bmQgaW4gdGhhdCBjb250ZXh0IHlvdXIgY29tbWVudHMgYXJlIGFic29sdXRlbHkgY29ycmVjdC4g QnV0IHRoZSBkb2N1bWVudCB5b3UgYXJlIHJldmlld2luZyBpcyBtb3N0IGFjY3VyYXRlbHkgc2Vl biBhcyBhbiDigJxhZGRlbmR1beKAnSB0byBSRkMgNzc1Mi4gVGhlIGlzc3VlcyB5b3UgcmFpc2UN CiBoYXZlIGFscmVhZHkgYmVlbiBhZGRyZXNzZWQgaW4gUkZDIDc3NTIgYW5kIGl0IGlzIHRoZXJl Zm9yZSB2ZXJ5IGFwcHJvcHJpYXRlIHRoYXQgd2UgYWRkcmVzcyB5b3VyIGNvbmNlcm5zIGJ5IGlu Y2x1ZGluZyBhIHJlZmVyZW5jZSB0byB0aGUgUkZDIDc3NTIgc2VjdXJpdHkgZGlzY3Vzc2lvbi48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgdGhpbmsgaXQgaXMg aW1wb3J0YW50IHRoYXQgeW91IG5vdGUgdGhpcyByZWxhdGlvbnNoaXAsIGJlY2F1c2UgdGhlIG5h dHVyZSBvZiBCR1AtTFMgaXMgdGhhdCB3aGVuZXZlciBJR1AgZXh0ZW5zaW9ucyBhcmUgZGVmaW5l ZCB0byBhZHZlcnRpc2UgbmV3IGluZm9ybWF0aW9uDQogaXQgaXMgbmVjZXNzYXJ5IHRvIGRlZmlu ZSBjb3JyZXNwb25kaW5nIEJHUC1MUyBjb2RlcG9pbnRzLiBUaGlzIGlzIG5vdCB0aGUgZmlyc3Qg c3VjaCBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IOKAkyBhbmQgaXQgaXMgc2FmZSB0byBzYXkg aXQgd29u4oCZdCBiZSB0aGUgbGFzdC4gSXQgd291bGQgYmUgaGVscGZ1bCB0byBhbGwgaWYgd2Ug cmVhY2hlZCBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9yIHRoaXMgZGlzY3Vzc2lvbiB3aWxsIHRh a2UgcGxhY2UNCiBldmVyeSB0aW1lIGEgQkdQLUxTIGV4dGVuc2lvbiBkb2N1bWVudCBpcyBiZWlu ZyByZXZpZXdlZCDigJMgd2hpY2ggd2lsbCBjb3N0IHVzIGFsbCB0aW1lIG5lZWRsZXNzbHkuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgTGVz PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFJvYmVydCBSYXN6dWsgJmx0O3Jv YmVydEByYXN6dWsubmV0Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBPY3RvYmVy IDE4LCAyMDE4IDExOjUyIFBNPGJyPg0KPGI+VG86PC9iPiBrYWR1a0BtaXQuZWR1PGJyPg0KPGI+ Q2M6PC9iPiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSAmbHQ7Z2luc2JlcmdAY2lzY28uY29tJmd0 OzsgaWRyQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBp ZXRmQGlldGYub3JnOyB5bmlyLmlldGZAZ21haWwuY29tOyBzZWNkaXJAaWV0Zi5vcmc8YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2Yg ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVsbG8gQmVuamFtaW4sPG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ob3Qgc3VyZSBpZiB5 b3UgaGF2ZSBzcG90dGVkIHNpbWlsYXIgY29tbWVudCBtYWRlIHRvIElEUiByZWdhcmRpbmcgdGhp cyB0b3BpYywgYnV0IHlvdXIgY29tbWVudCBzZWVtcyB0byBpbmRpY2F0ZSB0aGF0IGhlcmUgd2Ug YXJlIGFib3V0IHRvIGRlZmluZSB3YXlzIHRvIGNhcnJ5IG5pY2VseSBzY29wZWQgSUdQIGluZm9y bWF0aW9uIGludG8gQkdQLiBXZWxsIHRoYXQgaGFzIGFscmVhZHkgaGFwcGVuZWQgd2l0aA0KIFJG Qzc3NTIgYW5kIHlvdXIgY29tbWVudCBvciBmb3IgdGhhdCBtYXR0ZXIgWW9hdidzIHJlbWFya3Mg YXJlIGluZGVlZCBzcG90IG9uIGJ1dCB0byB0aGUgc2VjdXJpdHkgZGlzY3Vzc2lvbiBvbiBSRkM3 NzUyIGFuZCBJTU8gbm90IGFueSBmb2xsb3cgdXAgZXh0ZW5zaW9ucyBvZiBpdC4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3VyZSAt IGFzIG9ic2VydmVkIGJ5IFN1ZSAtIG9uZSBtYXkgYXJndWUgdGhhdCBwcm92aWRpbmcgbW9yZSBp bmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yayB0byB0aGUgcG90ZW50aWFsIGF0dGFja2VyIG1h a2VzIHRoZSBuZXR3b3JrIHdlYWtlciwgYnV0IHRoZSBjdXJlIGZvciB0aGF0IGlzIHRvIHByZXZl bnQgdGhlIGxlYWtzIGFuZCByZWR1Y2UgcHJvYmFiaWxpdHkgb2YgaW50ZXJjZXB0aW5nIG5ldyBp bmZvcm1hdGlvbg0KIGJ5IHVuYXV0aG9yaXplZCBwYXJ0aWVzLiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CR1AtTFMgaXMgYWxyZWFk eSBkZWZpbmVkIGluIGEgbmV3IFNBRkkgd2hhdCBieSBpdHNlbGYgZG9lcyBwcm92aWRlIG5pY2Ug bGV2ZWwgb2YgaXNvbGF0aW9uLiBSRkM3NzUyIGlzIHByZXR0eSBjbGVhciBvbiB0aGF0IHRvbyBh bmQgc2F5czombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+JnF1b3Q7QkdQIHBlZXJpbmdzIGFyZSBub3QgYXV0b21hdGljIGFuZCByZXF1 aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRoZSByZXNwb25zaWJpbGl0eSBvZiB0aGUg bmV0d29yayBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBvbmx5IHRydXN0ZWQgY29uc3VtZXJzIGFy ZSBjb25maWd1cmVkIHRvIHJlY2VpdmUgc3VjaCBpbmZvcm1hdGlvbi4mcXVvdDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgc29tZW9uZSB3 b3VsZCBiZSBzdGlsbCBjb25jZXJuZWQgYWJvdXQgY29uZmlndXJhdGlvbiBtaXN0YWtlcyBhbmQg bmVnb3RpYXRpbmcgU0FGSSA3MSBvciA3MiB0byB0aG9zZSB3aG8gc2hvdWxkIG5vdCBnZXQgdGhp cyBkYXRhIEkgcmVjb21tZW5kIHdlIHJlaXNzdWUgdGhlIFJGQzc3NTIgYXMgLWJpcyB2ZXJzaW9u IGFuZCByZXN0cmljdCB0aGUgc2NvcGUgb2YgdGhlIGRpc3RyaWJ1dGlvbiBldmVuIGZ1cnRoZXIN CiBieSBtYW5kYXRpbmcgZGVmYXVsdCB1c2Ugb2YgTk8tRVhQT1JUIGNvbW11bml0eSB3aXRoIGFi aWxpdHkgdG8gb3ZlcndyaXRlIGl0IGZvciB0aGUgc2VsZWN0aXZlIGVCR1AgcGVlcnMuIE9yIHBl cmhhcHMgd2UgY291bGQgcHJvZ3Jlc3MgSmltJ3MgT25lIEFkbWluaXN0cmF0aXZlIERvbWFpbiBk cmFmdCAoZHJhZnQtdXR0YXJvLWlkci1vYWQtMDEpLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBlaXRoZXIgY2FzZSB3aGlsZSBi b3RoIG9mIHlvdXIgY29tbWVudHMgYXJlIGdyZWF0IHRoZXkgc2VlbXMgYSBiaXQgbGF0ZSBpbiB0 aGUgZ2FtZSBoZXJlIG9yIGF0IGxlYXN0IHRhcmdldGluZyB3cm9uZyBkb2N1bWVudC4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+S2lu ZCByZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Um9iZXJ0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBGcmksIE9jdCAxOSwgMjAxOCBhdCAyOjI3IEFNIEJlbmphbWluIEthZHVrICZsdDs8 YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gVGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6MTNQTSAmIzQzOzAwMDAsIExlcyBHaW5z YmVyZyAoZ2luc2JlcmcpIHdyb3RlOjxicj4NCiZndDsgWW9hdiDigJM8YnI+DQomZ3Q7IDxicj4N CiZndDsgSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5n IHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBh IHN0YXRlbWVudCBpbiB0aGUgSUdQIGRyYWZ0czo8YnI+DQomZ3Q7IDxicj4NCiZndDsgRnJvbSBS RkM3ODEwPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGlu IHRoaXMgZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0b3IgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNw OyBhZHZlcnRpc2Ugc3RhdGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkp IHRoYXQgY291bGQgYmU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBzZW5zaXRpdmUgYW5kIHRoYXQg YW4gb3BlcmF0b3IgbWF5IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnTxicj4NCiZndDsgPGJyPg0K Jmd0OyBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZv cm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhhdmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMg Nzc1MiDigJMgbW9zdCByZWxldmFudCBpczo8YnI+DQomZ3Q7IDxicj4NCiZndDsg4oCcQWRkaXRp b25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0 ZSBhbmQ8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQg aW4gdGhpcyBkb2N1bWVudCBjb25zdGl0dXRlcyBhIHJpc2sgdG88YnI+DQomZ3Q7Jm5ic3A7ICZu YnNwOyBjb25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFsbHkg c2Vuc2l0aXZlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5l dHdvcmsu4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFNvIGxvbmcgYXMgdGhlcmUgYXJlIHJlZmVy ZW5jZXMgdG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhlcmVmb3JlIGhh cmQgcHJlc3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2VmdWxseSBzYWlk Ljxicj4NCiZndDsgQ2VydGFpbmx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1M UyB0cmFuc3BvcnQgbWVjaGFuaXNtIGFyZSBub3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcg VExWcyDigJMgYW5kIHNpbmNlIHRoZSBJR1AgUkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNr cyBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qg c2ltcGx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydA0KIG1lY2hhbmlz bSkgeW91IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hh dCBjYW4gbWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGlu IHRoZSByZWZlcmVuY2VzLjxicj4NCjxicj4NCk15IGFwb2xvZ2llcyBmb3IganVtcGluZyBpbiBp biB0aGUgbWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQIFJGQ3MgaGF2ZTxicj4NCmNvdmVyZWQgdGhl IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAq dW5kZXI8YnI+DQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtIGlz IHdpdGhpbiBhIHNpbmdsZSBBUyBhbmQ8YnI+DQphZG1pbmlzdHJhdGl2ZSBkb21haW4qLiZuYnNw OyBZb2F2IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdDxicj4NCmluZm9y bWF0aW9uIG1heSBjaGFuZ2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVy IGRvbWFpbiB0aGFuPGJyPg0KdGhlIG9uZSBmb3Igd2hpY2ggdGhlIHByZXZpb3VzIGFuYWx5c2lz IHdhcyBwZXJmb3JtZWQuPGJyPg0KPGJyPg0KLUJlbjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_c22b55313bc54157853d5668a146038cXCHALN001ciscocom_-- From nobody Fri Oct 19 07:58:12 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 271B9128D68; Fri, 19 Oct 2018 07:57:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.563 X-Spam-Level: X-Spam-Status: No, score=-14.563 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GfJ-Tvb8pPFZ; Fri, 19 Oct 2018 07:57:53 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C047E130EFA; Fri, 19 Oct 2018 07:57:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=31158; q=dns/txt; s=iport; t=1539961073; x=1541170673; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=gEIXGvuhoOmHQF32uGAkBGLVSdICZBQ8TqS5eLER9WM=; b=L6qkw/HdD/gsQAPawDuJXKKawojC37BgaruNM5aGdHQyzZ2ZGPPmSpX4 hWqdfbEswx5mPXmBW933ORDz2vm3d0nevhLEjZJ+mGeiv0LakMQk7VyYy kcqNN2ynuCn8YreYXQLXHZf1vP8kfCnZdhtr7Q/oN/wRhsQhvEvCkMHIq Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ATAAAF8Mlb/51dJa1kDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVQBAQEBAQELAYENSC9mfygKg2uUM4INeod+kBELAQE?= =?us-ascii?q?jhEkCF4RvITcKDQEDAQECAQECbRwMhTkBAQEBAyMKTBACAQgOAwQBAQEgBwM?= =?us-ascii?q?CAgIfERQJCAIEAQ0FCAwHgweBHUwDFQ+mc4Euh3MNghMFiQeCSBeBQT+BEYJ?= =?us-ascii?q?dBy6CVkUBAQIBghSCTYJXAo4yhhCJUS4JAoZcgxyDToMcH4FPhHOJZ4kjgzF?= =?us-ascii?q?4hk2CEgIRFIEmMyKBVXAVgyeCJheIXIUEOm8BAYokgR8BAQ?= X-IronPort-AV: E=Sophos;i="5.54,400,1534809600"; d="scan'208,217";a="458442452" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 14:57:51 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id w9JEvnO8001971 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 14:57:49 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 19 Oct 2018 09:57:48 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Fri, 19 Oct 2018 09:57:48 -0500 From: "Les Ginsberg (ginsberg)" To: Susan Hares , "'Robert Raszuk'" , "kaduk@mit.edu" CC: "ietf@ietf.org" , "secdir@ietf.org" , "ynir.ietf@gmail.com" , "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgABuEAD//8RJQA== Date: Fri, 19 Oct 2018 14:57:48 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> In-Reply-To: <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_b718ffb671c446adb1666ad9f73f4f82XCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: rcdn-core-6.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 14:57:57 -0000 --_000_b718ffb671c446adb1666ad9f73f4f82XCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VlIOKAkw0KDQpPbmUgb2YgdXMgaXMgY29uZnVzZWQuIOKYug0KDQpkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZ3AgaXMgbm90IHJlbGF0ZWQgdG8gU2VnbWVudCBSb3V0aW5nLiBUaG9zZSB3b3JkcyBk byBub3QgYXBwZWFyIGFueXdoZXJlIGluIHRoZSBkb2N1bWVudC4gTm9yIGlzIHRoZXJlIGEgcmVm ZXJlbmNlIHRvIGFueSBTUiBkb2N1bWVudC4NCg0KRnVydGhlciwgUkZDIDc3NTIgaW5jbHVkZXMg dHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiAoc2VlIGh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9yZmM3NzUyI3NlY3Rpb24tMy4zLjIgKSBzbyB0aGUgc3VnZ2VzdGlvbiB0aGF0IHdl IGFyZSBpbnRyb2R1Y2luZyBhIG5ldyBhdHRhY2sgdmVjdG9yIGJ5IGRlZmluaW5nIHNvbWUgYWRk aXRpb25hbChzaWMpIFRFIGNvZGVwb2ludHMgZG9lcyBub3QgbWFrZSBzZW5zZSB0byBtZS4NCg0K SSBhcHByZWNpYXRlIHRoYXQgdGhlcmUgYXJlIG90aGVyIGRyYWZ0cyBvbiB5b3VyIG1pbmQgd2hp Y2ggYXJlIFNSIHJlbGF0ZWQg4oCTIGJ1dCB0aGlzIGlzIG5vdCBvbmUgb2YgdGhlbS4NCg0KQ291 bGQgeW91IHBsZWFzZSB1cGRhdGUgeW91ciByZXNwb25zZSB3aXRoIHRoZXNlIHBvaW50cyBpbiBt aW5kPw0KDQpUaGFueC4NCg0KICAgTGVzDQoNCg0KRnJvbTogU3VzYW4gSGFyZXMgPHNoYXJlc0Bu ZHpoLmNvbT4NClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA2OjI2IEFNDQpUbzogJ1Jv YmVydCBSYXN6dWsnIDxyb2JlcnRAcmFzenVrLm5ldD47IGthZHVrQG1pdC5lZHUNCkNjOiBpZXRm QGlldGYub3JnOyBzZWNkaXJAaWV0Zi5vcmc7IHluaXIuaWV0ZkBnbWFpbC5jb207IGlkckBpZXRm Lm9yZzsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZw0KU3ViamVjdDogUkU6 IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUt cG0tYmdwLTEzDQoNClJvYmVydCwgQmVuamFtaW4sIGFuZCBZb2F2Og0KDQpJIGFncmVlIHRoZXNl IGNvbnRleHQgb2YgdGhlc2UgaXNzdWVzIGFyZSBub3Qgc3BlY2lmaWMgdG8gdGhpcyBkcmFmdC4g IEhvd2V2ZXIsIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gZG9lcyBwcm92aWRlIGlu Zm9ybWF0aW9uIHdoaWNoIGlzIGEgdGVtcHRpbmcgYXR0YWNrIHZlY3Rvci4NCg0KVGhlIG9yaWdp bmFsIFJGQzc3NTIgZGVzY3JpYmVkIGEgZGlmZmVyZW50IHB1cnBvc2Ugd2l0aCByZXN0cmljdGVk IHVzYWdlIHRoYXQgU1Igcm91dGluZyBleHRlbnNpb25zIGRvIG5vdCBhZGhlcmUgdG8gaW4gQkdQ LiAgIFNpbmNlIFNwcmluZyBXRyBzaG93cyB0aGF0IG9wZXJhdG9ycyBhcmUgaW50ZXJlc3RlZCBp biB0aGUgZXh0ZW5kZWQgdXNlLCBpdCBtYXkgYmUgdGltZSB0byBleGFtaW5lIHRoZSBSRkM3NzUy YmlzIG9yIG90aGVyIHNvbHV0aW9ucyB0aGF0IHRha2VzIGNhcmUgb2YgdGhlc2Ugc2VjdXJpdHkg aXNzdWVzLg0KDQpNeSBqb2IgYXMgYSBzaGVwaGVyZCBpcyB0byBwb2ludCBvdXQgdGhlc2UgaXNz dWVzIHBlciBkcmFmdCBmb3IgdGhlIElFU0cgYW5kIHNlY3VyaXR5IGRpcmVjdG9yYXRlIGluIG9y ZGVyIHRvIG9idGFpbiB0aGUgY29ycmVjdCBmZWVkYmFjay4gIEFzIGEgV0cgY2hhaXIsIEkgaGF2 ZSBwb2ludGVkIG91dCB0aGVzZSBpc3N1ZXMsIGJ1dCB0aGUgV0cgaGFzIHRoZXNlIGRyYWZ0cyBv biBXRyBMQyB3aXRob3V0IHRoZSBleHRyYSBzZWN1cml0eS4NCldpdGhvdXQgUkZDNzc1MmJpcyB3 aXRoIGFkZGl0aW9uYWwgc2VjdXJpdHkgaW4gdGhlIGJhc2UgZG9jdW1lbnQsIEkgYW0gd29ya2lu ZyBhcyBhIHNoZXBoZXJkIG1ha2UgdGhlIG1hbmFnZWFiaWxpdHkgYW5kIHNlY3VyaXR5IHNlY3Rp b25zIGFzIGNsZWFyIGFzIHBvc3NpYmxlLg0KDQpJZiB0aGUgZmVlZGJhY2sgZnJvbSB0aGUgc2Vj dXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3IG9yIHRoZSBJRVNHIGlzIHRoYXQgd2UgbmVlZCB0byBv YnRhaW4gYSBzb2x1dGlvbiBmb3IgUkZDNzc1MmJpcyB0aGF0IGRlc2NyaWJlcyBhbmQgaGFuZGxl cyB0aGVzZSBzZWN1cml0eSBpc3N1ZXMsIEkgd2lsbCBiZSBnbGFkIHRvIHN1cHBvcnQgZmFzdC10 cmFja2luZyB0aGlzIGlzc3VlIHdpdGhpbiB0aGUgV0cuDQoNCklmIGFuIG9mZmxpbmUgZGlzY3Vz c2lvbiB3aXRoIEJlbmphbWluLCBZb2F2LCB0aGUgSURSIGNoYWlycywgYW5kIEFsdmFybyB3b3Vs ZCBzcGVlZCB0aGlzIGFsb25nLCBJIGNhbiBzZXQgdGhpcyB1cCBlYXJseSBuZXh0IHdlZWsuICBJ dCB3b3VsZCBiZSBoZWxwZnVsIHRvIGhhdmUgdGhpcyBvZmZsaW5lIGRpc2N1c3Npb24gYmVmb3Jl IHRoZSBJRFIgaW50ZXJpbSBzZXNzaW9uIG9uIDEwLzI2Lg0KDQpUaGFuayB5b3UgZm9yIGFsbCB5 b3VyIGNvbW1lbnRzLg0KDQpTdWUNCg0KDQpGcm9tOiBJZHIgW21haWx0bzppZHItYm91bmNlc0Bp ZXRmLm9yZ10gT24gQmVoYWxmIE9mIFJvYmVydCBSYXN6dWsNClNlbnQ6IEZyaWRheSwgT2N0b2Jl ciAxOSwgMjAxOCAyOjUyIEFNDQpUbzoga2FkdWtAbWl0LmVkdTxtYWlsdG86a2FkdWtAbWl0LmVk dT4NCkNjOiBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGlldGYub3JnPjsgc2VjZGlyQGlldGYu b3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5 bmlyLmlldGZAZ21haWwuY29tPjsgaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlk ci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZHJdIFtzZWNkaXJdIFNl Y2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoNCkhlbGxv IEJlbmphbWluLA0KDQpOb3Qgc3VyZSBpZiB5b3UgaGF2ZSBzcG90dGVkIHNpbWlsYXIgY29tbWVu dCBtYWRlIHRvIElEUiByZWdhcmRpbmcgdGhpcyB0b3BpYywgYnV0IHlvdXIgY29tbWVudCBzZWVt cyB0byBpbmRpY2F0ZSB0aGF0IGhlcmUgd2UgYXJlIGFib3V0IHRvIGRlZmluZSB3YXlzIHRvIGNh cnJ5IG5pY2VseSBzY29wZWQgSUdQIGluZm9ybWF0aW9uIGludG8gQkdQLiBXZWxsIHRoYXQgaGFz IGFscmVhZHkgaGFwcGVuZWQgd2l0aCBSRkM3NzUyIGFuZCB5b3VyIGNvbW1lbnQgb3IgZm9yIHRo YXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBpbmRlZWQgc3BvdCBvbiBidXQgdG8gdGhlIHNl Y3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBhbmQgSU1PIG5vdCBhbnkgZm9sbG93IHVwIGV4 dGVuc2lvbnMgb2YgaXQuDQoNClN1cmUgLSBhcyBvYnNlcnZlZCBieSBTdWUgLSBvbmUgbWF5IGFy Z3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsgdG8g dGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0aGUgbmV0d29yayB3ZWFrZXIsIGJ1dCB0aGUg Y3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRoZSBsZWFrcyBhbmQgcmVkdWNlIHByb2JhYmls aXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3JtYXRpb24gYnkgdW5hdXRob3JpemVkIHBhcnRp ZXMuDQoNCkJHUC1MUyBpcyBhbHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0IGJ5IGl0 c2VsZiBkb2VzIHByb3ZpZGUgbmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIgaXMgcHJl dHR5IGNsZWFyIG9uIHRoYXQgdG9vIGFuZCBzYXlzOg0KDQoiQkdQIHBlZXJpbmdzIGFyZSBub3Qg YXV0b21hdGljIGFuZCByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRoZSByZXNw b25zaWJpbGl0eSBvZiB0aGUgbmV0d29yayBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBvbmx5IHRy dXN0ZWQgY29uc3VtZXJzIGFyZSBjb25maWd1cmVkIHRvIHJlY2VpdmUgc3VjaCBpbmZvcm1hdGlv bi4iDQoNCklmIHNvbWVvbmUgd291bGQgYmUgc3RpbGwgY29uY2VybmVkIGFib3V0IGNvbmZpZ3Vy YXRpb24gbWlzdGFrZXMgYW5kIG5lZ290aWF0aW5nIFNBRkkgNzEgb3IgNzIgdG8gdGhvc2Ugd2hv IHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0YSBJIHJlY29tbWVuZCB3ZSByZWlzc3VlIHRoZSBSRkM3 NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQgcmVzdHJpY3QgdGhlIHNjb3BlIG9mIHRoZSBkaXN0cmli dXRpb24gZXZlbiBmdXJ0aGVyIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1FWFBPUlQg Y29tbXVuaXR5IHdpdGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxlY3RpdmUg ZUJHUCBwZWVycy4gT3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUgQWRtaW5p c3RyYXRpdmUgRG9tYWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuDQoNCkluIGVp dGhlciBjYXNlIHdoaWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhleSBzZWVt cyBhIGJpdCBsYXRlIGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5nIHdyb25n IGRvY3VtZW50Lg0KDQpLaW5kIHJlZ2FyZHMsDQpSb2JlcnQuDQoNCg0KT24gRnJpLCBPY3QgMTks IDIwMTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayA8a2FkdWtAbWl0LmVkdTxtYWlsdG86a2Fk dWtAbWl0LmVkdT4+IHdyb3RlOg0KT24gVGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6MTNQTSAr MDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6DQo+IFlvYXYg4oCTDQo+DQo+IElu IHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhZHZlcnRpc2luZyB0aGUgc3Bl Y2lmaWMgaW5mb3JtYXRpb24gY292ZXJlZCBpbiB0aGlzIGRyYWZ0IHdlIGhhdmUgYSBzdGF0ZW1l bnQgaW4gdGhlIElHUCBkcmFmdHM6DQo+DQo+IEZyb20gUkZDNzgxMA0KPg0KPiDigJxUaGUgc3Vi LVRMVnMgaW50cm9kdWNlZCBpbiB0aGlzIGRvY3VtZW50IGFsbG93IGFuIG9wZXJhdG9yIHRvDQo+ ICAgIGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRoLCBkZWxh eSkgdGhhdCBjb3VsZCBiZQ0KPiAgICBzZW5zaXRpdmUgYW5kIHRoYXQgYW4gb3BlcmF0b3IgbWF5 IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnQ0KPg0KPiBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBh c3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhhdmUgYSBu dW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCByZWxldmFudCBpczoNCj4N Cj4g4oCcQWRkaXRpb25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQg b2YgbGluay1zdGF0ZSBhbmQNCj4gICAgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3JpYmVkIGluIHRo aXMgZG9jdW1lbnQgY29uc3RpdHV0ZXMgYSByaXNrIHRvDQo+ICAgIGNvbmZpZGVudGlhbGl0eSBv ZiBtaXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmUNCj4gICAgaW5mb3Jt YXRpb24gYWJvdXQgdGhlIG5ldHdvcmsu4oCdDQo+DQo+IFNvIGxvbmcgYXMgdGhlcmUgYXJlIHJl ZmVyZW5jZXMgdG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhlcmVmb3Jl IGhhcmQgcHJlc3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2VmdWxseSBz YWlkLg0KPiBDZXJ0YWlubHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQLUxTIHRy YW5zcG9ydCBtZWNoYW5pc20gYXJlIG5vdCBhbHRlcmVkIGJ5IGFkZGluZyBzb21lIG5ldyBUTFZz IOKAkyBhbmQgc2luY2UgdGhlIElHUCBSRkNzIGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJpc2tzIGFz c29jaWF0ZWQgd2l0aCB0aGUgc3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5vdCBzaW1w bHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgdHJhbnNwb3J0IG1lY2hhbmlzbSkgeW91 IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hhdCBjYW4g bWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGluIHRoZSBy ZWZlcmVuY2VzLg0KDQpNeSBhcG9sb2dpZXMgZm9yIGp1bXBpbmcgaW4gaW4gdGhlIG1pZGRsZSwg YnV0IElJVUMgdGhlIElHUCBSRkNzIGhhdmUNCmNvdmVyZWQgdGhlIHJpc2tzIGFzc29jaWF0ZWQg d2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAqdW5kZXINCnRoZSBhc3N1bXB0 aW9uIHRoYXQgdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xlIEFTIGFu ZA0KYWRtaW5pc3RyYXRpdmUgZG9tYWluKi4gIFlvYXYgaXMgcG9pbnRpbmcgb3V0IHRoYXQgdGhl IHJpc2tzIGZvciB0aGF0DQppbmZvcm1hdGlvbiBtYXkgY2hhbmdlIHdoZW4gdGhlIGRpc3RyaWJ1 dGlvbiBpcyBvdmVyIGEgYnJvYWRlciBkb21haW4gdGhhbg0KdGhlIG9uZSBmb3Igd2hpY2ggdGhl IHByZXZpb3VzIGFuYWx5c2lzIHdhcyBwZXJmb3JtZWQuDQoNCi1CZW4NCg== --_000_b718ffb671c446adb1666ad9f73f4f82XCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglw YW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNv LXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIs c2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+U3VlIOKAkzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T25lIG9mIHVzIGlzIGNvbmZ1c2VkLg0KPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncztjb2xvcjoj MUY0OTdEIj5KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cCBpcyBub3QgcmVsYXRlZCB0byBTZWdtZW50IFJvdXRpbmcuIFRob3NlIHdvcmRzIGRvIG5vdCBh cHBlYXIgYW55d2hlcmUgaW4gdGhlIGRvY3VtZW50LiBOb3IgaXMgdGhlcmUgYSByZWZlcmVuY2Ug dG8gYW55IFNSIGRvY3VtZW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+RnVydGhlciwgUkZDIDc3NTIgaW5jbHVkZXMgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZv cm1hdGlvbiAoc2VlDQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1 MiNzZWN0aW9uLTMuMy4yIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0 aW9uLTMuMy4yPC9hPiApIHNvIHRoZSBzdWdnZXN0aW9uIHRoYXQgd2UgYXJlIGludHJvZHVjaW5n IGEgbmV3IGF0dGFjayB2ZWN0b3IgYnkgZGVmaW5pbmcgc29tZSBhZGRpdGlvbmFsKHNpYykgVEUg Y29kZXBvaW50cyBkb2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1lLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhcHByZWNpYXRlIHRoYXQgdGhlcmUgYXJlIG90aGVy IGRyYWZ0cyBvbiB5b3VyIG1pbmQgd2hpY2ggYXJlIFNSIHJlbGF0ZWQg4oCTIGJ1dCB0aGlzIGlz IG5vdCBvbmUgb2YgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkNvdWxkIHlvdSBwbGVhc2UgdXBkYXRlIHlvdXIgcmVzcG9uc2Ugd2l0aCB0aGVzZSBwb2lu dHMgaW4gbWluZD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRo YW54LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5i c3A7IExlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFk ZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTdXNhbiBIYXJlcyAm bHQ7c2hhcmVzQG5kemguY29tJmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2Jl ciAxOSwgMjAxOCA2OjI2IEFNPGJyPg0KPGI+VG86PC9iPiAnUm9iZXJ0IFJhc3p1aycgJmx0O3Jv YmVydEByYXN6dWsubmV0Jmd0Ozsga2FkdWtAbWl0LmVkdTxicj4NCjxiPkNjOjwvYj4gaWV0ZkBp ZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnOyB5bmlyLmlldGZAZ21haWwuY29tOyBpZHJAaWV0Zi5v cmc7IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0 OjwvYj4gUkU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0 Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlJvYmVydCwgQmVuamFtaW4s IGFuZCBZb2F2Og0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5J IGFncmVlIHRoZXNlIGNvbnRleHQgb2YgdGhlc2UgaXNzdWVzIGFyZSBub3Qgc3BlY2lmaWMgdG8g dGhpcyBkcmFmdC4mbmJzcDsgSG93ZXZlciwgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlv biBkb2VzIHByb3ZpZGUgaW5mb3JtYXRpb24gd2hpY2ggaXMgYSB0ZW1wdGluZyBhdHRhY2sNCiB2 ZWN0b3IuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhlIG9y aWdpbmFsIFJGQzc3NTIgZGVzY3JpYmVkIGEgZGlmZmVyZW50IHB1cnBvc2Ugd2l0aCByZXN0cmlj dGVkIHVzYWdlIHRoYXQgU1Igcm91dGluZyBleHRlbnNpb25zIGRvIG5vdCBhZGhlcmUgdG8gaW4g QkdQLiZuYnNwOyZuYnNwOyBTaW5jZSBTcHJpbmcgV0cgc2hvd3MgdGhhdCBvcGVyYXRvcnMNCiBh cmUgaW50ZXJlc3RlZCBpbiB0aGUgZXh0ZW5kZWQgdXNlLCBpdCBtYXkgYmUgdGltZSB0byBleGFt aW5lIHRoZSBSRkM3NzUyYmlzIG9yIG90aGVyIHNvbHV0aW9ucyB0aGF0IHRha2VzIGNhcmUgb2Yg dGhlc2Ugc2VjdXJpdHkgaXNzdWVzLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5NeSBqb2IgYXMgYSBzaGVwaGVyZCBpcyB0byBwb2ludCBvdXQgdGhl c2UgaXNzdWVzIHBlciBkcmFmdCBmb3IgdGhlIElFU0cgYW5kIHNlY3VyaXR5IGRpcmVjdG9yYXRl IGluIG9yZGVyIHRvIG9idGFpbiB0aGUgY29ycmVjdCBmZWVkYmFjay4gJm5ic3A7QXMgYSBXRyBj aGFpciwgSSBoYXZlDQogcG9pbnRlZCBvdXQgdGhlc2UgaXNzdWVzLCBidXQgdGhlIFdHIGhhcyB0 aGVzZSBkcmFmdHMgb24gV0cgTEMgd2l0aG91dCB0aGUgZXh0cmEgc2VjdXJpdHkuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPldpdGhvdXQgUkZDNzc1MmJpcyB3aXRoIGFkZGl0aW9uYWwgc2VjdXJpdHkgaW4g dGhlIGJhc2UgZG9jdW1lbnQsIEkgYW0gd29ya2luZyBhcyBhIHNoZXBoZXJkIG1ha2UgdGhlIG1h bmFnZWFiaWxpdHkgYW5kIHNlY3VyaXR5IHNlY3Rpb25zIGFzIGNsZWFyIGFzIHBvc3NpYmxlLg0K ICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgdGhl IGZlZWRiYWNrIGZyb20gdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlIHJldmlldyBvciB0aGUgSUVT RyBpcyB0aGF0IHdlIG5lZWQgdG8gb2J0YWluIGEgc29sdXRpb24gZm9yIFJGQzc3NTJiaXMgdGhh dCBkZXNjcmliZXMgYW5kIGhhbmRsZXMgdGhlc2Ugc2VjdXJpdHkNCiBpc3N1ZXMsIEkgd2lsbCBi ZSBnbGFkIHRvIHN1cHBvcnQgZmFzdC10cmFja2luZyB0aGlzIGlzc3VlIHdpdGhpbiB0aGUgV0cu IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgYW4gb2ZmbGlu ZSBkaXNjdXNzaW9uIHdpdGggQmVuamFtaW4sIFlvYXYsIHRoZSBJRFIgY2hhaXJzLCBhbmQgQWx2 YXJvIHdvdWxkIHNwZWVkIHRoaXMgYWxvbmcsIEkgY2FuIHNldCB0aGlzIHVwIGVhcmx5IG5leHQg d2Vlay4mbmJzcDsgSXQgd291bGQgYmUgaGVscGZ1bCB0byBoYXZlDQogdGhpcyBvZmZsaW5lIGRp c2N1c3Npb24gYmVmb3JlIHRoZSBJRFIgaW50ZXJpbSBzZXNzaW9uIG9uIDEwLzI2LiA8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rIHlvdSBmb3IgYWxsIHlv dXIgY29tbWVudHMuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlN1ZQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1z ZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj4gSWRyIFs8YSBocmVmPSJtYWls dG86aWRyLWJvdW5jZXNAaWV0Zi5vcmciPm1haWx0bzppZHItYm91bmNlc0BpZXRmLm9yZzwvYT5d DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlJvYmVydCBSYXN6dWs8YnI+DQo8Yj5TZW50OjwvYj4gRnJp ZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDI6NTIgQU08YnI+DQo8Yj5Ubzo8L2I+IDxhIGhyZWY9Im1h aWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEg aHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJt YWlsdG86c2VjZGlyQGlldGYub3JnIj4NCnNlY2RpckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1h aWx0bzp5bmlyLmlldGZAZ21haWwuY29tIj55bmlyLmlldGZAZ21haWwuY29tPC9hPjsNCjxhIGhy ZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0 bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWRy XSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SGVsbG8gQmVuamFtaW4sPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Ob3Qgc3VyZSBpZiB5b3UgaGF2ZSBzcG90dGVkIHNpbWlsYXIgY29tbWVudCBtYWRlIHRv IElEUiByZWdhcmRpbmcgdGhpcyB0b3BpYywgYnV0IHlvdXIgY29tbWVudCBzZWVtcyB0byBpbmRp Y2F0ZSB0aGF0IGhlcmUgd2UgYXJlIGFib3V0IHRvIGRlZmluZSB3YXlzIHRvIGNhcnJ5IG5pY2Vs eSBzY29wZWQgSUdQIGluZm9ybWF0aW9uIGludG8gQkdQLiBXZWxsIHRoYXQgaGFzIGFscmVhZHkg aGFwcGVuZWQgd2l0aA0KIFJGQzc3NTIgYW5kIHlvdXIgY29tbWVudCBvciBmb3IgdGhhdCBtYXR0 ZXIgWW9hdidzIHJlbWFya3MgYXJlIGluZGVlZCBzcG90IG9uIGJ1dCB0byB0aGUgc2VjdXJpdHkg ZGlzY3Vzc2lvbiBvbiBSRkM3NzUyIGFuZCBJTU8gbm90IGFueSBmb2xsb3cgdXAgZXh0ZW5zaW9u cyBvZiBpdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+U3VyZSAtIGFzIG9ic2VydmVkIGJ5IFN1ZSAtIG9uZSBtYXkgYXJndWUgdGhh dCBwcm92aWRpbmcgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yayB0byB0aGUgcG90 ZW50aWFsIGF0dGFja2VyIG1ha2VzIHRoZSBuZXR3b3JrIHdlYWtlciwgYnV0IHRoZSBjdXJlIGZv ciB0aGF0IGlzIHRvIHByZXZlbnQgdGhlIGxlYWtzIGFuZCByZWR1Y2UgcHJvYmFiaWxpdHkgb2Yg aW50ZXJjZXB0aW5nIG5ldyBpbmZvcm1hdGlvbg0KIGJ5IHVuYXV0aG9yaXplZCBwYXJ0aWVzLiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5CR1AtTFMgaXMgYWxyZWFkeSBkZWZpbmVkIGluIGEgbmV3IFNBRkkgd2hhdCBieSBpdHNlbGYg ZG9lcyBwcm92aWRlIG5pY2UgbGV2ZWwgb2YgaXNvbGF0aW9uLiBSRkM3NzUyIGlzIHByZXR0eSBj bGVhciBvbiB0aGF0IHRvbyBhbmQgc2F5czombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+JnF1b3Q7QkdQIHBlZXJpbmdzIGFyZSBub3Qg YXV0b21hdGljIGFuZCByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRoZSByZXNw b25zaWJpbGl0eSBvZiB0aGUgbmV0d29yayBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBvbmx5IHRy dXN0ZWQgY29uc3VtZXJzIGFyZSBjb25maWd1cmVkIHRvIHJlY2VpdmUgc3VjaCBpbmZvcm1hdGlv bi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SWYgc29tZW9uZSB3b3VsZCBiZSBzdGlsbCBjb25jZXJuZWQgYWJvdXQgY29uZmlndXJh dGlvbiBtaXN0YWtlcyBhbmQgbmVnb3RpYXRpbmcgU0FGSSA3MSBvciA3MiB0byB0aG9zZSB3aG8g c2hvdWxkIG5vdCBnZXQgdGhpcyBkYXRhIEkgcmVjb21tZW5kIHdlIHJlaXNzdWUgdGhlIFJGQzc3 NTIgYXMgLWJpcyB2ZXJzaW9uIGFuZCByZXN0cmljdCB0aGUgc2NvcGUgb2YgdGhlIGRpc3RyaWJ1 dGlvbiBldmVuIGZ1cnRoZXINCiBieSBtYW5kYXRpbmcgZGVmYXVsdCB1c2Ugb2YgTk8tRVhQT1JU IGNvbW11bml0eSB3aXRoIGFiaWxpdHkgdG8gb3ZlcndyaXRlIGl0IGZvciB0aGUgc2VsZWN0aXZl IGVCR1AgcGVlcnMuIE9yIHBlcmhhcHMgd2UgY291bGQgcHJvZ3Jlc3MgSmltJ3MgT25lIEFkbWlu aXN0cmF0aXZlIERvbWFpbiBkcmFmdCAoZHJhZnQtdXR0YXJvLWlkci1vYWQtMDEpLiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBl aXRoZXIgY2FzZSB3aGlsZSBib3RoIG9mIHlvdXIgY29tbWVudHMgYXJlIGdyZWF0IHRoZXkgc2Vl bXMgYSBiaXQgbGF0ZSBpbiB0aGUgZ2FtZSBoZXJlIG9yIGF0IGxlYXN0IHRhcmdldGluZyB3cm9u ZyBkb2N1bWVudC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+S2luZCByZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Um9iZXJ0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIE9jdCAxOSwgMjAxOCBhdCAyOjI3IEFNIEJl bmphbWluIEthZHVrICZsdDs8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0 LmVkdTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIFRodSwgT2N0IDE4LCAyMDE4IGF0IDA2OjAwOjEzUE0gJiM0MzswMDAwLCBMZXMgR2luc2Jl cmcgKGdpbnNiZXJnKSB3cm90ZTo8YnI+DQomZ3Q7IFlvYXYg4oCTPGJyPg0KJmd0OyA8YnI+DQom Z3Q7IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhZHZlcnRpc2luZyB0 aGUgc3BlY2lmaWMgaW5mb3JtYXRpb24gY292ZXJlZCBpbiB0aGlzIGRyYWZ0IHdlIGhhdmUgYSBz dGF0ZW1lbnQgaW4gdGhlIElHUCBkcmFmdHM6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEZyb20gUkZD NzgxMDxicj4NCiZndDsgPGJyPg0KJmd0OyDigJxUaGUgc3ViLVRMVnMgaW50cm9kdWNlZCBpbiB0 aGlzIGRvY3VtZW50IGFsbG93IGFuIG9wZXJhdG9yIHRvPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsg YWR2ZXJ0aXNlIHN0YXRlIGluZm9ybWF0aW9uIG9mIGxpbmtzIChiYW5kd2lkdGgsIGRlbGF5KSB0 aGF0IGNvdWxkIGJlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgc2Vuc2l0aXZlIGFuZCB0aGF0IGFu IG9wZXJhdG9yIG1heSBub3Qgd2FudCB0byBkaXNjbG9zZS7igJ08YnI+DQomZ3Q7IDxicj4NCiZn dDsgSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHNlbmRpbmcgaW5mb3Jt YXRpb24gdmlhIEJHUC1MUyB3ZSBoYXZlIGEgbnVtYmVyIG9mIHN0YXRlbWVudHMgaW4gUkZDIDc3 NTIg4oCTIG1vc3QgcmVsZXZhbnQgaXM6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IOKAnEFkZGl0aW9u YWxseSwgaXQgbWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9mIGxpbmstc3RhdGUg YW5kPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3JpYmVkIGlu IHRoaXMgZG9jdW1lbnQgY29uc3RpdHV0ZXMgYSByaXNrIHRvPGJyPg0KJmd0OyZuYnNwOyAmbmJz cDsgY29uZmlkZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3IgY29tbWVyY2lhbGx5IHNl bnNpdGl2ZTxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3 b3JrLuKAnTxicj4NCiZndDsgPGJyPg0KJmd0OyBTbyBsb25nIGFzIHRoZXJlIGFyZSByZWZlcmVu Y2VzIHRvIGJvdGggdGhlIElHUCBSRkNzIGFuZCBSRkMgNzc1MiBJIGFtIHRoZXJlZm9yZSBoYXJk IHByZXNzZWQgdG8gdW5kZXJzdGFuZCB3aGF0IGVsc2UgY291bGQgYmUgdXNlZnVsbHkgc2FpZC48 YnI+DQomZ3Q7IENlcnRhaW5seSB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBCR1AtTFMg dHJhbnNwb3J0IG1lY2hhbmlzbSBhcmUgbm90IGFsdGVyZWQgYnkgYWRkaW5nIHNvbWUgbmV3IFRM VnMg4oCTIGFuZCBzaW5jZSB0aGUgSUdQIFJGQ3MgaGF2ZSBhbHJlYWR5IGNvdmVyZWQgcmlza3Mg YXNzb2NpYXRlZCB3aXRoIHRoZSBzcGVjaWZpYyBjbGFzcyBvZiBpbmZvcm1hdGlvbiAobm90IHNp bXBseSB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSB0cmFuc3BvcnQNCiBtZWNoYW5pc20p IHlvdSBhcmUgZ29pbmcgdG8gaGF2ZSB0byBwcm92aWRlIG1vcmUgc3BlY2lmaWNzIG9uIHdoYXQg Y2FuIG1lYW5pbmdmdWxseSBiZSBzYWlkIHRoYXQgaXMgbm90IGFscmVhZHkgY292ZXJlZCBpbiB0 aGUgcmVmZXJlbmNlcy48YnI+DQo8YnI+DQpNeSBhcG9sb2dpZXMgZm9yIGp1bXBpbmcgaW4gaW4g dGhlIG1pZGRsZSwgYnV0IElJVUMgdGhlIElHUCBSRkNzIGhhdmU8YnI+DQpjb3ZlcmVkIHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggYSBzcGVjaWZpYyBjbGFzcyBvZiBpbmZvcm1hdGlvbiwgKnVu ZGVyPGJyPg0KdGhlIGFzc3VtcHRpb24gdGhhdCB0aGUgdHJhbnNwb3J0IG1lY2hhbmlzbSBpcyB3 aXRoaW4gYSBzaW5nbGUgQVMgYW5kPGJyPg0KYWRtaW5pc3RyYXRpdmUgZG9tYWluKi4mbmJzcDsg WW9hdiBpcyBwb2ludGluZyBvdXQgdGhhdCB0aGUgcmlza3MgZm9yIHRoYXQ8YnI+DQppbmZvcm1h dGlvbiBtYXkgY2hhbmdlIHdoZW4gdGhlIGRpc3RyaWJ1dGlvbiBpcyBvdmVyIGEgYnJvYWRlciBk b21haW4gdGhhbjxicj4NCnRoZSBvbmUgZm9yIHdoaWNoIHRoZSBwcmV2aW91cyBhbmFseXNpcyB3 YXMgcGVyZm9ybWVkLjxicj4NCjxicj4NCi1CZW48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9k eT4NCjwvaHRtbD4NCg== --_000_b718ffb671c446adb1666ad9f73f4f82XCHALN001ciscocom_-- From nobody Fri Oct 19 08:33:00 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFEFF130EF6; Fri, 19 Oct 2018 08:32:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vDEtrUtm-mgF; Fri, 19 Oct 2018 08:32:49 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D860A128CF2; Fri, 19 Oct 2018 08:32:48 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> In-Reply-To: Date: Fri, 19 Oct 2018 11:32:44 -0400 Message-ID: <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_01E3_01D4679F.74B9ED70" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAUeOFiGjF42TsA== Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 15:32:52 -0000 This is a multipart message in MIME format. ------=_NextPart_000_01E3_01D4679F.74B9ED70 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les: =20 Thank you for responding to Robert=E2=80=99s post. =20 =20 Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information. The extension of the = scope beyond its stated scope might have trigger the current discussions = at that time. The authors indicated to the IDR chairs the RFC7752 scope = would not grow. =20 =20 As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft. As Shepherd, I do not agree with you that security = issues Yoav raises are specified in RFC7752. I =20 You are correct that there are many drafts (just BGP-LS extensions and = segment routing extensions that use BGP-LS). This draft is just the = first of a wave of drafts. It is appropriate to have a solution for = the security issues that covers all the drafts rather than go through = drafts one at a time. I suggest that a revision to RFC7752 that = addresses these issues is appropriate.=20 =20 If you are interested in discuss this topic with Yoav, Benjamin, and the = IDR WG =E2=80=93 shall we start a thread on this topic?=20 =20 Susan Hares=20 =20 =20 =20 =20 =20 =20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:52 AM To: Robert Raszuk; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert=E2=80=99s post addresses points I also want to make. =20 What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ). If this information = had already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been required. =20 In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. =20 I appreciate that from the POV of the Security Area you folks are not as = intimately familiar with the routing drafts and the relationship between = them. It is therefore understandable that you start looking at the new = draft as a standalone document =E2=80=93 and in that context your = comments are absolutely correct. But the document you are reviewing is = most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. The = issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. =20 I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time needlessly. =20 Les =20 =20 From: Robert Raszuk =20 Sent: Thursday, October 18, 2018 11:52 PM To: kaduk@mit.edu Cc: Les Ginsberg (ginsberg) ; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_01E3_01D4679F.74B9ED70 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

Thank you for responding to Robert=E2=80=99s post.=C2=A0 =

 

Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information.=C2=A0=C2=A0 The extension = of the scope beyond its stated scope might have trigger the current = discussions at that time.=C2=A0 The authors indicated to the IDR chairs = the RFC7752 scope would not grow. =C2=A0=C2=A0

 

As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft. =C2=A0As Shepherd, I do not agree with you that = security issues Yoav raises are specified in RFC7752. = =C2=A0=C2=A0I

 

You are correct that there are many drafts (just BGP-LS extensions = and segment routing extensions that use BGP-LS).=C2=A0 =C2=A0This draft = is just the first of a wave of drafts. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0It = is appropriate to have a solution for the security issues that covers = all the drafts rather than go through drafts one at a time. I suggest = that a revision to RFC7752 that addresses these issues is appropriate. =

 

If you are interested in discuss this topic with Yoav, Benjamin, and = the IDR WG =E2=80=93 shall we start a thread on this topic? =

 

Susan Hares

 

 

=C2=A0=C2=A0

 

 

 

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg)
Sent: Friday, October 19, 2018 10:52 = AM
To: Robert Raszuk; kaduk@mit.edu
Cc: = idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; = ynir.ietf@gmail.com
Subject: Re: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Robert=E2=80=99s post addresses points I also want to = make.

 

What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the  BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ). If this information had = already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been = required.

 

In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752.

 

I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. = The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion.

 

I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time = needlessly.

 

   Les

 

 

From: Robert = Raszuk <robert@raszuk.net>
Sent: Thursday, October 18, = 2018 11:52 PM
To: kaduk@mit.edu
Cc: Les Ginsberg = (ginsberg) <ginsberg@cisco.com>; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: Re: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_01E3_01D4679F.74B9ED70-- From nobody Fri Oct 19 08:57:02 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11F2D130F06; Fri, 19 Oct 2018 08:57:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.563 X-Spam-Level: X-Spam-Status: No, score=-14.563 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jquw7TC9X68t; Fri, 19 Oct 2018 08:56:56 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37154130F02; Fri, 19 Oct 2018 08:56:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=39950; q=dns/txt; s=iport; t=1539964616; x=1541174216; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=XGcwCRZpEqnNuc/Ujby+MbOXYjg2rm0cxZahlHZcMps=; b=F4+Qvg62Am/YIZK9mNZJR4adHS/9/sbJpORro9h4/36knSHgUxkcXSrZ aflpCgAYPQ7doO4ur5jJv6xfSOKCBvWP1mYk3Q5gBn7nV+iCWZU2qF49Q 3AQLhahFRHBmOyEVZYioN5gi4QIG4Nnj2Q2DKj7exK6+cQZX+9eOyp0ZD o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AJAAD+/clb/5JdJa1lDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVMCAQEBAQELAYENSC9mfygKg2uUMYINeod+jheBegs?= =?us-ascii?q?BASOESQIXhHEhNgsNAQMBAQIBAQJtHAyFOQEBAQEDIwpFBxACAQgOAwQBAQE?= =?us-ascii?q?gBwMCAgIfERQJCAIEAQ0FCAwHBIMDgR1MAxUPpyiBLodzDYITBYtPF4FBP4E?= =?us-ascii?q?Rgl0HLoJWRQEBAgGBdR+CTYJXAo4yhhCJUS4JAoZcgmGECYMcH5ApjFR4iF8?= =?us-ascii?q?CERSBJiQNJIFVcBWDJ4ImF4hchQQ6bwEBiiSBHwEB?= X-IronPort-AV: E=Sophos;i="5.54,400,1534809600"; d="scan'208,217";a="187970492" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 15:56:54 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id w9JFusUw015876 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 15:56:54 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 19 Oct 2018 10:56:54 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Fri, 19 Oct 2018 10:56:54 -0500 From: "Les Ginsberg (ginsberg)" To: Susan Hares , "'Robert Raszuk'" , "kaduk@mit.edu" CC: "idr@ietf.org" , "secdir@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ynir.ietf@gmail.com" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgAAtaFCAAGQmAP//rr8g Date: Fri, 19 Oct 2018 15:56:53 +0000 Message-ID: <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> In-Reply-To: <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_8a146dfd09814f8092a0ac10bd7d37d1XCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 15:57:00 -0000 --_000_8a146dfd09814f8092a0ac10bd7d37d1XCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VlIOKAkw0KDQpJIHdhcyBub3QgYW4gYXV0aG9yIG9mIFJGQyA3NzUyIGFuZCBoYXZlIG5vIGlk ZWEgd2hhdCBwcm9taXNlcyB0aGUgYXV0aG9ycyBtaWdodCBoYXZlIG1hZGUuIEkgd2lsbCBzYXkg dGhhdCBpdCBzZWVtcyB2ZXJ5IGxhdGUgaW4gdGhlIGdhbWUgZm9yIHlvdSB0byBzdWdnZXN0IHRo YXQgdGhpcyBkb2N1bWVudCBzaG91bGQgbm90IGJlIGFsbG93ZWQgdG8gcHJvZ3Jlc3MgYmVjYXVz ZSBpdCAgZXhjZWVkcyBzb21lIGFncmVlbWVudCBvbiB0aGUgc2NvcGUgb2YgUkZDIDc3NTIuIFdo eSB3ZXJlbuKAmXQgdGhlc2UgY29uY2VybnMgZXhwcmVzc2VkIGxvbmcgYmVmb3JlPw0KDQpJZiB5 b3UgZmVlbCB0aGF0IFJGQyA3NzUyIHNlY3VyaXR5IG5lZWRzIHJldmlzaW9uIEkgd291bGQgYXBw cmVjaWF0ZSBpdCBpZiB5b3Ugc3RhdGUgc28gY2xlYXJseSAodG8gdGhlIFdHIOKAkyBub3QganVz dCB0byBtZSkgYW5kIGluIHRoZSByaWdodCBjb250ZXh0LiBTdWNoIHdvcmsgaXMgY2xlYXJseSBu b3QgaW4gdGhlIHNjb3BlIG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC4NCg0KICAgTGVzDQoN CkZyb206IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb20+DQpTZW50OiBGcmlkYXksIE9jdG9i ZXIgMTksIDIwMTggODozMyBBTQ0KVG86IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpIDxnaW5zYmVy Z0BjaXNjby5jb20+OyAnUm9iZXJ0IFJhc3p1aycgPHJvYmVydEByYXN6dWsubmV0Pjsga2FkdWtA bWl0LmVkdQ0KQ2M6IGlkckBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnOyBpZXRmQGlldGYub3Jn OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyB5bmlyLmlldGZAZ21haWwu Y29tDQpTdWJqZWN0OiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KTGVzOg0KDQpUaGFuayB5b3UgZm9yIHJlc3Bv bmRpbmcgdG8gUm9iZXJ04oCZcyBwb3N0Lg0KDQpZb3VyIGFyZ3VtZW50IHRoYXQgdGhpcyBpbmZv cm1hdGlvbiB3b3VsZCBoYXZlIGFkZGVkIHRvIFJGQzc3NTIgaXMgb24g4oCcdGhpbiBpY2XigJ0g YXMgdGhlIElFU0cgaW4gdGhlaXIgYXBwcm92YWwgb2YgUkZDNzc1MiB3YXMgY29uY2VybmVkIGFi b3V0IHRoZSBzY29wZSBvZiB0aGUgaW5mb3JtYXRpb24uICAgVGhlIGV4dGVuc2lvbiBvZiB0aGUg c2NvcGUgYmV5b25kIGl0cyBzdGF0ZWQgc2NvcGUgbWlnaHQgaGF2ZSB0cmlnZ2VyIHRoZSBjdXJy ZW50IGRpc2N1c3Npb25zIGF0IHRoYXQgdGltZS4gIFRoZSBhdXRob3JzIGluZGljYXRlZCB0byB0 aGUgSURSIGNoYWlycyB0aGUgUkZDNzc1MiBzY29wZSB3b3VsZCBub3QgZ3Jvdy4NCg0KQXMgc2hl cGhlcmQgSSByZXF1ZXN0ZWQgdGhpcyBkcmFmdCB0byBiZSByZXZpZXdlZCBieSB0aGUgc2VjdXJp dHkgZGlyZWN0b3JhdGUgYmVjYXVzZSB3ZSBhcmUgZ29pbmcgYmV5b25kIHRoZSBvcmlnaW5hbCBz Y29wZSBvZiBSRkM3NzUyIHdpdGggdGhpcyBkcmFmdC4gIEFzIFNoZXBoZXJkLCBJIGRvIG5vdCBh Z3JlZSB3aXRoIHlvdSB0aGF0IHNlY3VyaXR5IGlzc3VlcyBZb2F2IHJhaXNlcyBhcmUgc3BlY2lm aWVkIGluIFJGQzc3NTIuICAgSQ0KDQpZb3UgYXJlIGNvcnJlY3QgdGhhdCB0aGVyZSBhcmUgbWFu eSBkcmFmdHMgKGp1c3QgQkdQLUxTIGV4dGVuc2lvbnMgYW5kIHNlZ21lbnQgcm91dGluZyBleHRl bnNpb25zIHRoYXQgdXNlIEJHUC1MUykuICAgVGhpcyBkcmFmdCBpcyBqdXN0IHRoZSBmaXJzdCBv ZiBhIHdhdmUgb2YgZHJhZnRzLiAgICAgIEl0IGlzIGFwcHJvcHJpYXRlIHRvIGhhdmUgYSBzb2x1 dGlvbiBmb3IgdGhlIHNlY3VyaXR5IGlzc3VlcyB0aGF0IGNvdmVycyBhbGwgdGhlIGRyYWZ0cyBy YXRoZXIgdGhhbiBnbyB0aHJvdWdoIGRyYWZ0cyBvbmUgYXQgYSB0aW1lLiBJIHN1Z2dlc3QgdGhh dCBhIHJldmlzaW9uIHRvIFJGQzc3NTIgdGhhdCBhZGRyZXNzZXMgdGhlc2UgaXNzdWVzIGlzIGFw cHJvcHJpYXRlLg0KDQpJZiB5b3UgYXJlIGludGVyZXN0ZWQgaW4gZGlzY3VzcyB0aGlzIHRvcGlj IHdpdGggWW9hdiwgQmVuamFtaW4sIGFuZCB0aGUgSURSIFdHIOKAkyBzaGFsbCB3ZSBzdGFydCBh IHRocmVhZCBvbiB0aGlzIHRvcGljPw0KDQpTdXNhbiBIYXJlcw0KDQoNCg0KDQoNCg0KDQoNCkZy b206IElkciBbbWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgTGVzIEdp bnNiZXJnIChnaW5zYmVyZykNClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAxMDo1MiBB TQ0KVG86IFJvYmVydCBSYXN6dWs7IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+ DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBzZWNkaXJAaWV0Zi5vcmc8 bWFpbHRvOnNlY2RpckBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5v cmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgeW5pci5pZXRmQGdtYWlsLmNvbTxtYWls dG86eW5pci5pZXRmQGdtYWlsLmNvbT4NClN1YmplY3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNk aXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpSb2JlcnTi gJlzIHBvc3QgYWRkcmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0byBtYWtlLg0KDQpXaGF0IGlz IGJlaW5nIGRvbmUgaGVyZSBpcyB0byBhZGQgYWRkaXRpb25hbCBCR1AtTFMgY29kZXBvaW50cyB0 byBhZHZlcnRpc2UgSUdQIGluZm9ybWF0aW9uIHRoYXQgd2FzIG5vdCBkZWZpbmVkIGF0IHRoZSB0 aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuLiBXZSBoYXZlbuKAmXQgY2hhbmdlZCB0aGUgIEJHUC1M UyB0cmFuc3BvcnQgbWVjaGFuaXNtIOKAkyBub3IgaXMgdGhlIGluZm9ybWF0aW9uIGJlaW5nIGFk dmVydGlzZWQgaGVyZSAoc29tZSBhZGRpdGlvbmFsIFRFIHJlbGF0ZWQgbGluayBhdHRyaWJ1dGUg aW5mb3JtYXRpb24pIHF1YWxpdGF0aXZlbHkgZGlmZmVyZW50IHRoYW4gYSBudW1iZXIgb2YgZXhp c3RpbmcgVExWcyBkZWZpbmVkIGluIFJGQyA3NzUyIChzZWUgaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL3JmYzc3NTIjc2VjdGlvbi0zLjMuMiApLiBJZiB0aGlzIGluZm9ybWF0aW9uIGhhZCBh bHJlYWR5IGJlZW4gZGVmaW5lZCBpbiB0aGUgSUdQcyBhdCB0aGUgdGltZSBSRkMgNzc1MiB3YXMg d3JpdHRlbiBpdCB3b3VsZCBzaW1wbHkgaGF2ZSBiZWVuIGluY2x1ZGVkIGFzIGEgc2VjdGlvbiBv ZiBSRkMgNzc1MiBhbmQgbm8gYWRkaXRpb25hbCBjaGFuZ2VzIHRvIFJGQyA3NzUyIHdvdWxkIGhh dmUgYmVlbiByZXF1aXJlZC4NCg0KSW4gdGhlb3J5LCB3ZSBjb3VsZCBoYXZlIHNpbXBseSB1cGRh dGVkIFJGQyA3NzUyIHJhdGhlciB3cml0aW5nIGEgc2VwYXJhdGUgZHJhZnQsIGJ1dCBwcmFjdGlj YWxseSB0aGlzIHdvdWxkIGJlIGEgcG9vciBzdHJhdGVneSBhcyBpdCB3b3VsZCBpbmNvcnJlY3Rs eSBzdWdnZXN0IHRoYXQgc29tZSBjaGFuZ2Ugd2FzIGJlaW5nIG1hZGUgdG8gdGhlIGV4aXN0aW5n IHRleHQgaW4gUkZDIDc3NTIuDQoNCkkgYXBwcmVjaWF0ZSB0aGF0IGZyb20gdGhlIFBPViBvZiB0 aGUgU2VjdXJpdHkgQXJlYSB5b3UgZm9sa3MgYXJlIG5vdCBhcyBpbnRpbWF0ZWx5IGZhbWlsaWFy IHdpdGggdGhlIHJvdXRpbmcgZHJhZnRzIGFuZCB0aGUgcmVsYXRpb25zaGlwIGJldHdlZW4gdGhl bS4gSXQgaXMgdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRoYXQgeW91IHN0YXJ0IGxvb2tpbmcg YXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9jdW1lbnQg4oCTIGFuZCBpbiB0aGF0 IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVseSBjb3JyZWN0LiBCdXQgdGhlIGRv Y3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNjdXJhdGVseSBzZWVuIGFzIGFuIOKA nGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLiBUaGUgaXNzdWVzIHlvdSByYWlzZSBoYXZlIGFscmVh ZHkgYmVlbiBhZGRyZXNzZWQgaW4gUkZDIDc3NTIgYW5kIGl0IGlzIHRoZXJlZm9yZSB2ZXJ5IGFw cHJvcHJpYXRlIHRoYXQgd2UgYWRkcmVzcyB5b3VyIGNvbmNlcm5zIGJ5IGluY2x1ZGluZyBhIHJl ZmVyZW5jZSB0byB0aGUgUkZDIDc3NTIgc2VjdXJpdHkgZGlzY3Vzc2lvbi4NCg0KSSB0aGluayBp dCBpcyBpbXBvcnRhbnQgdGhhdCB5b3Ugbm90ZSB0aGlzIHJlbGF0aW9uc2hpcCwgYmVjYXVzZSB0 aGUgbmF0dXJlIG9mIEJHUC1MUyBpcyB0aGF0IHdoZW5ldmVyIElHUCBleHRlbnNpb25zIGFyZSBk ZWZpbmVkIHRvIGFkdmVydGlzZSBuZXcgaW5mb3JtYXRpb24gaXQgaXMgbmVjZXNzYXJ5IHRvIGRl ZmluZSBjb3JyZXNwb25kaW5nIEJHUC1MUyBjb2RlcG9pbnRzLiBUaGlzIGlzIG5vdCB0aGUgZmly c3Qgc3VjaCBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IOKAkyBhbmQgaXQgaXMgc2FmZSB0byBz YXkgaXQgd29u4oCZdCBiZSB0aGUgbGFzdC4gSXQgd291bGQgYmUgaGVscGZ1bCB0byBhbGwgaWYg d2UgcmVhY2hlZCBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9yIHRoaXMgZGlzY3Vzc2lvbiB3aWxs IHRha2UgcGxhY2UgZXZlcnkgdGltZSBhIEJHUC1MUyBleHRlbnNpb24gZG9jdW1lbnQgaXMgYmVp bmcgcmV2aWV3ZWQg4oCTIHdoaWNoIHdpbGwgY29zdCB1cyBhbGwgdGltZSBuZWVkbGVzc2x5Lg0K DQogICBMZXMNCg0KDQpGcm9tOiBSb2JlcnQgUmFzenVrIDxyb2JlcnRAcmFzenVrLm5ldDxtYWls dG86cm9iZXJ0QHJhc3p1ay5uZXQ+Pg0KU2VudDogVGh1cnNkYXksIE9jdG9iZXIgMTgsIDIwMTgg MTE6NTIgUE0NClRvOiBrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0KQ2M6IExl cyBHaW5zYmVyZyAoZ2luc2JlcmcpIDxnaW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNiZXJn QGNpc2NvLmNvbT4+OyBpZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBpZXRmLm9yZz47IGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBt LWJncC5hbGxAaWV0Zi5vcmc+OyBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGlldGYub3JnPjsg eW5pci5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT47IHNlY2RpckBp ZXRmLm9yZzxtYWlsdG86c2VjZGlyQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZHJdIFtzZWNk aXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoN CkhlbGxvIEJlbmphbWluLA0KDQpOb3Qgc3VyZSBpZiB5b3UgaGF2ZSBzcG90dGVkIHNpbWlsYXIg Y29tbWVudCBtYWRlIHRvIElEUiByZWdhcmRpbmcgdGhpcyB0b3BpYywgYnV0IHlvdXIgY29tbWVu dCBzZWVtcyB0byBpbmRpY2F0ZSB0aGF0IGhlcmUgd2UgYXJlIGFib3V0IHRvIGRlZmluZSB3YXlz IHRvIGNhcnJ5IG5pY2VseSBzY29wZWQgSUdQIGluZm9ybWF0aW9uIGludG8gQkdQLiBXZWxsIHRo YXQgaGFzIGFscmVhZHkgaGFwcGVuZWQgd2l0aCBSRkM3NzUyIGFuZCB5b3VyIGNvbW1lbnQgb3Ig Zm9yIHRoYXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBpbmRlZWQgc3BvdCBvbiBidXQgdG8g dGhlIHNlY3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBhbmQgSU1PIG5vdCBhbnkgZm9sbG93 IHVwIGV4dGVuc2lvbnMgb2YgaXQuDQoNClN1cmUgLSBhcyBvYnNlcnZlZCBieSBTdWUgLSBvbmUg bWF5IGFyZ3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdv cmsgdG8gdGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0aGUgbmV0d29yayB3ZWFrZXIsIGJ1 dCB0aGUgY3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRoZSBsZWFrcyBhbmQgcmVkdWNlIHBy b2JhYmlsaXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3JtYXRpb24gYnkgdW5hdXRob3JpemVk IHBhcnRpZXMuDQoNCkJHUC1MUyBpcyBhbHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0 IGJ5IGl0c2VsZiBkb2VzIHByb3ZpZGUgbmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIg aXMgcHJldHR5IGNsZWFyIG9uIHRoYXQgdG9vIGFuZCBzYXlzOg0KDQoiQkdQIHBlZXJpbmdzIGFy ZSBub3QgYXV0b21hdGljIGFuZCByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRo ZSByZXNwb25zaWJpbGl0eSBvZiB0aGUgbmV0d29yayBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBv bmx5IHRydXN0ZWQgY29uc3VtZXJzIGFyZSBjb25maWd1cmVkIHRvIHJlY2VpdmUgc3VjaCBpbmZv cm1hdGlvbi4iDQoNCklmIHNvbWVvbmUgd291bGQgYmUgc3RpbGwgY29uY2VybmVkIGFib3V0IGNv bmZpZ3VyYXRpb24gbWlzdGFrZXMgYW5kIG5lZ290aWF0aW5nIFNBRkkgNzEgb3IgNzIgdG8gdGhv c2Ugd2hvIHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0YSBJIHJlY29tbWVuZCB3ZSByZWlzc3VlIHRo ZSBSRkM3NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQgcmVzdHJpY3QgdGhlIHNjb3BlIG9mIHRoZSBk aXN0cmlidXRpb24gZXZlbiBmdXJ0aGVyIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1F WFBPUlQgY29tbXVuaXR5IHdpdGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxl Y3RpdmUgZUJHUCBwZWVycy4gT3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUg QWRtaW5pc3RyYXRpdmUgRG9tYWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuDQoN CkluIGVpdGhlciBjYXNlIHdoaWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhl eSBzZWVtcyBhIGJpdCBsYXRlIGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5n IHdyb25nIGRvY3VtZW50Lg0KDQpLaW5kIHJlZ2FyZHMsDQpSb2JlcnQuDQoNCg0KT24gRnJpLCBP Y3QgMTksIDIwMTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayA8a2FkdWtAbWl0LmVkdTxtYWls dG86a2FkdWtAbWl0LmVkdT4+IHdyb3RlOg0KT24gVGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6 MTNQTSArMDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6DQo+IFlvYXYg4oCTDQo+ DQo+IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhZHZlcnRpc2luZyB0 aGUgc3BlY2lmaWMgaW5mb3JtYXRpb24gY292ZXJlZCBpbiB0aGlzIGRyYWZ0IHdlIGhhdmUgYSBz dGF0ZW1lbnQgaW4gdGhlIElHUCBkcmFmdHM6DQo+DQo+IEZyb20gUkZDNzgxMA0KPg0KPiDigJxU aGUgc3ViLVRMVnMgaW50cm9kdWNlZCBpbiB0aGlzIGRvY3VtZW50IGFsbG93IGFuIG9wZXJhdG9y IHRvDQo+ICAgIGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRo LCBkZWxheSkgdGhhdCBjb3VsZCBiZQ0KPiAgICBzZW5zaXRpdmUgYW5kIHRoYXQgYW4gb3BlcmF0 b3IgbWF5IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnQ0KPg0KPiBJbiByZWdhcmRzIHRvIHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhh dmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCByZWxldmFudCBp czoNCj4NCj4g4oCcQWRkaXRpb25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBl eHBvcnQgb2YgbGluay1zdGF0ZSBhbmQNCj4gICAgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3JpYmVk IGluIHRoaXMgZG9jdW1lbnQgY29uc3RpdHV0ZXMgYSByaXNrIHRvDQo+ICAgIGNvbmZpZGVudGlh bGl0eSBvZiBtaXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmUNCj4gICAg aW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsu4oCdDQo+DQo+IFNvIGxvbmcgYXMgdGhlcmUg YXJlIHJlZmVyZW5jZXMgdG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhl cmVmb3JlIGhhcmQgcHJlc3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2Vm dWxseSBzYWlkLg0KPiBDZXJ0YWlubHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQ LUxTIHRyYW5zcG9ydCBtZWNoYW5pc20gYXJlIG5vdCBhbHRlcmVkIGJ5IGFkZGluZyBzb21lIG5l dyBUTFZzIOKAkyBhbmQgc2luY2UgdGhlIElHUCBSRkNzIGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJp c2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgc3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5v dCBzaW1wbHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgdHJhbnNwb3J0IG1lY2hhbmlz bSkgeW91IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hh dCBjYW4gbWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGlu IHRoZSByZWZlcmVuY2VzLg0KDQpNeSBhcG9sb2dpZXMgZm9yIGp1bXBpbmcgaW4gaW4gdGhlIG1p ZGRsZSwgYnV0IElJVUMgdGhlIElHUCBSRkNzIGhhdmUNCmNvdmVyZWQgdGhlIHJpc2tzIGFzc29j aWF0ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAqdW5kZXINCnRoZSBh c3N1bXB0aW9uIHRoYXQgdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xl IEFTIGFuZA0KYWRtaW5pc3RyYXRpdmUgZG9tYWluKi4gIFlvYXYgaXMgcG9pbnRpbmcgb3V0IHRo YXQgdGhlIHJpc2tzIGZvciB0aGF0DQppbmZvcm1hdGlvbiBtYXkgY2hhbmdlIHdoZW4gdGhlIGRp c3RyaWJ1dGlvbiBpcyBvdmVyIGEgYnJvYWRlciBkb21haW4gdGhhbg0KdGhlIG9uZSBmb3Igd2hp Y2ggdGhlIHByZXZpb3VzIGFuYWx5c2lzIHdhcyBwZXJmb3JtZWQuDQoNCi1CZW4NCg== --_000_8a146dfd09814f8092a0ac10bd7d37d1XCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u RW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29y ZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0 aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+U3VlIOKAkzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB3 YXMgbm90IGFuIGF1dGhvciBvZiBSRkMgNzc1MiBhbmQgaGF2ZSBubyBpZGVhIHdoYXQgcHJvbWlz ZXMgdGhlIGF1dGhvcnMgbWlnaHQgaGF2ZSBtYWRlLiBJIHdpbGwgc2F5IHRoYXQgaXQgc2VlbXMg dmVyeSBsYXRlIGluIHRoZSBnYW1lIGZvciB5b3UgdG8gc3VnZ2VzdA0KIHRoYXQgdGhpcyBkb2N1 bWVudCBzaG91bGQgbm90IGJlIGFsbG93ZWQgdG8gcHJvZ3Jlc3MgYmVjYXVzZSBpdCZuYnNwOyBl eGNlZWRzIHNvbWUgYWdyZWVtZW50IG9uIHRoZSBzY29wZSBvZiBSRkMgNzc1Mi4gV2h5IHdlcmVu 4oCZdCB0aGVzZSBjb25jZXJucyBleHByZXNzZWQgbG9uZyBiZWZvcmU/PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB5b3UgZmVlbCB0aGF0IFJGQyA3NzUyIHNl Y3VyaXR5IG5lZWRzIHJldmlzaW9uIEkgd291bGQgYXBwcmVjaWF0ZSBpdCBpZiB5b3Ugc3RhdGUg c28gY2xlYXJseSAodG8gdGhlIFdHIOKAkyBub3QganVzdCB0byBtZSkgYW5kIGluIHRoZSByaWdo dCBjb250ZXh0LiBTdWNoIHdvcmsNCiBpcyBjbGVhcmx5IG5vdCBpbiB0aGUgc2NvcGUgb2YgZHJh ZnQtaWV0Zi1pZHItdGUtcG0tYmdwLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFN1c2FuIEhhcmVzICZsdDtzaGFy ZXNAbmR6aC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3RvYmVyIDE5LCAy MDE4IDg6MzMgQU08YnI+DQo8Yj5Ubzo8L2I+IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpICZsdDtn aW5zYmVyZ0BjaXNjby5jb20mZ3Q7OyAnUm9iZXJ0IFJhc3p1aycgJmx0O3JvYmVydEByYXN6dWsu bmV0Jmd0Ozsga2FkdWtAbWl0LmVkdTxicj4NCjxiPkNjOjwvYj4gaWRyQGlldGYub3JnOyBzZWNk aXJAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxA aWV0Zi5vcmc7IHluaXIuaWV0ZkBnbWFpbC5jb208YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtJ ZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkxlczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rIHlvdSBmb3IgcmVzcG9uZGluZyB0byBSb2JlcnTigJlz IHBvc3QuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PllvdXIgYXJndW1lbnQgdGhhdCB0aGlzIGluZm9ybWF0aW9uIHdvdWxkIGhhdmUgYWRkZWQgdG8g UkZDNzc1MiBpcyBvbiDigJx0aGluIGljZeKAnSBhcyB0aGUgSUVTRyBpbiB0aGVpciBhcHByb3Zh bCBvZiBSRkM3NzUyIHdhcyBjb25jZXJuZWQgYWJvdXQgdGhlIHNjb3BlIG9mIHRoZQ0KIGluZm9y bWF0aW9uLiZuYnNwOyZuYnNwOyBUaGUgZXh0ZW5zaW9uIG9mIHRoZSBzY29wZSBiZXlvbmQgaXRz IHN0YXRlZCBzY29wZSBtaWdodCBoYXZlIHRyaWdnZXIgdGhlIGN1cnJlbnQgZGlzY3Vzc2lvbnMg YXQgdGhhdCB0aW1lLiZuYnNwOyBUaGUgYXV0aG9ycyBpbmRpY2F0ZWQgdG8gdGhlIElEUiBjaGFp cnMgdGhlIFJGQzc3NTIgc2NvcGUgd291bGQgbm90IGdyb3cuICZuYnNwOyZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QXMgc2hlcGhlcmQgSSByZXF1ZXN0 ZWQgdGhpcyBkcmFmdCB0byBiZSByZXZpZXdlZCBieSB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUg YmVjYXVzZSB3ZSBhcmUgZ29pbmcgYmV5b25kIHRoZSBvcmlnaW5hbCBzY29wZSBvZiBSRkM3NzUy IHdpdGggdGhpcyBkcmFmdC4gJm5ic3A7QXMgU2hlcGhlcmQsDQogSSBkbyBub3QgYWdyZWUgd2l0 aCB5b3UgdGhhdCBzZWN1cml0eSBpc3N1ZXMgWW9hdiByYWlzZXMgYXJlIHNwZWNpZmllZCBpbiBS RkM3NzUyLiAmbmJzcDsmbmJzcDtJPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5Zb3UgYXJlIGNvcnJlY3QgdGhhdCB0aGVyZSBhcmUgbWFueSBkcmFmdHMgKGp1c3Qg QkdQLUxTIGV4dGVuc2lvbnMgYW5kIHNlZ21lbnQgcm91dGluZyBleHRlbnNpb25zIHRoYXQgdXNl IEJHUC1MUykuJm5ic3A7ICZuYnNwO1RoaXMgZHJhZnQgaXMganVzdCB0aGUgZmlyc3Qgb2YgYSB3 YXZlIG9mDQogZHJhZnRzLiAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtJdCBpcyBhcHBy b3ByaWF0ZSB0byBoYXZlIGEgc29sdXRpb24gZm9yIHRoZSBzZWN1cml0eSBpc3N1ZXMgdGhhdCBj b3ZlcnMgYWxsIHRoZSBkcmFmdHMgcmF0aGVyIHRoYW4gZ28gdGhyb3VnaCBkcmFmdHMgb25lIGF0 IGEgdGltZS4gSSBzdWdnZXN0IHRoYXQgYSByZXZpc2lvbiB0byBSRkM3NzUyIHRoYXQgYWRkcmVz c2VzIHRoZXNlIGlzc3VlcyBpcyBhcHByb3ByaWF0ZS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgeW91IGFyZSBpbnRlcmVzdGVkIGluIGRpc2N1c3MgdGhp cyB0b3BpYyB3aXRoIFlvYXYsIEJlbmphbWluLCBhbmQgdGhlIElEUiBXRyDigJMgc2hhbGwgd2Ug c3RhcnQgYSB0aHJlYWQgb24gdGhpcyB0b3BpYz8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+U3VzYW4gSGFyZXMNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1haWx0bzppZHItYm91bmNl c0BpZXRmLm9yZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFs ZiBPZiA8L2I+TGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5 LCBPY3RvYmVyIDE5LCAyMDE4IDEwOjUyIEFNPGJyPg0KPGI+VG86PC9iPiBSb2JlcnQgUmFzenVr OyA8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8 Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9yZzwvYT47 IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjsg PGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVm PSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnluaXIu aWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBnbWFpbC5jb208L2E+PGJyPg0KPGI+U3ViamVjdDo8 L2I+IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Sb2JlcnTigJlzIHBvc3QgYWRk cmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0byBtYWtlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+V2hhdCBpcyBiZWluZyBkb25lIGhlcmUgaXMgdG8gYWRkIGFk ZGl0aW9uYWwgQkdQLUxTIGNvZGVwb2ludHMgdG8gYWR2ZXJ0aXNlIElHUCBpbmZvcm1hdGlvbiB0 aGF0IHdhcyBub3QgZGVmaW5lZCBhdCB0aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbi4gV2Ug aGF2ZW7igJl0DQogY2hhbmdlZCB0aGUgJm5ic3A7QkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g 4oCTIG5vciBpcyB0aGUgaW5mb3JtYXRpb24gYmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChzb21lIGFk ZGl0aW9uYWwgVEUgcmVsYXRlZCBsaW5rIGF0dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVhbGl0YXRp dmVseSBkaWZmZXJlbnQgdGhhbiBhIG51bWJlciBvZiBleGlzdGluZyBUTFZzIGRlZmluZWQgaW4g UkZDIDc3NTIgKHNlZQ0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3 NTIjc2VjdGlvbi0zLjMuMiI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3NTIjc2Vj dGlvbi0zLjMuMjwvYT4gKS4gSWYgdGhpcyBpbmZvcm1hdGlvbiBoYWQgYWxyZWFkeSBiZWVuIGRl ZmluZWQgaW4gdGhlIElHUHMgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2FzIHdyaXR0ZW4gaXQgd291 bGQgc2ltcGx5IGhhdmUgYmVlbiBpbmNsdWRlZCBhcyBhIHNlY3Rpb24gb2YNCiBSRkMgNzc1MiBh bmQgbm8gYWRkaXRpb25hbCBjaGFuZ2VzIHRvIFJGQyA3NzUyIHdvdWxkIGhhdmUgYmVlbiByZXF1 aXJlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkluIHRoZW9y eSwgd2UgY291bGQgaGF2ZSBzaW1wbHkgdXBkYXRlZCBSRkMgNzc1MiByYXRoZXIgd3JpdGluZyBh IHNlcGFyYXRlIGRyYWZ0LCBidXQgcHJhY3RpY2FsbHkgdGhpcyB3b3VsZCBiZSBhIHBvb3Igc3Ry YXRlZ3kgYXMgaXQgd291bGQgaW5jb3JyZWN0bHkgc3VnZ2VzdA0KIHRoYXQgc29tZSBjaGFuZ2Ug d2FzIGJlaW5nIG1hZGUgdG8gdGhlIGV4aXN0aW5nIHRleHQgaW4gUkZDIDc3NTIuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIGFwcHJlY2lhdGUgdGhhdCBmcm9t IHRoZSBQT1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91IGZvbGtzIGFyZSBub3QgYXMgaW50aW1h dGVseSBmYW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRyYWZ0cyBhbmQgdGhlIHJlbGF0aW9uc2hp cCBiZXR3ZWVuIHRoZW0uIEl0IGlzDQogdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRoYXQgeW91 IHN0YXJ0IGxvb2tpbmcgYXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9jdW1lbnQg 4oCTIGFuZCBpbiB0aGF0IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVseSBjb3Jy ZWN0LiBCdXQgdGhlIGRvY3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNjdXJhdGVs eSBzZWVuIGFzIGFuIOKAnGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLiBUaGUgaXNzdWVzIHlvdSBy YWlzZQ0KIGhhdmUgYWxyZWFkeSBiZWVuIGFkZHJlc3NlZCBpbiBSRkMgNzc1MiBhbmQgaXQgaXMg dGhlcmVmb3JlIHZlcnkgYXBwcm9wcmlhdGUgdGhhdCB3ZSBhZGRyZXNzIHlvdXIgY29uY2VybnMg YnkgaW5jbHVkaW5nIGEgcmVmZXJlbmNlIHRvIHRoZSBSRkMgNzc1MiBzZWN1cml0eSBkaXNjdXNz aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB0aGluayBp dCBpcyBpbXBvcnRhbnQgdGhhdCB5b3Ugbm90ZSB0aGlzIHJlbGF0aW9uc2hpcCwgYmVjYXVzZSB0 aGUgbmF0dXJlIG9mIEJHUC1MUyBpcyB0aGF0IHdoZW5ldmVyIElHUCBleHRlbnNpb25zIGFyZSBk ZWZpbmVkIHRvIGFkdmVydGlzZSBuZXcgaW5mb3JtYXRpb24NCiBpdCBpcyBuZWNlc3NhcnkgdG8g ZGVmaW5lIGNvcnJlc3BvbmRpbmcgQkdQLUxTIGNvZGVwb2ludHMuIFRoaXMgaXMgbm90IHRoZSBm aXJzdCBzdWNoIEJHUC1MUyBleHRlbnNpb24gZG9jdW1lbnQg4oCTIGFuZCBpdCBpcyBzYWZlIHRv IHNheSBpdCB3b27igJl0IGJlIHRoZSBsYXN0LiBJdCB3b3VsZCBiZSBoZWxwZnVsIHRvIGFsbCBp ZiB3ZSByZWFjaGVkIGEgY29tbW9uIHVuZGVyc3RhbmRpbmcgb3IgdGhpcyBkaXNjdXNzaW9uIHdp bGwgdGFrZSBwbGFjZQ0KIGV2ZXJ5IHRpbWUgYSBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IGlz IGJlaW5nIHJldmlld2VkIOKAkyB3aGljaCB3aWxsIGNvc3QgdXMgYWxsIHRpbWUgbmVlZGxlc3Ns eS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNw OyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRp bmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gUm9iZXJ0IFJhc3p1ayAm bHQ7PGEgaHJlZj0ibWFpbHRvOnJvYmVydEByYXN6dWsubmV0Ij5yb2JlcnRAcmFzenVrLm5ldDwv YT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXksIE9jdG9iZXIgMTgsIDIwMTggMTE6 NTIgUE08YnI+DQo8Yj5Ubzo8L2I+IDxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1 a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0 OzxhIGhyZWY9Im1haWx0bzpnaW5zYmVyZ0BjaXNjby5jb20iPmdpbnNiZXJnQGNpc2NvLmNvbTwv YT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmlkckBpZXRmLm9yZyI+aWRyQGlldGYub3JnPC9hPjsg PGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmciPg0K ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0 bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzp5bmly LmlldGZAZ21haWwuY29tIj55bmlyLmlldGZAZ21haWwuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRv OnNlY2RpckBpZXRmLm9yZyI+DQpzZWNkaXJAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8 L2I+IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlbGxvIEJlbmphbWluLDxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm90IHN1cmUgaWYgeW91IGhhdmUgc3Bv dHRlZCBzaW1pbGFyIGNvbW1lbnQgbWFkZSB0byBJRFIgcmVnYXJkaW5nIHRoaXMgdG9waWMsIGJ1 dCB5b3VyIGNvbW1lbnQgc2VlbXMgdG8gaW5kaWNhdGUgdGhhdCBoZXJlIHdlIGFyZSBhYm91dCB0 byBkZWZpbmUgd2F5cyB0byBjYXJyeSBuaWNlbHkgc2NvcGVkIElHUCBpbmZvcm1hdGlvbiBpbnRv IEJHUC4gV2VsbCB0aGF0IGhhcyBhbHJlYWR5IGhhcHBlbmVkIHdpdGgNCiBSRkM3NzUyIGFuZCB5 b3VyIGNvbW1lbnQgb3IgZm9yIHRoYXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBpbmRlZWQg c3BvdCBvbiBidXQgdG8gdGhlIHNlY3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBhbmQgSU1P IG5vdCBhbnkgZm9sbG93IHVwIGV4dGVuc2lvbnMgb2YgaXQuJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1cmUgLSBhcyBvYnNlcnZl ZCBieSBTdWUgLSBvbmUgbWF5IGFyZ3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3JtYXRpb24g YWJvdXQgdGhlIG5ldHdvcmsgdG8gdGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0aGUgbmV0 d29yayB3ZWFrZXIsIGJ1dCB0aGUgY3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRoZSBsZWFr cyBhbmQgcmVkdWNlIHByb2JhYmlsaXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3JtYXRpb24N CiBieSB1bmF1dGhvcml6ZWQgcGFydGllcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QkdQLUxTIGlzIGFscmVhZHkgZGVmaW5lZCBp biBhIG5ldyBTQUZJIHdoYXQgYnkgaXRzZWxmIGRvZXMgcHJvdmlkZSBuaWNlIGxldmVsIG9mIGlz b2xhdGlvbi4gUkZDNzc1MiBpcyBwcmV0dHkgY2xlYXIgb24gdGhhdCB0b28gYW5kIHNheXM6Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZxdW90O0JHUCBwZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQgcmVxdWlyZSBjb25maWd1 cmF0aW9uOyB0aHVzLCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdvcmsgb3Bl cmF0b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29uZmlndXJl ZCB0byByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uJnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHNvbWVvbmUgd291bGQgYmUgc3Rp bGwgY29uY2VybmVkIGFib3V0IGNvbmZpZ3VyYXRpb24gbWlzdGFrZXMgYW5kIG5lZ290aWF0aW5n IFNBRkkgNzEgb3IgNzIgdG8gdGhvc2Ugd2hvIHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0YSBJIHJl Y29tbWVuZCB3ZSByZWlzc3VlIHRoZSBSRkM3NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQgcmVzdHJp Y3QgdGhlIHNjb3BlIG9mIHRoZSBkaXN0cmlidXRpb24gZXZlbiBmdXJ0aGVyDQogYnkgbWFuZGF0 aW5nIGRlZmF1bHQgdXNlIG9mIE5PLUVYUE9SVCBjb21tdW5pdHkgd2l0aCBhYmlsaXR5IHRvIG92 ZXJ3cml0ZSBpdCBmb3IgdGhlIHNlbGVjdGl2ZSBlQkdQIHBlZXJzLiBPciBwZXJoYXBzIHdlIGNv dWxkIHByb2dyZXNzIEppbSdzIE9uZSBBZG1pbmlzdHJhdGl2ZSBEb21haW4gZHJhZnQgKGRyYWZ0 LXV0dGFyby1pZHItb2FkLTAxKS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gZWl0aGVyIGNhc2Ugd2hpbGUgYm90aCBvZiB5b3Vy IGNvbW1lbnRzIGFyZSBncmVhdCB0aGV5IHNlZW1zIGEgYml0IGxhdGUgaW4gdGhlIGdhbWUgaGVy ZSBvciBhdCBsZWFzdCB0YXJnZXRpbmcgd3JvbmcgZG9jdW1lbnQuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPktpbmQgcmVnYXJkcyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJvYmVy dC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJp LCBPY3QgMTksIDIwMTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayAmbHQ7PGEgaHJlZj0ibWFp bHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVm dDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUaHUsIE9jdCAxOCwgMjAxOCBhdCAwNjow MDoxM1BNICYjNDM7MDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6PGJyPg0KJmd0 OyBZb2F2IOKAkzxicj4NCiZndDsgPGJyPg0KJmd0OyBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBh c3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0aW9uIGNvdmVy ZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1AgZHJhZnRzOjxi cj4NCiZndDsgPGJyPg0KJmd0OyBGcm9tIFJGQzc4MTA8YnI+DQomZ3Q7IDxicj4NCiZndDsg4oCc VGhlIHN1Yi1UTFZzIGludHJvZHVjZWQgaW4gdGhpcyBkb2N1bWVudCBhbGxvdyBhbiBvcGVyYXRv ciB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBv ZiBsaW5rcyAoYmFuZHdpZHRoLCBkZWxheSkgdGhhdCBjb3VsZCBiZTxicj4NCiZndDsmbmJzcDsg Jm5ic3A7IHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90IHdhbnQgdG8gZGlz Y2xvc2Uu4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFz c29jaWF0ZWQgd2l0aCBzZW5kaW5nIGluZm9ybWF0aW9uIHZpYSBCR1AtTFMgd2UgaGF2ZSBhIG51 bWJlciBvZiBzdGF0ZW1lbnRzIGluIFJGQyA3NzUyIOKAkyBtb3N0IHJlbGV2YW50IGlzOjxicj4N CiZndDsgPGJyPg0KJmd0OyDigJxBZGRpdGlvbmFsbHksIGl0IG1heSBiZSBjb25zaWRlcmVkIHRo YXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZDxicj4NCiZndDsmbmJzcDsgJm5ic3A7IFRF IGluZm9ybWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVzIGEg cmlzayB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGNvbmZpZGVudGlhbGl0eSBvZiBtaXNzaW9u LWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNw OyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yay7igJ08YnI+DQomZ3Q7IDxicj4NCiZndDsg U28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJR1AgUkZDcyBhbmQg UkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVyc3RhbmQgd2hhdCBl bHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuPGJyPg0KJmd0OyBDZXJ0YWlubHkgdGhlIHJpc2tz IGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20gYXJlIG5vdCBh bHRlcmVkIGJ5IGFkZGluZyBzb21lIG5ldyBUTFZzIOKAkyBhbmQgc2luY2UgdGhlIElHUCBSRkNz IGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgc3BlY2lmaWMg Y2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5vdCBzaW1wbHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0 aCB0aGUgdHJhbnNwb3J0DQogbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRvIGhhdmUgdG8gcHJv dmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkgYmUgc2FpZCB0aGF0 IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuPGJyPg0KPGJyPg0KTXkg YXBvbG9naWVzIGZvciBqdW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVDIHRoZSBJR1Ag UkZDcyBoYXZlPGJyPg0KY292ZXJlZCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGEgc3BlY2lm aWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24sICp1bmRlcjxicj4NCnRoZSBhc3N1bXB0aW9uIHRoYXQg dGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xlIEFTIGFuZDxicj4NCmFk bWluaXN0cmF0aXZlIGRvbWFpbiouJm5ic3A7IFlvYXYgaXMgcG9pbnRpbmcgb3V0IHRoYXQgdGhl IHJpc2tzIGZvciB0aGF0PGJyPg0KaW5mb3JtYXRpb24gbWF5IGNoYW5nZSB3aGVuIHRoZSBkaXN0 cmlidXRpb24gaXMgb3ZlciBhIGJyb2FkZXIgZG9tYWluIHRoYW48YnI+DQp0aGUgb25lIGZvciB3 aGljaCB0aGUgcHJldmlvdXMgYW5hbHlzaXMgd2FzIHBlcmZvcm1lZC48YnI+DQo8YnI+DQotQmVu PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_8a146dfd09814f8092a0ac10bd7d37d1XCHALN001ciscocom_-- From nobody Fri Oct 19 08:58:07 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39597130FBB for ; Fri, 19 Oct 2018 08:57:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LO5--i6u9rnw for ; Fri, 19 Oct 2018 08:57:49 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47508131000 for ; Fri, 19 Oct 2018 08:57:39 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id q41-v6so38806953qtq.10 for ; Fri, 19 Oct 2018 08:57:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wD2K8eqAMnxf6FzRhiM2a3yH+ae0KbOY7Jvk2KV1RsU=; b=FFP00onP+UQW7iiBiUnnzItqytFlC8EQQSIsP1Cqvyj+5prEnP8ZQOArkQYhm18Nnq gnnsr90dUE1cfVy3/UCNjxm9ACsMEq8SK98VMT0bV6QrHENzHLwemwCeTE7GJTG+xaZT vYbgYocVriemyUiaoK8PzCwWjksYknerVEGtOUZXXyATtoIzCoUqAc7et/Xs8zXTwjpU Z1CzfOyt6i1MSAvQ4OUMF0v7k1y+DOXayn1/ZyE8EP71Qx0RL5lbyjtBb1cqvlhIJy1u Ib5e6UrLilp5/UtH2NtFq6KmtA1HLw5ZPxPRwy/KyHQ3yGRhVgui2ySW6tj0z/m5y9pO CRYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wD2K8eqAMnxf6FzRhiM2a3yH+ae0KbOY7Jvk2KV1RsU=; b=RLwwjQnZ8bSRWT1/zPujOeIMkvkKqDLc2V2KZVfgOkb/yV1lE3d61lENlhktS+J6E3 LyNCnBEjG0kKC4VoLv6pMs5DPi2FxpkNne2CxSFQj5JXkXkkzsKkT5lZONzBJ8wG4zkZ 4bwkrjvV6Vj9+F0Lp3Rx4pCAkDg84JCffqJoZ6OOYw8baXkwMvtuKx7X4OMUGn0d+Ztc emIEDIqDpOtHMMtKRp/cSylWsAV5Y13QVkxFinJZniH7BBFpX7Hz8iQ+DqTBCRGKtNOX z5pOXqJBawZXP4S+mZyCGtmNQaqh76tp5hP6uNFKejzPehG4rXgR8KfighpAAvucIYFG tzOA== X-Gm-Message-State: ABuFfog1RAJcHGwzBXCpqCxewnOkDO+meigA8wQlq4nPVek/MlNAOqsY RnlJ3JPTgjQO7tZqQRLjbRX4fgNhNnMzX4614RXDkg== X-Google-Smtp-Source: ACcGV61cCTU1oqz3ZZpG8YkUqzmifu8LKiKuhCfXfzP/yzSC8Gn0TbFM6aNyaA6yCHef9X4xN8VVdon5mRHCu2Vc18Y= X-Received: by 2002:ac8:7153:: with SMTP id h19-v6mr34513556qtp.361.1539964658276; Fri, 19 Oct 2018 08:57:38 -0700 (PDT) MIME-Version: 1.0 References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> In-Reply-To: <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> From: Robert Raszuk Date: Fri, 19 Oct 2018 17:57:22 +0200 Message-ID: To: shares@ndzh.com Cc: "Les Ginsberg (ginsberg)" , kaduk@mit.edu, idr@ietf.org, secdir@ietf.org, ietf@ietf.org, Yoav Nir Content-Type: multipart/alternative; boundary="0000000000006c7c70057896f691" Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 15:58:02 -0000 --0000000000006c7c70057896f691 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Sue, RFC7752 title is: North-Bound Distribution of Link-State and Traffic Engineering (TE) Information Using BGP + section 1: 1 . Introduction The contents of a Link-State Database (LSDB) or of an IGP's Traffic Engineering Database (TED) describe only the links and nodes within an IGP area. So assuming that RFC7752 was read with some level of understading on what LSDB or TED mean there should be no surprise and also no content today that as LSDB or TED are continue to be extended in their respected WGs you will see new extensions of information to be added to RFC7752 vehicle in the forms of new TLV. Of course we would not have any of this discussions or need for new drafts if RFC7752 would simply zip and carry those two databases in binary chunks. Well for some reason authors decided to involve BGP in that process of carried data validation - but this alone should also be well understood by approvers of RFC7752. Kind regards, R. On Fri, Oct 19, 2018 at 5:32 PM Susan Hares wrote: > Les: > > > > Thank you for responding to Robert=E2=80=99s post. > > > > Your argument that this information would have added to RFC7752 is on > =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was c= oncerned about the > scope of the information. The extension of the scope beyond its stated > scope might have trigger the current discussions at that time. The autho= rs > indicated to the IDR chairs the RFC7752 scope would not grow. > > > > As shepherd I requested this draft to be reviewed by the security > directorate because we are going beyond the original scope of RFC7752 wit= h > this draft. As Shepherd, I do not agree with you that security issues Yo= av > raises are specified in RFC7752. I > > > > You are correct that there are many drafts (just BGP-LS extensions and > segment routing extensions that use BGP-LS). This draft is just the fir= st > of a wave of drafts. It is appropriate to have a solution for the > security issues that covers all the drafts rather than go through drafts > one at a time. I suggest that a revision to RFC7752 that addresses these > issues is appropriate. > > > > If you are interested in discuss this topic with Yoav, Benjamin, and the > IDR WG =E2=80=93 shall we start a thread on this topic? > > > > Susan Hares > > > > > > > > > > > > > > > > > > *From:* Idr [mailto:idr-bounces@ietf.org] *On Behalf Of *Les Ginsberg > (ginsberg) > *Sent:* Friday, October 19, 2018 10:52 AM > *To:* Robert Raszuk; kaduk@mit.edu > *Cc:* idr@ietf.org; secdir@ietf.org; ietf@ietf.org; > draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com > *Subject:* Re: [Idr] [secdir] Secdir early review of > draft-ietf-idr-te-pm-bgp-13 > > > > Robert=E2=80=99s post addresses points I also want to make. > > > > What is being done here is to add additional BGP-LS codepoints to > advertise IGP information that was not defined at the time RFC 7752 was > written. We haven=E2=80=99t changed the BGP-LS transport mechanism =E2= =80=93 nor is the > information being advertised here (some additional TE related link > attribute information) qualitatively different than a number of existing > TLVs defined in RFC 7752 (see > https://tools.ietf.org/html/rfc7752#section-3.3.2 ). If this information > had already been defined in the IGPs at the time RFC 7752 was written it > would simply have been included as a section of RFC 7752 and no additiona= l > changes to RFC 7752 would have been required. > > > > In theory, we could have simply updated RFC 7752 rather writing a separat= e > draft, but practically this would be a poor strategy as it would > incorrectly suggest that some change was being made to the existing text = in > RFC 7752. > > > > I appreciate that from the POV of the Security Area you folks are not as > intimately familiar with the routing drafts and the relationship between > them. It is therefore understandable that you start looking at the new > draft as a standalone document =E2=80=93 and in that context your comment= s are > absolutely correct. But the document you are reviewing is most accurately > seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. The issues you raise h= ave already been > addressed in RFC 7752 and it is therefore very appropriate that we addres= s > your concerns by including a reference to the RFC 7752 security discussio= n. > > > > I think it is important that you note this relationship, because the > nature of BGP-LS is that whenever IGP extensions are defined to advertise > new information it is necessary to define corresponding BGP-LS codepoints= . > This is not the first such BGP-LS extension document =E2=80=93 and it is = safe to > say it won=E2=80=99t be the last. It would be helpful to all if we reache= d a common > understanding or this discussion will take place every time a BGP-LS > extension document is being reviewed =E2=80=93 which will cost us all tim= e > needlessly. > > > > Les > > > > > > *From:* Robert Raszuk > *Sent:* Thursday, October 18, 2018 11:52 PM > *To:* kaduk@mit.edu > *Cc:* Les Ginsberg (ginsberg) ; idr@ietf.org; > draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com= ; > secdir@ietf.org > *Subject:* Re: [Idr] [secdir] Secdir early review of > draft-ietf-idr-te-pm-bgp-13 > > > > Hello Benjamin, > > > > Not sure if you have spotted similar comment made to IDR regarding this > topic, but your comment seems to indicate that here we are about to defin= e > ways to carry nicely scoped IGP information into BGP. Well that has alrea= dy > happened with RFC7752 and your comment or for that matter Yoav's remarks > are indeed spot on but to the security discussion on RFC7752 and IMO not > any follow up extensions of it. > > > > Sure - as observed by Sue - one may argue that providing more information > about the network to the potential attacker makes the network weaker, but > the cure for that is to prevent the leaks and reduce probability of > intercepting new information by unauthorized parties. > > > > BGP-LS is already defined in a new SAFI what by itself does provide nice > level of isolation. RFC7752 is pretty clear on that too and says: > > > > "BGP peerings are not automatic and require configuration; thus, it is th= e > responsibility of the network operator to ensure that only trusted > consumers are configured to receive such information." > > > > If someone would be still concerned about configuration mistakes and > negotiating SAFI 71 or 72 to those who should not get this data I recomme= nd > we reissue the RFC7752 as -bis version and restrict the scope of the > distribution even further by mandating default use of NO-EXPORT community > with ability to overwrite it for the selective eBGP peers. Or perhaps we > could progress Jim's One Administrative Domain draft > (draft-uttaro-idr-oad-01). > > > > In either case while both of your comments are great they seems a bit lat= e > in the game here or at least targeting wrong document. > > > > Kind regards, > > Robert. > > > > > > On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: > > On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > > Yoav =E2=80=93 > > > > In regards to the risks associated with advertising the specific > information covered in this draft we have a statement in the IGP drafts: > > > > From RFC7810 > > > > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > > advertise state information of links (bandwidth, delay) that could b= e > > sensitive and that an operator may not want to disclose.=E2=80=9D > > > > In regards to the risks associated with sending information via BGP-LS > we have a number of statements in RFC 7752 =E2=80=93 most relevant is: > > > > =E2=80=9CAdditionally, it may be considered that the export of link-sta= te and > > TE information as described in this document constitutes a risk to > > confidentiality of mission-critical or commercially sensitive > > information about the network.=E2=80=9D > > > > So long as there are references to both the IGP RFCs and RFC 7752 I am > therefore hard pressed to understand what else could be usefully said. > > Certainly the risks associated with the BGP-LS transport mechanism are > not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs have= already > covered risks associated with the specific class of information (not simp= ly > the risks associated with the transport mechanism) you are going to have = to > provide more specifics on what can meaningfully be said that is not alrea= dy > covered in the references. > > My apologies for jumping in in the middle, but IIUC the IGP RFCs have > covered the risks associated with a specific class of information, *under > the assumption that the transport mechanism is within a single AS and > administrative domain*. Yoav is pointing out that the risks for that > information may change when the distribution is over a broader domain tha= n > the one for which the previous analysis was performed. > > -Ben > > --0000000000006c7c70057896f691 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Sue,

RFC7752 title = is: North-Bound Distribution of Link-State and Traffic Engineering (TE) Inf= ormation Using BGP

+ section 1:

= 
1=
.  Introduction


   The contents of a Link-State Database (LSDB) or of an IGP's Traffic
   Engineering Database (TED) describe only the links and nodes within
   an IGP area.

So assuming that RFC7752 w=
as read with some level of understading on what LSDB or TED mean there shou=
ld be no surprise and also no content today that as LSDB or TED are continu=
e to be extended in their respected WGs you will see new extensions of info=
rmation to be added to RFC7752 vehicle in the forms of new TLV.=C2=A0

Of course we would not have=
 any of this discussions or need for new drafts if RFC7752 would simply zip=
 and carry those two databases in binary chunks. Well for some reason autho=
rs decided to involve BGP in that process of carried data validation - but =
this alone should also be well understood by approvers of RFC7752.=C2=A0

Kind regards,=C2=A0R.


<= pre class=3D"gmail-newpage" style=3D"font-size:13.3333px;margin-top:0px;mar= gin-bottom:0px;break-before:page;color:rgb(0,0,0)">


=
On Fri, Oct 19, 2018 at 5:32 PM= Susan Hares <shares@ndzh.com>= wrote:

Les:

=C2=A0

Thank you for resp= onding to Robert=E2=80=99s post.=C2=A0

=C2=A0

Your argument that this inform= ation would have added to RFC7752 is on =E2=80=9Cthin ice=E2=80=9D as the I= ESG in their approval of RFC7752 was concerned about the scope of the infor= mation.=C2=A0=C2=A0 The extension of the scope beyond its stated scope migh= t have trigger the current discussions at that time.=C2=A0 The authors indi= cated to the IDR chairs the RFC7752 scope would not grow. =C2=A0=C2=A0

=C2=A0

As shepherd I requested this draft to be reviewed by the security director= ate because we are going beyond the original scope of RFC7752 with this dra= ft.=C2=A0 As Shepherd, I do not agree with you that security issues Yoav ra= ises are specified in RFC7752. =C2=A0=C2=A0I

=C2=A0

=

You are correct that ther= e are many drafts (just BGP-LS extensions and segment routing extensions th= at use BGP-LS).=C2=A0 =C2=A0This draft is just the first of a wave of draft= s. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0It is appropriate to have a solution for t= he security issues that covers all the drafts rather than go through drafts= one at a time. I suggest that a revision to RFC7752 that addresses these i= ssues is appropriate.

=C2=A0

If you are interested in discuss this topic wit= h Yoav, Benjamin, and the IDR WG =E2=80=93 shall we start a thread on this = topic?

=C2=A0

Susan Hares

=C2=A0

=C2=A0

=C2=A0=C2=A0

=

=C2=A0

=C2=A0

=C2=A0=

= =C2=A0

<= u>=C2=A0

From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, October 19, 2018 10:52 AM=
To: Robert Raszuk; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.comSubject: Re: [Idr] [secdir] Secdir early review of draft-ietf-idr-= te-pm-bgp-13

= =C2=A0

Robe= rt=E2=80=99s post addresses points I also want to make.

=C2=A0=

What is being = done here is to add additional BGP-LS codepoints to advertise IGP informati= on that was not defined at the time RFC 7752 was written. We haven=E2=80=99= t changed the =C2=A0BGP-LS transport mechanism =E2=80=93 nor is the informa= tion being advertised here (some additional TE related link attribute infor= mation) qualitatively different than a number of existing TLVs defined in R= FC 7752 (see https://tools.ietf.org/html/rfc7752#section-3.3.2 ). = If this information had already been defined in the IGPs at the time RFC 77= 52 was written it would simply have been included as a section of RFC 7752 = and no additional changes to RFC 7752 would have been required.

=C2= =A0

In t= heory, we could have simply updated RFC 7752 rather writing a separate draf= t, but practically this would be a poor strategy as it would incorrectly su= ggest that some change was being made to the existing text in RFC 7752.<= /u>

<= /u>=C2=A0

=C2=A0

I think it is important that you note this relationship, = because the nature of BGP-LS is that whenever IGP extensions are defined to= advertise new information it is necessary to define corresponding BGP-LS c= odepoints. This is not the first such BGP-LS extension document =E2=80=93 a= nd it is safe to say it won=E2=80=99t be the last. It would be helpful to a= ll if we reached a common understanding or this discussion will take place = every time a BGP-LS extension document is being reviewed =E2=80=93 which wi= ll cost us all time needlessly.

=C2=A0

=C2=A0=C2=A0 Les<= /p>

=C2=A0

=C2=A0=

From: Robert Raszuk <robert@raszuk.net>
Sent: Th= ursday, October 18, 2018 11:52 PM
To: kaduk@mit.edu
Cc: Les Ginsberg (ginsb= erg) <ginsberg@c= isco.com>; idr@iet= f.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: R= e: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13=

=C2=A0

Hello Benjamin,

=C2=A0

Not sure if you have spotted similar comment made to IDR regarding= this topic, but your comment seems to indicate that here we are about to d= efine ways to carry nicely scoped IGP information into BGP. Well that has a= lready happened with RFC7752 and your comment or for that matter Yoav's= remarks are indeed spot on but to the security discussion on RFC7752 and I= MO not any follow up extensions of it.=C2=A0

=C2=A0

Sure - as observed by Sue - one may argue that providing more informati= on about the network to the potential attacker makes the network weaker, bu= t the cure for that is to prevent the leaks and reduce probability of inter= cepting new information by unauthorized parties.=C2=A0

=C2=A0

BGP-LS is already defined in a new SAFI what by itself does = provide nice level of isolation. RFC7752 is pretty clear on that too and sa= ys:=C2=A0

=C2=A0<= u>

"BGP peerings are not auto= matic and require configuration; thus, it is the responsibility of the netw= ork operator to ensure that only trusted consumers are configured to receiv= e such information."

=C2=A0

If someone woul= d be still concerned about configuration mistakes and negotiating SAFI 71 o= r 72 to those who should not get this data I recommend we reissue the RFC77= 52 as -bis version and restrict the scope of the distribution even further = by mandating default use of NO-EXPORT community with ability to overwrite i= t for the selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft (draft-uttaro-idr-oad-01).=C2=A0<= /p>

=C2=A0

In either case while both of your comments are great th= ey seems a bit late in the game here or at least targeting wrong document.= =C2=A0

=C2=A0<= /u>

Kind regards,

Robert.

=C2=A0

= =C2=A0

On Fri, Oct 19, 2018 at 2= :27 AM Benjamin Kaduk <kaduk@mit.edu> wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (gin= sberg) wrote:
> Yoav =E2=80=93
>
> In regards to the ris= ks associated with advertising the specific information covered in this dra= ft we have a statement in the IGP drafts:
>
> From RFC7810
= >
> =E2=80=9CThe sub-TLVs introduced in this document allow an op= erator to
>=C2=A0 =C2=A0 advertise state information of links (bandwi= dth, delay) that could be
>=C2=A0 =C2=A0 sensitive and that an operat= or may not want to disclose.=E2=80=9D
>
> In regards to the ri= sks associated with sending information via BGP-LS we have a number of stat= ements in RFC 7752 =E2=80=93 most relevant is:
>
> =E2=80=9CAd= ditionally, it may be considered that the export of link-state and
>= =C2=A0 =C2=A0 TE information as described in this document constitutes a ri= sk to
>=C2=A0 =C2=A0 confidentiality of mission-critical or commercia= lly sensitive
>=C2=A0 =C2=A0 information about the network.=E2=80=9D<= br>>
> So long as there are references to both the IGP RFCs and R= FC 7752 I am therefore hard pressed to understand what else could be useful= ly said.
> Certainly the risks associated with the BGP-LS transport m= echanism are not altered by adding some new TLVs =E2=80=93 and since the IG= P RFCs have already covered risks associated with the specific class of inf= ormation (not simply the risks associated with the transport mechanism) you= are going to have to provide more specifics on what can meaningfully be sa= id that is not already covered in the references.

My apologies for j= umping in in the middle, but IIUC the IGP RFCs have
covered the risks as= sociated with a specific class of information, *under
the assumption tha= t the transport mechanism is within a single AS and
administrative domai= n*.=C2=A0 Yoav is pointing out that the risks for that
information may c= hange when the distribution is over a broader domain than
the one for wh= ich the previous analysis was performed.

-Ben

--0000000000006c7c70057896f691-- From nobody Fri Oct 19 09:27:06 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16AFD130F72; Fri, 19 Oct 2018 09:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.225 X-Spam-Level: * X-Spam-Status: No, score=1.225 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, KHOP_DYNAMIC=1.999, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id actwLDJNgmjf; Fri, 19 Oct 2018 09:26:55 -0700 (PDT) Received: from mx0a-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF6C4130E81; Fri, 19 Oct 2018 09:26:55 -0700 (PDT) Received: from pps.filterd (m0108156.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9JGO3Ig020911; Fri, 19 Oct 2018 09:26:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=dS5VItIg30RrCmQQp8jPu2d08qUNWhNfcKvSLsFslY0=; b=AQSIeKYmVd9yS0pCgPqpwMzc01se27/s/nhpyIXaD5VFLbsw17iwgjEKT6OILRVRwtR7 jVLG7LcyP+xuMzSsOypK9GcNfWgQlVjqtaeE46gzKMqiUWrJuTxwOk9aMun3oGr3L1Hw wDcSg7OloGhU0BVFg8NmM0i7rMBv1v/1lPgXEzTUfxw1JCc1oBgVBuvTmrU/u4PunvzM voRPKKz3tp7xMhoePne6X1xPxIEW6zBTS1fexyWpYZwaX1g+fBFgFM1FixokZO10veob QbHkefpYF+GL8YGUHthtLRv7pjBOgK4T3+Bx1gS2k81PhyaoXlrdJkuYMgmcgsgIUGuP HA== Received: from nam02-sn1-obe.outbound.protection.outlook.com (mail-sn1nam02lp0020.outbound.protection.outlook.com [216.32.180.20]) by mx0a-00273201.pphosted.com with ESMTP id 2n7cccgkyc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 19 Oct 2018 09:26:52 -0700 Received: from BN7PR05MB4354.namprd05.prod.outlook.com (52.133.223.33) by BN7PR05MB4004.namprd05.prod.outlook.com (52.132.218.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.15; Fri, 19 Oct 2018 16:26:48 +0000 Received: from BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012]) by BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012%4]) with mapi id 15.20.1250.028; Fri, 19 Oct 2018 16:26:48 +0000 From: John E Drake To: "Les Ginsberg (ginsberg)" , Susan Hares , 'Robert Raszuk' , "kaduk@mit.edu" CC: "ynir.ietf@gmail.com" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZwyQN9RQyXdy5EeaDRo0vfHjgKUltrcAgABrlwCAAIYPgIAAC38AgAAGv4CAAAVBAA== Date: Fri, 19 Oct 2018 16:26:47 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> In-Reply-To: <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN7PR05MB4004; 6:NpqTp5qnpEC29Eig4F8Ww289BVA7Pc4RzA2Jv0c1F6If7AdpI494ebuoaJPrIcGcV9TKuSgf2GkotKYxbLyS+WrzlDet6gjtcmXFjYxKBR78isYOE1PpRczSfzHeVqX0SbhHsaDChh1EUSChyTqJ+WqtwhEK5HSjdvyfFKdWl1KuXGZkxwplN5eCkIjrF1DYa5eDIXNfVwHLrLN+nog+ZqGaRDmryny3MWU7KecJaVOv4G3xf+hfA20uAvnzvoA5EKzLTWKUAObwttC4Zs6Faic7UICOq9YjrOwfAbALFMa9joJDKuubFDWhmnnITVhxVlzjNw2i8Z1R6uXKLtEyaywjsjIg8UICh21bxL1f8DDF88kAYTmIsYzDpAtwYzIAK34nGvEQiYF4Fbnoo14lsoxLL963w9YG0I7A/taWRvOi8U6ERxRNgzxBcNIONxpRuTOBS6AgDT4rv/6DTwg5Eg==; 5:hkg0Zf5VdEaQQDcXkfAq1R9hOh2f/jOocAJG6rbxjHt/76l2T+IgPUiiF06ztQs64UD6yWO+Do6IU+qeMe0as9Wy9YecbTeQVv1+kEN+XmYEWaCdP0NE6Lji84Qjjs28tya7sQqGqnBq2Su7VHWB88AdR71zbxie6vIx2eByhNo=; 7:qQ9UYycwnhGHLuFe4Bhjxi6dwZS2nqNFiGU1Kk7rNEbdmELpKq26DLvjhS2/hxhXHP9mljiBNeH39hvwNt6Nr6/yPoDWHkGapOmO2D0ozyahoOHiHYev4XEGBwqCIIEzFjxx1cpSbP5nizegdjKbcCK0t2UcH51bZpnGrmYxqfFyUIGJ1svNhtlW++pax9YVge4VeTumQuZSi7xYaOkbyI1YmyP7jYjySsXX0A5WpII7Dt8OGqmwnmstGo9jbLKp x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: ee49f676-01b8-415b-512a-08d635dfaaf2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(5600074)(711020)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:BN7PR05MB4004; x-ms-traffictypediagnostic: BN7PR05MB4004: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(240460790083961)(85827821059158)(95692535739014)(269456686620040)(21748063052155)(28532068793085)(190501279198761)(227612066756510)(10436049006162); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(3231355)(944501410)(52105095)(93006095)(93001095)(10201501046)(6055026)(148016)(149066)(150057)(6041310)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123558120)(201708071742011)(7699051)(76991095); SRVR:BN7PR05MB4004; BCL:0; PCL:0; RULEID:; SRVR:BN7PR05MB4004; x-forefront-prvs: 0830866D19 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(396003)(346002)(39860400002)(366004)(376002)(52544003)(189003)(199004)(11346002)(54896002)(4326008)(81156014)(6306002)(93886005)(6246003)(55016002)(8676002)(2171002)(81166006)(39060400002)(71190400001)(345774005)(53936002)(2900100001)(186003)(9326002)(229853002)(6116002)(790700001)(3846002)(6436002)(26005)(6506007)(68736007)(102836004)(5660300001)(19609705001)(53546011)(97736004)(14444005)(256004)(99286004)(478600001)(446003)(7696005)(7736002)(76176011)(14454004)(110136005)(966005)(86362001)(54906003)(606006)(2501003)(486006)(2906002)(9686003)(236005)(476003)(106356001)(5250100002)(8936002)(25786009)(71200400001)(33656002)(105586002)(66066001)(74316002)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR05MB4004; H:BN7PR05MB4354.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-microsoft-antispam-message-info: 4EWHiietSOzMS76mddk+49Lr4GEPJ5CfrTWr5gFufXVp2e0OYon0i+7Dtv5+/XUW46CNuy3yGGXyZ31jnOPOMjXHgzrvhzKN3qwZs0jWiC0BphVWG7gKHSBut1o8W174OpXshVZD42j1qERQVZQjoahKZ5VH7A/soVvsN/mATmXoF71jW6rtGUnt7qP70TfSMq1IHRgU+fC7VgEbxwTn70RFf0kFhglzGt6MW7ekSEQhiLPOdw4swVs/trCsaOGf2m644MwbHJDklRNIdR3w2bijI0ZngsGmVglpt6YRqnjC8TkNQYJfGFMDb0T3QymVTdUN4CRgMS5IVVENsEIQ70qgjdmSh5OFNXxvjzSJ9BI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN7PR05MB43542FD43C555120A1E42BE1C7F90BN7PR05MB4354namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: ee49f676-01b8-415b-512a-08d635dfaaf2 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2018 16:26:47.9999 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB4004 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-10-19_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1810190145 Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 16:26:59 -0000 --_000_BN7PR05MB43542FD43C555120A1E42BE1C7F90BN7PR05MB4354namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkkgd2FzIGEgY28tYXV0aG9yIG9mIFJGQyA3NDcxIGFuZCAgUkZDIDc4MTAsIHdoaWNo IGludHJvZHVjZSBhIGhhbmRmdWwgb2YgbmV3IFRFIG1ldHJpY3MgaW50byB0aGUgZXhpc3Rpbmcg T1NQRiBhbmQgSVMtSVMgVEUgaW5mcmFzdHJ1Y3R1cmVzLiAgVGhlIHN1YmplY3QgZHJhZnQgZG9l cyBleGFjdGx5IHRoZSBzYW1lIHRoaW5nIGZvciB0aGUgZXhpc3RpbmcgQkdQLUxTIFRFIGluZnJh c3RydWN0dXJlIGRlZmluZWQgaW4gUkZDIDc3NTIuDQoNCkFzIExlcyBjb3JyZWN0bHkgcG9pbnRz IG91dCwgaWYgdGhlcmUgYXJlIHNlY3VyaXR5IGlzc3VlcyB3aXRoIHRoZSBleGlzdGluZyBCR1At TFMgVEUgaW5mcmFzdHJ1Y3R1cmUgb3IgbW9yZSBnZW5lcmFsbHkgd2l0aCBSRkMgNzc1MiwgdGhl biB0aG9zZSBpc3N1ZXMgbmVlZCB0byBiZSBhZGRyZXNzZWQgd2l0aCBhIHJldmlzaW9uIG9mIHRo YXQgUkZDIGFuZCBub3Qgd2l0aCB0aGlzIGRyYWZ0LiAgSS5lLiwgdGhpcyBkcmFmdCBkb2VzIG5v dCBjaGFuZ2UgdGhlIHNjb3BlIG9mIFJGQyA3NzUyIGluIGFueSB3YXkuDQoNCllvdXJzIElycmVz cGVjdGl2ZWx5LA0KDQpKb2huDQoNCkZyb206IElkciA8aWRyLWJvdW5jZXNAaWV0Zi5vcmc+IE9u IEJlaGFsZiBPZiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKQ0KU2VudDogRnJpZGF5LCBPY3RvYmVy IDE5LCAyMDE4IDExOjU3IEFNDQpUbzogU3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpoLmNvbT47ICdS b2JlcnQgUmFzenVrJyA8cm9iZXJ0QHJhc3p1ay5uZXQ+OyBrYWR1a0BtaXQuZWR1DQpDYzogeW5p ci5pZXRmQGdtYWlsLmNvbTsgaWRyQGlldGYub3JnOyBpZXRmQGlldGYub3JnOyBkcmFmdC1pZXRm LWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBzZWNkaXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJl OiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC0xMw0KDQpTdWUg4oCTDQoNCkkgd2FzIG5vdCBhbiBhdXRob3Igb2YgUkZDIDc3NTIg YW5kIGhhdmUgbm8gaWRlYSB3aGF0IHByb21pc2VzIHRoZSBhdXRob3JzIG1pZ2h0IGhhdmUgbWFk ZS4gSSB3aWxsIHNheSB0aGF0IGl0IHNlZW1zIHZlcnkgbGF0ZSBpbiB0aGUgZ2FtZSBmb3IgeW91 IHRvIHN1Z2dlc3QgdGhhdCB0aGlzIGRvY3VtZW50IHNob3VsZCBub3QgYmUgYWxsb3dlZCB0byBw cm9ncmVzcyBiZWNhdXNlIGl0ICBleGNlZWRzIHNvbWUgYWdyZWVtZW50IG9uIHRoZSBzY29wZSBv ZiBSRkMgNzc1Mi4gV2h5IHdlcmVu4oCZdCB0aGVzZSBjb25jZXJucyBleHByZXNzZWQgbG9uZyBi ZWZvcmU/DQoNCklmIHlvdSBmZWVsIHRoYXQgUkZDIDc3NTIgc2VjdXJpdHkgbmVlZHMgcmV2aXNp b24gSSB3b3VsZCBhcHByZWNpYXRlIGl0IGlmIHlvdSBzdGF0ZSBzbyBjbGVhcmx5ICh0byB0aGUg V0cg4oCTIG5vdCBqdXN0IHRvIG1lKSBhbmQgaW4gdGhlIHJpZ2h0IGNvbnRleHQuIFN1Y2ggd29y ayBpcyBjbGVhcmx5IG5vdCBpbiB0aGUgc2NvcGUgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdw Lg0KDQogICBMZXMNCg0KRnJvbTogU3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpoLmNvbTxtYWlsdG86 c2hhcmVzQG5kemguY29tPj4NClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA4OjMzIEFN DQpUbzogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNiZXJnQGNpc2NvLmNvbTxtYWlsdG86 Z2luc2JlcmdAY2lzY28uY29tPj47ICdSb2JlcnQgUmFzenVrJyA8cm9iZXJ0QHJhc3p1ay5uZXQ8 bWFpbHRvOnJvYmVydEByYXN6dWsubmV0Pj47IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1p dC5lZHU+DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBzZWNkaXJAaWV0 Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8bWFpbHRvOmlldGZA aWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgeW5pci5pZXRmQGdtYWlsLmNv bTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT4NClN1YmplY3Q6IFJFOiBbSWRyXSBbc2VjZGly XSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpM ZXM6DQoNClRoYW5rIHlvdSBmb3IgcmVzcG9uZGluZyB0byBSb2JlcnTigJlzIHBvc3QuDQoNCllv dXIgYXJndW1lbnQgdGhhdCB0aGlzIGluZm9ybWF0aW9uIHdvdWxkIGhhdmUgYWRkZWQgdG8gUkZD Nzc1MiBpcyBvbiDigJx0aGluIGljZeKAnSBhcyB0aGUgSUVTRyBpbiB0aGVpciBhcHByb3ZhbCBv ZiBSRkM3NzUyIHdhcyBjb25jZXJuZWQgYWJvdXQgdGhlIHNjb3BlIG9mIHRoZSBpbmZvcm1hdGlv bi4gICBUaGUgZXh0ZW5zaW9uIG9mIHRoZSBzY29wZSBiZXlvbmQgaXRzIHN0YXRlZCBzY29wZSBt aWdodCBoYXZlIHRyaWdnZXIgdGhlIGN1cnJlbnQgZGlzY3Vzc2lvbnMgYXQgdGhhdCB0aW1lLiAg VGhlIGF1dGhvcnMgaW5kaWNhdGVkIHRvIHRoZSBJRFIgY2hhaXJzIHRoZSBSRkM3NzUyIHNjb3Bl IHdvdWxkIG5vdCBncm93Lg0KDQpBcyBzaGVwaGVyZCBJIHJlcXVlc3RlZCB0aGlzIGRyYWZ0IHRv IGJlIHJldmlld2VkIGJ5IHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSBiZWNhdXNlIHdlIGFyZSBn b2luZyBiZXlvbmQgdGhlIG9yaWdpbmFsIHNjb3BlIG9mIFJGQzc3NTIgd2l0aCB0aGlzIGRyYWZ0 LiAgQXMgU2hlcGhlcmQsIEkgZG8gbm90IGFncmVlIHdpdGggeW91IHRoYXQgc2VjdXJpdHkgaXNz dWVzIFlvYXYgcmFpc2VzIGFyZSBzcGVjaWZpZWQgaW4gUkZDNzc1Mi4gICBJDQoNCllvdSBhcmUg Y29ycmVjdCB0aGF0IHRoZXJlIGFyZSBtYW55IGRyYWZ0cyAoanVzdCBCR1AtTFMgZXh0ZW5zaW9u cyBhbmQgc2VnbWVudCByb3V0aW5nIGV4dGVuc2lvbnMgdGhhdCB1c2UgQkdQLUxTKS4gICBUaGlz IGRyYWZ0IGlzIGp1c3QgdGhlIGZpcnN0IG9mIGEgd2F2ZSBvZiBkcmFmdHMuICAgICAgSXQgaXMg YXBwcm9wcmlhdGUgdG8gaGF2ZSBhIHNvbHV0aW9uIGZvciB0aGUgc2VjdXJpdHkgaXNzdWVzIHRo YXQgY292ZXJzIGFsbCB0aGUgZHJhZnRzIHJhdGhlciB0aGFuIGdvIHRocm91Z2ggZHJhZnRzIG9u ZSBhdCBhIHRpbWUuIEkgc3VnZ2VzdCB0aGF0IGEgcmV2aXNpb24gdG8gUkZDNzc1MiB0aGF0IGFk ZHJlc3NlcyB0aGVzZSBpc3N1ZXMgaXMgYXBwcm9wcmlhdGUuDQoNCklmIHlvdSBhcmUgaW50ZXJl c3RlZCBpbiBkaXNjdXNzIHRoaXMgdG9waWMgd2l0aCBZb2F2LCBCZW5qYW1pbiwgYW5kIHRoZSBJ RFIgV0cg4oCTIHNoYWxsIHdlIHN0YXJ0IGEgdGhyZWFkIG9uIHRoaXMgdG9waWM/DQoNClN1c2Fu IEhhcmVzDQoNCg0KDQoNCg0KDQoNCg0KRnJvbTogSWRyIFttYWlsdG86aWRyLWJvdW5jZXNAaWV0 Zi5vcmddIE9uIEJlaGFsZiBPZiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKQ0KU2VudDogRnJpZGF5 LCBPY3RvYmVyIDE5LCAyMDE4IDEwOjUyIEFNDQpUbzogUm9iZXJ0IFJhc3p1azsga2FkdWtAbWl0 LmVkdTxtYWlsdG86a2FkdWtAbWl0LmVkdT4NCkNjOiBpZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBp ZXRmLm9yZz47IHNlY2RpckBpZXRmLm9yZzxtYWlsdG86c2VjZGlyQGlldGYub3JnPjsgaWV0ZkBp ZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5h bGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc+ OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPg0KU3ViamVj dDogUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1p ZHItdGUtcG0tYmdwLTEzDQoNClJvYmVydOKAmXMgcG9zdCBhZGRyZXNzZXMgcG9pbnRzIEkgYWxz byB3YW50IHRvIG1ha2UuDQoNCldoYXQgaXMgYmVpbmcgZG9uZSBoZXJlIGlzIHRvIGFkZCBhZGRp dGlvbmFsIEJHUC1MUyBjb2RlcG9pbnRzIHRvIGFkdmVydGlzZSBJR1AgaW5mb3JtYXRpb24gdGhh dCB3YXMgbm90IGRlZmluZWQgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2FzIHdyaXR0ZW4uIFdlIGhh dmVu4oCZdCBjaGFuZ2VkIHRoZSAgQkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g4oCTIG5vciBp cyB0aGUgaW5mb3JtYXRpb24gYmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChzb21lIGFkZGl0aW9uYWwg VEUgcmVsYXRlZCBsaW5rIGF0dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVhbGl0YXRpdmVseSBkaWZm ZXJlbnQgdGhhbiBhIG51bWJlciBvZiBleGlzdGluZyBUTFZzIGRlZmluZWQgaW4gUkZDIDc3NTIg KHNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yPGh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMu aWV0Zi5vcmdfaHRtbF9yZmM3NzUyLTIzc2VjdGlvbi0yRDMuMy4yJmQ9RHdNR2FRJmM9SEFrWXVo NjNyc3VocjZTY2JmaDBVakJYZU1LLW5kYjN2b0RUWGNXem9DSSZyPUNSQjJ0SmlRZVBrMGNULWg1 TEdoRVdILXNfeFhYdXAzSHp2QlNNUmo1VkUmbT1ucG5fZ1ltNmRRaHJ6dHVyR2Z2b1dYNmw3eWo5 OEw4QjNSRXlwb0lISktzJnM9OG53QlZNaDUwTkFYWTZTVDhIT1lRczRYWS1sUENKQzVuM2s4dUtG bFc0dyZlPT4gKS4gSWYgdGhpcyBpbmZvcm1hdGlvbiBoYWQgYWxyZWFkeSBiZWVuIGRlZmluZWQg aW4gdGhlIElHUHMgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2FzIHdyaXR0ZW4gaXQgd291bGQgc2lt cGx5IGhhdmUgYmVlbiBpbmNsdWRlZCBhcyBhIHNlY3Rpb24gb2YgUkZDIDc3NTIgYW5kIG5vIGFk ZGl0aW9uYWwgY2hhbmdlcyB0byBSRkMgNzc1MiB3b3VsZCBoYXZlIGJlZW4gcmVxdWlyZWQuDQoN CkluIHRoZW9yeSwgd2UgY291bGQgaGF2ZSBzaW1wbHkgdXBkYXRlZCBSRkMgNzc1MiByYXRoZXIg d3JpdGluZyBhIHNlcGFyYXRlIGRyYWZ0LCBidXQgcHJhY3RpY2FsbHkgdGhpcyB3b3VsZCBiZSBh IHBvb3Igc3RyYXRlZ3kgYXMgaXQgd291bGQgaW5jb3JyZWN0bHkgc3VnZ2VzdCB0aGF0IHNvbWUg Y2hhbmdlIHdhcyBiZWluZyBtYWRlIHRvIHRoZSBleGlzdGluZyB0ZXh0IGluIFJGQyA3NzUyLg0K DQpJIGFwcHJlY2lhdGUgdGhhdCBmcm9tIHRoZSBQT1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91 IGZvbGtzIGFyZSBub3QgYXMgaW50aW1hdGVseSBmYW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRy YWZ0cyBhbmQgdGhlIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIHRoZW0uIEl0IGlzIHRoZXJlZm9yZSB1 bmRlcnN0YW5kYWJsZSB0aGF0IHlvdSBzdGFydCBsb29raW5nIGF0IHRoZSBuZXcgZHJhZnQgYXMg YSBzdGFuZGFsb25lIGRvY3VtZW50IOKAkyBhbmQgaW4gdGhhdCBjb250ZXh0IHlvdXIgY29tbWVu dHMgYXJlIGFic29sdXRlbHkgY29ycmVjdC4gQnV0IHRoZSBkb2N1bWVudCB5b3UgYXJlIHJldmll d2luZyBpcyBtb3N0IGFjY3VyYXRlbHkgc2VlbiBhcyBhbiDigJxhZGRlbmR1beKAnSB0byBSRkMg Nzc1Mi4gVGhlIGlzc3VlcyB5b3UgcmFpc2UgaGF2ZSBhbHJlYWR5IGJlZW4gYWRkcmVzc2VkIGlu IFJGQyA3NzUyIGFuZCBpdCBpcyB0aGVyZWZvcmUgdmVyeSBhcHByb3ByaWF0ZSB0aGF0IHdlIGFk ZHJlc3MgeW91ciBjb25jZXJucyBieSBpbmNsdWRpbmcgYSByZWZlcmVuY2UgdG8gdGhlIFJGQyA3 NzUyIHNlY3VyaXR5IGRpc2N1c3Npb24uDQoNCkkgdGhpbmsgaXQgaXMgaW1wb3J0YW50IHRoYXQg eW91IG5vdGUgdGhpcyByZWxhdGlvbnNoaXAsIGJlY2F1c2UgdGhlIG5hdHVyZSBvZiBCR1AtTFMg aXMgdGhhdCB3aGVuZXZlciBJR1AgZXh0ZW5zaW9ucyBhcmUgZGVmaW5lZCB0byBhZHZlcnRpc2Ug bmV3IGluZm9ybWF0aW9uIGl0IGlzIG5lY2Vzc2FyeSB0byBkZWZpbmUgY29ycmVzcG9uZGluZyBC R1AtTFMgY29kZXBvaW50cy4gVGhpcyBpcyBub3QgdGhlIGZpcnN0IHN1Y2ggQkdQLUxTIGV4dGVu c2lvbiBkb2N1bWVudCDigJMgYW5kIGl0IGlzIHNhZmUgdG8gc2F5IGl0IHdvbuKAmXQgYmUgdGhl IGxhc3QuIEl0IHdvdWxkIGJlIGhlbHBmdWwgdG8gYWxsIGlmIHdlIHJlYWNoZWQgYSBjb21tb24g dW5kZXJzdGFuZGluZyBvciB0aGlzIGRpc2N1c3Npb24gd2lsbCB0YWtlIHBsYWNlIGV2ZXJ5IHRp bWUgYSBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IGlzIGJlaW5nIHJldmlld2VkIOKAkyB3aGlj aCB3aWxsIGNvc3QgdXMgYWxsIHRpbWUgbmVlZGxlc3NseS4NCg0KICAgTGVzDQoNCg0KRnJvbTog Um9iZXJ0IFJhc3p1ayA8cm9iZXJ0QHJhc3p1ay5uZXQ8bWFpbHRvOnJvYmVydEByYXN6dWsubmV0 Pj4NClNlbnQ6IFRodXJzZGF5LCBPY3RvYmVyIDE4LCAyMDE4IDExOjUyIFBNDQpUbzoga2FkdWtA bWl0LmVkdTxtYWlsdG86a2FkdWtAbWl0LmVkdT4NCkNjOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJn KSA8Z2luc2JlcmdAY2lzY28uY29tPG1haWx0bzpnaW5zYmVyZ0BjaXNjby5jb20+PjsgaWRyQGll dGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsg aWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208 bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2Rp ckBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2 aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpIZWxsbyBCZW5qYW1pbiwNCg0K Tm90IHN1cmUgaWYgeW91IGhhdmUgc3BvdHRlZCBzaW1pbGFyIGNvbW1lbnQgbWFkZSB0byBJRFIg cmVnYXJkaW5nIHRoaXMgdG9waWMsIGJ1dCB5b3VyIGNvbW1lbnQgc2VlbXMgdG8gaW5kaWNhdGUg dGhhdCBoZXJlIHdlIGFyZSBhYm91dCB0byBkZWZpbmUgd2F5cyB0byBjYXJyeSBuaWNlbHkgc2Nv cGVkIElHUCBpbmZvcm1hdGlvbiBpbnRvIEJHUC4gV2VsbCB0aGF0IGhhcyBhbHJlYWR5IGhhcHBl bmVkIHdpdGggUkZDNzc1MiBhbmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1hdHRlciBZb2F2 J3MgcmVtYXJrcyBhcmUgaW5kZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0eSBkaXNjdXNz aW9uIG9uIFJGQzc3NTIgYW5kIElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNpb25zIG9mIGl0 Lg0KDQpTdXJlIC0gYXMgb2JzZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0aGF0IHByb3Zp ZGluZyBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBwb3RlbnRpYWwg YXR0YWNrZXIgbWFrZXMgdGhlIG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUgZm9yIHRoYXQg aXMgdG8gcHJldmVudCB0aGUgbGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBvZiBpbnRlcmNl cHRpbmcgbmV3IGluZm9ybWF0aW9uIGJ5IHVuYXV0aG9yaXplZCBwYXJ0aWVzLg0KDQpCR1AtTFMg aXMgYWxyZWFkeSBkZWZpbmVkIGluIGEgbmV3IFNBRkkgd2hhdCBieSBpdHNlbGYgZG9lcyBwcm92 aWRlIG5pY2UgbGV2ZWwgb2YgaXNvbGF0aW9uLiBSRkM3NzUyIGlzIHByZXR0eSBjbGVhciBvbiB0 aGF0IHRvbyBhbmQgc2F5czoNCg0KIkJHUCBwZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQg cmVxdWlyZSBjb25maWd1cmF0aW9uOyB0aHVzLCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2Yg dGhlIG5ldHdvcmsgb3BlcmF0b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVy cyBhcmUgY29uZmlndXJlZCB0byByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uIg0KDQpJZiBzb21l b25lIHdvdWxkIGJlIHN0aWxsIGNvbmNlcm5lZCBhYm91dCBjb25maWd1cmF0aW9uIG1pc3Rha2Vz IGFuZCBuZWdvdGlhdGluZyBTQUZJIDcxIG9yIDcyIHRvIHRob3NlIHdobyBzaG91bGQgbm90IGdl dCB0aGlzIGRhdGEgSSByZWNvbW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZDNzc1MiBhcyAtYmlzIHZl cnNpb24gYW5kIHJlc3RyaWN0IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJpYnV0aW9uIGV2ZW4gZnVy dGhlciBieSBtYW5kYXRpbmcgZGVmYXVsdCB1c2Ugb2YgTk8tRVhQT1JUIGNvbW11bml0eSB3aXRo IGFiaWxpdHkgdG8gb3ZlcndyaXRlIGl0IGZvciB0aGUgc2VsZWN0aXZlIGVCR1AgcGVlcnMuIE9y IHBlcmhhcHMgd2UgY291bGQgcHJvZ3Jlc3MgSmltJ3MgT25lIEFkbWluaXN0cmF0aXZlIERvbWFp biBkcmFmdCAoZHJhZnQtdXR0YXJvLWlkci1vYWQtMDEpLg0KDQpJbiBlaXRoZXIgY2FzZSB3aGls ZSBib3RoIG9mIHlvdXIgY29tbWVudHMgYXJlIGdyZWF0IHRoZXkgc2VlbXMgYSBiaXQgbGF0ZSBp biB0aGUgZ2FtZSBoZXJlIG9yIGF0IGxlYXN0IHRhcmdldGluZyB3cm9uZyBkb2N1bWVudC4NCg0K S2luZCByZWdhcmRzLA0KUm9iZXJ0Lg0KDQoNCk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6Mjcg QU0gQmVuamFtaW4gS2FkdWsgPGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+PiB3 cm90ZToNCk9uIFRodSwgT2N0IDE4LCAyMDE4IGF0IDA2OjAwOjEzUE0gKzAwMDAsIExlcyBHaW5z YmVyZyAoZ2luc2JlcmcpIHdyb3RlOg0KPiBZb2F2IOKAkw0KPg0KPiBJbiByZWdhcmRzIHRvIHRo ZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0 aW9uIGNvdmVyZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1Ag ZHJhZnRzOg0KPg0KPiBGcm9tIFJGQzc4MTANCj4NCj4g4oCcVGhlIHN1Yi1UTFZzIGludHJvZHVj ZWQgaW4gdGhpcyBkb2N1bWVudCBhbGxvdyBhbiBvcGVyYXRvciB0bw0KPiAgICBhZHZlcnRpc2Ug c3RhdGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQgY291bGQg YmUNCj4gICAgc2Vuc2l0aXZlIGFuZCB0aGF0IGFuIG9wZXJhdG9yIG1heSBub3Qgd2FudCB0byBk aXNjbG9zZS7igJ0NCj4NCj4gSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRo IHNlbmRpbmcgaW5mb3JtYXRpb24gdmlhIEJHUC1MUyB3ZSBoYXZlIGEgbnVtYmVyIG9mIHN0YXRl bWVudHMgaW4gUkZDIDc3NTIg4oCTIG1vc3QgcmVsZXZhbnQgaXM6DQo+DQo+IOKAnEFkZGl0aW9u YWxseSwgaXQgbWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9mIGxpbmstc3RhdGUg YW5kDQo+ICAgIFRFIGluZm9ybWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNv bnN0aXR1dGVzIGEgcmlzayB0bw0KPiAgICBjb25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0 aWNhbCBvciBjb21tZXJjaWFsbHkgc2Vuc2l0aXZlDQo+ICAgIGluZm9ybWF0aW9uIGFib3V0IHRo ZSBuZXR3b3JrLuKAnQ0KPg0KPiBTbyBsb25nIGFzIHRoZXJlIGFyZSByZWZlcmVuY2VzIHRvIGJv dGggdGhlIElHUCBSRkNzIGFuZCBSRkMgNzc1MiBJIGFtIHRoZXJlZm9yZSBoYXJkIHByZXNzZWQg dG8gdW5kZXJzdGFuZCB3aGF0IGVsc2UgY291bGQgYmUgdXNlZnVsbHkgc2FpZC4NCj4gQ2VydGFp bmx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFu aXNtIGFyZSBub3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDigJMgYW5kIHNpbmNl IHRoZSBJR1AgUkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNrcyBhc3NvY2lhdGVkIHdpdGgg dGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZSByaXNrcyBh c3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20pIHlvdSBhcmUgZ29pbmcgdG8g aGF2ZSB0byBwcm92aWRlIG1vcmUgc3BlY2lmaWNzIG9uIHdoYXQgY2FuIG1lYW5pbmdmdWxseSBi ZSBzYWlkIHRoYXQgaXMgbm90IGFscmVhZHkgY292ZXJlZCBpbiB0aGUgcmVmZXJlbmNlcy4NCg0K TXkgYXBvbG9naWVzIGZvciBqdW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVDIHRoZSBJ R1AgUkZDcyBoYXZlDQpjb3ZlcmVkIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYSBzcGVjaWZp YyBjbGFzcyBvZiBpbmZvcm1hdGlvbiwgKnVuZGVyDQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0 cmFuc3BvcnQgbWVjaGFuaXNtIGlzIHdpdGhpbiBhIHNpbmdsZSBBUyBhbmQNCmFkbWluaXN0cmF0 aXZlIGRvbWFpbiouICBZb2F2IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhh dA0KaW5mb3JtYXRpb24gbWF5IGNoYW5nZSB3aGVuIHRoZSBkaXN0cmlidXRpb24gaXMgb3ZlciBh IGJyb2FkZXIgZG9tYWluIHRoYW4NCnRoZSBvbmUgZm9yIHdoaWNoIHRoZSBwcmV2aW91cyBhbmFs eXNpcyB3YXMgcGVyZm9ybWVkLg0KDQotQmVuDQo= --_000_BN7PR05MB43542FD43C555120A1E42BE1C7F90BN7PR05MB4354namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u RW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5 N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47 DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2FzIGEgY28tYXV0aG9yIG9m IFJGQyA3NDcxIGFuZCZuYnNwOyBSRkMgNzgxMCwgd2hpY2ggaW50cm9kdWNlIGEgaGFuZGZ1bCBv ZiBuZXcgVEUgbWV0cmljcyBpbnRvIHRoZSBleGlzdGluZyBPU1BGIGFuZCBJUy1JUyBURSBpbmZy YXN0cnVjdHVyZXMuJm5ic3A7IFRoZSBzdWJqZWN0IGRyYWZ0DQogZG9lcyBleGFjdGx5IHRoZSBz YW1lIHRoaW5nIGZvciB0aGUgZXhpc3RpbmcgQkdQLUxTIFRFIGluZnJhc3RydWN0dXJlIGRlZmlu ZWQgaW4gUkZDIDc3NTIuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPkFzIExlcyBjb3JyZWN0bHkgcG9pbnRzIG91dCwgaWYgdGhlcmUgYXJlIHNlY3Vy aXR5IGlzc3VlcyB3aXRoIHRoZSBleGlzdGluZyBCR1AtTFMgVEUgaW5mcmFzdHJ1Y3R1cmUgb3Ig bW9yZSBnZW5lcmFsbHkgd2l0aCBSRkMgNzc1MiwgdGhlbiB0aG9zZSBpc3N1ZXMgbmVlZCB0bw0K IGJlIGFkZHJlc3NlZCB3aXRoIGEgcmV2aXNpb24gb2YgdGhhdCBSRkMgYW5kIG5vdCB3aXRoIHRo aXMgZHJhZnQuJm5ic3A7IEkuZS4sIHRoaXMgZHJhZnQgZG9lcyBub3QgY2hhbmdlIHRoZSBzY29w ZSBvZiBSRkMgNzc1MiBpbiBhbnkgd2F5Lg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+WW91cnMgSXJyZXNwZWN0aXZlbHksPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Kb2huPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEg MS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIg Jmx0O2lkci1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5MZXMgR2lu c2JlcmcgKGdpbnNiZXJnKTxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTksIDIw MTggMTE6NTcgQU08YnI+DQo8Yj5Ubzo8L2I+IFN1c2FuIEhhcmVzICZsdDtzaGFyZXNAbmR6aC5j b20mZ3Q7OyAnUm9iZXJ0IFJhc3p1aycgJmx0O3JvYmVydEByYXN6dWsubmV0Jmd0Ozsga2FkdWtA bWl0LmVkdTxicj4NCjxiPkNjOjwvYj4geW5pci5pZXRmQGdtYWlsLmNvbTsgaWRyQGlldGYub3Jn OyBpZXRmQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBz ZWNkaXJAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNl Y2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPlN1ZSDigJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkkgd2FzIG5vdCBhbiBhdXRob3Igb2YgUkZDIDc3NTIgYW5kIGhhdmUgbm8gaWRlYSB3 aGF0IHByb21pc2VzIHRoZSBhdXRob3JzIG1pZ2h0IGhhdmUgbWFkZS4gSSB3aWxsIHNheSB0aGF0 IGl0IHNlZW1zIHZlcnkgbGF0ZSBpbiB0aGUgZ2FtZSBmb3IgeW91IHRvIHN1Z2dlc3QNCiB0aGF0 IHRoaXMgZG9jdW1lbnQgc2hvdWxkIG5vdCBiZSBhbGxvd2VkIHRvIHByb2dyZXNzIGJlY2F1c2Ug aXQmbmJzcDsgZXhjZWVkcyBzb21lIGFncmVlbWVudCBvbiB0aGUgc2NvcGUgb2YgUkZDIDc3NTIu IFdoeSB3ZXJlbuKAmXQgdGhlc2UgY29uY2VybnMgZXhwcmVzc2VkIGxvbmcgYmVmb3JlPzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgeW91IGZlZWwgdGhhdCBS RkMgNzc1MiBzZWN1cml0eSBuZWVkcyByZXZpc2lvbiBJIHdvdWxkIGFwcHJlY2lhdGUgaXQgaWYg eW91IHN0YXRlIHNvIGNsZWFybHkgKHRvIHRoZSBXRyDigJMgbm90IGp1c3QgdG8gbWUpIGFuZCBp biB0aGUgcmlnaHQgY29udGV4dC4gU3VjaCB3b3JrDQogaXMgY2xlYXJseSBub3QgaW4gdGhlIHNj b3BlIG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTdXNhbiBIYXJl cyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXJlc0BuZHpoLmNvbSI+c2hhcmVzQG5kemguY29tPC9h PiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggODozMyBB TTxicj4NCjxiPlRvOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0OzxhIGhyZWY9Im1h aWx0bzpnaW5zYmVyZ0BjaXNjby5jb20iPmdpbnNiZXJnQGNpc2NvLmNvbTwvYT4mZ3Q7OyAnUm9i ZXJ0IFJhc3p1aycgJmx0OzxhIGhyZWY9Im1haWx0bzpyb2JlcnRAcmFzenVrLm5ldCI+cm9iZXJ0 QHJhc3p1ay5uZXQ8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1 a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmlkckBpZXRmLm9y ZyI+aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpz ZWNkaXJAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8 YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwv YT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSBy ZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi Pkxlczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rIHlv dSBmb3IgcmVzcG9uZGluZyB0byBSb2JlcnTigJlzIHBvc3QuJm5ic3A7DQo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdXIgYXJndW1lbnQgdGhhdCB0aGlzIGlu Zm9ybWF0aW9uIHdvdWxkIGhhdmUgYWRkZWQgdG8gUkZDNzc1MiBpcyBvbiDigJx0aGluIGljZeKA nSBhcyB0aGUgSUVTRyBpbiB0aGVpciBhcHByb3ZhbCBvZiBSRkM3NzUyIHdhcyBjb25jZXJuZWQg YWJvdXQgdGhlIHNjb3BlIG9mIHRoZQ0KIGluZm9ybWF0aW9uLiZuYnNwOyZuYnNwOyBUaGUgZXh0 ZW5zaW9uIG9mIHRoZSBzY29wZSBiZXlvbmQgaXRzIHN0YXRlZCBzY29wZSBtaWdodCBoYXZlIHRy aWdnZXIgdGhlIGN1cnJlbnQgZGlzY3Vzc2lvbnMgYXQgdGhhdCB0aW1lLiZuYnNwOyBUaGUgYXV0 aG9ycyBpbmRpY2F0ZWQgdG8gdGhlIElEUiBjaGFpcnMgdGhlIFJGQzc3NTIgc2NvcGUgd291bGQg bm90IGdyb3cuICZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+QXMgc2hlcGhlcmQgSSByZXF1ZXN0ZWQgdGhpcyBkcmFmdCB0byBiZSByZXZpZXdl ZCBieSB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgYmVjYXVzZSB3ZSBhcmUgZ29pbmcgYmV5b25k IHRoZSBvcmlnaW5hbCBzY29wZSBvZiBSRkM3NzUyIHdpdGggdGhpcyBkcmFmdC4gJm5ic3A7QXMg U2hlcGhlcmQsDQogSSBkbyBub3QgYWdyZWUgd2l0aCB5b3UgdGhhdCBzZWN1cml0eSBpc3N1ZXMg WW9hdiByYWlzZXMgYXJlIHNwZWNpZmllZCBpbiBSRkM3NzUyLiAmbmJzcDsmbmJzcDtJPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Zb3UgYXJlIGNvcnJlY3QgdGhh dCB0aGVyZSBhcmUgbWFueSBkcmFmdHMgKGp1c3QgQkdQLUxTIGV4dGVuc2lvbnMgYW5kIHNlZ21l bnQgcm91dGluZyBleHRlbnNpb25zIHRoYXQgdXNlIEJHUC1MUykuJm5ic3A7ICZuYnNwO1RoaXMg ZHJhZnQgaXMganVzdCB0aGUgZmlyc3Qgb2YgYSB3YXZlIG9mDQogZHJhZnRzLiAmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDtJdCBpcyBhcHByb3ByaWF0ZSB0byBoYXZlIGEgc29sdXRpb24g Zm9yIHRoZSBzZWN1cml0eSBpc3N1ZXMgdGhhdCBjb3ZlcnMgYWxsIHRoZSBkcmFmdHMgcmF0aGVy IHRoYW4gZ28gdGhyb3VnaCBkcmFmdHMgb25lIGF0IGEgdGltZS4gSSBzdWdnZXN0IHRoYXQgYSBy ZXZpc2lvbiB0byBSRkM3NzUyIHRoYXQgYWRkcmVzc2VzIHRoZXNlIGlzc3VlcyBpcyBhcHByb3By aWF0ZS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYgeW91 IGFyZSBpbnRlcmVzdGVkIGluIGRpc2N1c3MgdGhpcyB0b3BpYyB3aXRoIFlvYXYsIEJlbmphbWlu LCBhbmQgdGhlIElEUiBXRyDigJMgc2hhbGwgd2Ugc3RhcnQgYSB0aHJlYWQgb24gdGhpcyB0b3Bp Yz8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+U3VzYW4gSGFy ZXMNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1 QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rh aG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJ ZHIgWzxhIGhyZWY9Im1haWx0bzppZHItYm91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlkci1ib3Vu Y2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+TGVzIEdpbnNiZXJnIChnaW5z YmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDEwOjUyIEFN PGJyPg0KPGI+VG86PC9iPiBSb2JlcnQgUmFzenVrOyA8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0 LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpp ZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0 Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5v cmciPmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUt cG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYu b3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBn bWFpbC5jb208L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNk aXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5Sb2JlcnTigJlzIHBvc3QgYWRkcmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0 byBtYWtlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+V2hhdCBp cyBiZWluZyBkb25lIGhlcmUgaXMgdG8gYWRkIGFkZGl0aW9uYWwgQkdQLUxTIGNvZGVwb2ludHMg dG8gYWR2ZXJ0aXNlIElHUCBpbmZvcm1hdGlvbiB0aGF0IHdhcyBub3QgZGVmaW5lZCBhdCB0aGUg dGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbi4gV2UgaGF2ZW7igJl0DQogY2hhbmdlZCB0aGUgJm5i c3A7QkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g4oCTIG5vciBpcyB0aGUgaW5mb3JtYXRpb24g YmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChzb21lIGFkZGl0aW9uYWwgVEUgcmVsYXRlZCBsaW5rIGF0 dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVhbGl0YXRpdmVseSBkaWZmZXJlbnQgdGhhbiBhIG51bWJl ciBvZiBleGlzdGluZyBUTFZzIGRlZmluZWQgaW4gUkZDIDc3NTIgKHNlZQ0KPGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5p ZXRmLm9yZ19odG1sX3JmYzc3NTItMjNzZWN0aW9uLTJEMy4zLjImYW1wO2Q9RHdNR2FRJmFtcDtj PUhBa1l1aDYzcnN1aHI2U2NiZmgwVWpCWGVNSy1uZGIzdm9EVFhjV3pvQ0kmYW1wO3I9Q1JCMnRK aVFlUGswY1QtaDVMR2hFV0gtc194WFh1cDNIenZCU01SajVWRSZhbXA7bT1ucG5fZ1ltNmRRaHJ6 dHVyR2Z2b1dYNmw3eWo5OEw4QjNSRXlwb0lISktzJmFtcDtzPThud0JWTWg1ME5BWFk2U1Q4SE9Z UXM0WFktbFBDSkM1bjNrOHVLRmxXNHcmYW1wO2U9Ij4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9yZmM3NzUyI3NlY3Rpb24tMy4zLjI8L2E+ICkuIElmIHRoaXMgaW5mb3JtYXRpb24gaGFk IGFscmVhZHkgYmVlbiBkZWZpbmVkIGluIHRoZSBJR1BzIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdh cyB3cml0dGVuIGl0IHdvdWxkIHNpbXBseSBoYXZlIGJlZW4gaW5jbHVkZWQgYXMgYSBzZWN0aW9u IG9mIFJGQyA3NzUyIGFuZCBubyBhZGRpdGlvbmFsIGNoYW5nZXMgdG8gUkZDIDc3NTIgd291bGQg aGF2ZSBiZWVuDQogcmVxdWlyZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5JbiB0aGVvcnksIHdlIGNvdWxkIGhhdmUgc2ltcGx5IHVwZGF0ZWQgUkZDIDc3NTIg cmF0aGVyIHdyaXRpbmcgYSBzZXBhcmF0ZSBkcmFmdCwgYnV0IHByYWN0aWNhbGx5IHRoaXMgd291 bGQgYmUgYSBwb29yIHN0cmF0ZWd5IGFzIGl0IHdvdWxkIGluY29ycmVjdGx5IHN1Z2dlc3QNCiB0 aGF0IHNvbWUgY2hhbmdlIHdhcyBiZWluZyBtYWRlIHRvIHRoZSBleGlzdGluZyB0ZXh0IGluIFJG QyA3NzUyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhcHBy ZWNpYXRlIHRoYXQgZnJvbSB0aGUgUE9WIG9mIHRoZSBTZWN1cml0eSBBcmVhIHlvdSBmb2xrcyBh cmUgbm90IGFzIGludGltYXRlbHkgZmFtaWxpYXIgd2l0aCB0aGUgcm91dGluZyBkcmFmdHMgYW5k IHRoZSByZWxhdGlvbnNoaXAgYmV0d2VlbiB0aGVtLiBJdCBpcw0KIHRoZXJlZm9yZSB1bmRlcnN0 YW5kYWJsZSB0aGF0IHlvdSBzdGFydCBsb29raW5nIGF0IHRoZSBuZXcgZHJhZnQgYXMgYSBzdGFu ZGFsb25lIGRvY3VtZW50IOKAkyBhbmQgaW4gdGhhdCBjb250ZXh0IHlvdXIgY29tbWVudHMgYXJl IGFic29sdXRlbHkgY29ycmVjdC4gQnV0IHRoZSBkb2N1bWVudCB5b3UgYXJlIHJldmlld2luZyBp cyBtb3N0IGFjY3VyYXRlbHkgc2VlbiBhcyBhbiDigJxhZGRlbmR1beKAnSB0byBSRkMgNzc1Mi4g VGhlIGlzc3VlcyB5b3UgcmFpc2UNCiBoYXZlIGFscmVhZHkgYmVlbiBhZGRyZXNzZWQgaW4gUkZD IDc3NTIgYW5kIGl0IGlzIHRoZXJlZm9yZSB2ZXJ5IGFwcHJvcHJpYXRlIHRoYXQgd2UgYWRkcmVz cyB5b3VyIGNvbmNlcm5zIGJ5IGluY2x1ZGluZyBhIHJlZmVyZW5jZSB0byB0aGUgUkZDIDc3NTIg c2VjdXJpdHkgZGlzY3Vzc2lvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkkgdGhpbmsgaXQgaXMgaW1wb3J0YW50IHRoYXQgeW91IG5vdGUgdGhpcyByZWxhdGlv bnNoaXAsIGJlY2F1c2UgdGhlIG5hdHVyZSBvZiBCR1AtTFMgaXMgdGhhdCB3aGVuZXZlciBJR1Ag ZXh0ZW5zaW9ucyBhcmUgZGVmaW5lZCB0byBhZHZlcnRpc2UgbmV3IGluZm9ybWF0aW9uDQogaXQg aXMgbmVjZXNzYXJ5IHRvIGRlZmluZSBjb3JyZXNwb25kaW5nIEJHUC1MUyBjb2RlcG9pbnRzLiBU aGlzIGlzIG5vdCB0aGUgZmlyc3Qgc3VjaCBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IOKAkyBh bmQgaXQgaXMgc2FmZSB0byBzYXkgaXQgd29u4oCZdCBiZSB0aGUgbGFzdC4gSXQgd291bGQgYmUg aGVscGZ1bCB0byBhbGwgaWYgd2UgcmVhY2hlZCBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9yIHRo aXMgZGlzY3Vzc2lvbiB3aWxsIHRha2UgcGxhY2UNCiBldmVyeSB0aW1lIGEgQkdQLUxTIGV4dGVu c2lvbiBkb2N1bWVudCBpcyBiZWluZyByZXZpZXdlZCDigJMgd2hpY2ggd2lsbCBjb3N0IHVzIGFs bCB0aW1lIG5lZWRsZXNzbHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDsmbmJzcDsgTGVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4w cHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0Ux RTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ IFJvYmVydCBSYXN6dWsgJmx0OzxhIGhyZWY9Im1haWx0bzpyb2JlcnRAcmFzenVrLm5ldCI+cm9i ZXJ0QHJhc3p1ay5uZXQ8L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBPY3Rv YmVyIDE4LCAyMDE4IDExOjUyIFBNPGJyPg0KPGI+VG86PC9iPiA8YSBocmVmPSJtYWlsdG86a2Fk dWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8Yj5DYzo8L2I+IExlcyBHaW5zYmVy ZyAoZ2luc2JlcmcpICZsdDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5naW5z YmVyZ0BjaXNjby5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlk ckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3Au YWxsQGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+ OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9yZzwvYT47DQo8YSBo cmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47 IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjxi cj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmll dyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxsbyBCZW5qYW1p biw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vdCBzdXJl IGlmIHlvdSBoYXZlIHNwb3R0ZWQgc2ltaWxhciBjb21tZW50IG1hZGUgdG8gSURSIHJlZ2FyZGlu ZyB0aGlzIHRvcGljLCBidXQgeW91ciBjb21tZW50IHNlZW1zIHRvIGluZGljYXRlIHRoYXQgaGVy ZSB3ZSBhcmUgYWJvdXQgdG8gZGVmaW5lIHdheXMgdG8gY2FycnkgbmljZWx5IHNjb3BlZCBJR1Ag aW5mb3JtYXRpb24gaW50byBCR1AuIFdlbGwgdGhhdCBoYXMgYWxyZWFkeSBoYXBwZW5lZCB3aXRo DQogUkZDNzc1MiBhbmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1hdHRlciBZb2F2J3MgcmVt YXJrcyBhcmUgaW5kZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0eSBkaXNjdXNzaW9uIG9u IFJGQzc3NTIgYW5kIElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNpb25zIG9mIGl0LiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5T dXJlIC0gYXMgb2JzZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0aGF0IHByb3ZpZGluZyBt b3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBwb3RlbnRpYWwgYXR0YWNr ZXIgbWFrZXMgdGhlIG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUgZm9yIHRoYXQgaXMgdG8g cHJldmVudCB0aGUgbGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBvZiBpbnRlcmNlcHRpbmcg bmV3IGluZm9ybWF0aW9uDQogYnkgdW5hdXRob3JpemVkIHBhcnRpZXMuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJHUC1MUyBpcyBh bHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0IGJ5IGl0c2VsZiBkb2VzIHByb3ZpZGUg bmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIgaXMgcHJldHR5IGNsZWFyIG9uIHRoYXQg dG9vIGFuZCBzYXlzOiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mcXVvdDtCR1AgcGVlcmluZ3MgYXJlIG5vdCBhdXRvbWF0aWMgYW5k IHJlcXVpcmUgY29uZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJlc3BvbnNpYmlsaXR5IG9m IHRoZSBuZXR3b3JrIG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkgdHJ1c3RlZCBjb25zdW1l cnMgYXJlIGNvbmZpZ3VyZWQgdG8gcmVjZWl2ZSBzdWNoIGluZm9ybWF0aW9uLiZxdW90OzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBzb21l b25lIHdvdWxkIGJlIHN0aWxsIGNvbmNlcm5lZCBhYm91dCBjb25maWd1cmF0aW9uIG1pc3Rha2Vz IGFuZCBuZWdvdGlhdGluZyBTQUZJIDcxIG9yIDcyIHRvIHRob3NlIHdobyBzaG91bGQgbm90IGdl dCB0aGlzIGRhdGEgSSByZWNvbW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZDNzc1MiBhcyAtYmlzIHZl cnNpb24gYW5kIHJlc3RyaWN0IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJpYnV0aW9uIGV2ZW4gZnVy dGhlcg0KIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1FWFBPUlQgY29tbXVuaXR5IHdp dGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxlY3RpdmUgZUJHUCBwZWVycy4g T3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUgQWRtaW5pc3RyYXRpdmUgRG9t YWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIGVpdGhlciBjYXNlIHdo aWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhleSBzZWVtcyBhIGJpdCBsYXRl IGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5nIHdyb25nIGRvY3VtZW50LiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5LaW5kIHJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5Sb2JlcnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6MjcgQU0gQmVuamFtaW4gS2FkdWsg Jmx0OzxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0BtaXQuZWR1PC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4g Ni4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGlu O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVGh1LCBPY3Qg MTgsIDIwMTggYXQgMDY6MDA6MTNQTSAmIzQzOzAwMDAsIExlcyBHaW5zYmVyZyAoZ2luc2Jlcmcp IHdyb3RlOjxicj4NCiZndDsgWW9hdiDigJM8YnI+DQomZ3Q7IDxicj4NCiZndDsgSW4gcmVnYXJk cyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5nIHRoZSBzcGVjaWZpYyBp bmZvcm1hdGlvbiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBhIHN0YXRlbWVudCBpbiB0 aGUgSUdQIGRyYWZ0czo8YnI+DQomZ3Q7IDxicj4NCiZndDsgRnJvbSBSRkM3ODEwPGJyPg0KJmd0 OyA8YnI+DQomZ3Q7IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGluIHRoaXMgZG9jdW1lbnQg YWxsb3cgYW4gb3BlcmF0b3IgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBhZHZlcnRpc2Ugc3Rh dGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQgY291bGQgYmU8 YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBzZW5zaXRpdmUgYW5kIHRoYXQgYW4gb3BlcmF0b3IgbWF5 IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnTxicj4NCiZndDsgPGJyPg0KJmd0OyBJbiByZWdhcmRz IHRvIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQ LUxTIHdlIGhhdmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCBy ZWxldmFudCBpczo8YnI+DQomZ3Q7IDxicj4NCiZndDsg4oCcQWRkaXRpb25hbGx5LCBpdCBtYXkg YmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0ZSBhbmQ8YnI+DQomZ3Q7 Jm5ic3A7ICZuYnNwOyBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVu dCBjb25zdGl0dXRlcyBhIHJpc2sgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBjb25maWRlbnRp YWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFsbHkgc2Vuc2l0aXZlPGJyPg0K Jmd0OyZuYnNwOyAmbmJzcDsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsu4oCdPGJyPg0K Jmd0OyA8YnI+DQomZ3Q7IFNvIGxvbmcgYXMgdGhlcmUgYXJlIHJlZmVyZW5jZXMgdG8gYm90aCB0 aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhlcmVmb3JlIGhhcmQgcHJlc3NlZCB0byB1 bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2VmdWxseSBzYWlkLjxicj4NCiZndDsgQ2Vy dGFpbmx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1MUyB0cmFuc3BvcnQgbWVj aGFuaXNtIGFyZSBub3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDigJMgYW5kIHNp bmNlIHRoZSBJR1AgUkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNrcyBhc3NvY2lhdGVkIHdp dGggdGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZSByaXNr cyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydA0KIG1lY2hhbmlzbSkgeW91IGFyZSBnb2lu ZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hhdCBjYW4gbWVhbmluZ2Z1 bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGluIHRoZSByZWZlcmVuY2Vz Ljxicj4NCjxicj4NCk15IGFwb2xvZ2llcyBmb3IganVtcGluZyBpbiBpbiB0aGUgbWlkZGxlLCBi dXQgSUlVQyB0aGUgSUdQIFJGQ3MgaGF2ZTxicj4NCmNvdmVyZWQgdGhlIHJpc2tzIGFzc29jaWF0 ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAqdW5kZXI8YnI+DQp0aGUg YXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtIGlzIHdpdGhpbiBhIHNpbmds ZSBBUyBhbmQ8YnI+DQphZG1pbmlzdHJhdGl2ZSBkb21haW4qLiZuYnNwOyBZb2F2IGlzIHBvaW50 aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdDxicj4NCmluZm9ybWF0aW9uIG1heSBjaGFu Z2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVyIGRvbWFpbiB0aGFuPGJy Pg0KdGhlIG9uZSBmb3Igd2hpY2ggdGhlIHByZXZpb3VzIGFuYWx5c2lzIHdhcyBwZXJmb3JtZWQu PGJyPg0KPGJyPg0KLUJlbjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_BN7PR05MB43542FD43C555120A1E42BE1C7F90BN7PR05MB4354namp_-- From nobody Fri Oct 19 09:29:30 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72D02130F88; Fri, 19 Oct 2018 09:29:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xp4ao79MNBO5; Fri, 19 Oct 2018 09:29:19 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FB5C130E81; Fri, 19 Oct 2018 09:29:18 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> In-Reply-To: <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> Date: Fri, 19 Oct 2018 12:27:58 -0400 Message-ID: <022501d467c8$b33126d0$19937470$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0226_01D467A7.2C23CC90" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAUeOFiECtDA/VAGZqNHmovUqnkA= Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 16:29:22 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0226_01D467A7.2C23CC90 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les: =20 The discussion was not with specifically with me, but with both IDR = chairs, the AD for routing, and the IESG. I am simply reporting what = happened during the approval process. =20 =20 Perhaps you have not been active in IDR for a while. I stated these = concerns during the original RFC7752 discussion, but agreed that a = limited scope would limit my concerns. As we have expanded these = drafts, I have repeated these concerns and in person to the authors = who discussed these issues with me at IETF IDR meetings. You have not = been at any of the in-person author discussions at IETF. Please see my = comments on the list regarding BGP-LS additions and SR routing drafts.=20 =20 You felt that RFC7752 was sufficient to cover these drafts. I stated = clearly to you as a shepherd of your draft that you might wish to = upgrade your security section. You felt it was sufficient. Therefore, = I sent the draft to the security directorate for an impartial review. =20 =20 You are in this discussion because security directorate reviewer, Yoav, = pointed this issue regarding RFC7752 security. You feel it is = sufficient and my understanding of the discussion is that they do not = feel it is sufficient. =20 =20 I do agree that the IDR WG should engage in a general solution is to the = queries from the security directorate on RFC7752 security. It is not = specifically an issue specific to the draft-ietf-te-pm-bgp draft. I = have made the same suggestion for a revision to RFC7752 security to the = draft-ietf-idr-bgpls-segment-routing-epe and = draft-ietf-idr-bgpls-segment-routing-ext. =20 =20 If you agree that the RFC7752 needs a revision with improved security, = you can put that statement in your draft. I will be glad to help = =E2=80=9Cfast-track=E2=80=9D an RFC7752bis with the security issues = resolved. If this issue of critical importance to deployed code that is = important to operators, the IDR WG can move within 6-8 weeks. The next = IESG meeting this document can reach approval will be after IETF 103 (~6 = weeks). =20 =20 Shall we take the approach of adding a reference of RFC7752bis with = security issues to draft-ietf-idr-te-pm-bgp-13 or do you wish to engage = in a discussion thread where you prove a revision to RFC7752bis is not = required? =20 =20 Cheerily, Sue=20 =20 From: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]=20 Sent: Friday, October 19, 2018 11:57 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long before? =20 If you feel that RFC 7752 security needs revision I would appreciate it = if you state so clearly (to the WG =E2=80=93 not just to me) and in the = right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp. =20 Les =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 8:33 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 Thank you for responding to Robert=E2=80=99s post. =20 =20 Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information. The extension of the = scope beyond its stated scope might have trigger the current discussions = at that time. The authors indicated to the IDR chairs the RFC7752 scope = would not grow. =20 =20 As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft. As Shepherd, I do not agree with you that security = issues Yoav raises are specified in RFC7752. I =20 You are correct that there are many drafts (just BGP-LS extensions and = segment routing extensions that use BGP-LS). This draft is just the = first of a wave of drafts. It is appropriate to have a solution for = the security issues that covers all the drafts rather than go through = drafts one at a time. I suggest that a revision to RFC7752 that = addresses these issues is appropriate.=20 =20 If you are interested in discuss this topic with Yoav, Benjamin, and the = IDR WG =E2=80=93 shall we start a thread on this topic?=20 =20 Susan Hares=20 =20 =20 =20 =20 =20 =20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:52 AM To: Robert Raszuk; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert=E2=80=99s post addresses points I also want to make. =20 What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ). If this information = had already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been required. =20 In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. =20 I appreciate that from the POV of the Security Area you folks are not as = intimately familiar with the routing drafts and the relationship between = them. It is therefore understandable that you start looking at the new = draft as a standalone document =E2=80=93 and in that context your = comments are absolutely correct. But the document you are reviewing is = most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. The = issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. =20 I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time needlessly. =20 Les =20 =20 From: Robert Raszuk =20 Sent: Thursday, October 18, 2018 11:52 PM To: kaduk@mit.edu Cc: Les Ginsberg (ginsberg) ; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_0226_01D467A7.2C23CC90 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

The discussion was not with specifically with me, but with both IDR = chairs, the AD for routing, and the IESG. =C2=A0I am simply reporting = what happened during the approval process. = =C2=A0=C2=A0

 

Perhaps you have not been active in IDR for a while.=C2=A0 I stated = these concerns during the original RFC7752 discussion, but agreed that a = limited scope would limit my concerns.=C2=A0 As we have expanded these = drafts, =C2=A0=C2=A0I have repeated these concerns and in person to the = authors who discussed these issues with me at IETF IDR meetings. = =C2=A0=C2=A0You have not been at any of the in-person author discussions = at IETF.=C2=A0 Please see my comments on the list regarding BGP-LS = additions and SR routing drafts.

 

You felt that RFC7752 was sufficient to cover these drafts. =C2=A0I = stated clearly to you as a shepherd of your draft that you might wish to = upgrade your security section.=C2=A0 You felt it was sufficient.=C2=A0 = =C2=A0Therefore, I sent the draft to the security directorate for an = impartial review.=C2=A0

 

You are in this discussion because security directorate reviewer, = Yoav, pointed this issue regarding RFC7752 security. =C2=A0You feel it = is sufficient and my understanding of the discussion is that they do not = feel it is sufficient. =C2=A0=C2=A0=C2=A0

 

I do agree that the IDR WG should engage in a general solution is to = the queries from the security directorate on RFC7752 security.=C2=A0 It = is not specifically an issue specific to the draft-ietf-te-pm-bgp = draft.=C2=A0 I have made the same suggestion for a revision to RFC7752 = security to the draft-ietf-idr-bgpls-segment-routing-epe and = draft-ietf-idr-bgpls-segment-routing-ext.=C2=A0

 

If you agree that the RFC7752 needs a revision with improved = security, you can put that statement in your draft.=C2=A0 I will be glad = to help =E2=80=9Cfast-track=E2=80=9D an RFC7752bis with the security = issues resolved.=C2=A0 If this issue of critical importance to deployed = code that is important to operators, the IDR WG can move within 6-8 = weeks. =C2=A0The next IESG meeting this document can reach approval will = be after IETF 103 (~6 weeks).=C2=A0 =C2=A0=C2=A0

 

Shall we take the approach of adding a reference of RFC7752bis with = security issues to draft-ietf-idr-te-pm-bgp-13 or do you wish to engage = in a discussion thread where you prove a revision to RFC7752bis is not = required?=C2=A0 =C2=A0

 

Cheerily, Sue

 

From:= = Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]
Sent: = Friday, October 19, 2018 11:57 AM
To: Susan Hares; 'Robert = Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; = ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; = ynir.ietf@gmail.com
Subject: RE: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it  exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long = before?

 

If you feel that RFC 7752 security needs revision I would appreciate = it if you state so clearly (to the WG =E2=80=93 not just to me) and in = the right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp.

 

   Les

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 8:33 AM
To: Les Ginsberg (ginsberg) = <ginsberg@cisco.com>; 'Robert Raszuk' <robert@raszuk.net>; = kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; = ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; = ynir.ietf@gmail.com
Subject: RE: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

Thank you for responding to Robert=E2=80=99s post.  =

 

Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information.   The extension = of the scope beyond its stated scope might have trigger the current = discussions at that time.  The authors indicated to the IDR chairs = the RFC7752 scope would not grow.   

 

As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft.  As Shepherd, I do not agree with you that = security issues Yoav raises are specified in RFC7752. =   I

 

You are correct that there are many drafts (just BGP-LS extensions = and segment routing extensions that use BGP-LS).   This draft = is just the first of a wave of drafts.      It = is appropriate to have a solution for the security issues that covers = all the drafts rather than go through drafts one at a time. I suggest = that a revision to RFC7752 that addresses these issues is appropriate. =

 

If you are interested in discuss this topic with Yoav, Benjamin, and = the IDR WG =E2=80=93 shall we start a thread on this topic? =

 

Susan Hares

 

 

  

 

 

 

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:52 AM
To: Robert Raszuk; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert=E2=80=99s post addresses points I also want to = make.

 

What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the  BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ). If this information had = already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been = required.

 

In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752.

 

I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. = The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion.

 

I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time = needlessly.

 

   Les

 

 

From: Robert = Raszuk <robert@raszuk.net> =
Sent: Thursday, October 18, 2018 11:52 PM
To: kaduk@mit.edu
Cc: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_0226_01D467A7.2C23CC90-- From nobody Fri Oct 19 09:33:27 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BF73130E39; Fri, 19 Oct 2018 09:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.936 X-Spam-Level: ** X-Spam-Status: No, score=2.936 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z0zy-fWF9gny; Fri, 19 Oct 2018 09:33:23 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFFC7130F73; Fri, 19 Oct 2018 09:33:22 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'John E Drake'" , "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> In-Reply-To: Date: Fri, 19 Oct 2018 12:33:17 -0400 Message-ID: <023e01d467c9$713a98a0$53afc9e0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_023F_01D467A7.EA2CA220" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAUeOFiECtDA/VAGZqNHmAXwhzhqi6VHkkA== Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 16:33:26 -0000 This is a multipart message in MIME format. ------=_NextPart_000_023F_01D467A7.EA2CA220 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable John:=20 =20 I agree with you that this issue is not specific to = draft-ietf-idr-te-pm-bgp-13.txt, but should be taken up as a revision to = RFC7752. =20 =20 I disagree with you on the change of scope for RFC7752. This draft = (draft-ietf-idr-te-pm-bgp-13.txt) does add additional risk for the scope = of the attack surface on RFC7752 as it adds to the traffic engineering = information passed. =20 =20 Shall we agree on creating RFC7752bis that expands the security section? = I am glad to sponsor a =E2=80=9Cfast-track=E2=80=9D action on an = RFC7752bis.=20 =20 Yours respectfully,=20 Sue=20 =20 From: John E Drake [mailto:jdrake@juniper.net]=20 Sent: Friday, October 19, 2018 12:27 PM To: Les Ginsberg (ginsberg); Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hi, =20 I was a co-author of RFC 7471 and RFC 7810, which introduce a handful = of new TE metrics into the existing OSPF and IS-IS TE infrastructures. = The subject draft does exactly the same thing for the existing BGP-LS TE = infrastructure defined in RFC 7752. =20 =20 As Les correctly points out, if there are security issues with the = existing BGP-LS TE infrastructure or more generally with RFC 7752, then = those issues need to be addressed with a revision of that RFC and not = with this draft. I.e., this draft does not change the scope of RFC 7752 = in any way.=20 =20 Yours Irrespectively, =20 John =20 From: Idr On Behalf Of Les Ginsberg (ginsberg) Sent: Friday, October 19, 2018 11:57 AM To: Susan Hares ; 'Robert Raszuk' ; = kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long before? =20 If you feel that RFC 7752 security needs revision I would appreciate it = if you state so clearly (to the WG =E2=80=93 not just to me) and in the = right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp. =20 Les =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 8:33 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 Thank you for responding to Robert=E2=80=99s post. =20 =20 Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information. The extension of the = scope beyond its stated scope might have trigger the current discussions = at that time. The authors indicated to the IDR chairs the RFC7752 scope = would not grow. =20 =20 As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft. As Shepherd, I do not agree with you that security = issues Yoav raises are specified in RFC7752. I =20 You are correct that there are many drafts (just BGP-LS extensions and = segment routing extensions that use BGP-LS). This draft is just the = first of a wave of drafts. It is appropriate to have a solution for = the security issues that covers all the drafts rather than go through = drafts one at a time. I suggest that a revision to RFC7752 that = addresses these issues is appropriate.=20 =20 If you are interested in discuss this topic with Yoav, Benjamin, and the = IDR WG =E2=80=93 shall we start a thread on this topic?=20 =20 Susan Hares=20 =20 =20 =20 =20 =20 =20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:52 AM To: Robert Raszuk; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert=E2=80=99s post addresses points I also want to make. =20 What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 = ). If this information had already been defined in = the IGPs at the time RFC 7752 was written it would simply have been = included as a section of RFC 7752 and no additional changes to RFC 7752 = would have been required. =20 In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. =20 I appreciate that from the POV of the Security Area you folks are not as = intimately familiar with the routing drafts and the relationship between = them. It is therefore understandable that you start looking at the new = draft as a standalone document =E2=80=93 and in that context your = comments are absolutely correct. But the document you are reviewing is = most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. The = issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. =20 I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time needlessly. =20 Les =20 =20 From: Robert Raszuk =20 Sent: Thursday, October 18, 2018 11:52 PM To: kaduk@mit.edu Cc: Les Ginsberg (ginsberg) ; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_023F_01D467A7.EA2CA220 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

John:

 

I agree with you that this issue is not specific to = draft-ietf-idr-te-pm-bgp-13.txt, but should be taken up as a revision to = RFC7752.=C2=A0=C2=A0

 

I disagree with you on the change of scope for RFC7752.=C2=A0 This = draft (draft-ietf-idr-te-pm-bgp-13.txt) does add additional risk for the = scope of the attack surface on RFC7752 as it adds to the traffic = engineering information passed.=C2=A0

 

Shall we agree on creating RFC7752bis that expands the security = section? =C2=A0I am glad to sponsor a =E2=80=9Cfast-track=E2=80=9D = action on an RFC7752bis.

 

Yours respectfully,

Sue

 

From:= = John E Drake [mailto:jdrake@juniper.net]
Sent: Friday, = October 19, 2018 12:27 PM
To: Les Ginsberg (ginsberg); Susan = Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: ynir.ietf@gmail.com; = idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; = secdir@ietf.org
Subject: RE: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Hi,

 

I was a co-author of RFC 7471 and  RFC 7810, which introduce a = handful of new TE metrics into the existing OSPF and IS-IS TE = infrastructures.  The subject draft does exactly the same thing for = the existing BGP-LS TE infrastructure defined in RFC 7752.  =

 

As Les correctly points out, if there are security issues with the = existing BGP-LS TE infrastructure or more generally with RFC 7752, then = those issues need to be addressed with a revision of that RFC and not = with this draft.  I.e., this draft does not change the scope of RFC = 7752 in any way.

 

Yours Irrespectively,

 

John

 

From: Idr = <idr-bounces@ietf.org> On Behalf Of Les Ginsberg = (ginsberg)
Sent: Friday, October 19, 2018 11:57 = AM
To: Susan Hares <shares@ndzh.com>; 'Robert Raszuk' = <robert@raszuk.net>; kaduk@mit.edu
Cc: = ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; = secdir@ietf.org
Subject: Re: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it  exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long = before?

 

If you feel that RFC 7752 security needs revision I would appreciate = it if you state so clearly (to the WG =E2=80=93 not just to me) and in = the right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp.

 

   Les

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 8:33 AM
To: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

Thank you for responding to Robert=E2=80=99s post.  =

 

Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information.   The extension = of the scope beyond its stated scope might have trigger the current = discussions at that time.  The authors indicated to the IDR chairs = the RFC7752 scope would not grow.   

 

As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft.  As Shepherd, I do not agree with you that = security issues Yoav raises are specified in RFC7752. =   I

 

You are correct that there are many drafts (just BGP-LS extensions = and segment routing extensions that use BGP-LS).   This draft = is just the first of a wave of drafts.      It = is appropriate to have a solution for the security issues that covers = all the drafts rather than go through drafts one at a time. I suggest = that a revision to RFC7752 that addresses these issues is appropriate. =

 

If you are interested in discuss this topic with Yoav, Benjamin, and = the IDR WG =E2=80=93 shall we start a thread on this topic? =

 

Susan Hares

 

 

  

 

 

 

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:52 AM
To: Robert Raszuk; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert=E2=80=99s post addresses points I also want to = make.

 

What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the  BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see https://tools.ietf.org/= html/rfc7752#section-3.3.2 ). If this information had already been = defined in the IGPs at the time RFC 7752 was written it would simply = have been included as a section of RFC 7752 and no additional changes to = RFC 7752 would have been required.

 

In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752.

 

I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. = The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion.

 

I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time = needlessly.

 

   Les

 

 

From: Robert = Raszuk <robert@raszuk.net> =
Sent: Thursday, October 18, 2018 11:52 PM
To: kaduk@mit.edu
Cc: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_023F_01D467A7.EA2CA220-- From nobody Fri Oct 19 09:52:55 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3FD0131008; Fri, 19 Oct 2018 09:52:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.225 X-Spam-Level: * X-Spam-Status: No, score=1.225 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, KHOP_DYNAMIC=1.999, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nQsusf-jkOE0; Fri, 19 Oct 2018 09:52:41 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F0DF130FB1; Fri, 19 Oct 2018 09:52:41 -0700 (PDT) Received: from pps.filterd (m0108162.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9JGnFcl028349; Fri, 19 Oct 2018 09:52:37 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=jVvXu+XZny9fGc5ZdLIPnpDl9X4KaF63nj49DbM2AwI=; b=iQxmV98V/uKNo8SEYBER3NxNRRo0Jf1V9n1c0gmBbXDYTf2X/y2KCEMxGLwf6xo5HzRQ vH59J8wY6flKvTKBNCwYgsiWTSdQDGJVWYC6OZL8ozUhkfSrkmt8AfwOEU+/0Gs1wS+m Is8ARL0D3xDijEznDNHP7vrqp0ZGqDDXaEWYJvpPvTexhrVnFmZScdLM1NDsdXUEfwSn MRPB0m2UUQzfc5ZZpfioO9VNeYPytooN3lGuG7wS2KQ3TH2x2extJxXEU60cBpqYrv4L 1U11sL+mnKnOWu0e7viIqtidptu27QKp6bqx9+OHigSe0tvaO7YOA+1enTIJIfyvJilN 4A== Received: from nam01-bn3-obe.outbound.protection.outlook.com (mail-bn3nam01lp0181.outbound.protection.outlook.com [216.32.180.181]) by mx0b-00273201.pphosted.com with ESMTP id 2n7fbp0cn8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 19 Oct 2018 09:52:37 -0700 Received: from BN7PR05MB4354.namprd05.prod.outlook.com (52.133.223.33) by BN7PR05MB3924.namprd05.prod.outlook.com (52.132.216.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.13; Fri, 19 Oct 2018 16:52:33 +0000 Received: from BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012]) by BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012%4]) with mapi id 15.20.1250.028; Fri, 19 Oct 2018 16:52:33 +0000 From: John E Drake To: Susan Hares , "'Les Ginsberg (ginsberg)'" , 'Robert Raszuk' , "kaduk@mit.edu" CC: "ynir.ietf@gmail.com" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZwyQN9RQyXdy5EeaDRo0vfHjgKUltrcAgABrlwCAAIYPgIAAC38AgAAGv4CAAAVBAIAABOuAgAAEm6A= Date: Fri, 19 Oct 2018 16:52:33 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> <023e01d467c9$713a98a0$53afc9e0$@ndzh.com> In-Reply-To: <023e01d467c9$713a98a0$53afc9e0$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN7PR05MB3924; 6:NMaz6TkC+agDD97QiBibR67Rr/6W4GH9m+Ir2UdHfFkdXFqQ7g96KLDx6siP76WPENJhmTq0FjKLrD9GT15nNXFGgTpXR4dqI2wSB228CRFatx59VaGST9pOhK2pizGjA3KQgDOQdnIIPV8DPdCTAiGvQ4ahM2qsueNWEjZnJJSVpMZSIYyeL58aK3LwA3VJnpNNNBbp2DXmIzgbcIrnYKOkky3BiMcklofw9QcaxPmluRhrJJSQYHW5CeVFBZVeaYHQxQtVNQtWNl/CBQCPR/81GmTrNM8LMkpW/XiaMCHWqM7CuypHdBSJ3aSYDGZJJvROoNhwy4xfndRRwDnojjkLk0CrJyF3GJ889mif+48JbnsLk8r0RB9RgbV2Ukt5G3KrbfDzzInCkxCIuzPPBVMt585jcvz9xslPVmoQK+S+F1ljC4nEGiwSN6yS0E1Biwi9JUaKrtgGqM77CFWLdg==; 5:EHsiQqGPoKwSsbSEXjl9WyyWzS0YsIPU/hAu1zyMclIXdchG5bHxdQoX6UMPR82IwyNu5DWoKlRT1P93hFPV6Twabfq6VHDArlVGzNhqhcA4f0c+Jn0a5DqLOjK8ujNAbrT2s/NP+0Zr5na0Hb9NA4AUVPvXfjsOeSW+sDIkyuU=; 7:jbYb4Vvzt3wbHOWT+8v0xlVcqBO1gOGaaaOTNm5v+I6xP3yFpl/AoabdC1Q3x3LHb8MwK0/AJyXoWaIHvDyP5PzcmEmR17ZLIl3y/PVRrZfEKGFfDlnfxUuFvfaaG2oOxUHX3uxJa9yjcfLIrwzzWw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: cb07241a-59fd-4779-9d8d-08d635e34412 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:BN7PR05MB3924; x-ms-traffictypediagnostic: BN7PR05MB3924: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(163750095850)(138986009662008)(95692535739014)(240460790083961)(85827821059158)(192374486261705)(269456686620040)(21748063052155)(28532068793085)(190501279198761); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3002001)(3231355)(944501410)(52105095)(6055026)(148016)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(20161123562045)(20161123564045)(201708071742011)(7699051)(76991095); SRVR:BN7PR05MB3924; BCL:0; PCL:0; RULEID:; SRVR:BN7PR05MB3924; x-forefront-prvs: 0830866D19 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(136003)(376002)(396003)(39850400004)(52544003)(189003)(199004)(2906002)(33656002)(486006)(14444005)(3846002)(966005)(6116002)(790700001)(256004)(316002)(476003)(86362001)(478600001)(11346002)(68736007)(14454004)(93886005)(6246003)(446003)(97736004)(110136005)(54906003)(6346003)(81166006)(8676002)(81156014)(105586002)(2171002)(4326008)(19609705001)(2900100001)(53546011)(6506007)(2501003)(4744004)(102836004)(5250100002)(99286004)(7696005)(76176011)(25786009)(106356001)(5660300001)(39060400002)(236005)(9686003)(54896002)(6306002)(53936002)(606006)(66066001)(71190400001)(71200400001)(6436002)(7736002)(74316002)(8936002)(26005)(229853002)(55016002)(345774005)(186003); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR05MB3924; H:BN7PR05MB4354.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-microsoft-antispam-message-info: 2gy9D0KtxMEOgmhEmJiqkIyUXrHAp3usvjzTX6q3PNYPqio2RF/NKCjOLVsu8PV1kYijC8Nh2TXitU26KoICA+zoSEV0gB2HeWOD2E9nCIv/TG9ZgDAn9fW4OhUYG2Q60finZkMXxWS2pJZPmA353v1ov/0N7d0WlJb7dlzBf5RcFAtTn27bqJDMeWXoZKiGriajPUIadJTpCXBFfAjuvAFNYtnYmM7WgSGVcLw5Uanrg1UXNsmhF8FhEJ4d2Qsaueu98TLJP4asGHEaoitffc7uNskh2eNXo13+yac/ju1swNddll1Y95ZR7tgWCFGoJoNhDZW1x4LkbgawnobaV2Ve6HLi9y5FK2QAcg76imE= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN7PR05MB43543D3516A9BD3C125F1423C7F90BN7PR05MB4354namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: cb07241a-59fd-4779-9d8d-08d635e34412 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2018 16:52:33.3871 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB3924 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-10-19_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1810190149 Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 16:52:54 -0000 --_000_BN7PR05MB43543D3516A9BD3C125F1423C7F90BN7PR05MB4354namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VlLA0KDQpDb21tZW50cyBpbmxpbmUuDQoNCllvdXJzIElycmVzcGVjdGl2ZWx5LA0KDQpKb2hu DQoNCkZyb206IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb20+DQpTZW50OiBGcmlkYXksIE9j dG9iZXIgMTksIDIwMTggMTI6MzMgUE0NClRvOiBKb2huIEUgRHJha2UgPGpkcmFrZUBqdW5pcGVy Lm5ldD47ICdMZXMgR2luc2JlcmcgKGdpbnNiZXJnKScgPGdpbnNiZXJnQGNpc2NvLmNvbT47ICdS b2JlcnQgUmFzenVrJyA8cm9iZXJ0QHJhc3p1ay5uZXQ+OyBrYWR1a0BtaXQuZWR1DQpDYzogeW5p ci5pZXRmQGdtYWlsLmNvbTsgaWRyQGlldGYub3JnOyBpZXRmQGlldGYub3JnOyBkcmFmdC1pZXRm LWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBzZWNkaXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJF OiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC0xMw0KDQpKb2huOg0KDQpJIGFncmVlIHdpdGggeW91IHRoYXQgdGhpcyBpc3N1ZSBp cyBub3Qgc3BlY2lmaWMgdG8gZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzLnR4dCwgYnV0IHNo b3VsZCBiZSB0YWtlbiB1cCBhcyBhIHJldmlzaW9uIHRvIFJGQzc3NTIuDQoNCltKRF0gIEZpbmUg dy8gbWUNCg0KSSBkaXNhZ3JlZSB3aXRoIHlvdSBvbiB0aGUgY2hhbmdlIG9mIHNjb3BlIGZvciBS RkM3NzUyLiAgVGhpcyBkcmFmdCAoZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzLnR4dCkgZG9l cyBhZGQgYWRkaXRpb25hbCByaXNrIGZvciB0aGUgc2NvcGUgb2YgdGhlIGF0dGFjayBzdXJmYWNl IG9uIFJGQzc3NTIgYXMgaXQgYWRkcyB0byB0aGUgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1h dGlvbiBwYXNzZWQuDQoNCltKRF0gIFRoYXQgc291bmRzIHN1c3BpY2lvdXNseSBsaWtlIGFuIGFz c2VydGlvbg0KDQpTaGFsbCB3ZSBhZ3JlZSBvbiBjcmVhdGluZyBSRkM3NzUyYmlzIHRoYXQgZXhw YW5kcyB0aGUgc2VjdXJpdHkgc2VjdGlvbj8gIEkgYW0gZ2xhZCB0byBzcG9uc29yIGEg4oCcZmFz dC10cmFja+KAnSBhY3Rpb24gb24gYW4gUkZDNzc1MmJpcy4NCg0KW0pEXSAgRmluZSB3LyBtZQ0K DQpZb3VycyByZXNwZWN0ZnVsbHksDQpTdWUNCg0KRnJvbTogSm9obiBFIERyYWtlIFttYWlsdG86 amRyYWtlQGp1bmlwZXIubmV0XQ0KU2VudDogRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDEyOjI3 IFBNDQpUbzogTGVzIEdpbnNiZXJnIChnaW5zYmVyZyk7IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJh c3p1ayc7IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogeW5pci5pZXRm QGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT47IGlkckBpZXRmLm9yZzxtYWls dG86aWRyQGlldGYub3JnPjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IGRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBp ZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3 IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpIaSwNCg0KSSB3YXMgYSBjby1hdXRo b3Igb2YgUkZDIDc0NzEgYW5kICBSRkMgNzgxMCwgd2hpY2ggaW50cm9kdWNlIGEgaGFuZGZ1bCBv ZiBuZXcgVEUgbWV0cmljcyBpbnRvIHRoZSBleGlzdGluZyBPU1BGIGFuZCBJUy1JUyBURSBpbmZy YXN0cnVjdHVyZXMuICBUaGUgc3ViamVjdCBkcmFmdCBkb2VzIGV4YWN0bHkgdGhlIHNhbWUgdGhp bmcgZm9yIHRoZSBleGlzdGluZyBCR1AtTFMgVEUgaW5mcmFzdHJ1Y3R1cmUgZGVmaW5lZCBpbiBS RkMgNzc1Mi4NCg0KQXMgTGVzIGNvcnJlY3RseSBwb2ludHMgb3V0LCBpZiB0aGVyZSBhcmUgc2Vj dXJpdHkgaXNzdWVzIHdpdGggdGhlIGV4aXN0aW5nIEJHUC1MUyBURSBpbmZyYXN0cnVjdHVyZSBv ciBtb3JlIGdlbmVyYWxseSB3aXRoIFJGQyA3NzUyLCB0aGVuIHRob3NlIGlzc3VlcyBuZWVkIHRv IGJlIGFkZHJlc3NlZCB3aXRoIGEgcmV2aXNpb24gb2YgdGhhdCBSRkMgYW5kIG5vdCB3aXRoIHRo aXMgZHJhZnQuICBJLmUuLCB0aGlzIGRyYWZ0IGRvZXMgbm90IGNoYW5nZSB0aGUgc2NvcGUgb2Yg UkZDIDc3NTIgaW4gYW55IHdheS4NCg0KWW91cnMgSXJyZXNwZWN0aXZlbHksDQoNCkpvaG4NCg0K RnJvbTogSWRyIDxpZHItYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86aWRyLWJvdW5jZXNAaWV0Zi5v cmc+PiBPbiBCZWhhbGYgT2YgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykNClNlbnQ6IEZyaWRheSwg T2N0b2JlciAxOSwgMjAxOCAxMTo1NyBBTQ0KVG86IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5j b208bWFpbHRvOnNoYXJlc0BuZHpoLmNvbT4+OyAnUm9iZXJ0IFJhc3p1aycgPHJvYmVydEByYXN6 dWsubmV0PG1haWx0bzpyb2JlcnRAcmFzenVrLm5ldD4+OyBrYWR1a0BtaXQuZWR1PG1haWx0bzpr YWR1a0BtaXQuZWR1Pg0KQ2M6IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnluaXIuaWV0ZkBn bWFpbC5jb20+OyBpZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBpZXRmLm9yZz47IGlldGZAaWV0Zi5v cmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGll dGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgc2Vj ZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkcl0g W3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3At MTMNCg0KU3VlIOKAkw0KDQpJIHdhcyBub3QgYW4gYXV0aG9yIG9mIFJGQyA3NzUyIGFuZCBoYXZl IG5vIGlkZWEgd2hhdCBwcm9taXNlcyB0aGUgYXV0aG9ycyBtaWdodCBoYXZlIG1hZGUuIEkgd2ls bCBzYXkgdGhhdCBpdCBzZWVtcyB2ZXJ5IGxhdGUgaW4gdGhlIGdhbWUgZm9yIHlvdSB0byBzdWdn ZXN0IHRoYXQgdGhpcyBkb2N1bWVudCBzaG91bGQgbm90IGJlIGFsbG93ZWQgdG8gcHJvZ3Jlc3Mg YmVjYXVzZSBpdCAgZXhjZWVkcyBzb21lIGFncmVlbWVudCBvbiB0aGUgc2NvcGUgb2YgUkZDIDc3 NTIuIFdoeSB3ZXJlbuKAmXQgdGhlc2UgY29uY2VybnMgZXhwcmVzc2VkIGxvbmcgYmVmb3JlPw0K DQpJZiB5b3UgZmVlbCB0aGF0IFJGQyA3NzUyIHNlY3VyaXR5IG5lZWRzIHJldmlzaW9uIEkgd291 bGQgYXBwcmVjaWF0ZSBpdCBpZiB5b3Ugc3RhdGUgc28gY2xlYXJseSAodG8gdGhlIFdHIOKAkyBu b3QganVzdCB0byBtZSkgYW5kIGluIHRoZSByaWdodCBjb250ZXh0LiBTdWNoIHdvcmsgaXMgY2xl YXJseSBub3QgaW4gdGhlIHNjb3BlIG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC4NCg0KICAg TGVzDQoNCkZyb206IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb208bWFpbHRvOnNoYXJlc0Bu ZHpoLmNvbT4+DQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggODozMyBBTQ0KVG86IExl cyBHaW5zYmVyZyAoZ2luc2JlcmcpIDxnaW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNiZXJn QGNpc2NvLmNvbT4+OyAnUm9iZXJ0IFJhc3p1aycgPHJvYmVydEByYXN6dWsubmV0PG1haWx0bzpy b2JlcnRAcmFzenVrLm5ldD4+OyBrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0K Q2M6IGlkckBpZXRmLm9yZzxtYWlsdG86aWRyQGlldGYub3JnPjsgc2VjZGlyQGlldGYub3JnPG1h aWx0bzpzZWNkaXJAaWV0Zi5vcmc+OyBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGlldGYub3Jn PjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0 Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRv OnluaXIuaWV0ZkBnbWFpbC5jb20+DQpTdWJqZWN0OiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGly IGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KTGVzOg0KDQpU aGFuayB5b3UgZm9yIHJlc3BvbmRpbmcgdG8gUm9iZXJ04oCZcyBwb3N0Lg0KDQpZb3VyIGFyZ3Vt ZW50IHRoYXQgdGhpcyBpbmZvcm1hdGlvbiB3b3VsZCBoYXZlIGFkZGVkIHRvIFJGQzc3NTIgaXMg b24g4oCcdGhpbiBpY2XigJ0gYXMgdGhlIElFU0cgaW4gdGhlaXIgYXBwcm92YWwgb2YgUkZDNzc1 MiB3YXMgY29uY2VybmVkIGFib3V0IHRoZSBzY29wZSBvZiB0aGUgaW5mb3JtYXRpb24uICAgVGhl IGV4dGVuc2lvbiBvZiB0aGUgc2NvcGUgYmV5b25kIGl0cyBzdGF0ZWQgc2NvcGUgbWlnaHQgaGF2 ZSB0cmlnZ2VyIHRoZSBjdXJyZW50IGRpc2N1c3Npb25zIGF0IHRoYXQgdGltZS4gIFRoZSBhdXRo b3JzIGluZGljYXRlZCB0byB0aGUgSURSIGNoYWlycyB0aGUgUkZDNzc1MiBzY29wZSB3b3VsZCBu b3QgZ3Jvdy4NCg0KQXMgc2hlcGhlcmQgSSByZXF1ZXN0ZWQgdGhpcyBkcmFmdCB0byBiZSByZXZp ZXdlZCBieSB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgYmVjYXVzZSB3ZSBhcmUgZ29pbmcgYmV5 b25kIHRoZSBvcmlnaW5hbCBzY29wZSBvZiBSRkM3NzUyIHdpdGggdGhpcyBkcmFmdC4gIEFzIFNo ZXBoZXJkLCBJIGRvIG5vdCBhZ3JlZSB3aXRoIHlvdSB0aGF0IHNlY3VyaXR5IGlzc3VlcyBZb2F2 IHJhaXNlcyBhcmUgc3BlY2lmaWVkIGluIFJGQzc3NTIuICAgSQ0KDQpZb3UgYXJlIGNvcnJlY3Qg dGhhdCB0aGVyZSBhcmUgbWFueSBkcmFmdHMgKGp1c3QgQkdQLUxTIGV4dGVuc2lvbnMgYW5kIHNl Z21lbnQgcm91dGluZyBleHRlbnNpb25zIHRoYXQgdXNlIEJHUC1MUykuICAgVGhpcyBkcmFmdCBp cyBqdXN0IHRoZSBmaXJzdCBvZiBhIHdhdmUgb2YgZHJhZnRzLiAgICAgIEl0IGlzIGFwcHJvcHJp YXRlIHRvIGhhdmUgYSBzb2x1dGlvbiBmb3IgdGhlIHNlY3VyaXR5IGlzc3VlcyB0aGF0IGNvdmVy cyBhbGwgdGhlIGRyYWZ0cyByYXRoZXIgdGhhbiBnbyB0aHJvdWdoIGRyYWZ0cyBvbmUgYXQgYSB0 aW1lLiBJIHN1Z2dlc3QgdGhhdCBhIHJldmlzaW9uIHRvIFJGQzc3NTIgdGhhdCBhZGRyZXNzZXMg dGhlc2UgaXNzdWVzIGlzIGFwcHJvcHJpYXRlLg0KDQpJZiB5b3UgYXJlIGludGVyZXN0ZWQgaW4g ZGlzY3VzcyB0aGlzIHRvcGljIHdpdGggWW9hdiwgQmVuamFtaW4sIGFuZCB0aGUgSURSIFdHIOKA kyBzaGFsbCB3ZSBzdGFydCBhIHRocmVhZCBvbiB0aGlzIHRvcGljPw0KDQpTdXNhbiBIYXJlcw0K DQoNCg0KDQoNCg0KDQoNCkZyb206IElkciBbbWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnXSBP biBCZWhhbGYgT2YgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykNClNlbnQ6IEZyaWRheSwgT2N0b2Jl ciAxOSwgMjAxOCAxMDo1MiBBTQ0KVG86IFJvYmVydCBSYXN6dWs7IGthZHVrQG1pdC5lZHU8bWFp bHRvOmthZHVrQG1pdC5lZHU+DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+ OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8 bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYu b3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgeW5pci5p ZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT4NClN1YmplY3Q6IFJlOiBb SWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBt LWJncC0xMw0KDQpSb2JlcnTigJlzIHBvc3QgYWRkcmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0 byBtYWtlLg0KDQpXaGF0IGlzIGJlaW5nIGRvbmUgaGVyZSBpcyB0byBhZGQgYWRkaXRpb25hbCBC R1AtTFMgY29kZXBvaW50cyB0byBhZHZlcnRpc2UgSUdQIGluZm9ybWF0aW9uIHRoYXQgd2FzIG5v dCBkZWZpbmVkIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuLiBXZSBoYXZlbuKAmXQg Y2hhbmdlZCB0aGUgIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIOKAkyBub3IgaXMgdGhlIGlu Zm9ybWF0aW9uIGJlaW5nIGFkdmVydGlzZWQgaGVyZSAoc29tZSBhZGRpdGlvbmFsIFRFIHJlbGF0 ZWQgbGluayBhdHRyaWJ1dGUgaW5mb3JtYXRpb24pIHF1YWxpdGF0aXZlbHkgZGlmZmVyZW50IHRo YW4gYSBudW1iZXIgb2YgZXhpc3RpbmcgVExWcyBkZWZpbmVkIGluIFJGQyA3NzUyIChzZWUgaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3NTIjc2VjdGlvbi0zLjMuMjxodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3Jn X2h0bWxfcmZjNzc1Mi0yM3NlY3Rpb24tMkQzLjMuMiZkPUR3TUdhUSZjPUhBa1l1aDYzcnN1aHI2 U2NiZmgwVWpCWGVNSy1uZGIzdm9EVFhjV3pvQ0kmcj1DUkIydEppUWVQazBjVC1oNUxHaEVXSC1z X3hYWHVwM0h6dkJTTVJqNVZFJm09bnBuX2dZbTZkUWhyenR1ckdmdm9XWDZsN3lqOThMOEIzUkV5 cG9JSEpLcyZzPThud0JWTWg1ME5BWFk2U1Q4SE9ZUXM0WFktbFBDSkM1bjNrOHVLRmxXNHcmZT0+ ICkuIElmIHRoaXMgaW5mb3JtYXRpb24gaGFkIGFscmVhZHkgYmVlbiBkZWZpbmVkIGluIHRoZSBJ R1BzIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuIGl0IHdvdWxkIHNpbXBseSBoYXZl IGJlZW4gaW5jbHVkZWQgYXMgYSBzZWN0aW9uIG9mIFJGQyA3NzUyIGFuZCBubyBhZGRpdGlvbmFs IGNoYW5nZXMgdG8gUkZDIDc3NTIgd291bGQgaGF2ZSBiZWVuIHJlcXVpcmVkLg0KDQpJbiB0aGVv cnksIHdlIGNvdWxkIGhhdmUgc2ltcGx5IHVwZGF0ZWQgUkZDIDc3NTIgcmF0aGVyIHdyaXRpbmcg YSBzZXBhcmF0ZSBkcmFmdCwgYnV0IHByYWN0aWNhbGx5IHRoaXMgd291bGQgYmUgYSBwb29yIHN0 cmF0ZWd5IGFzIGl0IHdvdWxkIGluY29ycmVjdGx5IHN1Z2dlc3QgdGhhdCBzb21lIGNoYW5nZSB3 YXMgYmVpbmcgbWFkZSB0byB0aGUgZXhpc3RpbmcgdGV4dCBpbiBSRkMgNzc1Mi4NCg0KSSBhcHBy ZWNpYXRlIHRoYXQgZnJvbSB0aGUgUE9WIG9mIHRoZSBTZWN1cml0eSBBcmVhIHlvdSBmb2xrcyBh cmUgbm90IGFzIGludGltYXRlbHkgZmFtaWxpYXIgd2l0aCB0aGUgcm91dGluZyBkcmFmdHMgYW5k IHRoZSByZWxhdGlvbnNoaXAgYmV0d2VlbiB0aGVtLiBJdCBpcyB0aGVyZWZvcmUgdW5kZXJzdGFu ZGFibGUgdGhhdCB5b3Ugc3RhcnQgbG9va2luZyBhdCB0aGUgbmV3IGRyYWZ0IGFzIGEgc3RhbmRh bG9uZSBkb2N1bWVudCDigJMgYW5kIGluIHRoYXQgY29udGV4dCB5b3VyIGNvbW1lbnRzIGFyZSBh YnNvbHV0ZWx5IGNvcnJlY3QuIEJ1dCB0aGUgZG9jdW1lbnQgeW91IGFyZSByZXZpZXdpbmcgaXMg bW9zdCBhY2N1cmF0ZWx5IHNlZW4gYXMgYW4g4oCcYWRkZW5kdW3igJ0gdG8gUkZDIDc3NTIuIFRo ZSBpc3N1ZXMgeW91IHJhaXNlIGhhdmUgYWxyZWFkeSBiZWVuIGFkZHJlc3NlZCBpbiBSRkMgNzc1 MiBhbmQgaXQgaXMgdGhlcmVmb3JlIHZlcnkgYXBwcm9wcmlhdGUgdGhhdCB3ZSBhZGRyZXNzIHlv dXIgY29uY2VybnMgYnkgaW5jbHVkaW5nIGEgcmVmZXJlbmNlIHRvIHRoZSBSRkMgNzc1MiBzZWN1 cml0eSBkaXNjdXNzaW9uLg0KDQpJIHRoaW5rIGl0IGlzIGltcG9ydGFudCB0aGF0IHlvdSBub3Rl IHRoaXMgcmVsYXRpb25zaGlwLCBiZWNhdXNlIHRoZSBuYXR1cmUgb2YgQkdQLUxTIGlzIHRoYXQg d2hlbmV2ZXIgSUdQIGV4dGVuc2lvbnMgYXJlIGRlZmluZWQgdG8gYWR2ZXJ0aXNlIG5ldyBpbmZv cm1hdGlvbiBpdCBpcyBuZWNlc3NhcnkgdG8gZGVmaW5lIGNvcnJlc3BvbmRpbmcgQkdQLUxTIGNv ZGVwb2ludHMuIFRoaXMgaXMgbm90IHRoZSBmaXJzdCBzdWNoIEJHUC1MUyBleHRlbnNpb24gZG9j dW1lbnQg4oCTIGFuZCBpdCBpcyBzYWZlIHRvIHNheSBpdCB3b27igJl0IGJlIHRoZSBsYXN0LiBJ dCB3b3VsZCBiZSBoZWxwZnVsIHRvIGFsbCBpZiB3ZSByZWFjaGVkIGEgY29tbW9uIHVuZGVyc3Rh bmRpbmcgb3IgdGhpcyBkaXNjdXNzaW9uIHdpbGwgdGFrZSBwbGFjZSBldmVyeSB0aW1lIGEgQkdQ LUxTIGV4dGVuc2lvbiBkb2N1bWVudCBpcyBiZWluZyByZXZpZXdlZCDigJMgd2hpY2ggd2lsbCBj b3N0IHVzIGFsbCB0aW1lIG5lZWRsZXNzbHkuDQoNCiAgIExlcw0KDQoNCkZyb206IFJvYmVydCBS YXN6dWsgPHJvYmVydEByYXN6dWsubmV0PG1haWx0bzpyb2JlcnRAcmFzenVrLm5ldD4+DQpTZW50 OiBUaHVyc2RheSwgT2N0b2JlciAxOCwgMjAxOCAxMTo1MiBQTQ0KVG86IGthZHVrQG1pdC5lZHU8 bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNi ZXJnQGNpc2NvLmNvbTxtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tPj47IGlkckBpZXRmLm9yZzxt YWlsdG86aWRyQGlldGYub3JnPjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9y ZzxtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZz47IGlldGZAaWV0 Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5 bmlyLmlldGZAZ21haWwuY29tPjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KSGVsbG8gQmVuamFtaW4sDQoNCk5vdCBzdXJl IGlmIHlvdSBoYXZlIHNwb3R0ZWQgc2ltaWxhciBjb21tZW50IG1hZGUgdG8gSURSIHJlZ2FyZGlu ZyB0aGlzIHRvcGljLCBidXQgeW91ciBjb21tZW50IHNlZW1zIHRvIGluZGljYXRlIHRoYXQgaGVy ZSB3ZSBhcmUgYWJvdXQgdG8gZGVmaW5lIHdheXMgdG8gY2FycnkgbmljZWx5IHNjb3BlZCBJR1Ag aW5mb3JtYXRpb24gaW50byBCR1AuIFdlbGwgdGhhdCBoYXMgYWxyZWFkeSBoYXBwZW5lZCB3aXRo IFJGQzc3NTIgYW5kIHlvdXIgY29tbWVudCBvciBmb3IgdGhhdCBtYXR0ZXIgWW9hdidzIHJlbWFy a3MgYXJlIGluZGVlZCBzcG90IG9uIGJ1dCB0byB0aGUgc2VjdXJpdHkgZGlzY3Vzc2lvbiBvbiBS RkM3NzUyIGFuZCBJTU8gbm90IGFueSBmb2xsb3cgdXAgZXh0ZW5zaW9ucyBvZiBpdC4NCg0KU3Vy ZSAtIGFzIG9ic2VydmVkIGJ5IFN1ZSAtIG9uZSBtYXkgYXJndWUgdGhhdCBwcm92aWRpbmcgbW9y ZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yayB0byB0aGUgcG90ZW50aWFsIGF0dGFja2Vy IG1ha2VzIHRoZSBuZXR3b3JrIHdlYWtlciwgYnV0IHRoZSBjdXJlIGZvciB0aGF0IGlzIHRvIHBy ZXZlbnQgdGhlIGxlYWtzIGFuZCByZWR1Y2UgcHJvYmFiaWxpdHkgb2YgaW50ZXJjZXB0aW5nIG5l dyBpbmZvcm1hdGlvbiBieSB1bmF1dGhvcml6ZWQgcGFydGllcy4NCg0KQkdQLUxTIGlzIGFscmVh ZHkgZGVmaW5lZCBpbiBhIG5ldyBTQUZJIHdoYXQgYnkgaXRzZWxmIGRvZXMgcHJvdmlkZSBuaWNl IGxldmVsIG9mIGlzb2xhdGlvbi4gUkZDNzc1MiBpcyBwcmV0dHkgY2xlYXIgb24gdGhhdCB0b28g YW5kIHNheXM6DQoNCiJCR1AgcGVlcmluZ3MgYXJlIG5vdCBhdXRvbWF0aWMgYW5kIHJlcXVpcmUg Y29uZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJlc3BvbnNpYmlsaXR5IG9mIHRoZSBuZXR3 b3JrIG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkgdHJ1c3RlZCBjb25zdW1lcnMgYXJlIGNv bmZpZ3VyZWQgdG8gcmVjZWl2ZSBzdWNoIGluZm9ybWF0aW9uLiINCg0KSWYgc29tZW9uZSB3b3Vs ZCBiZSBzdGlsbCBjb25jZXJuZWQgYWJvdXQgY29uZmlndXJhdGlvbiBtaXN0YWtlcyBhbmQgbmVn b3RpYXRpbmcgU0FGSSA3MSBvciA3MiB0byB0aG9zZSB3aG8gc2hvdWxkIG5vdCBnZXQgdGhpcyBk YXRhIEkgcmVjb21tZW5kIHdlIHJlaXNzdWUgdGhlIFJGQzc3NTIgYXMgLWJpcyB2ZXJzaW9uIGFu ZCByZXN0cmljdCB0aGUgc2NvcGUgb2YgdGhlIGRpc3RyaWJ1dGlvbiBldmVuIGZ1cnRoZXIgYnkg bWFuZGF0aW5nIGRlZmF1bHQgdXNlIG9mIE5PLUVYUE9SVCBjb21tdW5pdHkgd2l0aCBhYmlsaXR5 IHRvIG92ZXJ3cml0ZSBpdCBmb3IgdGhlIHNlbGVjdGl2ZSBlQkdQIHBlZXJzLiBPciBwZXJoYXBz IHdlIGNvdWxkIHByb2dyZXNzIEppbSdzIE9uZSBBZG1pbmlzdHJhdGl2ZSBEb21haW4gZHJhZnQg KGRyYWZ0LXV0dGFyby1pZHItb2FkLTAxKS4NCg0KSW4gZWl0aGVyIGNhc2Ugd2hpbGUgYm90aCBv ZiB5b3VyIGNvbW1lbnRzIGFyZSBncmVhdCB0aGV5IHNlZW1zIGEgYml0IGxhdGUgaW4gdGhlIGdh bWUgaGVyZSBvciBhdCBsZWFzdCB0YXJnZXRpbmcgd3JvbmcgZG9jdW1lbnQuDQoNCktpbmQgcmVn YXJkcywNClJvYmVydC4NCg0KDQpPbiBGcmksIE9jdCAxOSwgMjAxOCBhdCAyOjI3IEFNIEJlbmph bWluIEthZHVrIDxrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pj4gd3JvdGU6DQpP biBUaHUsIE9jdCAxOCwgMjAxOCBhdCAwNjowMDoxM1BNICswMDAwLCBMZXMgR2luc2JlcmcgKGdp bnNiZXJnKSB3cm90ZToNCj4gWW9hdiDigJMNCj4NCj4gSW4gcmVnYXJkcyB0byB0aGUgcmlza3Mg YXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5nIHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbiBjb3Zl cmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBhIHN0YXRlbWVudCBpbiB0aGUgSUdQIGRyYWZ0czoN Cj4NCj4gRnJvbSBSRkM3ODEwDQo+DQo+IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGluIHRo aXMgZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0b3IgdG8NCj4gICAgYWR2ZXJ0aXNlIHN0YXRlIGlu Zm9ybWF0aW9uIG9mIGxpbmtzIChiYW5kd2lkdGgsIGRlbGF5KSB0aGF0IGNvdWxkIGJlDQo+ICAg IHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90IHdhbnQgdG8gZGlzY2xvc2Uu 4oCdDQo+DQo+IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBzZW5kaW5n IGluZm9ybWF0aW9uIHZpYSBCR1AtTFMgd2UgaGF2ZSBhIG51bWJlciBvZiBzdGF0ZW1lbnRzIGlu IFJGQyA3NzUyIOKAkyBtb3N0IHJlbGV2YW50IGlzOg0KPg0KPiDigJxBZGRpdGlvbmFsbHksIGl0 IG1heSBiZSBjb25zaWRlcmVkIHRoYXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZA0KPiAg ICBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVudCBjb25zdGl0dXRl cyBhIHJpc2sgdG8NCj4gICAgY29uZmlkZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3Ig Y29tbWVyY2lhbGx5IHNlbnNpdGl2ZQ0KPiAgICBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29y ay7igJ0NCj4NCj4gU28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJ R1AgUkZDcyBhbmQgUkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVy c3RhbmQgd2hhdCBlbHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuDQo+IENlcnRhaW5seSB0aGUg cmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBCR1AtTFMgdHJhbnNwb3J0IG1lY2hhbmlzbSBhcmUg bm90IGFsdGVyZWQgYnkgYWRkaW5nIHNvbWUgbmV3IFRMVnMg4oCTIGFuZCBzaW5jZSB0aGUgSUdQ IFJGQ3MgaGF2ZSBhbHJlYWR5IGNvdmVyZWQgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBzcGVj aWZpYyBjbGFzcyBvZiBpbmZvcm1hdGlvbiAobm90IHNpbXBseSB0aGUgcmlza3MgYXNzb2NpYXRl ZCB3aXRoIHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRvIGhhdmUgdG8g cHJvdmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkgYmUgc2FpZCB0 aGF0IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuDQoNCk15IGFwb2xv Z2llcyBmb3IganVtcGluZyBpbiBpbiB0aGUgbWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQIFJGQ3Mg aGF2ZQ0KY292ZXJlZCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGEgc3BlY2lmaWMgY2xhc3Mg b2YgaW5mb3JtYXRpb24sICp1bmRlcg0KdGhlIGFzc3VtcHRpb24gdGhhdCB0aGUgdHJhbnNwb3J0 IG1lY2hhbmlzbSBpcyB3aXRoaW4gYSBzaW5nbGUgQVMgYW5kDQphZG1pbmlzdHJhdGl2ZSBkb21h aW4qLiAgWW9hdiBpcyBwb2ludGluZyBvdXQgdGhhdCB0aGUgcmlza3MgZm9yIHRoYXQNCmluZm9y bWF0aW9uIG1heSBjaGFuZ2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVy IGRvbWFpbiB0aGFuDQp0aGUgb25lIGZvciB3aGljaCB0aGUgcHJldmlvdXMgYW5hbHlzaXMgd2Fz IHBlcmZvcm1lZC4NCg0KLUJlbg0K --_000_BN7PR05MB43543D3516A9BD3C125F1423C7F90BN7PR05MB4354namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u RW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0K c3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5 bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBp biAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+U3VlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+Q29tbWVudHMgaW5saW5lLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdXJzIElycmVzcGVjdGl2ZWx5LDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Sm9objxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU3Vz YW4gSGFyZXMgJmx0O3NoYXJlc0BuZHpoLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlk YXksIE9jdG9iZXIgMTksIDIwMTggMTI6MzMgUE08YnI+DQo8Yj5Ubzo8L2I+IEpvaG4gRSBEcmFr ZSAmbHQ7amRyYWtlQGp1bmlwZXIubmV0Jmd0OzsgJ0xlcyBHaW5zYmVyZyAoZ2luc2JlcmcpJyAm bHQ7Z2luc2JlcmdAY2lzY28uY29tJmd0OzsgJ1JvYmVydCBSYXN6dWsnICZsdDtyb2JlcnRAcmFz enVrLm5ldCZndDs7IGthZHVrQG1pdC5lZHU8YnI+DQo8Yj5DYzo8L2I+IHluaXIuaWV0ZkBnbWFp bC5jb207IGlkckBpZXRmLm9yZzsgaWV0ZkBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwLmFsbEBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJF OiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Kb2huOg0KPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIGFncmVlIHdpdGggeW91IHRoYXQgdGhpcyBpc3N1 ZSBpcyBub3Qgc3BlY2lmaWMgdG8gZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzLnR4dCwgYnV0 IHNob3VsZCBiZSB0YWtlbiB1cCBhcyBhIHJldmlzaW9uIHRvIFJGQzc3NTIuJm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PltKRF0mbmJzcDsgRmluZSB3LyBtZQ0KPC9zcGFuPjwvaT48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ SSBkaXNhZ3JlZSB3aXRoIHlvdSBvbiB0aGUgY2hhbmdlIG9mIHNjb3BlIGZvciBSRkM3NzUyLiZu YnNwOyBUaGlzIGRyYWZ0IChkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMudHh0KSBkb2VzIGFk ZCBhZGRpdGlvbmFsIHJpc2sgZm9yIHRoZSBzY29wZSBvZiB0aGUgYXR0YWNrIHN1cmZhY2UNCiBv biBSRkM3NzUyIGFzIGl0IGFkZHMgdG8gdGhlIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRp b24gcGFzc2VkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5bSkRdJm5ic3A7IFRoYXQgc291bmRzIHN1c3BpY2lvdXNseSBsaWtl IGFuIGFzc2VydGlvbjwvc3Bhbj48L2k+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlNoYWxsIHdlIGFn cmVlIG9uIGNyZWF0aW5nIFJGQzc3NTJiaXMgdGhhdCBleHBhbmRzIHRoZSBzZWN1cml0eSBzZWN0 aW9uPyAmbmJzcDtJIGFtIGdsYWQgdG8gc3BvbnNvciBhIOKAnGZhc3QtdHJhY2vigJ0gYWN0aW9u IG9uIGFuIFJGQzc3NTJiaXMuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+W0pEXSZuYnNwOyBGaW5lIHcvIG1lDQo8L3NwYW4+ PC9pPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Zb3VycyByZXNwZWN0ZnVsbHksDQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+U3VlDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1 QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rh aG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBK b2huIEUgRHJha2UgWzxhIGhyZWY9Im1haWx0bzpqZHJha2VAanVuaXBlci5uZXQiPm1haWx0bzpq ZHJha2VAanVuaXBlci5uZXQ8L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2Jl ciAxOSwgMjAxOCAxMjoyNyBQTTxicj4NCjxiPlRvOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVy Zyk7IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJhc3p1ayc7IDxhIGhyZWY9Im1haWx0bzprYWR1a0Bt aXQuZWR1Ij4NCmthZHVrQG1pdC5lZHU8L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWls dG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47IDxhIGhyZWY9 Im1haWx0bzppZHJAaWV0Zi5vcmciPg0KaWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRv OmlldGZAaWV0Zi5vcmciPmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQt aWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1i Z3AuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+c2Vj ZGlyQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0lkcl0gW3NlY2Rpcl0g U2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+SGksPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5JIHdhcyBhIGNvLWF1dGhvciBvZiBSRkMgNzQ3MSBhbmQmbmJzcDsgUkZDIDc4MTAsIHdo aWNoIGludHJvZHVjZSBhIGhhbmRmdWwgb2YgbmV3IFRFIG1ldHJpY3MgaW50byB0aGUgZXhpc3Rp bmcgT1NQRiBhbmQgSVMtSVMgVEUgaW5mcmFzdHJ1Y3R1cmVzLiZuYnNwOyBUaGUgc3ViamVjdCBk cmFmdA0KIGRvZXMgZXhhY3RseSB0aGUgc2FtZSB0aGluZyBmb3IgdGhlIGV4aXN0aW5nIEJHUC1M UyBURSBpbmZyYXN0cnVjdHVyZSBkZWZpbmVkIGluIFJGQyA3NzUyLiZuYnNwOw0KPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5BcyBMZXMgY29ycmVjdGx5IHBvaW50 cyBvdXQsIGlmIHRoZXJlIGFyZSBzZWN1cml0eSBpc3N1ZXMgd2l0aCB0aGUgZXhpc3RpbmcgQkdQ LUxTIFRFIGluZnJhc3RydWN0dXJlIG9yIG1vcmUgZ2VuZXJhbGx5IHdpdGggUkZDIDc3NTIsIHRo ZW4gdGhvc2UgaXNzdWVzIG5lZWQgdG8NCiBiZSBhZGRyZXNzZWQgd2l0aCBhIHJldmlzaW9uIG9m IHRoYXQgUkZDIGFuZCBub3Qgd2l0aCB0aGlzIGRyYWZ0LiZuYnNwOyBJLmUuLCB0aGlzIGRyYWZ0 IGRvZXMgbm90IGNoYW5nZSB0aGUgc2NvcGUgb2YgUkZDIDc3NTIgaW4gYW55IHdheS4NCjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdXJzIElycmVz cGVjdGl2ZWx5LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Sm9o bjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFk ZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gSWRyICZsdDs8YSBocmVmPSJtYWlsdG86aWRyLWJvdW5jZXNA aWV0Zi5vcmciPmlkci1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8 L2I+TGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3Rv YmVyIDE5LCAyMDE4IDExOjU3IEFNPGJyPg0KPGI+VG86PC9iPiBTdXNhbiBIYXJlcyAmbHQ7PGEg aHJlZj0ibWFpbHRvOnNoYXJlc0BuZHpoLmNvbSI+c2hhcmVzQG5kemguY29tPC9hPiZndDs7ICdS b2JlcnQgUmFzenVrJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJvYmVydEByYXN6dWsubmV0Ij5yb2Jl cnRAcmFzenVrLm5ldDwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmthZHVrQG1pdC5lZHUiPmth ZHVrQG1pdC5lZHU8L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86eW5pci5pZXRm QGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzppZHJA aWV0Zi5vcmciPg0KaWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5v cmciPmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUt cG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYu b3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+c2VjZGlyQGlldGYub3Jn PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5 IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+U3VlIOKAkzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB3 YXMgbm90IGFuIGF1dGhvciBvZiBSRkMgNzc1MiBhbmQgaGF2ZSBubyBpZGVhIHdoYXQgcHJvbWlz ZXMgdGhlIGF1dGhvcnMgbWlnaHQgaGF2ZSBtYWRlLiBJIHdpbGwgc2F5IHRoYXQgaXQgc2VlbXMg dmVyeSBsYXRlIGluIHRoZSBnYW1lIGZvciB5b3UgdG8gc3VnZ2VzdA0KIHRoYXQgdGhpcyBkb2N1 bWVudCBzaG91bGQgbm90IGJlIGFsbG93ZWQgdG8gcHJvZ3Jlc3MgYmVjYXVzZSBpdCZuYnNwOyBl eGNlZWRzIHNvbWUgYWdyZWVtZW50IG9uIHRoZSBzY29wZSBvZiBSRkMgNzc1Mi4gV2h5IHdlcmVu 4oCZdCB0aGVzZSBjb25jZXJucyBleHByZXNzZWQgbG9uZyBiZWZvcmU/PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB5b3UgZmVlbCB0aGF0IFJGQyA3NzUyIHNl Y3VyaXR5IG5lZWRzIHJldmlzaW9uIEkgd291bGQgYXBwcmVjaWF0ZSBpdCBpZiB5b3Ugc3RhdGUg c28gY2xlYXJseSAodG8gdGhlIFdHIOKAkyBub3QganVzdCB0byBtZSkgYW5kIGluIHRoZSByaWdo dCBjb250ZXh0LiBTdWNoIHdvcmsNCiBpcyBjbGVhcmx5IG5vdCBpbiB0aGUgc2NvcGUgb2YgZHJh ZnQtaWV0Zi1pZHItdGUtcG0tYmdwLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFN1c2FuIEhhcmVzICZsdDs8YSBo cmVmPSJtYWlsdG86c2hhcmVzQG5kemguY29tIj5zaGFyZXNAbmR6aC5jb208L2E+Jmd0Ow0KPGJy Pg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA4OjMzIEFNPGJyPg0KPGI+ VG86PC9iPiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmdpbnNi ZXJnQGNpc2NvLmNvbSI+Z2luc2JlcmdAY2lzY28uY29tPC9hPiZndDs7ICdSb2JlcnQgUmFzenVr JyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJvYmVydEByYXN6dWsubmV0Ij5yb2JlcnRAcmFzenVrLm5l dDwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8 L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0 Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86c2VjZGlyQGlldGYub3JnIj4NCnNlY2RpckBpZXRm Lm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3JnPC9h PjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmci Pg0KZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1h aWx0bzp5bmlyLmlldGZAZ21haWwuY29tIj55bmlyLmlldGZAZ21haWwuY29tPC9hPjxicj4NCjxi PlN1YmplY3Q6PC9iPiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+TGVzOjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmsgeW91IGZvciByZXNw b25kaW5nIHRvIFJvYmVydOKAmXMgcG9zdC4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+WW91ciBhcmd1bWVudCB0aGF0IHRoaXMgaW5mb3JtYXRpb24g d291bGQgaGF2ZSBhZGRlZCB0byBSRkM3NzUyIGlzIG9uIOKAnHRoaW4gaWNl4oCdIGFzIHRoZSBJ RVNHIGluIHRoZWlyIGFwcHJvdmFsIG9mIFJGQzc3NTIgd2FzIGNvbmNlcm5lZCBhYm91dCB0aGUg c2NvcGUgb2YgdGhlDQogaW5mb3JtYXRpb24uJm5ic3A7Jm5ic3A7IFRoZSBleHRlbnNpb24gb2Yg dGhlIHNjb3BlIGJleW9uZCBpdHMgc3RhdGVkIHNjb3BlIG1pZ2h0IGhhdmUgdHJpZ2dlciB0aGUg Y3VycmVudCBkaXNjdXNzaW9ucyBhdCB0aGF0IHRpbWUuJm5ic3A7IFRoZSBhdXRob3JzIGluZGlj YXRlZCB0byB0aGUgSURSIGNoYWlycyB0aGUgUkZDNzc1MiBzY29wZSB3b3VsZCBub3QgZ3Jvdy4g Jm5ic3A7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5B cyBzaGVwaGVyZCBJIHJlcXVlc3RlZCB0aGlzIGRyYWZ0IHRvIGJlIHJldmlld2VkIGJ5IHRoZSBz ZWN1cml0eSBkaXJlY3RvcmF0ZSBiZWNhdXNlIHdlIGFyZSBnb2luZyBiZXlvbmQgdGhlIG9yaWdp bmFsIHNjb3BlIG9mIFJGQzc3NTIgd2l0aCB0aGlzIGRyYWZ0LiAmbmJzcDtBcyBTaGVwaGVyZCwN CiBJIGRvIG5vdCBhZ3JlZSB3aXRoIHlvdSB0aGF0IHNlY3VyaXR5IGlzc3VlcyBZb2F2IHJhaXNl cyBhcmUgc3BlY2lmaWVkIGluIFJGQzc3NTIuICZuYnNwOyZuYnNwO0k8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdSBhcmUgY29ycmVjdCB0aGF0IHRoZXJlIGFy ZSBtYW55IGRyYWZ0cyAoanVzdCBCR1AtTFMgZXh0ZW5zaW9ucyBhbmQgc2VnbWVudCByb3V0aW5n IGV4dGVuc2lvbnMgdGhhdCB1c2UgQkdQLUxTKS4mbmJzcDsgJm5ic3A7VGhpcyBkcmFmdCBpcyBq dXN0IHRoZSBmaXJzdCBvZiBhIHdhdmUgb2YNCiBkcmFmdHMuICZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwO0l0IGlzIGFwcHJvcHJpYXRlIHRvIGhhdmUgYSBzb2x1dGlvbiBmb3IgdGhlIHNl Y3VyaXR5IGlzc3VlcyB0aGF0IGNvdmVycyBhbGwgdGhlIGRyYWZ0cyByYXRoZXIgdGhhbiBnbyB0 aHJvdWdoIGRyYWZ0cyBvbmUgYXQgYSB0aW1lLiBJIHN1Z2dlc3QgdGhhdCBhIHJldmlzaW9uIHRv IFJGQzc3NTIgdGhhdCBhZGRyZXNzZXMgdGhlc2UgaXNzdWVzIGlzIGFwcHJvcHJpYXRlLg0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB5b3UgYXJlIGludGVy ZXN0ZWQgaW4gZGlzY3VzcyB0aGlzIHRvcGljIHdpdGggWW9hdiwgQmVuamFtaW4sIGFuZCB0aGUg SURSIFdHIOKAkyBzaGFsbCB3ZSBzdGFydCBhIHRocmVhZCBvbiB0aGlzIHRvcGljPw0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TdXNhbiBIYXJlcw0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+IElkciBbPGEgaHJl Zj0ibWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnIj5tYWlsdG86aWRyLWJvdW5jZXNAaWV0Zi5v cmc8L2E+XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5MZXMgR2luc2JlcmcgKGdpbnNiZXJnKTxicj4N CjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggMTA6NTIgQU08YnI+DQo8Yj5U bzo8L2I+IFJvYmVydCBSYXN6dWs7IDxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1 a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmlkckBpZXRmLm9y ZyI+aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpz ZWNkaXJAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8 YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwv YT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSBy ZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlJvYmVydOKAmXMgcG9zdCBhZGRyZXNzZXMgcG9pbnRzIEkgYWxzbyB3YW50IHRvIG1ha2UuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5XaGF0IGlzIGJlaW5nIGRv bmUgaGVyZSBpcyB0byBhZGQgYWRkaXRpb25hbCBCR1AtTFMgY29kZXBvaW50cyB0byBhZHZlcnRp c2UgSUdQIGluZm9ybWF0aW9uIHRoYXQgd2FzIG5vdCBkZWZpbmVkIGF0IHRoZSB0aW1lIFJGQyA3 NzUyIHdhcyB3cml0dGVuLiBXZSBoYXZlbuKAmXQNCiBjaGFuZ2VkIHRoZSAmbmJzcDtCR1AtTFMg dHJhbnNwb3J0IG1lY2hhbmlzbSDigJMgbm9yIGlzIHRoZSBpbmZvcm1hdGlvbiBiZWluZyBhZHZl cnRpc2VkIGhlcmUgKHNvbWUgYWRkaXRpb25hbCBURSByZWxhdGVkIGxpbmsgYXR0cmlidXRlIGlu Zm9ybWF0aW9uKSBxdWFsaXRhdGl2ZWx5IGRpZmZlcmVudCB0aGFuIGEgbnVtYmVyIG9mIGV4aXN0 aW5nIFRMVnMgZGVmaW5lZCBpbiBSRkMgNzc1MiAoc2VlDQo8YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0 bWxfcmZjNzc1Mi0yM3NlY3Rpb24tMkQzLjMuMiZhbXA7ZD1Ed01HYVEmYW1wO2M9SEFrWXVoNjNy c3VocjZTY2JmaDBVakJYZU1LLW5kYjN2b0RUWGNXem9DSSZhbXA7cj1DUkIydEppUWVQazBjVC1o NUxHaEVXSC1zX3hYWHVwM0h6dkJTTVJqNVZFJmFtcDttPW5wbl9nWW02ZFFocnp0dXJHZnZvV1g2 bDd5ajk4TDhCM1JFeXBvSUhKS3MmYW1wO3M9OG53QlZNaDUwTkFYWTZTVDhIT1lRczRYWS1sUENK QzVuM2s4dUtGbFc0dyZhbXA7ZT0iPg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3 NTIjc2VjdGlvbi0zLjMuMjwvYT4gKS4gSWYgdGhpcyBpbmZvcm1hdGlvbiBoYWQgYWxyZWFkeSBi ZWVuIGRlZmluZWQgaW4gdGhlIElHUHMgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2FzIHdyaXR0ZW4g aXQgd291bGQgc2ltcGx5IGhhdmUgYmVlbiBpbmNsdWRlZCBhcyBhIHNlY3Rpb24gb2YgUkZDIDc3 NTIgYW5kIG5vIGFkZGl0aW9uYWwgY2hhbmdlcyB0byBSRkMgNzc1MiB3b3VsZCBoYXZlIGJlZW4N CiByZXF1aXJlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklu IHRoZW9yeSwgd2UgY291bGQgaGF2ZSBzaW1wbHkgdXBkYXRlZCBSRkMgNzc1MiByYXRoZXIgd3Jp dGluZyBhIHNlcGFyYXRlIGRyYWZ0LCBidXQgcHJhY3RpY2FsbHkgdGhpcyB3b3VsZCBiZSBhIHBv b3Igc3RyYXRlZ3kgYXMgaXQgd291bGQgaW5jb3JyZWN0bHkgc3VnZ2VzdA0KIHRoYXQgc29tZSBj aGFuZ2Ugd2FzIGJlaW5nIG1hZGUgdG8gdGhlIGV4aXN0aW5nIHRleHQgaW4gUkZDIDc3NTIuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIGFwcHJlY2lhdGUgdGhh dCBmcm9tIHRoZSBQT1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91IGZvbGtzIGFyZSBub3QgYXMg aW50aW1hdGVseSBmYW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRyYWZ0cyBhbmQgdGhlIHJlbGF0 aW9uc2hpcCBiZXR3ZWVuIHRoZW0uIEl0IGlzDQogdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRo YXQgeW91IHN0YXJ0IGxvb2tpbmcgYXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9j dW1lbnQg4oCTIGFuZCBpbiB0aGF0IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVs eSBjb3JyZWN0LiBCdXQgdGhlIGRvY3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNj dXJhdGVseSBzZWVuIGFzIGFuIOKAnGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLiBUaGUgaXNzdWVz IHlvdSByYWlzZQ0KIGhhdmUgYWxyZWFkeSBiZWVuIGFkZHJlc3NlZCBpbiBSRkMgNzc1MiBhbmQg aXQgaXMgdGhlcmVmb3JlIHZlcnkgYXBwcm9wcmlhdGUgdGhhdCB3ZSBhZGRyZXNzIHlvdXIgY29u Y2VybnMgYnkgaW5jbHVkaW5nIGEgcmVmZXJlbmNlIHRvIHRoZSBSRkMgNzc1MiBzZWN1cml0eSBk aXNjdXNzaW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB0 aGluayBpdCBpcyBpbXBvcnRhbnQgdGhhdCB5b3Ugbm90ZSB0aGlzIHJlbGF0aW9uc2hpcCwgYmVj YXVzZSB0aGUgbmF0dXJlIG9mIEJHUC1MUyBpcyB0aGF0IHdoZW5ldmVyIElHUCBleHRlbnNpb25z IGFyZSBkZWZpbmVkIHRvIGFkdmVydGlzZSBuZXcgaW5mb3JtYXRpb24NCiBpdCBpcyBuZWNlc3Nh cnkgdG8gZGVmaW5lIGNvcnJlc3BvbmRpbmcgQkdQLUxTIGNvZGVwb2ludHMuIFRoaXMgaXMgbm90 IHRoZSBmaXJzdCBzdWNoIEJHUC1MUyBleHRlbnNpb24gZG9jdW1lbnQg4oCTIGFuZCBpdCBpcyBz YWZlIHRvIHNheSBpdCB3b27igJl0IGJlIHRoZSBsYXN0LiBJdCB3b3VsZCBiZSBoZWxwZnVsIHRv IGFsbCBpZiB3ZSByZWFjaGVkIGEgY29tbW9uIHVuZGVyc3RhbmRpbmcgb3IgdGhpcyBkaXNjdXNz aW9uIHdpbGwgdGFrZSBwbGFjZQ0KIGV2ZXJ5IHRpbWUgYSBCR1AtTFMgZXh0ZW5zaW9uIGRvY3Vt ZW50IGlzIGJlaW5nIHJldmlld2VkIOKAkyB3aGljaCB3aWxsIGNvc3QgdXMgYWxsIHRpbWUgbmVl ZGxlc3NseS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw OyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gUm9iZXJ0IFJh c3p1ayAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJvYmVydEByYXN6dWsubmV0Ij5yb2JlcnRAcmFzenVr Lm5ldDwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXksIE9jdG9iZXIgMTgsIDIw MTggMTE6NTIgUE08YnI+DQo8Yj5Ubzo8L2I+IDxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1 Ij5rYWR1a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVy ZykgJmx0OzxhIGhyZWY9Im1haWx0bzpnaW5zYmVyZ0BjaXNjby5jb20iPmdpbnNiZXJnQGNpc2Nv LmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmlkckBpZXRmLm9yZyI+aWRyQGlldGYub3Jn PC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5v cmciPg0KZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0 bzp5bmlyLmlldGZAZ21haWwuY29tIj55bmlyLmlldGZAZ21haWwuY29tPC9hPjsgPGEgaHJlZj0i bWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNkaXJAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0 LWlldGYtaWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlbGxvIEJlbmphbWluLDxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm90IHN1cmUgaWYgeW91IGhh dmUgc3BvdHRlZCBzaW1pbGFyIGNvbW1lbnQgbWFkZSB0byBJRFIgcmVnYXJkaW5nIHRoaXMgdG9w aWMsIGJ1dCB5b3VyIGNvbW1lbnQgc2VlbXMgdG8gaW5kaWNhdGUgdGhhdCBoZXJlIHdlIGFyZSBh Ym91dCB0byBkZWZpbmUgd2F5cyB0byBjYXJyeSBuaWNlbHkgc2NvcGVkIElHUCBpbmZvcm1hdGlv biBpbnRvIEJHUC4gV2VsbCB0aGF0IGhhcyBhbHJlYWR5IGhhcHBlbmVkIHdpdGgNCiBSRkM3NzUy IGFuZCB5b3VyIGNvbW1lbnQgb3IgZm9yIHRoYXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBp bmRlZWQgc3BvdCBvbiBidXQgdG8gdGhlIHNlY3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBh bmQgSU1PIG5vdCBhbnkgZm9sbG93IHVwIGV4dGVuc2lvbnMgb2YgaXQuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1cmUgLSBhcyBv YnNlcnZlZCBieSBTdWUgLSBvbmUgbWF5IGFyZ3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3Jt YXRpb24gYWJvdXQgdGhlIG5ldHdvcmsgdG8gdGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0 aGUgbmV0d29yayB3ZWFrZXIsIGJ1dCB0aGUgY3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRo ZSBsZWFrcyBhbmQgcmVkdWNlIHByb2JhYmlsaXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3Jt YXRpb24NCiBieSB1bmF1dGhvcml6ZWQgcGFydGllcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QkdQLUxTIGlzIGFscmVhZHkgZGVm aW5lZCBpbiBhIG5ldyBTQUZJIHdoYXQgYnkgaXRzZWxmIGRvZXMgcHJvdmlkZSBuaWNlIGxldmVs IG9mIGlzb2xhdGlvbi4gUkZDNzc1MiBpcyBwcmV0dHkgY2xlYXIgb24gdGhhdCB0b28gYW5kIHNh eXM6Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZxdW90O0JHUCBwZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQgcmVxdWlyZSBj b25maWd1cmF0aW9uOyB0aHVzLCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdv cmsgb3BlcmF0b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29u ZmlndXJlZCB0byByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uJnF1b3Q7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHNvbWVvbmUgd291bGQg YmUgc3RpbGwgY29uY2VybmVkIGFib3V0IGNvbmZpZ3VyYXRpb24gbWlzdGFrZXMgYW5kIG5lZ290 aWF0aW5nIFNBRkkgNzEgb3IgNzIgdG8gdGhvc2Ugd2hvIHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0 YSBJIHJlY29tbWVuZCB3ZSByZWlzc3VlIHRoZSBSRkM3NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQg cmVzdHJpY3QgdGhlIHNjb3BlIG9mIHRoZSBkaXN0cmlidXRpb24gZXZlbiBmdXJ0aGVyDQogYnkg bWFuZGF0aW5nIGRlZmF1bHQgdXNlIG9mIE5PLUVYUE9SVCBjb21tdW5pdHkgd2l0aCBhYmlsaXR5 IHRvIG92ZXJ3cml0ZSBpdCBmb3IgdGhlIHNlbGVjdGl2ZSBlQkdQIHBlZXJzLiBPciBwZXJoYXBz IHdlIGNvdWxkIHByb2dyZXNzIEppbSdzIE9uZSBBZG1pbmlzdHJhdGl2ZSBEb21haW4gZHJhZnQg KGRyYWZ0LXV0dGFyby1pZHItb2FkLTAxKS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gZWl0aGVyIGNhc2Ugd2hpbGUgYm90aCBv ZiB5b3VyIGNvbW1lbnRzIGFyZSBncmVhdCB0aGV5IHNlZW1zIGEgYml0IGxhdGUgaW4gdGhlIGdh bWUgaGVyZSBvciBhdCBsZWFzdCB0YXJnZXRpbmcgd3JvbmcgZG9jdW1lbnQuJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPktpbmQgcmVn YXJkcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlJvYmVydC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gRnJpLCBPY3QgMTksIDIwMTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJn aW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJv dHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUaHUsIE9jdCAxOCwgMjAxOCBh dCAwNjowMDoxM1BNICYjNDM7MDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6PGJy Pg0KJmd0OyBZb2F2IOKAkzxicj4NCiZndDsgPGJyPg0KJmd0OyBJbiByZWdhcmRzIHRvIHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0aW9u IGNvdmVyZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1AgZHJh ZnRzOjxicj4NCiZndDsgPGJyPg0KJmd0OyBGcm9tIFJGQzc4MTA8YnI+DQomZ3Q7IDxicj4NCiZn dDsg4oCcVGhlIHN1Yi1UTFZzIGludHJvZHVjZWQgaW4gdGhpcyBkb2N1bWVudCBhbGxvdyBhbiBv cGVyYXRvciB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1h dGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRoLCBkZWxheSkgdGhhdCBjb3VsZCBiZTxicj4NCiZndDsm bmJzcDsgJm5ic3A7IHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90IHdhbnQg dG8gZGlzY2xvc2Uu4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEluIHJlZ2FyZHMgdG8gdGhlIHJp c2tzIGFzc29jaWF0ZWQgd2l0aCBzZW5kaW5nIGluZm9ybWF0aW9uIHZpYSBCR1AtTFMgd2UgaGF2 ZSBhIG51bWJlciBvZiBzdGF0ZW1lbnRzIGluIFJGQyA3NzUyIOKAkyBtb3N0IHJlbGV2YW50IGlz Ojxicj4NCiZndDsgPGJyPg0KJmd0OyDigJxBZGRpdGlvbmFsbHksIGl0IG1heSBiZSBjb25zaWRl cmVkIHRoYXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZDxicj4NCiZndDsmbmJzcDsgJm5i c3A7IFRFIGluZm9ybWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1 dGVzIGEgcmlzayB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGNvbmZpZGVudGlhbGl0eSBvZiBt aXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmU8YnI+DQomZ3Q7Jm5ic3A7 ICZuYnNwOyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yay7igJ08YnI+DQomZ3Q7IDxicj4N CiZndDsgU28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJR1AgUkZD cyBhbmQgUkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVyc3RhbmQg d2hhdCBlbHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuPGJyPg0KJmd0OyBDZXJ0YWlubHkgdGhl IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20gYXJl IG5vdCBhbHRlcmVkIGJ5IGFkZGluZyBzb21lIG5ldyBUTFZzIOKAkyBhbmQgc2luY2UgdGhlIElH UCBSRkNzIGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgc3Bl Y2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5vdCBzaW1wbHkgdGhlIHJpc2tzIGFzc29jaWF0 ZWQgd2l0aCB0aGUgdHJhbnNwb3J0DQogbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRvIGhhdmUg dG8gcHJvdmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkgYmUgc2Fp ZCB0aGF0IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuPGJyPg0KPGJy Pg0KTXkgYXBvbG9naWVzIGZvciBqdW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVDIHRo ZSBJR1AgUkZDcyBoYXZlPGJyPg0KY292ZXJlZCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGEg c3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24sICp1bmRlcjxicj4NCnRoZSBhc3N1bXB0aW9u IHRoYXQgdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xlIEFTIGFuZDxi cj4NCmFkbWluaXN0cmF0aXZlIGRvbWFpbiouJm5ic3A7IFlvYXYgaXMgcG9pbnRpbmcgb3V0IHRo YXQgdGhlIHJpc2tzIGZvciB0aGF0PGJyPg0KaW5mb3JtYXRpb24gbWF5IGNoYW5nZSB3aGVuIHRo ZSBkaXN0cmlidXRpb24gaXMgb3ZlciBhIGJyb2FkZXIgZG9tYWluIHRoYW48YnI+DQp0aGUgb25l IGZvciB3aGljaCB0aGUgcHJldmlvdXMgYW5hbHlzaXMgd2FzIHBlcmZvcm1lZC48YnI+DQo8YnI+ DQotQmVuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jv ZHk+DQo8L2h0bWw+DQo= --_000_BN7PR05MB43543D3516A9BD3C125F1423C7F90BN7PR05MB4354namp_-- From nobody Fri Oct 19 09:55:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5DB6130FFE; Fri, 19 Oct 2018 09:55:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.936 X-Spam-Level: ** X-Spam-Status: No, score=2.936 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdiWioq-wyyl; Fri, 19 Oct 2018 09:55:31 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C49D0130FB1; Fri, 19 Oct 2018 09:55:30 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'John E Drake'" , "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <01e201d467c0$fbc6f990$f354ecb0$@ndzh.com> <8a146dfd09814f8092a0ac10bd7d37d1@XCH-ALN-001.cisco.com> <023e01d467c9$713a98a0$53afc9e0$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 12:55:25 -0400 Message-ID: <026b01d467cc$88fc6a60$9af53f20$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_026C_01D467AB.01EDD7A0" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAUeOFiECtDA/VAGZqNHmAXwhzhoCUSN6RAHEbix9osisafA= Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 16:55:35 -0000 This is a multipart message in MIME format. ------=_NextPart_000_026C_01D467AB.01EDD7A0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable John: =20 I believe we are aligned on the next steps. Thanks for the input.=20 =20 Cheerily, Sue=20 =20 From: John E Drake [mailto:jdrake@juniper.net]=20 Sent: Friday, October 19, 2018 12:53 PM To: Susan Hares; 'Les Ginsberg (ginsberg)'; 'Robert Raszuk'; = kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue, =20 Comments inline. =20 Yours Irrespectively, =20 John =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 12:33 PM To: John E Drake ; 'Les Ginsberg (ginsberg)' = ; 'Robert Raszuk' ; kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 John:=20 =20 I agree with you that this issue is not specific to = draft-ietf-idr-te-pm-bgp-13.txt, but should be taken up as a revision to = RFC7752.=20 =20 [JD] Fine w/ me=20 =20 I disagree with you on the change of scope for RFC7752. This draft = (draft-ietf-idr-te-pm-bgp-13.txt) does add additional risk for the scope = of the attack surface on RFC7752 as it adds to the traffic engineering = information passed. =20 [JD] That sounds suspiciously like an assertion [Sue2] Yes =E2=80=93 this is my assertion. If you wish to have this = assertion reviewed by security directorate, I can ask. However, we = agree on the solution.=20 =20 Shall we agree on creating RFC7752bis that expands the security section? = I am glad to sponsor a =E2=80=9Cfast-track=E2=80=9D action on an = RFC7752bis.=20 =20 [JD] Fine w/ me=20 =20 Yours respectfully,=20 Sue=20 =20 From: John E Drake [mailto:jdrake@juniper.net]=20 Sent: Friday, October 19, 2018 12:27 PM To: Les Ginsberg (ginsberg); Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hi, =20 I was a co-author of RFC 7471 and RFC 7810, which introduce a handful = of new TE metrics into the existing OSPF and IS-IS TE infrastructures. = The subject draft does exactly the same thing for the existing BGP-LS TE = infrastructure defined in RFC 7752. =20 =20 As Les correctly points out, if there are security issues with the = existing BGP-LS TE infrastructure or more generally with RFC 7752, then = those issues need to be addressed with a revision of that RFC and not = with this draft. I.e., this draft does not change the scope of RFC 7752 = in any way.=20 =20 Yours Irrespectively, =20 John =20 From: Idr On Behalf Of Les Ginsberg (ginsberg) Sent: Friday, October 19, 2018 11:57 AM To: Susan Hares ; 'Robert Raszuk' ; = kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long before? =20 If you feel that RFC 7752 security needs revision I would appreciate it = if you state so clearly (to the WG =E2=80=93 not just to me) and in the = right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp. =20 Les =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 8:33 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 Thank you for responding to Robert=E2=80=99s post. =20 =20 Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information. The extension of the = scope beyond its stated scope might have trigger the current discussions = at that time. The authors indicated to the IDR chairs the RFC7752 scope = would not grow. =20 =20 As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft. As Shepherd, I do not agree with you that security = issues Yoav raises are specified in RFC7752. I =20 You are correct that there are many drafts (just BGP-LS extensions and = segment routing extensions that use BGP-LS). This draft is just the = first of a wave of drafts. It is appropriate to have a solution for = the security issues that covers all the drafts rather than go through = drafts one at a time. I suggest that a revision to RFC7752 that = addresses these issues is appropriate.=20 =20 If you are interested in discuss this topic with Yoav, Benjamin, and the = IDR WG =E2=80=93 shall we start a thread on this topic?=20 =20 Susan Hares=20 =20 =20 =20 =20 =20 =20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:52 AM To: Robert Raszuk; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert=E2=80=99s post addresses points I also want to make. =20 What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 = ). If this information had already been defined in = the IGPs at the time RFC 7752 was written it would simply have been = included as a section of RFC 7752 and no additional changes to RFC 7752 = would have been required. =20 In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. =20 I appreciate that from the POV of the Security Area you folks are not as = intimately familiar with the routing drafts and the relationship between = them. It is therefore understandable that you start looking at the new = draft as a standalone document =E2=80=93 and in that context your = comments are absolutely correct. But the document you are reviewing is = most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. The = issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. =20 I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time needlessly. =20 Les =20 =20 From: Robert Raszuk =20 Sent: Thursday, October 18, 2018 11:52 PM To: kaduk@mit.edu Cc: Les Ginsberg (ginsberg) ; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_026C_01D467AB.01EDD7A0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

John:

 

I believe we are aligned on the next steps.=C2=A0 =C2=A0=C2=A0Thanks = for the input.

 

Cheerily, Sue

 

From:= = John E Drake [mailto:jdrake@juniper.net]
Sent: Friday, = October 19, 2018 12:53 PM
To: Susan Hares; 'Les Ginsberg = (ginsberg)'; 'Robert Raszuk'; kaduk@mit.edu
Cc: = ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; = secdir@ietf.org
Subject: RE: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Sue,

 

Comments inline.

 

Yours Irrespectively,

 

John

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 12:33 PM
To: John E Drake <jdrake@juniper.net>; 'Les = Ginsberg (ginsberg)' <ginsberg@cisco.com>; 'Robert Raszuk' = <robert@raszuk.net>; kaduk@mit.edu
Cc: = ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; = secdir@ietf.org
Subject: RE: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

John:

 

I agree with you that this issue is not specific to = draft-ietf-idr-te-pm-bgp-13.txt, but should be taken up as a revision to = RFC7752. 

 

[JD]  Fine w/ me

 

I disagree with you on the change of scope for RFC7752.  This = draft (draft-ietf-idr-te-pm-bgp-13.txt) does add additional risk for the = scope of the attack surface on RFC7752 as it adds to the traffic = engineering information passed.

 

[JD]  That sounds suspiciously like an = assertion

[Sue2] Yes =E2=80=93 this is my assertion.=C2=A0 If you wish to have = this assertion reviewed by security directorate, I can ask.=C2=A0 = However, we agree on the solution.

 

Shall we agree on creating RFC7752bis that expands the security = section?  I am glad to sponsor a =E2=80=9Cfast-track=E2=80=9D = action on an RFC7752bis.

 

[JD]  Fine w/ me

 

Yours respectfully,

Sue

 

From:= = John E Drake [mailto:jdrake@juniper.net] =
Sent: Friday, October 19, 2018 12:27 PM
To: Les = Ginsberg (ginsberg); Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hi,

 

I was a co-author of RFC 7471 and  RFC 7810, which introduce a = handful of new TE metrics into the existing OSPF and IS-IS TE = infrastructures.  The subject draft does exactly the same thing for = the existing BGP-LS TE infrastructure defined in RFC 7752.  =

 

As Les correctly points out, if there are security issues with the = existing BGP-LS TE infrastructure or more generally with RFC 7752, then = those issues need to be addressed with a revision of that RFC and not = with this draft.  I.e., this draft does not change the scope of RFC = 7752 in any way.

 

Yours Irrespectively,

 

John

 

From: Idr = <idr-bounces@ietf.org> = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 11:57 AM
To: Susan Hares <shares@ndzh.com>; 'Robert Raszuk' = <robert@raszuk.net>; kaduk@mit.edu
Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

I was not an author of RFC 7752 and have no idea what promises the = authors might have made. I will say that it seems very late in the game = for you to suggest that this document should not be allowed to progress = because it  exceeds some agreement on the scope of RFC 7752. Why = weren=E2=80=99t these concerns expressed long = before?

 

If you feel that RFC 7752 security needs revision I would appreciate = it if you state so clearly (to the WG =E2=80=93 not just to me) and in = the right context. Such work is clearly not in the scope of = draft-ietf-idr-te-pm-bgp.

 

   Les

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 8:33 AM
To: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

Thank you for responding to Robert=E2=80=99s post.  =

 

Your argument that this information would have added to RFC7752 is on = =E2=80=9Cthin ice=E2=80=9D as the IESG in their approval of RFC7752 was = concerned about the scope of the information.   The extension = of the scope beyond its stated scope might have trigger the current = discussions at that time.  The authors indicated to the IDR chairs = the RFC7752 scope would not grow.   

 

As shepherd I requested this draft to be reviewed by the security = directorate because we are going beyond the original scope of RFC7752 = with this draft.  As Shepherd, I do not agree with you that = security issues Yoav raises are specified in RFC7752. =   I

 

You are correct that there are many drafts (just BGP-LS extensions = and segment routing extensions that use BGP-LS).   This draft = is just the first of a wave of drafts.      It = is appropriate to have a solution for the security issues that covers = all the drafts rather than go through drafts one at a time. I suggest = that a revision to RFC7752 that addresses these issues is appropriate. =

 

If you are interested in discuss this topic with Yoav, Benjamin, and = the IDR WG =E2=80=93 shall we start a thread on this topic? =

 

Susan Hares

 

 

  

 

 

 

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:52 AM
To: Robert Raszuk; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert=E2=80=99s post addresses points I also want to = make.

 

What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the  BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see https://tools.ietf.org/= html/rfc7752#section-3.3.2 ). If this information had already been = defined in the IGPs at the time RFC 7752 was written it would simply = have been included as a section of RFC 7752 and no additional changes to = RFC 7752 would have been required.

 

In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752.

 

I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. = The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion.

 

I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time = needlessly.

 

   Les

 

 

From: Robert = Raszuk <robert@raszuk.net> =
Sent: Thursday, October 18, 2018 11:52 PM
To: kaduk@mit.edu
Cc: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_026C_01D467AB.01EDD7A0-- From nobody Fri Oct 19 10:08:08 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF0F4130F73; Fri, 19 Oct 2018 10:07:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gQO_PDHucOLG; Fri, 19 Oct 2018 10:07:49 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A05C12426A; Fri, 19 Oct 2018 10:07:48 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 13:07:42 -0400 Message-ID: <028b01d467ce$402b2400$c0816c00$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_028C_01D467AC.B91BCDF0" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BKMC91CA Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 17:07:52 -0000 This is a multipart message in MIME format. ------=_NextPart_000_028C_01D467AC.B91BCDF0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les: =20 I apologize if my email message was unclear. We both agree that your = draft is not related to SR routing. SR routing is related to BGP-LS as = a transport mechanism for information. =20 =20 I agree that RFC7752 had traffic engineering information. However, that = traffic engineering information almost got that draft rejected by the = IESG at the time. As my previous message to this list indicated, we got = agreement on RFC7752 based on limiting that information and the = assurance that BGP-LS nodes were deployed on a separate set of nodes. = Expanding the traffic engineering information beyond RFC7752 re-opens = all the security issues and questions from RFC7752=E2=80=99s original = review. =20 =20 The security directorate reviewer is asking these security questions. = The security directorate does have people with both routing and security = experts. =20 =20 SR routing is also expanding the information past the original RFC7752. = The expansions requested by SR routing also re-open those original = security questions and issues. =20 =20 One way to answer these questions is to provide a RFC7752bis with an = updated security section. If you agree with this approach, I suggest = simply referring to a RFC7752bis that in your security section. If you = disagree that an update to the RFC7752bis is required, we can start a = thread on that point.=20 =20 Did this message clarify my earlier brief message? Do you want to = continue to discuss the need for RFC7752bis?=20 =20 Cheerily, Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:58 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 One of us is confused. J =20 draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those words = do not appear anywhere in the document. Nor is there a reference to any = SR document. =20 Further, RFC 7752 includes traffic engineering information (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion = that we are introducing a new attack vector by defining some = additional(sic) TE codepoints does not make sense to me. =20 I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them. =20 Could you please update your response with these points in mind? =20 Thanx. =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 6:26 AM To: 'Robert Raszuk' ; kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_028C_01D467AC.B91BCDF0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

I apologize if my email message was unclear. =C2=A0=C2=A0We both = agree that your draft is not related to SR routing.=C2=A0=C2=A0 SR = routing is related to BGP-LS as a transport mechanism for information. = =C2=A0

 

I agree that RFC7752 had traffic engineering information.=C2=A0 = However, that traffic engineering information almost got that draft = rejected by the IESG at the time.=C2=A0 As my previous message to this = list indicated, we got agreement on RFC7752 based on limiting that = information and the assurance that BGP-LS nodes were deployed on a = separate set of nodes. =C2=A0Expanding the traffic engineering = information beyond RFC7752 re-opens all the security issues and = questions from RFC7752=E2=80=99s original review. = =C2=A0

 

The security directorate reviewer is asking these security = questions.=C2=A0 The security directorate does have people with both = routing and security experts. =C2=A0=C2=A0

 

SR routing is also expanding the information past the original = RFC7752.=C2=A0=C2=A0 The expansions requested by SR routing also re-open = those original security questions and issues.=C2=A0 =

 

One way to answer these questions is to provide a =C2=A0RFC7752bis = with an updated security section.=C2=A0 If you agree with this approach, = I suggest simply referring to a RFC7752bis that in your security = section. =C2=A0=C2=A0If you disagree that an update to the RFC7752bis is = required, we can start a thread on that point.

 

Did this message clarify my earlier brief message? =C2=A0Do you want = to continue to discuss the need for RFC7752bis?

 

Cheerily, Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg)
Sent: Friday, October 19, 2018 10:58 = AM
To: Susan Hares; 'Robert Raszuk'; = kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: Re: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

One of us is confused. J

 

draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those = words do not appear anywhere in the document. Nor is there a reference = to any SR document.

 

Further, RFC 7752 includes traffic engineering information (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion that we are = introducing a new attack vector by defining some additional(sic) TE = codepoints does not make sense to me.

 

I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them.

 

Could you please update your response with these points in = mind?

 

Thanx.

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 6:26 AM
To: 'Robert Raszuk' <robert@raszuk.net>; = kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; = ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.  However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.   = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues. 

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. =  As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible.  

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.  = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Robert Raszuk
Sent: Friday, October 19, = 2018 2:52 AM
To: kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: Re: [Idr] [secdir] Secdir = early review of draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_028C_01D467AC.B91BCDF0-- From nobody Fri Oct 19 10:29:14 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CDAE130DDC; Fri, 19 Oct 2018 10:29:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.563 X-Spam-Level: X-Spam-Status: No, score=-14.563 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GQSd9uiQPoFv; Fri, 19 Oct 2018 10:28:57 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE78F12F1A2; Fri, 19 Oct 2018 10:28:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=50670; q=dns/txt; s=iport; t=1539970136; x=1541179736; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=D29WShFx70IKhbbXQ0lCYRnluMXYOvv2vChTdTr/3tc=; b=Yrcfq/0Sd74szI6H60aS5ERfTELuVTpJw5vM8s5uSVehmuerM0R2TEUc c91C0NCuSaydyfo8wKiEEAu36I0DAjTH00ja8MrIYDRC+MG+8sba4iGnM fNQQS69yymYq82M0y2qx4RqNfJaGTZZoAsC6DCab+0ATfg+L9y8J4nevK U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AJAACGE8pb/4cNJK1kDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVMCAQEBAQELAYENSC9mfygKg2uUMYINeod+jhcUgWY?= =?us-ascii?q?LAQEjhEkCF4RxITYLDQEDAQECAQECbRwMhTkBAQEEIwo+DhACAQgOAwQBAQE?= =?us-ascii?q?gAQYDAgICHxEUCQgCBAENBQgMB4MHgR1MAxUPpyuBLodzDYITBYkHgSuBHRe?= =?us-ascii?q?BQT+BEYJdBy6CVkUBAQIBgStKH4JNglcCiGMuhSGBVYQ7iVEuCQKGXIMcg06?= =?us-ascii?q?DHB+BT4RzZokBiSODMXiGTYISAhEUgSYkCClkcXAVO4JsggMjF4hchQQ6bwE?= =?us-ascii?q?BinWBHwEB?= X-IronPort-AV: E=Sophos;i="5.54,400,1534809600"; d="scan'208,217";a="468760400" Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 17:28:55 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by alln-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id w9JHStpv005486 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 17:28:55 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 19 Oct 2018 12:28:54 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Fri, 19 Oct 2018 12:28:54 -0500 From: "Les Ginsberg (ginsberg)" To: Susan Hares , "'Robert Raszuk'" , "kaduk@mit.edu" CC: "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "ynir.ietf@gmail.com" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgABuEAD//8RJQAAPN8wAAApAKAA= Date: Fri, 19 Oct 2018 17:28:54 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> In-Reply-To: <028b01d467ce$402b2400$c0816c00$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_f20b00331cbf42f49dcc5ab61c8d2d8fXCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: alln-core-2.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 17:29:01 -0000 --_000_f20b00331cbf42f49dcc5ab61c8d2d8fXCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VlIOKAkw0KDQpJbmxpbmUuDQoNCkZyb206IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb20+ DQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggMTA6MDggQU0NClRvOiBMZXMgR2luc2Jl cmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdAY2lzY28uY29tPjsgJ1JvYmVydCBSYXN6dWsnIDxyb2Jl cnRAcmFzenVrLm5ldD47IGthZHVrQG1pdC5lZHUNCkNjOiBpZHJAaWV0Zi5vcmc7IGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IHluaXIuaWV0ZkBn bWFpbC5jb207IHNlY2RpckBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtJZHJdIFtzZWNkaXJdIFNl Y2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoNCkxlczoN Cg0KSSBhcG9sb2dpemUgaWYgbXkgZW1haWwgbWVzc2FnZSB3YXMgdW5jbGVhci4gICBXZSBib3Ro IGFncmVlIHRoYXQgeW91ciBkcmFmdCBpcyBub3QgcmVsYXRlZCB0byBTUiByb3V0aW5nLiAgIFNS IHJvdXRpbmcgaXMgcmVsYXRlZCB0byBCR1AtTFMgYXMgYSB0cmFuc3BvcnQgbWVjaGFuaXNtIGZv ciBpbmZvcm1hdGlvbi4NCg0KSSBhZ3JlZSB0aGF0IFJGQzc3NTIgaGFkIHRyYWZmaWMgZW5naW5l ZXJpbmcgaW5mb3JtYXRpb24uICBIb3dldmVyLCB0aGF0IHRyYWZmaWMgZW5naW5lZXJpbmcgaW5m b3JtYXRpb24gYWxtb3N0IGdvdCB0aGF0IGRyYWZ0IHJlamVjdGVkIGJ5IHRoZSBJRVNHIGF0IHRo ZSB0aW1lLiAgQXMgbXkgcHJldmlvdXMgbWVzc2FnZSB0byB0aGlzIGxpc3QgaW5kaWNhdGVkLCB3 ZSBnb3QgYWdyZWVtZW50IG9uIFJGQzc3NTIgYmFzZWQgb24gbGltaXRpbmcgdGhhdCBpbmZvcm1h dGlvbiBhbmQgdGhlIGFzc3VyYW5jZSB0aGF0IEJHUC1MUyBub2RlcyB3ZXJlIGRlcGxveWVkIG9u IGEgc2VwYXJhdGUgc2V0IG9mIG5vZGVzLiAgRXhwYW5kaW5nIHRoZSB0cmFmZmljIGVuZ2luZWVy aW5nIGluZm9ybWF0aW9uIGJleW9uZCBSRkM3NzUyIHJlLW9wZW5zIGFsbCB0aGUgc2VjdXJpdHkg aXNzdWVzIGFuZCBxdWVzdGlvbnMgZnJvbSBSRkM3NzUy4oCZcyBvcmlnaW5hbCByZXZpZXcuDQoN CltMZXM6XSBTbyBmYXIsIHlvdSBhcmUgdGhlIG9ubHkgcGVyc29uIHdobyBzZWVtcyBhd2FyZSBv ZiB0aGlzLiBJIGFtIG5vdCBzYXlpbmcgeW91IGFyZSB3cm9uZyDigJMgSSBhbSBqdXN0IHNheWlu ZyBteSBwcml2YXRlIGF0dGVtcHRzIHRvIGdldCBtb3JlIGNvbnRleHQgZm9yIHRoaXMgaGF2ZSB0 aHVzIGZhciBmYWlsZWQg4oCTIGFuZCB5b3UgaGF2ZSBub3QgcHJvdmlkZWQgYW55IGRvY3VtZW50 YXRpb24gb2YgdGhpcy4NCklmIHlvdXIgc3RhdGVtZW50IGlzIGFjY3VyYXRlIChhZ2FpbiDigJMg bm90IHNheWluZyBpdCBpc27igJl0KSDigJMgaXQgYWxzbyBzZWVtcyBtb3N0IHVuZm9ydHVuYXRl IChhbmQgSSBhbSBiZWluZyDigJxraW5k4oCdIGhlcmUpIHRoYXQgdGhpcyB3YXMgbm90IG1lbnRp b25lZCBpbiB0aGUgY291cnNlIG9mIHRoZSBmb3VyIHllYXJzIHRoYXQgZHJhZnQtaWV0Zi1pZHIt dGUtcG0tYmdwIGhhcyB0YWtlbiB0byBwcm9ncmVzcyB0byB0aGlzIHBvaW50Lg0KDQpUaGUgc2Vj dXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3ZXIgaXMgYXNraW5nIHRoZXNlIHNlY3VyaXR5IHF1ZXN0 aW9ucy4gIFRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSBkb2VzIGhhdmUgcGVvcGxlIHdpdGggYm90 aCByb3V0aW5nIGFuZCBzZWN1cml0eSBleHBlcnRzLg0KDQpTUiByb3V0aW5nIGlzIGFsc28gZXhw YW5kaW5nIHRoZSBpbmZvcm1hdGlvbiBwYXN0IHRoZSBvcmlnaW5hbCBSRkM3NzUyLiAgIFRoZSBl eHBhbnNpb25zIHJlcXVlc3RlZCBieSBTUiByb3V0aW5nIGFsc28gcmUtb3BlbiB0aG9zZSBvcmln aW5hbCBzZWN1cml0eSBxdWVzdGlvbnMgYW5kIGlzc3Vlcy4NCg0KW0xlczpdIEkgZG8gbm90IGtu b3cgd2h5IHlvdSBtZW50aW9uIFNSIGhlcmUgc2luY2Ugd2UgYm90aCBhZ3JlZSB0aGlzIGRyYWZ0 IGlzIG5vdCBTUiByZWxhdGVkLg0KDQpPbmUgd2F5IHRvIGFuc3dlciB0aGVzZSBxdWVzdGlvbnMg aXMgdG8gcHJvdmlkZSBhICBSRkM3NzUyYmlzIHdpdGggYW4gdXBkYXRlZCBzZWN1cml0eSBzZWN0 aW9uLiAgSWYgeW91IGFncmVlIHdpdGggdGhpcyBhcHByb2FjaCwgSSBzdWdnZXN0IHNpbXBseSBy ZWZlcnJpbmcgdG8gYSBSRkM3NzUyYmlzIHRoYXQgaW4geW91ciBzZWN1cml0eSBzZWN0aW9uLiAg IElmIHlvdSBkaXNhZ3JlZSB0aGF0IGFuIHVwZGF0ZSB0byB0aGUgUkZDNzc1MmJpcyBpcyByZXF1 aXJlZCwgd2UgY2FuIHN0YXJ0IGEgdGhyZWFkIG9uIHRoYXQgcG9pbnQuDQoNCltMZXM6XSBUaGVy ZSBpcyBubyBSRkM3NzUyYmlzIGRyYWZ0LiDimLogIFNvIHlvdSBhcmUgYXNraW5nIG1lIHRvIHJl ZmVyZW5jZSBhIG5vbi1leGlzdGVudCBkb2N1bWVudD8NCg0KSSB1bmRlcnN0YW5kIHRoYXQgeW91 IChhdCBsZWFzdCkgd291bGQgbGlrZSB0byBoYXZlIG9uZSDigJMgd2hpY2ggaXMgcGVyZmVjdGx5 IGxlZ2l0aW1hdGUg4oCTIHRob3VnaCB5b3Ugc2hvdWxkIGdvIHRocm91Z2ggdGhlIG5vcm1hbCBX RyBwcm9jZXNzIHRvIHRha2UgdGhpcyB3b3JrIG9uIOKAkyBjb3JyZWN0Pw0KDQpCdXQgdGhpcyBk b2RnZXMgdGhlIHF1ZXN0aW9uIGFzIHRvIHdoZXRoZXIgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdw IGhhcyBhIGRlcGVuZGVuY3kgb24gZW5oYW5jZWQgc2VjdXJpdHkuIFNvIGZhciwgeW91IGFyZSB0 aGUgb25seSBwZXJzb24gbWFraW5nIHRoaXMgY2xhaW0g4oCTIGFuZCBzZXZlcmFsIGZvbGtzIChp bmNsdWRpbmcgbXlzZWxmKSBoYXZlIGV4cHJlc3NlZCBhIGRpZmZlcmVudCBQT1YuIEkgdGhpbmsg eW91IGF0IGxlYXN0IGhhdmUgdG8gcHJvdmlkZSBhIGp1c3RpZmljYXRpb24gZm9yIHRoaXMgZGVw ZW5kZW5jeSBiZWZvcmUgd2UgaW50cm9kdWNlIGl0IGFuZCBnZXQgc29tZSBzdXBwb3J0IGZvciB5 b3VyIHBvc2l0aW9uIOKAkyBzaW5jZSB0aGlzIHdpbGwgbWVhbiBkcmFmdC1pZXRmLWlkci10ZS1w bS1iZ3Agd291bGQgYmUgc3R1Y2sgaW4gTUlTU1JFRiBzdGF0ZSB1bnRpbCB0aGlzIGN1cnJlbnRs eSBub24tZXhpc3RlbnQgZHJhZnQgYmVjb21lcyBhbiBSRkMuDQoNCiAgIExlcw0KDQpEaWQgdGhp cyBtZXNzYWdlIGNsYXJpZnkgbXkgZWFybGllciBicmllZiBtZXNzYWdlPyAgRG8geW91IHdhbnQg dG8gY29udGludWUgdG8gZGlzY3VzcyB0aGUgbmVlZCBmb3IgUkZDNzc1MmJpcz8NCg0KQ2hlZXJp bHksIFN1ZQ0KDQpGcm9tOiBJZHIgW21haWx0bzppZHItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVo YWxmIE9mIExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpDQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTks IDIwMTggMTA6NTggQU0NClRvOiBTdXNhbiBIYXJlczsgJ1JvYmVydCBSYXN6dWsnOyBrYWR1a0Bt aXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0KQ2M6IGlkckBpZXRmLm9yZzxtYWlsdG86aWRy QGlldGYub3JnPjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzxtYWlsdG86 ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8bWFp bHRvOmlldGZAaWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZA Z21haWwuY29tPjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQpTdWJq ZWN0OiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRm LWlkci10ZS1wbS1iZ3AtMTMNCg0KU3VlIOKAkw0KDQpPbmUgb2YgdXMgaXMgY29uZnVzZWQuIOKY ug0KDQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaXMgbm90IHJlbGF0ZWQgdG8gU2VnbWVudCBS b3V0aW5nLiBUaG9zZSB3b3JkcyBkbyBub3QgYXBwZWFyIGFueXdoZXJlIGluIHRoZSBkb2N1bWVu dC4gTm9yIGlzIHRoZXJlIGEgcmVmZXJlbmNlIHRvIGFueSBTUiBkb2N1bWVudC4NCg0KRnVydGhl ciwgUkZDIDc3NTIgaW5jbHVkZXMgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiAoc2Vl IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NzUyI3NlY3Rpb24tMy4zLjIgKSBzbyB0 aGUgc3VnZ2VzdGlvbiB0aGF0IHdlIGFyZSBpbnRyb2R1Y2luZyBhIG5ldyBhdHRhY2sgdmVjdG9y IGJ5IGRlZmluaW5nIHNvbWUgYWRkaXRpb25hbChzaWMpIFRFIGNvZGVwb2ludHMgZG9lcyBub3Qg bWFrZSBzZW5zZSB0byBtZS4NCg0KSSBhcHByZWNpYXRlIHRoYXQgdGhlcmUgYXJlIG90aGVyIGRy YWZ0cyBvbiB5b3VyIG1pbmQgd2hpY2ggYXJlIFNSIHJlbGF0ZWQg4oCTIGJ1dCB0aGlzIGlzIG5v dCBvbmUgb2YgdGhlbS4NCg0KQ291bGQgeW91IHBsZWFzZSB1cGRhdGUgeW91ciByZXNwb25zZSB3 aXRoIHRoZXNlIHBvaW50cyBpbiBtaW5kPw0KDQpUaGFueC4NCg0KICAgTGVzDQoNCg0KRnJvbTog U3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpoLmNvbTxtYWlsdG86c2hhcmVzQG5kemguY29tPj4NClNl bnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA2OjI2IEFNDQpUbzogJ1JvYmVydCBSYXN6dWsn IDxyb2JlcnRAcmFzenVrLm5ldDxtYWlsdG86cm9iZXJ0QHJhc3p1ay5uZXQ+Pjsga2FkdWtAbWl0 LmVkdTxtYWlsdG86a2FkdWtAbWl0LmVkdT4NCkNjOiBpZXRmQGlldGYub3JnPG1haWx0bzppZXRm QGlldGYub3JnPjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+OyB5bmly LmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tPjsgaWRyQGlldGYub3Jn PG1haWx0bzppZHJAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYu b3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPg0KU3ViamVj dDogUkU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1p ZHItdGUtcG0tYmdwLTEzDQoNClJvYmVydCwgQmVuamFtaW4sIGFuZCBZb2F2Og0KDQpJIGFncmVl IHRoZXNlIGNvbnRleHQgb2YgdGhlc2UgaXNzdWVzIGFyZSBub3Qgc3BlY2lmaWMgdG8gdGhpcyBk cmFmdC4gIEhvd2V2ZXIsIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gZG9lcyBwcm92 aWRlIGluZm9ybWF0aW9uIHdoaWNoIGlzIGEgdGVtcHRpbmcgYXR0YWNrIHZlY3Rvci4NCg0KVGhl IG9yaWdpbmFsIFJGQzc3NTIgZGVzY3JpYmVkIGEgZGlmZmVyZW50IHB1cnBvc2Ugd2l0aCByZXN0 cmljdGVkIHVzYWdlIHRoYXQgU1Igcm91dGluZyBleHRlbnNpb25zIGRvIG5vdCBhZGhlcmUgdG8g aW4gQkdQLiAgIFNpbmNlIFNwcmluZyBXRyBzaG93cyB0aGF0IG9wZXJhdG9ycyBhcmUgaW50ZXJl c3RlZCBpbiB0aGUgZXh0ZW5kZWQgdXNlLCBpdCBtYXkgYmUgdGltZSB0byBleGFtaW5lIHRoZSBS RkM3NzUyYmlzIG9yIG90aGVyIHNvbHV0aW9ucyB0aGF0IHRha2VzIGNhcmUgb2YgdGhlc2Ugc2Vj dXJpdHkgaXNzdWVzLg0KDQpNeSBqb2IgYXMgYSBzaGVwaGVyZCBpcyB0byBwb2ludCBvdXQgdGhl c2UgaXNzdWVzIHBlciBkcmFmdCBmb3IgdGhlIElFU0cgYW5kIHNlY3VyaXR5IGRpcmVjdG9yYXRl IGluIG9yZGVyIHRvIG9idGFpbiB0aGUgY29ycmVjdCBmZWVkYmFjay4gIEFzIGEgV0cgY2hhaXIs IEkgaGF2ZSBwb2ludGVkIG91dCB0aGVzZSBpc3N1ZXMsIGJ1dCB0aGUgV0cgaGFzIHRoZXNlIGRy YWZ0cyBvbiBXRyBMQyB3aXRob3V0IHRoZSBleHRyYSBzZWN1cml0eS4NCldpdGhvdXQgUkZDNzc1 MmJpcyB3aXRoIGFkZGl0aW9uYWwgc2VjdXJpdHkgaW4gdGhlIGJhc2UgZG9jdW1lbnQsIEkgYW0g d29ya2luZyBhcyBhIHNoZXBoZXJkIG1ha2UgdGhlIG1hbmFnZWFiaWxpdHkgYW5kIHNlY3VyaXR5 IHNlY3Rpb25zIGFzIGNsZWFyIGFzIHBvc3NpYmxlLg0KDQpJZiB0aGUgZmVlZGJhY2sgZnJvbSB0 aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3IG9yIHRoZSBJRVNHIGlzIHRoYXQgd2UgbmVl ZCB0byBvYnRhaW4gYSBzb2x1dGlvbiBmb3IgUkZDNzc1MmJpcyB0aGF0IGRlc2NyaWJlcyBhbmQg aGFuZGxlcyB0aGVzZSBzZWN1cml0eSBpc3N1ZXMsIEkgd2lsbCBiZSBnbGFkIHRvIHN1cHBvcnQg ZmFzdC10cmFja2luZyB0aGlzIGlzc3VlIHdpdGhpbiB0aGUgV0cuDQoNCklmIGFuIG9mZmxpbmUg ZGlzY3Vzc2lvbiB3aXRoIEJlbmphbWluLCBZb2F2LCB0aGUgSURSIGNoYWlycywgYW5kIEFsdmFy byB3b3VsZCBzcGVlZCB0aGlzIGFsb25nLCBJIGNhbiBzZXQgdGhpcyB1cCBlYXJseSBuZXh0IHdl ZWsuICBJdCB3b3VsZCBiZSBoZWxwZnVsIHRvIGhhdmUgdGhpcyBvZmZsaW5lIGRpc2N1c3Npb24g YmVmb3JlIHRoZSBJRFIgaW50ZXJpbSBzZXNzaW9uIG9uIDEwLzI2Lg0KDQpUaGFuayB5b3UgZm9y IGFsbCB5b3VyIGNvbW1lbnRzLg0KDQpTdWUNCg0KDQpGcm9tOiBJZHIgW21haWx0bzppZHItYm91 bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFJvYmVydCBSYXN6dWsNClNlbnQ6IEZyaWRheSwg T2N0b2JlciAxOSwgMjAxOCAyOjUyIEFNDQpUbzoga2FkdWtAbWl0LmVkdTxtYWlsdG86a2FkdWtA bWl0LmVkdT4NCkNjOiBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGlldGYub3JnPjsgc2VjZGly QGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1h aWx0bzp5bmlyLmlldGZAZ21haWwuY29tPjsgaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5v cmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZHJdIFtzZWNk aXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoN CkhlbGxvIEJlbmphbWluLA0KDQpOb3Qgc3VyZSBpZiB5b3UgaGF2ZSBzcG90dGVkIHNpbWlsYXIg Y29tbWVudCBtYWRlIHRvIElEUiByZWdhcmRpbmcgdGhpcyB0b3BpYywgYnV0IHlvdXIgY29tbWVu dCBzZWVtcyB0byBpbmRpY2F0ZSB0aGF0IGhlcmUgd2UgYXJlIGFib3V0IHRvIGRlZmluZSB3YXlz IHRvIGNhcnJ5IG5pY2VseSBzY29wZWQgSUdQIGluZm9ybWF0aW9uIGludG8gQkdQLiBXZWxsIHRo YXQgaGFzIGFscmVhZHkgaGFwcGVuZWQgd2l0aCBSRkM3NzUyIGFuZCB5b3VyIGNvbW1lbnQgb3Ig Zm9yIHRoYXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBpbmRlZWQgc3BvdCBvbiBidXQgdG8g dGhlIHNlY3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBhbmQgSU1PIG5vdCBhbnkgZm9sbG93 IHVwIGV4dGVuc2lvbnMgb2YgaXQuDQoNClN1cmUgLSBhcyBvYnNlcnZlZCBieSBTdWUgLSBvbmUg bWF5IGFyZ3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdv cmsgdG8gdGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0aGUgbmV0d29yayB3ZWFrZXIsIGJ1 dCB0aGUgY3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRoZSBsZWFrcyBhbmQgcmVkdWNlIHBy b2JhYmlsaXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3JtYXRpb24gYnkgdW5hdXRob3JpemVk IHBhcnRpZXMuDQoNCkJHUC1MUyBpcyBhbHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0 IGJ5IGl0c2VsZiBkb2VzIHByb3ZpZGUgbmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIg aXMgcHJldHR5IGNsZWFyIG9uIHRoYXQgdG9vIGFuZCBzYXlzOg0KDQoiQkdQIHBlZXJpbmdzIGFy ZSBub3QgYXV0b21hdGljIGFuZCByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRo ZSByZXNwb25zaWJpbGl0eSBvZiB0aGUgbmV0d29yayBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBv bmx5IHRydXN0ZWQgY29uc3VtZXJzIGFyZSBjb25maWd1cmVkIHRvIHJlY2VpdmUgc3VjaCBpbmZv cm1hdGlvbi4iDQoNCklmIHNvbWVvbmUgd291bGQgYmUgc3RpbGwgY29uY2VybmVkIGFib3V0IGNv bmZpZ3VyYXRpb24gbWlzdGFrZXMgYW5kIG5lZ290aWF0aW5nIFNBRkkgNzEgb3IgNzIgdG8gdGhv c2Ugd2hvIHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0YSBJIHJlY29tbWVuZCB3ZSByZWlzc3VlIHRo ZSBSRkM3NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQgcmVzdHJpY3QgdGhlIHNjb3BlIG9mIHRoZSBk aXN0cmlidXRpb24gZXZlbiBmdXJ0aGVyIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1F WFBPUlQgY29tbXVuaXR5IHdpdGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxl Y3RpdmUgZUJHUCBwZWVycy4gT3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUg QWRtaW5pc3RyYXRpdmUgRG9tYWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuDQoN CkluIGVpdGhlciBjYXNlIHdoaWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhl eSBzZWVtcyBhIGJpdCBsYXRlIGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5n IHdyb25nIGRvY3VtZW50Lg0KDQpLaW5kIHJlZ2FyZHMsDQpSb2JlcnQuDQoNCg0KT24gRnJpLCBP Y3QgMTksIDIwMTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayA8a2FkdWtAbWl0LmVkdTxtYWls dG86a2FkdWtAbWl0LmVkdT4+IHdyb3RlOg0KT24gVGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6 MTNQTSArMDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6DQo+IFlvYXYg4oCTDQo+ DQo+IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhZHZlcnRpc2luZyB0 aGUgc3BlY2lmaWMgaW5mb3JtYXRpb24gY292ZXJlZCBpbiB0aGlzIGRyYWZ0IHdlIGhhdmUgYSBz dGF0ZW1lbnQgaW4gdGhlIElHUCBkcmFmdHM6DQo+DQo+IEZyb20gUkZDNzgxMA0KPg0KPiDigJxU aGUgc3ViLVRMVnMgaW50cm9kdWNlZCBpbiB0aGlzIGRvY3VtZW50IGFsbG93IGFuIG9wZXJhdG9y IHRvDQo+ICAgIGFkdmVydGlzZSBzdGF0ZSBpbmZvcm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRo LCBkZWxheSkgdGhhdCBjb3VsZCBiZQ0KPiAgICBzZW5zaXRpdmUgYW5kIHRoYXQgYW4gb3BlcmF0 b3IgbWF5IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnQ0KPg0KPiBJbiByZWdhcmRzIHRvIHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhh dmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDigJMgbW9zdCByZWxldmFudCBp czoNCj4NCj4g4oCcQWRkaXRpb25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBl eHBvcnQgb2YgbGluay1zdGF0ZSBhbmQNCj4gICAgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3JpYmVk IGluIHRoaXMgZG9jdW1lbnQgY29uc3RpdHV0ZXMgYSByaXNrIHRvDQo+ICAgIGNvbmZpZGVudGlh bGl0eSBvZiBtaXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmUNCj4gICAg aW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsu4oCdDQo+DQo+IFNvIGxvbmcgYXMgdGhlcmUg YXJlIHJlZmVyZW5jZXMgdG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhl cmVmb3JlIGhhcmQgcHJlc3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2Vm dWxseSBzYWlkLg0KPiBDZXJ0YWlubHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQ LUxTIHRyYW5zcG9ydCBtZWNoYW5pc20gYXJlIG5vdCBhbHRlcmVkIGJ5IGFkZGluZyBzb21lIG5l dyBUTFZzIOKAkyBhbmQgc2luY2UgdGhlIElHUCBSRkNzIGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJp c2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgc3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5v dCBzaW1wbHkgdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgdHJhbnNwb3J0IG1lY2hhbmlz bSkgeW91IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hh dCBjYW4gbWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGlu IHRoZSByZWZlcmVuY2VzLg0KDQpNeSBhcG9sb2dpZXMgZm9yIGp1bXBpbmcgaW4gaW4gdGhlIG1p ZGRsZSwgYnV0IElJVUMgdGhlIElHUCBSRkNzIGhhdmUNCmNvdmVyZWQgdGhlIHJpc2tzIGFzc29j aWF0ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAqdW5kZXINCnRoZSBh c3N1bXB0aW9uIHRoYXQgdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xl IEFTIGFuZA0KYWRtaW5pc3RyYXRpdmUgZG9tYWluKi4gIFlvYXYgaXMgcG9pbnRpbmcgb3V0IHRo YXQgdGhlIHJpc2tzIGZvciB0aGF0DQppbmZvcm1hdGlvbiBtYXkgY2hhbmdlIHdoZW4gdGhlIGRp c3RyaWJ1dGlvbiBpcyBvdmVyIGEgYnJvYWRlciBkb21haW4gdGhhbg0KdGhlIG9uZSBmb3Igd2hp Y2ggdGhlIHByZXZpb3VzIGFuYWx5c2lzIHdhcyBwZXJmb3JtZWQuDQoNCi1CZW4NCg== --_000_f20b00331cbf42f49dcc5ab61c8d2d8fXCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglw YW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNv LXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIs c2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIw DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXpl OjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAy NiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+ DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5n PSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2Vj dGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPlN1ZSDigJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklu bGluZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiBTdXNhbiBIYXJlcyAmbHQ7c2hhcmVzQG5kemguY29tJmd0Ow0KPGJy Pg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAxMDowOCBBTTxicj4NCjxi PlRvOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0O2dpbnNiZXJnQGNpc2NvLmNvbSZn dDs7ICdSb2JlcnQgUmFzenVrJyAmbHQ7cm9iZXJ0QHJhc3p1ay5uZXQmZ3Q7OyBrYWR1a0BtaXQu ZWR1PGJyPg0KPGI+Q2M6PC9iPiBpZHJAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IHluaXIuaWV0ZkBnbWFpbC5jb207IHNlY2Rp ckBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGly IGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+TGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ SSBhcG9sb2dpemUgaWYgbXkgZW1haWwgbWVzc2FnZSB3YXMgdW5jbGVhci4gJm5ic3A7Jm5ic3A7 V2UgYm90aCBhZ3JlZSB0aGF0IHlvdXIgZHJhZnQgaXMgbm90IHJlbGF0ZWQgdG8gU1Igcm91dGlu Zy4mbmJzcDsmbmJzcDsgU1Igcm91dGluZyBpcyByZWxhdGVkIHRvIEJHUC1MUyBhcyBhIHRyYW5z cG9ydCBtZWNoYW5pc20NCiBmb3IgaW5mb3JtYXRpb24uICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhZ3JlZSB0aGF0IFJGQzc3NTIgaGFkIHRyYWZm aWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24uJm5ic3A7IEhvd2V2ZXIsIHRoYXQgdHJhZmZpYyBl bmdpbmVlcmluZyBpbmZvcm1hdGlvbiBhbG1vc3QgZ290IHRoYXQgZHJhZnQgcmVqZWN0ZWQgYnkg dGhlIElFU0cgYXQgdGhlIHRpbWUuJm5ic3A7DQogQXMgbXkgcHJldmlvdXMgbWVzc2FnZSB0byB0 aGlzIGxpc3QgaW5kaWNhdGVkLCB3ZSBnb3QgYWdyZWVtZW50IG9uIFJGQzc3NTIgYmFzZWQgb24g bGltaXRpbmcgdGhhdCBpbmZvcm1hdGlvbiBhbmQgdGhlIGFzc3VyYW5jZSB0aGF0IEJHUC1MUyBu b2RlcyB3ZXJlIGRlcGxveWVkIG9uIGEgc2VwYXJhdGUgc2V0IG9mIG5vZGVzLiAmbmJzcDtFeHBh bmRpbmcgdGhlIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gYmV5b25kIFJGQzc3NTIg cmUtb3BlbnMNCiBhbGwgdGhlIHNlY3VyaXR5IGlzc3VlcyBhbmQgcXVlc3Rpb25zIGZyb20gUkZD Nzc1MuKAmXMgb3JpZ2luYWwgcmV2aWV3LiAmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPltMZXM6XSBTbyBmYXIsIHlvdSBhcmUgdGhlIG9ubHkg cGVyc29uIHdobyBzZWVtcyBhd2FyZSBvZiB0aGlzLiBJIGFtIG5vdCBzYXlpbmcgeW91IGFyZSB3 cm9uZyDigJMgSSBhbSBqdXN0IHNheWluZyBteSBwcml2YXRlIGF0dGVtcHRzIHRvIGdldCBtb3Jl IGNvbnRleHQNCiBmb3IgdGhpcyBoYXZlIHRodXMgZmFyIGZhaWxlZCDigJMgYW5kIHlvdSBoYXZl IG5vdCBwcm92aWRlZCBhbnkgZG9jdW1lbnRhdGlvbiBvZiB0aGlzLjxvOnA+PC9vOnA+PC9zcGFu PjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPklmIHlvdXIgc3RhdGVtZW50IGlzIGFjY3VyYXRlIChhZ2FpbiDigJMg bm90IHNheWluZyBpdCBpc27igJl0KSDigJMgaXQgYWxzbyBzZWVtcyBtb3N0IHVuZm9ydHVuYXRl IChhbmQgSSBhbSBiZWluZyDigJxraW5k4oCdIGhlcmUpIHRoYXQgdGhpcyB3YXMgbm90IG1lbnRp b25lZCBpbg0KIHRoZSBjb3Vyc2Ugb2YgdGhlIGZvdXIgeWVhcnMgdGhhdCBkcmFmdC1pZXRmLWlk ci10ZS1wbS1iZ3AgaGFzIHRha2VuIHRvIHByb2dyZXNzIHRvIHRoaXMgcG9pbnQuPG86cD48L286 cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBzZWN1cml0eSBk aXJlY3RvcmF0ZSByZXZpZXdlciBpcyBhc2tpbmcgdGhlc2Ugc2VjdXJpdHkgcXVlc3Rpb25zLiZu YnNwOyBUaGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgZG9lcyBoYXZlIHBlb3BsZSB3aXRoIGJvdGgg cm91dGluZyBhbmQgc2VjdXJpdHkgZXhwZXJ0cy4gJm5ic3A7Jm5ic3A7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TUiByb3V0aW5nIGlzIGFsc28gZXhwYW5kaW5n IHRoZSBpbmZvcm1hdGlvbiBwYXN0IHRoZSBvcmlnaW5hbCBSRkM3NzUyLiZuYnNwOyZuYnNwOyBU aGUgZXhwYW5zaW9ucyByZXF1ZXN0ZWQgYnkgU1Igcm91dGluZyBhbHNvIHJlLW9wZW4gdGhvc2Ug b3JpZ2luYWwgc2VjdXJpdHkgcXVlc3Rpb25zDQogYW5kIGlzc3Vlcy4mbmJzcDsgPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5bTGVzOl0gSSBkbyBub3Qg a25vdyB3aHkgeW91IG1lbnRpb24gU1IgaGVyZSBzaW5jZSB3ZSBib3RoIGFncmVlIHRoaXMgZHJh ZnQgaXMgbm90IFNSIHJlbGF0ZWQuPG86cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPk9uZSB3YXkgdG8gYW5zd2VyIHRoZXNlIHF1ZXN0aW9ucyBpcyB0byBw cm92aWRlIGEgJm5ic3A7UkZDNzc1MmJpcyB3aXRoIGFuIHVwZGF0ZWQgc2VjdXJpdHkgc2VjdGlv bi4mbmJzcDsgSWYgeW91IGFncmVlIHdpdGggdGhpcyBhcHByb2FjaCwgSSBzdWdnZXN0IHNpbXBs eSByZWZlcnJpbmcgdG8NCiBhIFJGQzc3NTJiaXMgdGhhdCBpbiB5b3VyIHNlY3VyaXR5IHNlY3Rp b24uICZuYnNwOyZuYnNwO0lmIHlvdSBkaXNhZ3JlZSB0aGF0IGFuIHVwZGF0ZSB0byB0aGUgUkZD Nzc1MmJpcyBpcyByZXF1aXJlZCwgd2UgY2FuIHN0YXJ0IGEgdGhyZWFkIG9uIHRoYXQgcG9pbnQu DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPltMZXM6 XSBUaGVyZSBpcyBubyBSRkM3NzUyYmlzIGRyYWZ0Lg0KPC9zcGFuPjwvaT48L2I+PGI+PGk+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMx RjQ5N0QiPko8L3NwYW4+PC9pPjwvYj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+ICZuYnNwO1NvIHlvdSBhcmUgYXNraW5nIG1lIHRvIHJlZmVyZW5jZSBhIG5vbi1leGlzdGVu dCBkb2N1bWVudD88bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHVuZGVyc3RhbmQgdGhhdCB5b3UgKGF0IGxlYXN0 KSB3b3VsZCBsaWtlIHRvIGhhdmUgb25lIOKAkyB3aGljaCBpcyBwZXJmZWN0bHkgbGVnaXRpbWF0 ZSDigJMgdGhvdWdoIHlvdSBzaG91bGQgZ28gdGhyb3VnaCB0aGUgbm9ybWFsIFdHIHByb2Nlc3Mg dG8gdGFrZSB0aGlzDQogd29yayBvbiDigJMgY29ycmVjdD88bzpwPjwvbzpwPjwvc3Bhbj48L2k+ PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5CdXQgdGhp cyBkb2RnZXMgdGhlIHF1ZXN0aW9uIGFzIHRvIHdoZXRoZXIgZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwIGhhcyBhIGRlcGVuZGVuY3kgb24gZW5oYW5jZWQgc2VjdXJpdHkuIFNvIGZhciwgeW91IGFy ZSB0aGUgb25seSBwZXJzb24gbWFraW5nIHRoaXMgY2xhaW0NCiDigJMgYW5kIHNldmVyYWwgZm9s a3MgKGluY2x1ZGluZyBteXNlbGYpIGhhdmUgZXhwcmVzc2VkIGEgZGlmZmVyZW50IFBPVi4gSSB0 aGluayB5b3UgYXQgbGVhc3QgaGF2ZSB0byBwcm92aWRlIGEganVzdGlmaWNhdGlvbiBmb3IgdGhp cyBkZXBlbmRlbmN5IGJlZm9yZSB3ZSBpbnRyb2R1Y2UgaXQgYW5kIGdldCBzb21lIHN1cHBvcnQg Zm9yIHlvdXIgcG9zaXRpb24g4oCTIHNpbmNlIHRoaXMgd2lsbCBtZWFuIGRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncCB3b3VsZA0KIGJlIHN0dWNrIGluIE1JU1NSRUYgc3RhdGUgdW50aWwgdGhpcyBj dXJyZW50bHkgbm9uLWV4aXN0ZW50IGRyYWZ0IGJlY29tZXMgYW4gUkZDLjxvOnA+PC9vOnA+PC9z cGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5EaWQgdGhpcyBtZXNzYWdlIGNsYXJpZnkgbXkgZWFy bGllciBicmllZiBtZXNzYWdlPyAmbmJzcDtEbyB5b3Ugd2FudCB0byBjb250aW51ZSB0byBkaXNj dXNzIHRoZSBuZWVkIGZvciBSRkM3NzUyYmlzPw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5DaGVlcmlseSwgU3VlDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1 b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1haWx0bzppZHItYm91bmNlc0BpZXRmLm9y ZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+ TGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3RvYmVy IDE5LCAyMDE4IDEwOjU4IEFNPGJyPg0KPGI+VG86PC9iPiBTdXNhbiBIYXJlczsgJ1JvYmVydCBS YXN6dWsnOyA8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48 YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9y ZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYu b3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8YSBocmVm PSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9yZzwvYT47DQo8YSBocmVmPSJtYWls dG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47IDxhIGhyZWY9 Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFm dC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+U3VlIOKAkzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T25lIG9mIHVzIGlzIGNvbmZ1 c2VkLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Oldp bmdkaW5ncztjb2xvcjojMUY0OTdEIj5KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncCBpcyBub3QgcmVsYXRlZCB0byBTZWdtZW50IFJvdXRpbmcuIFRob3Nl IHdvcmRzIGRvIG5vdCBhcHBlYXIgYW55d2hlcmUgaW4gdGhlIGRvY3VtZW50LiBOb3IgaXMgdGhl cmUgYSByZWZlcmVuY2UgdG8gYW55IFNSIGRvY3VtZW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+RnVydGhlciwgUkZDIDc3NTIgaW5jbHVkZXMgdHJhZmZpYyBl bmdpbmVlcmluZyBpbmZvcm1hdGlvbiAoc2VlDQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yPC9hPiApIHNvIHRoZSBzdWdnZXN0aW9uIHRoYXQgd2Ug YXJlIGludHJvZHVjaW5nIGEgbmV3IGF0dGFjayB2ZWN0b3IgYnkgZGVmaW5pbmcgc29tZSBhZGRp dGlvbmFsKHNpYykgVEUgY29kZXBvaW50cyBkb2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1lLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhcHByZWNpYXRlIHRoYXQg dGhlcmUgYXJlIG90aGVyIGRyYWZ0cyBvbiB5b3VyIG1pbmQgd2hpY2ggYXJlIFNSIHJlbGF0ZWQg 4oCTIGJ1dCB0aGlzIGlzIG5vdCBvbmUgb2YgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPkNvdWxkIHlvdSBwbGVhc2UgdXBkYXRlIHlvdXIgcmVzcG9uc2Ug d2l0aCB0aGVzZSBwb2ludHMgaW4gbWluZD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPlRoYW54LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQu MHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiBTdXNhbiBIYXJlcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXJlc0BuZHpoLmNvbSI+c2hhcmVz QG5kemguY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTks IDIwMTggNjoyNiBBTTxicj4NCjxiPlRvOjwvYj4gJ1JvYmVydCBSYXN6dWsnICZsdDs8YSBocmVm PSJtYWlsdG86cm9iZXJ0QHJhc3p1ay5uZXQiPnJvYmVydEByYXN6dWsubmV0PC9hPiZndDs7DQo8 YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8Yj5D Yzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3JnPC9hPjsg PGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNkaXJAaWV0Zi5vcmc8L2E+OyA8 YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwv YT47DQo8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5vcmc8L2E+OyA8YSBo cmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFm dC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9i PiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlk ci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Um9iZXJ0LCBCZW5qYW1pbiwgYW5k IFlvYXY6DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgYWdy ZWUgdGhlc2UgY29udGV4dCBvZiB0aGVzZSBpc3N1ZXMgYXJlIG5vdCBzcGVjaWZpYyB0byB0aGlz IGRyYWZ0LiZuYnNwOyBIb3dldmVyLCB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0aW9uIGRv ZXMgcHJvdmlkZSBpbmZvcm1hdGlvbiB3aGljaCBpcyBhIHRlbXB0aW5nIGF0dGFjaw0KIHZlY3Rv ci4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGUgb3JpZ2lu YWwgUkZDNzc1MiBkZXNjcmliZWQgYSBkaWZmZXJlbnQgcHVycG9zZSB3aXRoIHJlc3RyaWN0ZWQg dXNhZ2UgdGhhdCBTUiByb3V0aW5nIGV4dGVuc2lvbnMgZG8gbm90IGFkaGVyZSB0byBpbiBCR1Au Jm5ic3A7Jm5ic3A7IFNpbmNlIFNwcmluZyBXRyBzaG93cyB0aGF0IG9wZXJhdG9ycw0KIGFyZSBp bnRlcmVzdGVkIGluIHRoZSBleHRlbmRlZCB1c2UsIGl0IG1heSBiZSB0aW1lIHRvIGV4YW1pbmUg dGhlIFJGQzc3NTJiaXMgb3Igb3RoZXIgc29sdXRpb25zIHRoYXQgdGFrZXMgY2FyZSBvZiB0aGVz ZSBzZWN1cml0eSBpc3N1ZXMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPk15IGpvYiBhcyBhIHNoZXBoZXJkIGlzIHRvIHBvaW50IG91dCB0aGVzZSBp c3N1ZXMgcGVyIGRyYWZ0IGZvciB0aGUgSUVTRyBhbmQgc2VjdXJpdHkgZGlyZWN0b3JhdGUgaW4g b3JkZXIgdG8gb2J0YWluIHRoZSBjb3JyZWN0IGZlZWRiYWNrLiAmbmJzcDtBcyBhIFdHIGNoYWly LCBJIGhhdmUNCiBwb2ludGVkIG91dCB0aGVzZSBpc3N1ZXMsIGJ1dCB0aGUgV0cgaGFzIHRoZXNl IGRyYWZ0cyBvbiBXRyBMQyB3aXRob3V0IHRoZSBleHRyYSBzZWN1cml0eS48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+V2l0aG91dCBSRkM3NzUyYmlzIHdpdGggYWRkaXRpb25hbCBzZWN1cml0eSBpbiB0aGUg YmFzZSBkb2N1bWVudCwgSSBhbSB3b3JraW5nIGFzIGEgc2hlcGhlcmQgbWFrZSB0aGUgbWFuYWdl YWJpbGl0eSBhbmQgc2VjdXJpdHkgc2VjdGlvbnMgYXMgY2xlYXIgYXMgcG9zc2libGUuDQogJm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB0aGUgZmVl ZGJhY2sgZnJvbSB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3IG9yIHRoZSBJRVNHIGlz IHRoYXQgd2UgbmVlZCB0byBvYnRhaW4gYSBzb2x1dGlvbiBmb3IgUkZDNzc1MmJpcyB0aGF0IGRl c2NyaWJlcyBhbmQgaGFuZGxlcyB0aGVzZSBzZWN1cml0eQ0KIGlzc3VlcywgSSB3aWxsIGJlIGds YWQgdG8gc3VwcG9ydCBmYXN0LXRyYWNraW5nIHRoaXMgaXNzdWUgd2l0aGluIHRoZSBXRy4gPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiBhbiBvZmZsaW5lIGRp c2N1c3Npb24gd2l0aCBCZW5qYW1pbiwgWW9hdiwgdGhlIElEUiBjaGFpcnMsIGFuZCBBbHZhcm8g d291bGQgc3BlZWQgdGhpcyBhbG9uZywgSSBjYW4gc2V0IHRoaXMgdXAgZWFybHkgbmV4dCB3ZWVr LiZuYnNwOyBJdCB3b3VsZCBiZSBoZWxwZnVsIHRvIGhhdmUNCiB0aGlzIG9mZmxpbmUgZGlzY3Vz c2lvbiBiZWZvcmUgdGhlIElEUiBpbnRlcmltIHNlc3Npb24gb24gMTAvMjYuIDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmsgeW91IGZvciBhbGwgeW91ciBj b21tZW50cy4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+U3Vl DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlm Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1haWx0bzpp ZHItYm91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxi Pk9uIEJlaGFsZiBPZiA8L2I+Um9iZXJ0IFJhc3p1azxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXks IE9jdG9iZXIgMTksIDIwMTggMjo1MiBBTTxicj4NCjxiPlRvOjwvYj4gPGEgaHJlZj0ibWFpbHRv OmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVm PSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0 bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRv OnluaXIuaWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBnbWFpbC5jb208L2E+Ow0KPGEgaHJlZj0i bWFpbHRvOmlkckBpZXRmLm9yZyI+aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1pZHItdGUt cG0tYmdwLmFsbEBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtz ZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEz PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxs byBCZW5qYW1pbiw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk5vdCBzdXJlIGlmIHlvdSBoYXZlIHNwb3R0ZWQgc2ltaWxhciBjb21tZW50IG1hZGUgdG8gSURS IHJlZ2FyZGluZyB0aGlzIHRvcGljLCBidXQgeW91ciBjb21tZW50IHNlZW1zIHRvIGluZGljYXRl IHRoYXQgaGVyZSB3ZSBhcmUgYWJvdXQgdG8gZGVmaW5lIHdheXMgdG8gY2FycnkgbmljZWx5IHNj b3BlZCBJR1AgaW5mb3JtYXRpb24gaW50byBCR1AuIFdlbGwgdGhhdCBoYXMgYWxyZWFkeSBoYXBw ZW5lZCB3aXRoDQogUkZDNzc1MiBhbmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1hdHRlciBZ b2F2J3MgcmVtYXJrcyBhcmUgaW5kZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0eSBkaXNj dXNzaW9uIG9uIFJGQzc3NTIgYW5kIElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNpb25zIG9m IGl0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5TdXJlIC0gYXMgb2JzZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0aGF0IHBy b3ZpZGluZyBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBwb3RlbnRp YWwgYXR0YWNrZXIgbWFrZXMgdGhlIG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUgZm9yIHRo YXQgaXMgdG8gcHJldmVudCB0aGUgbGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBvZiBpbnRl cmNlcHRpbmcgbmV3IGluZm9ybWF0aW9uDQogYnkgdW5hdXRob3JpemVkIHBhcnRpZXMuJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJH UC1MUyBpcyBhbHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0IGJ5IGl0c2VsZiBkb2Vz IHByb3ZpZGUgbmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIgaXMgcHJldHR5IGNsZWFy IG9uIHRoYXQgdG9vIGFuZCBzYXlzOiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mcXVvdDtCR1AgcGVlcmluZ3MgYXJlIG5vdCBhdXRv bWF0aWMgYW5kIHJlcXVpcmUgY29uZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJlc3BvbnNp YmlsaXR5IG9mIHRoZSBuZXR3b3JrIG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkgdHJ1c3Rl ZCBjb25zdW1lcnMgYXJlIGNvbmZpZ3VyZWQgdG8gcmVjZWl2ZSBzdWNoIGluZm9ybWF0aW9uLiZx dW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5JZiBzb21lb25lIHdvdWxkIGJlIHN0aWxsIGNvbmNlcm5lZCBhYm91dCBjb25maWd1cmF0aW9u IG1pc3Rha2VzIGFuZCBuZWdvdGlhdGluZyBTQUZJIDcxIG9yIDcyIHRvIHRob3NlIHdobyBzaG91 bGQgbm90IGdldCB0aGlzIGRhdGEgSSByZWNvbW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZDNzc1MiBh cyAtYmlzIHZlcnNpb24gYW5kIHJlc3RyaWN0IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJpYnV0aW9u IGV2ZW4gZnVydGhlcg0KIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1FWFBPUlQgY29t bXVuaXR5IHdpdGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxlY3RpdmUgZUJH UCBwZWVycy4gT3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUgQWRtaW5pc3Ry YXRpdmUgRG9tYWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIGVpdGhl ciBjYXNlIHdoaWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhleSBzZWVtcyBh IGJpdCBsYXRlIGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5nIHdyb25nIGRv Y3VtZW50LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5LaW5kIHJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5Sb2JlcnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6MjcgQU0gQmVuamFt aW4gS2FkdWsgJmx0OzxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0BtaXQuZWR1 PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t cmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g VGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6MTNQTSAmIzQzOzAwMDAsIExlcyBHaW5zYmVyZyAo Z2luc2JlcmcpIHdyb3RlOjxicj4NCiZndDsgWW9hdiDigJM8YnI+DQomZ3Q7IDxicj4NCiZndDsg SW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5nIHRoZSBz cGVjaWZpYyBpbmZvcm1hdGlvbiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBhIHN0YXRl bWVudCBpbiB0aGUgSUdQIGRyYWZ0czo8YnI+DQomZ3Q7IDxicj4NCiZndDsgRnJvbSBSRkM3ODEw PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGluIHRoaXMg ZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0b3IgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBhZHZl cnRpc2Ugc3RhdGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQg Y291bGQgYmU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBzZW5zaXRpdmUgYW5kIHRoYXQgYW4gb3Bl cmF0b3IgbWF5IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnTxicj4NCiZndDsgPGJyPg0KJmd0OyBJ biByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZvcm1hdGlv biB2aWEgQkdQLUxTIHdlIGhhdmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMgNzc1MiDi gJMgbW9zdCByZWxldmFudCBpczo8YnI+DQomZ3Q7IDxicj4NCiZndDsg4oCcQWRkaXRpb25hbGx5 LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0ZSBhbmQ8 YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhp cyBkb2N1bWVudCBjb25zdGl0dXRlcyBhIHJpc2sgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBj b25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFsbHkgc2Vuc2l0 aXZlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsu 4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFNvIGxvbmcgYXMgdGhlcmUgYXJlIHJlZmVyZW5jZXMg dG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhlcmVmb3JlIGhhcmQgcHJl c3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2VmdWxseSBzYWlkLjxicj4N CiZndDsgQ2VydGFpbmx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1MUyB0cmFu c3BvcnQgbWVjaGFuaXNtIGFyZSBub3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDi gJMgYW5kIHNpbmNlIHRoZSBJR1AgUkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNrcyBhc3Nv Y2lhdGVkIHdpdGggdGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5 IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydA0KIG1lY2hhbmlzbSkgeW91 IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hhdCBjYW4g bWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGluIHRoZSBy ZWZlcmVuY2VzLjxicj4NCjxicj4NCk15IGFwb2xvZ2llcyBmb3IganVtcGluZyBpbiBpbiB0aGUg bWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQIFJGQ3MgaGF2ZTxicj4NCmNvdmVyZWQgdGhlIHJpc2tz IGFzc29jaWF0ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAqdW5kZXI8 YnI+DQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtIGlzIHdpdGhp biBhIHNpbmdsZSBBUyBhbmQ8YnI+DQphZG1pbmlzdHJhdGl2ZSBkb21haW4qLiZuYnNwOyBZb2F2 IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdDxicj4NCmluZm9ybWF0aW9u IG1heSBjaGFuZ2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVyIGRvbWFp biB0aGFuPGJyPg0KdGhlIG9uZSBmb3Igd2hpY2ggdGhlIHByZXZpb3VzIGFuYWx5c2lzIHdhcyBw ZXJmb3JtZWQuPGJyPg0KPGJyPg0KLUJlbjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_f20b00331cbf42f49dcc5ab61c8d2d8fXCHALN001ciscocom_-- From nobody Fri Oct 19 12:08:22 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6721A131117 for ; Fri, 19 Oct 2018 12:08:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yOb7nIpqtjOQ for ; Fri, 19 Oct 2018 12:08:09 -0700 (PDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C270D1310BD for ; Fri, 19 Oct 2018 12:08:06 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id v68-v6so21667851qka.2 for ; Fri, 19 Oct 2018 12:08:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=92VgnNQG6Nvb8HC/53uTAN9lNf9DVMprREZOoV6o56g=; b=bSLC7C27cn+nJsmgIQVDV9FCGK1d1bx0pxvKCZJh5ETOC7CDi/0NLvzG5kou3ZfRNg TnRQ7WqmXkgVMbY4Xob3+dSntv3P/mEDYwD+ldZGbXyCJIrHSO76Ao3QldoC0N7TBUjy CHluzfZq/ZQ68yHfx68v6j7Z84fnzjRXgLij8Ij9LyOW9WLCFd3+rR44hoYOZMiZGgih 5AZ5FaXAATkGapHU8f3Ycuds4VvpbDex7UcwoML0FO+/8M0k0g/dj6HFaMBZYlgsN9AK jF9wJGXp8h60p4MnRRe+64JNBAclGRbzvZ1j7BX63+mZENcMQHF7UIRz1pbdj6drn/Vs z1cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=92VgnNQG6Nvb8HC/53uTAN9lNf9DVMprREZOoV6o56g=; b=irxcGnGlJOph/tc9whdPajqgjwufRRd6hSPiXADqJ6m0FTgcjkD9s0JI+yWdT42vvT btHDtWFX/tbDKnRuRNUtRJKmYaMiImL470n/hQgfPcGbbyaQ/EEADjyRNCoF1n27QP0A 4aXkNATs624vk+udZC6itto8ZUTTeyOBrbnQNeyCp6X99n7+oL5XeuR8MBE/fZRxwQJQ Z3PGltdTZE27KNFgSS62i4RAmCHid0SM4veM+pFvEBoutYMEFtUo/z5ll38+lR8BCepO xwo19J6jwNxF6ZiQlrdfprLNqSClWdxYzymV1PE5E+jby/4/wPq+tqKNhWUKr+C38ePy ASnA== X-Gm-Message-State: ABuFfoi+WqM9cn3ci+h8qRIQK0xbxUtGzKlV9sVgCdAksimn5D1ShPTc IY542ueubZkrgKfJosiESRsgE1Iap+Jhz285H9Yi0w== X-Google-Smtp-Source: ACcGV62jACARDjYS3tBkUR4tYuA8HJlh1Glaa88tR80BUPUOTmHcCfm868VGX9w28q5ucL1D5ymPBqhNtwnIRlLqndY= X-Received: by 2002:a37:9203:: with SMTP id u3-v6mr33219275qkd.72.1539976085804; Fri, 19 Oct 2018 12:08:05 -0700 (PDT) MIME-Version: 1.0 References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> In-Reply-To: <028b01d467ce$402b2400$c0816c00$@ndzh.com> From: Robert Raszuk Date: Fri, 19 Oct 2018 21:07:56 +0200 Message-ID: To: shares@ndzh.com Cc: "Les Ginsberg (ginsberg)" , kaduk@mit.edu, idr@ietf.org, Yoav Nir , secdir@ietf.org Content-Type: multipart/alternative; boundary="0000000000008ebf0a0578999f1b" Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 19:08:17 -0000 --0000000000008ebf0a0578999f1b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Sue, It seems that we have arrived here at a point that indeed further discussion and clarification is needed. Yes RFC7752 has issues in the way it is designed ... those issues are there since day one. Just to name a few: * Point to multipoint protocol is used as a container to distribute point to point information. * Fate sharing separation is not enforced in any way and various address families are send via the same BGP infrastructure * The growth of the amount of information being carried by BGP-LS can impact bgp processing (ex: update generation) of other types of SAFIs * More and more applications want have a free ride on this transport - othen only because it is already there. We should discuss those in a separate thread if RFC7752bis is needed or perhaps other work can offer alternate transport for BGP-LS be it an enforced different TCP session or in general for link state type of data (BMP analogy for IGP). *However IMO non of the above is about security. * SAFIs just do not get advertised automagically to attackers. For further scoping tools like local BGP policy is already in place today. As mentioned use of NO-EXPORT can be applied today with no new draft needed. So to proceed I would like to see a list of valid security issues of RFC7752. If none will be produced all companion work should be progressed with their current security sections just referencing RFC7752 or RFC4271. Kind regards, Robert On Fri, Oct 19, 2018 at 7:07 PM Susan Hares wrote: > Les: > > > > I apologize if my email message was unclear. We both agree that your > draft is not related to SR routing. SR routing is related to BGP-LS as = a > transport mechanism for information. > > > > I agree that RFC7752 had traffic engineering information. However, that > traffic engineering information almost got that draft rejected by the IES= G > at the time. As my previous message to this list indicated, we got > agreement on RFC7752 based on limiting that information and the assurance > that BGP-LS nodes were deployed on a separate set of nodes. Expanding th= e > traffic engineering information beyond RFC7752 re-opens all the security > issues and questions from RFC7752=E2=80=99s original review. > > > > The security directorate reviewer is asking these security questions. Th= e > security directorate does have people with both routing and security > experts. > > > > SR routing is also expanding the information past the original RFC7752. > The expansions requested by SR routing also re-open those original securi= ty > questions and issues. > > > > One way to answer these questions is to provide a RFC7752bis with an > updated security section. If you agree with this approach, I suggest > simply referring to a RFC7752bis that in your security section. If you > disagree that an update to the RFC7752bis is required, we can start a > thread on that point. > > > > Did this message clarify my earlier brief message? Do you want to > continue to discuss the need for RFC7752bis? > > > > Cheerily, Sue > --0000000000008ebf0a0578999f1b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Sue,

It seems that we hav= e arrived here at a point that indeed further discussion and clarification = is needed.

Yes RFC7752 has issues in the way it is= designed ... those issues are there since day one.=C2=A0

Just to name a few:=C2=A0

* Point to multi= point protocol is used as a container to distribute point to point informat= ion.=C2=A0
* Fate sharing separation is not enforced in any way a= nd various address families are send via the same BGP infrastructure
<= div>* The growth of the amount of information being carried by BGP-LS can i= mpact bgp processing (ex: update generation) of other types of SAFIs
<= div>* More and more applications want have a free ride on this transport - = othen only because it is already there.=C2=A0

We s= hould discuss those in a separate thread if RFC7752bis is needed or perhaps= other work can offer alternate transport for BGP-LS be it=C2=A0
<= div>an enforced different TCP session or in general for link state type of = data (BMP analogy for IGP).=C2=A0

Howev= er IMO non of the above is about security.=C2=A0
SAFIs just do not get advertised automagically to attackers. F= or further scoping tools like local BGP policy is already in place today. A= s mentioned=C2=A0
use of NO-EXPORT can be applied today with no n= ew draft needed.=C2=A0

So to proceed I would like = to see a list of valid security issues of RFC7752. If none will be produced= all companion work should be progressed=C2=A0
with their current= security sections just referencing RFC7752 or RFC4271.

Kind regards,
Robert


On Fri, Oct 19, 2018 at 7:07 P= M Susan Hares <shares@ndzh.com>= ; wrote:

Les:

=C2=A0=

I apologize if= my email message was unclear. =C2=A0=C2=A0We both agree that your draft is= not related to SR routing.=C2=A0=C2=A0 SR routing is related to BGP-LS as = a transport mechanism for information. =C2=A0

=C2=A0

I agree that RFC7752 had= traffic engineering information.=C2=A0 However, that traffic engineering i= nformation almost got that draft rejected by the IESG at the time.=C2=A0 As= my previous message to this list indicated, we got agreement on RFC7752 ba= sed on limiting that information and the assurance that BGP-LS nodes were d= eployed on a separate set of nodes.=C2=A0 Expanding the traffic engineering= information beyond RFC7752 re-opens all the security issues and questions = from RFC7752=E2=80=99s original review. =C2=A0

=C2=A0

The security directorat= e reviewer is asking these security questions.=C2=A0 The security directora= te does have people with both routing and security experts. =C2=A0=C2=A0=

= =C2=A0

SR routing is also expanding the information past the original RFC7752.= =C2=A0=C2=A0 The expansions requested by SR routing also re-open those orig= inal security questions and issues.=C2=A0

=C2=A0

One way to answer these que= stions is to provide a =C2=A0RFC7752bis with an updated security section.= =C2=A0 If you agree with this approach, I suggest simply referring to a RFC= 7752bis that in your security section. =C2=A0=C2=A0If you disagree that an = update to the RFC7752bis is required, we can start a thread on that point. =

= =C2=A0

Did this message clarify my earlier brief message?=C2=A0 Do you want = to continue to discuss the need for RFC7752bis?

=C2=A0=

Cheerily, Sue<= /p>

--0000000000008ebf0a0578999f1b-- From nobody Fri Oct 19 12:42:54 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 036C8130DD1; Fri, 19 Oct 2018 12:42:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.764 X-Spam-Level: X-Spam-Status: No, score=-0.764 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, KHOP_DYNAMIC=1.999, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYIbp5b8-M2t; Fri, 19 Oct 2018 12:42:42 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00CDE130DF9; Fri, 19 Oct 2018 12:42:41 -0700 (PDT) Received: from pps.filterd (m0108162.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9JJdJgU030081; Fri, 19 Oct 2018 12:42:39 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=oHgYdZGE0ltP9z1/zehXSw/MabqhwvY+zdkbfY1ZWgA=; b=wIAWLrqGfgLmh+uDDBNvL375R0PMtF2dam9CiQW26uwSCyS1TZqW0y7R/rqKbScSjxqx NufxO1Thjhh+1mhrVjNHQTNsKpnCMpbCnc5lTxsQsloPww/lu01eyzeOZVIZ558MTjg5 v2/BiPWmu3H78+5mADecEVU7K3+v79z7Q0r0wTWdAMq7X/QguPR00hfKNw/GMVg+ISvH OxEUjQYha/VWUDZf7I+P0jbLQDcSooENmpLov9xiC6fcaspBuQmtX2qrsHooa2y0006C bsl4pn5dYE0lEtNY9dfXXheFSjiAFHu0ykEwtkywlkzl3oB9Oo2xW8SJETvQHqhh/RTl 0w== Received: from nam05-dm3-obe.outbound.protection.outlook.com (mail-dm3nam05lp0117.outbound.protection.outlook.com [216.32.181.117]) by mx0b-00273201.pphosted.com with ESMTP id 2n7fbp0mnh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 19 Oct 2018 12:42:39 -0700 Received: from BN7PR05MB4354.namprd05.prod.outlook.com (52.133.223.33) by BN7PR05MB5699.namprd05.prod.outlook.com (20.176.28.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.13; Fri, 19 Oct 2018 19:42:35 +0000 Received: from BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012]) by BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012%4]) with mapi id 15.20.1250.028; Fri, 19 Oct 2018 19:42:34 +0000 From: John E Drake To: Robert Raszuk , "shares@ndzh.com" CC: "secdir@ietf.org" , "kaduk@mit.edu" , Yoav Nir , "idr@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZwyQN9RQyXdy5EeaDRo0vfHjgKUltrcAgABrlwCAAG4QAIAAGbsAgAAkTACAACGXAIAACWfA Date: Fri, 19 Oct 2018 19:42:34 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [66.129.241.13] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN7PR05MB5699; 6:584PRl8/V31v6hPYV5wQZqfXQzhe1fAvr+iGhtEYPk58N0oeWAwcx1rrTl0ASBIM8FiZhNx5Utzyv+ZWYIzFCGqY65M/VQYsx8xrcgkGllSlNWvRMtr5gp+Vp4YWfXNVnn6xtBm/3ZVBBZ+Es7rUcMB0MnqG3UY4saU4CIwHXM3N0GM1Y5DBM7Ooktymao4rhEbt8UyAJhWw4AB4TcfETzb/cj/X5uLq5rraCZneIedOb6jKAecxlSls57nMsL+srs+WB9ewRptOkxJTCg+Bk+UoqzSJOZ3Pt/7AyUSv5tGaHMEGb0LakSPnAgN808+WhgrFCpo0sRw2Q0kqjozDSWs+MHanFHagT8O0gDrj1rYv7tdsYm8RdLIfvvsl2heUw0HACv2ymAvup/HOyT0AgGugABnuoW2GFKxA3WS19PCG00tc0dbjrFspZbE0i+ypCc+6JbQRk6kTl1lXCzWFbw==; 5:HGw1mm9HhzR6qpaeVAdZtscvStq7XQmGIAk0yb/QDlY3J6zNePqRuX/WkQMR7wQCzTz90CUCiCkKhCRhbnoF6LbVDU23pDBJqb18x+4qC8EdJsW5ebTpJlFEFNvhZET2Hm6kDrN1lxLBW3hnKwxEIPaOAcqDWPT4iu4c+9AhpYQ=; 7:IZGcJPPBtXTTj3ld7MkngzjxlzcpQsfuA92YEaNRwlJsZvSprbzfZ03KEUnav3Xfq3FZlLoJcmN2Xemd9FYctQIcVbicTd+g3+JEg/wJEmo+Yqz504iytojAiA2EIlcrFLoJ8AkMgTpcyNpNPljvAg== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 7481fcf0-ac8f-47fc-5a8a-08d635fb047f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(5600074)(711020)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:BN7PR05MB5699; x-ms-traffictypediagnostic: BN7PR05MB5699: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(240460790083961)(85827821059158)(278428928389397)(192374486261705)(21748063052155)(28532068793085)(190501279198761)(227612066756510); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3002001)(3231355)(944501410)(52105095)(6055026)(148016)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201708071742011)(7699051)(76991095); SRVR:BN7PR05MB5699; BCL:0; PCL:0; RULEID:; SRVR:BN7PR05MB5699; x-forefront-prvs: 0830866D19 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(376002)(346002)(39860400002)(136003)(366004)(199004)(189003)(4326008)(6436002)(25786009)(39060400002)(55016002)(9686003)(256004)(7736002)(478600001)(6306002)(74316002)(54896002)(236005)(14444005)(53936002)(316002)(7696005)(66066001)(76176011)(106356001)(105586002)(99286004)(6246003)(54906003)(110136005)(97736004)(229853002)(14454004)(53546011)(6506007)(81156014)(8676002)(102836004)(81166006)(71190400001)(71200400001)(186003)(26005)(33656002)(68736007)(8936002)(19609705001)(9326002)(486006)(2501003)(2900100001)(11346002)(476003)(446003)(2906002)(5660300001)(93886005)(86362001)(6116002)(790700001)(3846002)(5250100002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR05MB5699; H:BN7PR05MB4354.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-microsoft-antispam-message-info: z8GuY+sl+dR1tWI5HNh/YYn0iweJZpN147h6KLtH1R24y1mfLUiAIMWXjSHqC+qM81k2oWhtuGbuDiQsTw6L0/2cnuAt0anRf9XxIglcIlmAy44Wb7Oyo4mX1ToPlYvJAUlCJOkRRvuis1J685JTtdZ84+xw8veEaRJJhm4P2BMDbldCgkM5MHb404MKGKa4Ea9Mu2da6U9nxHhb1/izwesqgUCSl0qV5bP/xbdm+1I52YeLBYBQoz+9OAkXRKkMci0LqQzHVSXl5RA+irBMofPLY94xLje1s8AC5hUmVCsGPwx2Ii5E2OjhyGSGdzl0q3qMguHqwyqEhgOwbvFOnGFB8OcvNmvUQ11jVYHWi/k= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN7PR05MB4354CF37F315E746A4E6E5EBC7F90BN7PR05MB4354namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 7481fcf0-ac8f-47fc-5a8a-08d635fb047f X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2018 19:42:34.7111 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB5699 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-10-19_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1810190174 Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 19:42:44 -0000 --_000_BN7PR05MB4354CF37F315E746A4E6E5EBC7F90BN7PR05MB4354namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCldoYXQgaGUgc2FpZC4NCg0KWW91cnMgSXJyZXNwZWN0aXZlbHksDQoNCkpvaG4NCg0K RnJvbTogSWRyIDxpZHItYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIFJvYmVydCBSYXN6 dWsNClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAzOjA4IFBNDQpUbzogc2hhcmVzQG5k emguY29tDQpDYzogc2VjZGlyQGlldGYub3JnOyBrYWR1a0BtaXQuZWR1OyBZb2F2IE5pciA8eW5p ci5pZXRmQGdtYWlsLmNvbT47IGlkckBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtJZHJdIFtzZWNk aXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoN CkhpIFN1ZSwNCg0KSXQgc2VlbXMgdGhhdCB3ZSBoYXZlIGFycml2ZWQgaGVyZSBhdCBhIHBvaW50 IHRoYXQgaW5kZWVkIGZ1cnRoZXIgZGlzY3Vzc2lvbiBhbmQgY2xhcmlmaWNhdGlvbiBpcyBuZWVk ZWQuDQoNClllcyBSRkM3NzUyIGhhcyBpc3N1ZXMgaW4gdGhlIHdheSBpdCBpcyBkZXNpZ25lZCAu Li4gdGhvc2UgaXNzdWVzIGFyZSB0aGVyZSBzaW5jZSBkYXkgb25lLg0KDQpKdXN0IHRvIG5hbWUg YSBmZXc6DQoNCiogUG9pbnQgdG8gbXVsdGlwb2ludCBwcm90b2NvbCBpcyB1c2VkIGFzIGEgY29u dGFpbmVyIHRvIGRpc3RyaWJ1dGUgcG9pbnQgdG8gcG9pbnQgaW5mb3JtYXRpb24uDQoqIEZhdGUg c2hhcmluZyBzZXBhcmF0aW9uIGlzIG5vdCBlbmZvcmNlZCBpbiBhbnkgd2F5IGFuZCB2YXJpb3Vz IGFkZHJlc3MgZmFtaWxpZXMgYXJlIHNlbmQgdmlhIHRoZSBzYW1lIEJHUCBpbmZyYXN0cnVjdHVy ZQ0KKiBUaGUgZ3Jvd3RoIG9mIHRoZSBhbW91bnQgb2YgaW5mb3JtYXRpb24gYmVpbmcgY2Fycmll ZCBieSBCR1AtTFMgY2FuIGltcGFjdCBiZ3AgcHJvY2Vzc2luZyAoZXg6IHVwZGF0ZSBnZW5lcmF0 aW9uKSBvZiBvdGhlciB0eXBlcyBvZiBTQUZJcw0KKiBNb3JlIGFuZCBtb3JlIGFwcGxpY2F0aW9u cyB3YW50IGhhdmUgYSBmcmVlIHJpZGUgb24gdGhpcyB0cmFuc3BvcnQgLSBvdGhlbiBvbmx5IGJl Y2F1c2UgaXQgaXMgYWxyZWFkeSB0aGVyZS4NCg0KV2Ugc2hvdWxkIGRpc2N1c3MgdGhvc2UgaW4g YSBzZXBhcmF0ZSB0aHJlYWQgaWYgUkZDNzc1MmJpcyBpcyBuZWVkZWQgb3IgcGVyaGFwcyBvdGhl ciB3b3JrIGNhbiBvZmZlciBhbHRlcm5hdGUgdHJhbnNwb3J0IGZvciBCR1AtTFMgYmUgaXQNCmFu IGVuZm9yY2VkIGRpZmZlcmVudCBUQ1Agc2Vzc2lvbiBvciBpbiBnZW5lcmFsIGZvciBsaW5rIHN0 YXRlIHR5cGUgb2YgZGF0YSAoQk1QIGFuYWxvZ3kgZm9yIElHUCkuDQoNCkhvd2V2ZXIgSU1PIG5v biBvZiB0aGUgYWJvdmUgaXMgYWJvdXQgc2VjdXJpdHkuDQoNClNBRklzIGp1c3QgZG8gbm90IGdl dCBhZHZlcnRpc2VkIGF1dG9tYWdpY2FsbHkgdG8gYXR0YWNrZXJzLiBGb3IgZnVydGhlciBzY29w aW5nIHRvb2xzIGxpa2UgbG9jYWwgQkdQIHBvbGljeSBpcyBhbHJlYWR5IGluIHBsYWNlIHRvZGF5 LiBBcyBtZW50aW9uZWQNCnVzZSBvZiBOTy1FWFBPUlQgY2FuIGJlIGFwcGxpZWQgdG9kYXkgd2l0 aCBubyBuZXcgZHJhZnQgbmVlZGVkLg0KDQpTbyB0byBwcm9jZWVkIEkgd291bGQgbGlrZSB0byBz ZWUgYSBsaXN0IG9mIHZhbGlkIHNlY3VyaXR5IGlzc3VlcyBvZiBSRkM3NzUyLiBJZiBub25lIHdp bGwgYmUgcHJvZHVjZWQgYWxsIGNvbXBhbmlvbiB3b3JrIHNob3VsZCBiZSBwcm9ncmVzc2VkDQp3 aXRoIHRoZWlyIGN1cnJlbnQgc2VjdXJpdHkgc2VjdGlvbnMganVzdCByZWZlcmVuY2luZyBSRkM3 NzUyIG9yIFJGQzQyNzEuDQoNCktpbmQgcmVnYXJkcywNClJvYmVydA0KDQoNCg0KT24gRnJpLCBP Y3QgMTksIDIwMTggYXQgNzowNyBQTSBTdXNhbiBIYXJlcyA8c2hhcmVzQG5kemguY29tPG1haWx0 bzpzaGFyZXNAbmR6aC5jb20+PiB3cm90ZToNCkxlczoNCg0KSSBhcG9sb2dpemUgaWYgbXkgZW1h aWwgbWVzc2FnZSB3YXMgdW5jbGVhci4gICBXZSBib3RoIGFncmVlIHRoYXQgeW91ciBkcmFmdCBp cyBub3QgcmVsYXRlZCB0byBTUiByb3V0aW5nLiAgIFNSIHJvdXRpbmcgaXMgcmVsYXRlZCB0byBC R1AtTFMgYXMgYSB0cmFuc3BvcnQgbWVjaGFuaXNtIGZvciBpbmZvcm1hdGlvbi4NCg0KSSBhZ3Jl ZSB0aGF0IFJGQzc3NTIgaGFkIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24uICBIb3dl dmVyLCB0aGF0IHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gYWxtb3N0IGdvdCB0aGF0 IGRyYWZ0IHJlamVjdGVkIGJ5IHRoZSBJRVNHIGF0IHRoZSB0aW1lLiAgQXMgbXkgcHJldmlvdXMg bWVzc2FnZSB0byB0aGlzIGxpc3QgaW5kaWNhdGVkLCB3ZSBnb3QgYWdyZWVtZW50IG9uIFJGQzc3 NTIgYmFzZWQgb24gbGltaXRpbmcgdGhhdCBpbmZvcm1hdGlvbiBhbmQgdGhlIGFzc3VyYW5jZSB0 aGF0IEJHUC1MUyBub2RlcyB3ZXJlIGRlcGxveWVkIG9uIGEgc2VwYXJhdGUgc2V0IG9mIG5vZGVz LiAgRXhwYW5kaW5nIHRoZSB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0aW9uIGJleW9uZCBS RkM3NzUyIHJlLW9wZW5zIGFsbCB0aGUgc2VjdXJpdHkgaXNzdWVzIGFuZCBxdWVzdGlvbnMgZnJv bSBSRkM3NzUy4oCZcyBvcmlnaW5hbCByZXZpZXcuDQoNClRoZSBzZWN1cml0eSBkaXJlY3RvcmF0 ZSByZXZpZXdlciBpcyBhc2tpbmcgdGhlc2Ugc2VjdXJpdHkgcXVlc3Rpb25zLiAgVGhlIHNlY3Vy aXR5IGRpcmVjdG9yYXRlIGRvZXMgaGF2ZSBwZW9wbGUgd2l0aCBib3RoIHJvdXRpbmcgYW5kIHNl Y3VyaXR5IGV4cGVydHMuDQoNClNSIHJvdXRpbmcgaXMgYWxzbyBleHBhbmRpbmcgdGhlIGluZm9y bWF0aW9uIHBhc3QgdGhlIG9yaWdpbmFsIFJGQzc3NTIuICAgVGhlIGV4cGFuc2lvbnMgcmVxdWVz dGVkIGJ5IFNSIHJvdXRpbmcgYWxzbyByZS1vcGVuIHRob3NlIG9yaWdpbmFsIHNlY3VyaXR5IHF1 ZXN0aW9ucyBhbmQgaXNzdWVzLg0KDQpPbmUgd2F5IHRvIGFuc3dlciB0aGVzZSBxdWVzdGlvbnMg aXMgdG8gcHJvdmlkZSBhICBSRkM3NzUyYmlzIHdpdGggYW4gdXBkYXRlZCBzZWN1cml0eSBzZWN0 aW9uLiAgSWYgeW91IGFncmVlIHdpdGggdGhpcyBhcHByb2FjaCwgSSBzdWdnZXN0IHNpbXBseSBy ZWZlcnJpbmcgdG8gYSBSRkM3NzUyYmlzIHRoYXQgaW4geW91ciBzZWN1cml0eSBzZWN0aW9uLiAg IElmIHlvdSBkaXNhZ3JlZSB0aGF0IGFuIHVwZGF0ZSB0byB0aGUgUkZDNzc1MmJpcyBpcyByZXF1 aXJlZCwgd2UgY2FuIHN0YXJ0IGEgdGhyZWFkIG9uIHRoYXQgcG9pbnQuDQoNCkRpZCB0aGlzIG1l c3NhZ2UgY2xhcmlmeSBteSBlYXJsaWVyIGJyaWVmIG1lc3NhZ2U/ICBEbyB5b3Ugd2FudCB0byBj b250aW51ZSB0byBkaXNjdXNzIHRoZSBuZWVkIGZvciBSRkM3NzUyYmlzPw0KDQpDaGVlcmlseSwg U3VlDQo= --_000_BN7PR05MB4354CF37F315E746A4E6E5EBC7F90BN7PR05MB4354namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGksPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5XaGF0IGhlIHNhaWQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Zb3VycyBJcnJlc3BlY3RpdmVseSw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkpvaG48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgJmx0O2lk ci1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5Sb2JlcnQgUmFzenVr PGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAzOjA4IFBNPGJyPg0K PGI+VG86PC9iPiBzaGFyZXNAbmR6aC5jb208YnI+DQo8Yj5DYzo8L2I+IHNlY2RpckBpZXRmLm9y Zzsga2FkdWtAbWl0LmVkdTsgWW9hdiBOaXIgJmx0O3luaXIuaWV0ZkBnbWFpbC5jb20mZ3Q7OyBp ZHJAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2Rp ciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBTdWUs PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0 IHNlZW1zIHRoYXQgd2UgaGF2ZSBhcnJpdmVkIGhlcmUgYXQgYSBwb2ludCB0aGF0IGluZGVlZCBm dXJ0aGVyIGRpc2N1c3Npb24gYW5kIGNsYXJpZmljYXRpb24gaXMgbmVlZGVkLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5ZZXMgUkZDNzc1MiBo YXMgaXNzdWVzIGluIHRoZSB3YXkgaXQgaXMgZGVzaWduZWQgLi4uIHRob3NlIGlzc3VlcyBhcmUg dGhlcmUgc2luY2UgZGF5IG9uZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SnVzdCB0byBuYW1lIGEgZmV3OiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIFBvaW50IHRv IG11bHRpcG9pbnQgcHJvdG9jb2wgaXMgdXNlZCBhcyBhIGNvbnRhaW5lciB0byBkaXN0cmlidXRl IHBvaW50IHRvIHBvaW50IGluZm9ybWF0aW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBGYXRlIHNoYXJpbmcgc2VwYXJhdGlvbiBp cyBub3QgZW5mb3JjZWQgaW4gYW55IHdheSBhbmQgdmFyaW91cyBhZGRyZXNzIGZhbWlsaWVzIGFy ZSBzZW5kIHZpYSB0aGUgc2FtZSBCR1AgaW5mcmFzdHJ1Y3R1cmU8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogVGhlIGdyb3d0aCBvZiB0aGUgYW1v dW50IG9mIGluZm9ybWF0aW9uIGJlaW5nIGNhcnJpZWQgYnkgQkdQLUxTIGNhbiBpbXBhY3QgYmdw IHByb2Nlc3NpbmcgKGV4OiB1cGRhdGUgZ2VuZXJhdGlvbikgb2Ygb3RoZXIgdHlwZXMgb2YgU0FG SXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog TW9yZSBhbmQgbW9yZSBhcHBsaWNhdGlvbnMgd2FudCBoYXZlIGEgZnJlZSByaWRlIG9uIHRoaXMg dHJhbnNwb3J0IC0gb3RoZW4gb25seSBiZWNhdXNlIGl0IGlzIGFscmVhZHkgdGhlcmUuJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldl IHNob3VsZCBkaXNjdXNzIHRob3NlIGluIGEgc2VwYXJhdGUgdGhyZWFkIGlmIFJGQzc3NTJiaXMg aXMgbmVlZGVkIG9yIHBlcmhhcHMgb3RoZXIgd29yayBjYW4gb2ZmZXIgYWx0ZXJuYXRlIHRyYW5z cG9ydCBmb3IgQkdQLUxTIGJlIGl0Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5hbiBlbmZvcmNlZCBkaWZmZXJlbnQgVENQIHNlc3Npb24g b3IgaW4gZ2VuZXJhbCBmb3IgbGluayBzdGF0ZSB0eXBlIG9mIGRhdGEgKEJNUCBhbmFsb2d5IGZv ciBJR1ApLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHU+SG93ZXZlciBJTU8gbm9uIG9mIHRoZSBhYm92ZSBpcyBh Ym91dCBzZWN1cml0eS48L3U+PC9iPjx1PiZuYnNwOzwvdT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TQUZJcyBqdXN0IGRvIG5v dCBnZXQgYWR2ZXJ0aXNlZCBhdXRvbWFnaWNhbGx5IHRvIGF0dGFja2Vycy4gRm9yIGZ1cnRoZXIg c2NvcGluZyB0b29scyBsaWtlIGxvY2FsIEJHUCBwb2xpY3kgaXMgYWxyZWFkeSBpbiBwbGFjZSB0 b2RheS4gQXMgbWVudGlvbmVkJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj51c2Ugb2YgTk8tRVhQT1JUIGNhbiBiZSBhcHBsaWVkIHRvZGF5 IHdpdGggbm8gbmV3IGRyYWZ0IG5lZWRlZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gdG8gcHJvY2VlZCBJIHdvdWxkIGxpa2Ug dG8gc2VlIGEgbGlzdCBvZiB2YWxpZCBzZWN1cml0eSBpc3N1ZXMgb2YgUkZDNzc1Mi4gSWYgbm9u ZSB3aWxsIGJlIHByb2R1Y2VkIGFsbCBjb21wYW5pb24gd29yayBzaG91bGQgYmUgcHJvZ3Jlc3Nl ZCZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+d2l0aCB0aGVpciBjdXJyZW50IHNlY3VyaXR5IHNlY3Rpb25zIGp1c3QgcmVmZXJlbmNpbmcg UkZDNzc1MiBvciBSRkM0MjcxLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5LaW5kIHJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Sb2JlcnQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIE9jdCAxOSwgMjAxOCBhdCA3OjA3IFBN IFN1c2FuIEhhcmVzICZsdDs8YSBocmVmPSJtYWlsdG86c2hhcmVzQG5kemguY29tIj5zaGFyZXNA bmR6aC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGlu Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+TGVzOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPkkgYXBvbG9naXplIGlmIG15IGVtYWlsIG1lc3NhZ2Ugd2FzIHVuY2xlYXIuICZu YnNwOyZuYnNwO1dlIGJvdGggYWdyZWUgdGhhdCB5b3VyIGRyYWZ0IGlzIG5vdCByZWxhdGVkIHRv IFNSIHJvdXRpbmcuJm5ic3A7Jm5ic3A7DQogU1Igcm91dGluZyBpcyByZWxhdGVkIHRvIEJHUC1M UyBhcyBhIHRyYW5zcG9ydCBtZWNoYW5pc20gZm9yIGluZm9ybWF0aW9uLiAmbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIGFncmVlIHRoYXQgUkZD Nzc1MiBoYWQgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbi4mbmJzcDsgSG93ZXZlciwg dGhhdCB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0aW9uDQogYWxtb3N0IGdvdCB0aGF0IGRy YWZ0IHJlamVjdGVkIGJ5IHRoZSBJRVNHIGF0IHRoZSB0aW1lLiZuYnNwOyBBcyBteSBwcmV2aW91 cyBtZXNzYWdlIHRvIHRoaXMgbGlzdCBpbmRpY2F0ZWQsIHdlIGdvdCBhZ3JlZW1lbnQgb24gUkZD Nzc1MiBiYXNlZCBvbiBsaW1pdGluZyB0aGF0IGluZm9ybWF0aW9uIGFuZCB0aGUgYXNzdXJhbmNl IHRoYXQgQkdQLUxTIG5vZGVzIHdlcmUgZGVwbG95ZWQgb24gYSBzZXBhcmF0ZSBzZXQgb2Ygbm9k ZXMuJm5ic3A7IEV4cGFuZGluZw0KIHRoZSB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0aW9u IGJleW9uZCBSRkM3NzUyIHJlLW9wZW5zIGFsbCB0aGUgc2VjdXJpdHkgaXNzdWVzIGFuZCBxdWVz dGlvbnMgZnJvbSBSRkM3NzUy4oCZcyBvcmlnaW5hbCByZXZpZXcuICZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBzZWN1cml0eSBkaXJlY3Rv cmF0ZSByZXZpZXdlciBpcyBhc2tpbmcgdGhlc2Ugc2VjdXJpdHkgcXVlc3Rpb25zLiZuYnNwOyBU aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgZG9lcw0KIGhhdmUgcGVvcGxlIHdpdGggYm90aCByb3V0 aW5nIGFuZCBzZWN1cml0eSBleHBlcnRzLiAmbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TUiByb3V0aW5nIGlzIGFsc28gZXhwYW5kaW5n IHRoZSBpbmZvcm1hdGlvbiBwYXN0IHRoZSBvcmlnaW5hbCBSRkM3NzUyLiZuYnNwOyZuYnNwOyBU aGUgZXhwYW5zaW9ucyByZXF1ZXN0ZWQNCiBieSBTUiByb3V0aW5nIGFsc28gcmUtb3BlbiB0aG9z ZSBvcmlnaW5hbCBzZWN1cml0eSBxdWVzdGlvbnMgYW5kIGlzc3Vlcy4mbmJzcDsgPC9zcGFuPg0K PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5PbmUgd2F5IHRvIGFuc3dl ciB0aGVzZSBxdWVzdGlvbnMgaXMgdG8gcHJvdmlkZSBhICZuYnNwO1JGQzc3NTJiaXMgd2l0aCBh biB1cGRhdGVkIHNlY3VyaXR5IHNlY3Rpb24uJm5ic3A7IElmDQogeW91IGFncmVlIHdpdGggdGhp cyBhcHByb2FjaCwgSSBzdWdnZXN0IHNpbXBseSByZWZlcnJpbmcgdG8gYSBSRkM3NzUyYmlzIHRo YXQgaW4geW91ciBzZWN1cml0eSBzZWN0aW9uLiAmbmJzcDsmbmJzcDtJZiB5b3UgZGlzYWdyZWUg dGhhdCBhbiB1cGRhdGUgdG8gdGhlIFJGQzc3NTJiaXMgaXMgcmVxdWlyZWQsIHdlIGNhbiBzdGFy dCBhIHRocmVhZCBvbiB0aGF0IHBvaW50Lg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PkRpZCB0aGlzIG1lc3NhZ2UgY2xhcmlmeSBteSBlYXJsaWVyIGJyaWVmIG1lc3NhZ2U/Jm5ic3A7 IERvIHlvdSB3YW50IHRvIGNvbnRpbnVlIHRvIGRpc2N1c3MgdGhlIG5lZWQgZm9yDQogUkZDNzc1 MmJpcz8gPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Q2hl ZXJpbHksIFN1ZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_BN7PR05MB4354CF37F315E746A4E6E5EBC7F90BN7PR05MB4354namp_-- From nobody Fri Oct 19 14:32:25 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E120130E05; Fri, 19 Oct 2018 14:32:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QSJX6iC0tcxg; Fri, 19 Oct 2018 14:32:06 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8104130DEB; Fri, 19 Oct 2018 14:32:05 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 17:31:59 -0400 Message-ID: <03e101d467f3$2bff9130$83feb390$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_03E2_01D467D1.A4F51D20" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BAE930AoAZRhPWOi7LDcsA== Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 21:32:09 -0000 This is a multipart message in MIME format. ------=_NextPart_000_03E2_01D467D1.A4F51D20 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les: =20 I will respond to this information point by point after I have responded = to Ketan who sent me messages regarding his draft prior to yours. = However, I would like your feedback on whether you believe RFC7752 has = security that is equivalent to, less than, or greater than a trusted = domain?=20 =20 The spring routing architecture (RFC8402) indicates that be default SR = operates within a trusted domain. It says further:=20 =20 =E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of = best practices to reduce the risk of tampering within the trusted domain = is important. Such practices are discussed in [RFC4381 = ] and are applicable to both = SR-MPLS and SRv6.=E2=80=9D=20 =20 If you believe that RFC7752 describes a trusted domain [per RFC4381],=20 RFC7762 does not state that it is a trusted domain.=20 =20 If you believe the RFC7752 has stronger security=20 than a trusted domain, can you let me know=20 why you think it is stronger than a trusted domain. =20 =20 If you believe that RFC7752 describes security which=20 is less than a trusted domain, please let me how it is less.=20 =20 The RFC7752 text is below for ease of the IDR and secdir readers.=20 =20 Thank you for providing this feedback,=20 =20 Sue =20 ------------ =20 RFC7752 security section (section 8.) =20 =20 8. Security Considerations =20 Procedures and protocol extensions defined in this document do not affect the BGP security model. See the Security Considerations section of [RFC4271] for a discussion of BGP security. Also refer to [RFC4272] and [RFC6952] for analysis of security issues for BGP =20 In the context of the BGP peerings associated with this document, a BGP speaker MUST NOT accept updates from a consumer peer. That is, a participating BGP speaker should be aware of the nature of its relationships for link-state relationships and should protect itself from peers sending updates that either represent erroneous information feedback loops or are false input. Such protection can be achieved by manual configuration of consumer peers at the BGP speaker. =20 An operator SHOULD employ a mechanism to protect a BGP speaker against DDoS attacks from consumers. The principal attack a consumer may apply is to attempt to start multiple sessions either sequentially or simultaneously. Protection can be applied by imposing rate limits. =20 Additionally, it may be considered that the export of link-state and TE information as described in this document constitutes a risk to confidentiality of mission-critical or commercially sensitive information about the network. BGP peerings are not automatic and require configuration; thus, it is the responsibility of the network operator to ensure that only trusted consumers are configured to receive such information. =20 =20 =20 From: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]=20 Sent: Friday, October 19, 2018 1:29 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 Inline. =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 10:08 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I apologize if my email message was unclear. We both agree that your = draft is not related to SR routing. SR routing is related to BGP-LS as = a transport mechanism for information. =20 =20 I agree that RFC7752 had traffic engineering information. However, that = traffic engineering information almost got that draft rejected by the = IESG at the time. As my previous message to this list indicated, we got = agreement on RFC7752 based on limiting that information and the = assurance that BGP-LS nodes were deployed on a separate set of nodes. = Expanding the traffic engineering information beyond RFC7752 re-opens = all the security issues and questions from RFC7752=E2=80=99s original = review. =20 =20 [Les:] So far, you are the only person who seems aware of this. I am not = saying you are wrong =E2=80=93 I am just saying my private attempts to = get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this. If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point. =20 The security directorate reviewer is asking these security questions. = The security directorate does have people with both routing and security = experts. =20 =20 SR routing is also expanding the information past the original RFC7752. = The expansions requested by SR routing also re-open those original = security questions and issues. =20 =20 [Les:] I do not know why you mention SR here since we both agree this = draft is not SR related. =20 One way to answer these questions is to provide a RFC7752bis with an = updated security section. If you agree with this approach, I suggest = simply referring to a RFC7752bis that in your security section. If you = disagree that an update to the RFC7752bis is required, we can start a = thread on that point.=20 =20 [Les:] There is no RFC7752bis draft. J So you are asking me to = reference a non-existent document? =20 I understand that you (at least) would like to have one =E2=80=93 which = is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 correct? =20 But this dodges the question as to whether draft-ietf-idr-te-pm-bgp has = a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an RFC. =20 Les =20 Did this message clarify my earlier brief message? Do you want to = continue to discuss the need for RFC7752bis?=20 =20 Cheerily, Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:58 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 One of us is confused. J =20 draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those words = do not appear anywhere in the document. Nor is there a reference to any = SR document. =20 Further, RFC 7752 includes traffic engineering information (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion = that we are introducing a new attack vector by defining some = additional(sic) TE codepoints does not make sense to me. =20 I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them. =20 Could you please update your response with these points in mind? =20 Thanx. =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 6:26 AM To: 'Robert Raszuk' ; kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_03E2_01D467D1.A4F51D20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

I will respond to this information point by point after I have = responded to Ketan who sent me messages regarding his draft prior to = yours. =C2=A0=C2=A0However, I would like your feedback on whether you = believe RFC7752 has security that is equivalent to, less than, or = greater than a trusted domain?

 

The spring routing architecture (RFC8402) indicates that be default = SR operates within a trusted domain.=C2=A0 =C2=A0It says further: =

 

=E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of best = practices to reduce the risk of tampering within the trusted domain is = important.=C2=A0 Such practices are discussed in [RFC4381] and are applicable to both SR-MPLS and = SRv6.=E2=80=9D

 

If you believe that RFC7752 describes a trusted domain [per RFC4381], =

RFC7762 does not state that it is a trusted domain. =

 

If you believe the RFC7752 has stronger security =

than a trusted domain, can you let me know

why you think it is stronger than a trusted domain.=C2=A0 =

 

If you believe that RFC7752 describes security which =

is less than a trusted domain, please let me how it is less. =

 

The RFC7752 text is below for ease of the IDR and secdir readers. =

 

Thank you for providing this feedback,

 

Sue

 

------------

 

RFC7752 security section (section 8.) =C2=A0

 

8.=C2=A0 Security Considerations

 

=C2=A0=C2=A0 Procedures and protocol extensions defined in this = document do not

=C2=A0=C2=A0 affect the BGP security model.=C2=A0 See the Security = Considerations

=C2=A0=C2=A0 section of [RFC4271] for a discussion of BGP = security.=C2=A0 Also refer to

=C2=A0=C2=A0 [RFC4272] and [RFC6952] for analysis of security issues = for BGP

 

=C2=A0 =C2=A0In the context of the BGP peerings associated with this = document, a

=C2=A0=C2=A0 BGP speaker MUST NOT accept updates from a consumer = peer.=C2=A0 That is, a

=C2=A0=C2=A0 participating BGP speaker should be aware of the nature of = its

=C2=A0=C2=A0 relationships for link-state relationships and should = protect itself

=C2=A0=C2=A0 from peers sending updates that either represent = erroneous

=C2=A0=C2=A0 information feedback loops or are false input.=C2=A0 Such = protection can

=C2=A0=C2=A0 be achieved by manual configuration of consumer peers at = the BGP

=C2=A0=C2=A0 speaker.

 

=C2=A0 =C2=A0=C2=A0An operator SHOULD employ a mechanism to protect a = BGP speaker

=C2=A0=C2=A0 against DDoS attacks from consumers.=C2=A0 The principal = attack a consumer

=C2=A0=C2=A0 may apply is to attempt to start multiple sessions = either

=C2=A0=C2=A0 sequentially or simultaneously.=C2=A0 Protection can be = applied by

=C2=A0=C2=A0 imposing rate limits.

 

=C2=A0=C2=A0 Additionally, it may be considered that the export of = link-state and

=C2=A0=C2=A0 TE information as described in this document constitutes = a risk to

=C2=A0=C2=A0 confidentiality of mission-critical or commercially = sensitive

=C2=A0=C2=A0 information about the network.=C2=A0 BGP peerings are = not automatic and

=C2=A0=C2=A0 require configuration; thus, it is the responsibility of = the network

=C2=A0=C2=A0 operator to ensure that only trusted consumers are = configured to

=C2=A0=C2=A0 receive such information.

 

 

 

From:= = Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]
Sent: = Friday, October 19, 2018 1:29 PM
To: Susan Hares; 'Robert = Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

Inline.

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 10:08 AM
To: Les Ginsberg (ginsberg) = <ginsberg@cisco.com>; 'Robert Raszuk' <robert@raszuk.net>; = kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I apologize if my email message was unclear.   We both = agree that your draft is not related to SR routing.   SR = routing is related to BGP-LS as a transport mechanism for information. =  

 

I agree that RFC7752 had traffic engineering information.  = However, that traffic engineering information almost got that draft = rejected by the IESG at the time.  As my previous message to this = list indicated, we got agreement on RFC7752 based on limiting that = information and the assurance that BGP-LS nodes were deployed on a = separate set of nodes.  Expanding the traffic engineering = information beyond RFC7752 re-opens all the security issues and = questions from RFC7752=E2=80=99s original review. =  

 

[Les:] So far, you are the only person who seems aware of this. I am = not saying you are wrong =E2=80=93 I am just saying my private attempts = to get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this.

If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point.

 

The security directorate reviewer is asking these security = questions.  The security directorate does have people with both = routing and security experts.   

 

SR routing is also expanding the information past the original = RFC7752.   The expansions requested by SR routing also re-open = those original security questions and issues.  =

 

[Les:] I do not know why you mention SR here since we both agree this = draft is not SR related.

 

One way to answer these questions is to provide a  RFC7752bis = with an updated security section.  If you agree with this approach, = I suggest simply referring to a RFC7752bis that in your security = section.   If you disagree that an update to the RFC7752bis is = required, we can start a thread on that point.

 

[Les:] There is no RFC7752bis draft. J  So you are asking me to reference a non-existent = document?

 

I understand that you (at least) would like to have one =E2=80=93 = which is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 = correct?

 

But this dodges the question as to whether draft-ietf-idr-te-pm-bgp = has a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an = RFC.

 

   Les

 

Did this message clarify my earlier brief message?  Do you want = to continue to discuss the need for RFC7752bis?

 

Cheerily, Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:58 AM
To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

One of us is confused. J

 

draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those = words do not appear anywhere in the document. Nor is there a reference = to any SR document.

 

Further, RFC 7752 includes traffic engineering information (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion that we are = introducing a new attack vector by defining some additional(sic) TE = codepoints does not make sense to me.

 

I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them.

 

Could you please update your response with these points in = mind?

 

Thanx.

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 6:26 AM
To: 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: RE: [Idr] [secdir] Secdir = early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.  However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.   = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues. 

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. =  As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible.  

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.  = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Robert Raszuk
Sent: Friday, October 19, = 2018 2:52 AM
To: kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: Re: [Idr] [secdir] Secdir = early review of draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_03E2_01D467D1.A4F51D20-- From nobody Fri Oct 19 15:01:11 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65D92130DF4; Fri, 19 Oct 2018 15:00:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.563 X-Spam-Level: X-Spam-Status: No, score=-14.563 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C9_-aGN2YlzP; Fri, 19 Oct 2018 15:00:43 -0700 (PDT) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F4061130FEE; Fri, 19 Oct 2018 15:00:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=80446; q=dns/txt; s=iport; t=1539986440; x=1541196040; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=gAJhjeETq/NcU6vA/Ra+v58qF4Wa56yxeuKw7pv1Jaw=; b=Aqu94jmgLDuIeURDeorCzZ+SZo7jjk7N0fQ6M0q5UoGoituArYvDA0zO 3kU5TvOJTBZ4xLtCu+O8lldaRZcYwpLHr7DO05OS3nfMAUVcBxVHDtaQ/ qwUCrs3WHL9TH9B22Xbuon/AktRae8nQvnxI1pRAhkma2X+u1jZrlzbZT I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ALAABFU8pb/5RdJa1kDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVMCAQEBAQELAYENSC9mfygKg2uUMoINeod+jhcUgWY?= =?us-ascii?q?LAQEjhEkCF4RxITYLDQEDAQECAQECbRwMhToBAQEEGgkKPgcHEAIBCA4DAQM?= =?us-ascii?q?BAQEgAQYDAgICHxEUAwYIAgQBDQUIDAeDB4EdTAMVD6dCgS6Hcw2CEwWJB4E?= =?us-ascii?q?eDYEdF4FBP4ERghRJBy6CVkUBAQIBgStKH4JNglcCiGMKJIUhgVWEO4lRLgk?= =?us-ascii?q?ChlyDHINOgxwfgU+Ec2aJAYkjgzF4hk2CEgIRFIEmJAUsZHFwFTuCbIIDIxe?= =?us-ascii?q?IXIUEOQFvAQGLBIEfAQE?= X-IronPort-AV: E=Sophos;i="5.54,401,1534809600"; d="scan'208,217";a="466987595" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Oct 2018 22:00:37 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id w9JM0bIg014110 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 19 Oct 2018 22:00:37 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 19 Oct 2018 17:00:37 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Fri, 19 Oct 2018 17:00:37 -0500 From: "Les Ginsberg (ginsberg)" To: Susan Hares , "'Robert Raszuk'" , "kaduk@mit.edu" CC: "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "ynir.ietf@gmail.com" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgABuEAD//8RJQAAPN8wAAApAKAD///fVgIAATiRw Date: Fri, 19 Oct 2018 22:00:37 +0000 Message-ID: <44855683021a4ffbb8070364182d9d53@XCH-ALN-001.cisco.com> References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> In-Reply-To: <03e101d467f3$2bff9130$83feb390$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_44855683021a4ffbb8070364182d9d53XCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.13, xch-rcd-003.cisco.com X-Outbound-Node: rcdn-core-12.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 22:00:50 -0000 --_000_44855683021a4ffbb8070364182d9d53XCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VlIOKAkw0KDQpJIHdpbGwgbm90IHJlaW5mb3JjZSB5b3VyIGluYXBwcm9wcmlhdGUgaW5zZXJ0 aW9uIG9mIHRoZSBkaXNjdXNzaW9uIG9mIHBvc3NpYmxlIFJGQyA3NzUyIGRlZmljaWVuY2llcyBp bnRvIGEgdGhyZWFkIHdoaWNoIGlzIHJldmlld2luZyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3Au IFRoaXMgaXMgd3Jvbmcg4oCTIHBsZWFzZSBzdG9wIGl0Lg0KDQpZb3Ugd2FudCB0byBkaXNjdXNz IGlzc3VlcyB3aXRoIFJGQyA3NzUyIOKAkyBwbGVhc2Ugc3RhcnQgYSBzZXBhcmF0ZSB0aHJlYWQg 4oCTIGRpcmVjdGVkIGF0IHRoZSBXRyAob2YgY291cnNlKSDigJMgYW5kIHN0YXRlIHlvdXIgcG9z aXRpb24gYXMgYSBXRyBtZW1iZXIgYXMgdG8gd2hhdCB5b3UgZmVlbCBuZWVkcyB0byBiZSBkb25l LiBUaGVuIG90aGVycyBjYW4gY29tbWVudCBhbmQgdGhlIFdHIGNhbiBkZWNpZGUgd2hldGhlciB0 aGV5IGFncmVlIHdvcmsgbmVlZHMgdG8gYmUgZG9uZS4NCg0KQWxzbyAtIGFuZCBmb3IgdGhlIHRo aXJkIHRpbWUgLSBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaXMgTk9UIFNSIHJlbGF0ZWQg4oCT IHBsZWFzZSBhbHNvIHN0b3AgaW5zZXJ0aW5nIGEgZGlzY3Vzc2lvbiBvZiBTUi9CR1AtTFMgaW50 byB0aGUgcmV2aWV3IG9mIHRoaXMgZHJhZnQuDQoNCihBcG9sb2dpZXMgZm9yIHRoZSBoYXJzaCB0 b25lIOKAkyBidXQgaXQgaXMgYmVjb21pbmcgaW5jcmVhc2luZ2x5IGZydXN0cmF0aW5nIHRvIHdh dGNoIHRoaXMgdGhyZWFkIGJlaW5nIG1pc2RpcmVjdGVkLikNCg0KICAgTGVzDQoNCg0KRnJvbTog U3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpoLmNvbT4NClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwg MjAxOCAyOjMyIFBNDQpUbzogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNiZXJnQGNpc2Nv LmNvbT47ICdSb2JlcnQgUmFzenVrJyA8cm9iZXJ0QHJhc3p1ay5uZXQ+OyBrYWR1a0BtaXQuZWR1 DQpDYzogaWRyQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3Jn OyBpZXRmQGlldGYub3JnOyB5bmlyLmlldGZAZ21haWwuY29tOyBzZWNkaXJAaWV0Zi5vcmcNClN1 YmplY3Q6IFJFOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncC0xMw0KDQpMZXM6DQoNCkkgd2lsbCByZXNwb25kIHRvIHRoaXMgaW5m b3JtYXRpb24gcG9pbnQgYnkgcG9pbnQgYWZ0ZXIgSSBoYXZlIHJlc3BvbmRlZCB0byBLZXRhbiB3 aG8gc2VudCBtZSBtZXNzYWdlcyByZWdhcmRpbmcgaGlzIGRyYWZ0IHByaW9yIHRvIHlvdXJzLiAg IEhvd2V2ZXIsIEkgd291bGQgbGlrZSB5b3VyIGZlZWRiYWNrIG9uIHdoZXRoZXIgeW91IGJlbGll dmUgUkZDNzc1MiBoYXMgc2VjdXJpdHkgdGhhdCBpcyBlcXVpdmFsZW50IHRvLCBsZXNzIHRoYW4s IG9yIGdyZWF0ZXIgdGhhbiBhIHRydXN0ZWQgZG9tYWluPw0KDQpUaGUgc3ByaW5nIHJvdXRpbmcg YXJjaGl0ZWN0dXJlIChSRkM4NDAyKSBpbmRpY2F0ZXMgdGhhdCBiZSBkZWZhdWx0IFNSIG9wZXJh dGVzIHdpdGhpbiBhIHRydXN0ZWQgZG9tYWluLiAgIEl0IHNheXMgZnVydGhlcjoNCg0K4oCcVHJh ZmZpYyBNVVNUIGJlIGZpbHRlcmVkIGF0IHRoZSBkb21haW4gYm91bmRhcmllcy4gVGhlIHVzZSBv ZiBiZXN0IHByYWN0aWNlcyB0byByZWR1Y2UgdGhlIHJpc2sgb2YgdGFtcGVyaW5nIHdpdGhpbiB0 aGUgdHJ1c3RlZCBkb21haW4gaXMgaW1wb3J0YW50LiAgU3VjaCBwcmFjdGljZXMgYXJlIGRpc2N1 c3NlZCBpbiBbUkZDNDM4MTxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNDM4MT5dIGFu ZCBhcmUgYXBwbGljYWJsZSB0byBib3RoIFNSLU1QTFMgYW5kIFNSdjYu4oCdDQoNCklmIHlvdSBi ZWxpZXZlIHRoYXQgUkZDNzc1MiBkZXNjcmliZXMgYSB0cnVzdGVkIGRvbWFpbiBbcGVyIFJGQzQz ODFdLA0KUkZDNzc2MiBkb2VzIG5vdCBzdGF0ZSB0aGF0IGl0IGlzIGEgdHJ1c3RlZCBkb21haW4u DQoNCklmIHlvdSBiZWxpZXZlIHRoZSBSRkM3NzUyIGhhcyBzdHJvbmdlciBzZWN1cml0eQ0KdGhh biBhIHRydXN0ZWQgZG9tYWluLCBjYW4geW91IGxldCBtZSBrbm93DQp3aHkgeW91IHRoaW5rIGl0 IGlzIHN0cm9uZ2VyIHRoYW4gYSB0cnVzdGVkIGRvbWFpbi4NCg0KSWYgeW91IGJlbGlldmUgdGhh dCBSRkM3NzUyIGRlc2NyaWJlcyBzZWN1cml0eSB3aGljaA0KaXMgbGVzcyB0aGFuIGEgdHJ1c3Rl ZCBkb21haW4sIHBsZWFzZSBsZXQgbWUgaG93IGl0IGlzIGxlc3MuDQoNClRoZSBSRkM3NzUyIHRl eHQgaXMgYmVsb3cgZm9yIGVhc2Ugb2YgdGhlIElEUiBhbmQgc2VjZGlyIHJlYWRlcnMuDQoNClRo YW5rIHlvdSBmb3IgcHJvdmlkaW5nIHRoaXMgZmVlZGJhY2ssDQoNClN1ZQ0KDQotLS0tLS0tLS0t LS0NCg0KUkZDNzc1MiBzZWN1cml0eSBzZWN0aW9uIChzZWN0aW9uIDguKQ0KDQo4LiAgU2VjdXJp dHkgQ29uc2lkZXJhdGlvbnMNCg0KICAgUHJvY2VkdXJlcyBhbmQgcHJvdG9jb2wgZXh0ZW5zaW9u cyBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQgZG8gbm90DQogICBhZmZlY3QgdGhlIEJHUCBzZWN1 cml0eSBtb2RlbC4gIFNlZSB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCiAgIHNlY3Rpb24g b2YgW1JGQzQyNzFdIGZvciBhIGRpc2N1c3Npb24gb2YgQkdQIHNlY3VyaXR5LiAgQWxzbyByZWZl ciB0bw0KICAgW1JGQzQyNzJdIGFuZCBbUkZDNjk1Ml0gZm9yIGFuYWx5c2lzIG9mIHNlY3VyaXR5 IGlzc3VlcyBmb3IgQkdQDQoNCiAgIEluIHRoZSBjb250ZXh0IG9mIHRoZSBCR1AgcGVlcmluZ3Mg YXNzb2NpYXRlZCB3aXRoIHRoaXMgZG9jdW1lbnQsIGENCiAgIEJHUCBzcGVha2VyIE1VU1QgTk9U IGFjY2VwdCB1cGRhdGVzIGZyb20gYSBjb25zdW1lciBwZWVyLiAgVGhhdCBpcywgYQ0KICAgcGFy dGljaXBhdGluZyBCR1Agc3BlYWtlciBzaG91bGQgYmUgYXdhcmUgb2YgdGhlIG5hdHVyZSBvZiBp dHMNCiAgIHJlbGF0aW9uc2hpcHMgZm9yIGxpbmstc3RhdGUgcmVsYXRpb25zaGlwcyBhbmQgc2hv dWxkIHByb3RlY3QgaXRzZWxmDQogICBmcm9tIHBlZXJzIHNlbmRpbmcgdXBkYXRlcyB0aGF0IGVp dGhlciByZXByZXNlbnQgZXJyb25lb3VzDQogICBpbmZvcm1hdGlvbiBmZWVkYmFjayBsb29wcyBv ciBhcmUgZmFsc2UgaW5wdXQuICBTdWNoIHByb3RlY3Rpb24gY2FuDQogICBiZSBhY2hpZXZlZCBi eSBtYW51YWwgY29uZmlndXJhdGlvbiBvZiBjb25zdW1lciBwZWVycyBhdCB0aGUgQkdQDQogICBz cGVha2VyLg0KDQogICAgQW4gb3BlcmF0b3IgU0hPVUxEIGVtcGxveSBhIG1lY2hhbmlzbSB0byBw cm90ZWN0IGEgQkdQIHNwZWFrZXINCiAgIGFnYWluc3QgRERvUyBhdHRhY2tzIGZyb20gY29uc3Vt ZXJzLiAgVGhlIHByaW5jaXBhbCBhdHRhY2sgYSBjb25zdW1lcg0KICAgbWF5IGFwcGx5IGlzIHRv IGF0dGVtcHQgdG8gc3RhcnQgbXVsdGlwbGUgc2Vzc2lvbnMgZWl0aGVyDQogICBzZXF1ZW50aWFs bHkgb3Igc2ltdWx0YW5lb3VzbHkuICBQcm90ZWN0aW9uIGNhbiBiZSBhcHBsaWVkIGJ5DQogICBp bXBvc2luZyByYXRlIGxpbWl0cy4NCg0KICAgQWRkaXRpb25hbGx5LCBpdCBtYXkgYmUgY29uc2lk ZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0ZSBhbmQNCiAgIFRFIGluZm9ybWF0aW9u IGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVzIGEgcmlzayB0bw0KICAg Y29uZmlkZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3IgY29tbWVyY2lhbGx5IHNlbnNp dGl2ZQ0KICAgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsuICBCR1AgcGVlcmluZ3MgYXJl IG5vdCBhdXRvbWF0aWMgYW5kDQogICByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlz IHRoZSByZXNwb25zaWJpbGl0eSBvZiB0aGUgbmV0d29yaw0KICAgb3BlcmF0b3IgdG8gZW5zdXJl IHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29uZmlndXJlZCB0bw0KICAgcmVjZWl2 ZSBzdWNoIGluZm9ybWF0aW9uLg0KDQoNCg0KRnJvbTogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykg W21haWx0bzpnaW5zYmVyZ0BjaXNjby5jb21dDQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIw MTggMToyOSBQTQ0KVG86IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJhc3p1ayc7IGthZHVrQG1pdC5l ZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0 Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFm dC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86 aWV0ZkBpZXRmLm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnluaXIuaWV0ZkBnbWFp bC5jb20+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz4NClN1YmplY3Q6 IFJFOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC0xMw0KDQpTdWUg4oCTDQoNCklubGluZS4NCg0KRnJvbTogU3VzYW4gSGFyZXMg PHNoYXJlc0BuZHpoLmNvbTxtYWlsdG86c2hhcmVzQG5kemguY29tPj4NClNlbnQ6IEZyaWRheSwg T2N0b2JlciAxOSwgMjAxOCAxMDowOCBBTQ0KVG86IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpIDxn aW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbT4+OyAnUm9iZXJ0IFJh c3p1aycgPHJvYmVydEByYXN6dWsubmV0PG1haWx0bzpyb2JlcnRAcmFzenVrLm5ldD4+OyBrYWR1 a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0KQ2M6IGlkckBpZXRmLm9yZzxtYWlsdG86 aWRyQGlldGYub3JnPjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzxtYWls dG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8 bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmll dGZAZ21haWwuY29tPjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQpT dWJqZWN0OiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KTGVzOg0KDQpJIGFwb2xvZ2l6ZSBpZiBteSBlbWFpbCBt ZXNzYWdlIHdhcyB1bmNsZWFyLiAgIFdlIGJvdGggYWdyZWUgdGhhdCB5b3VyIGRyYWZ0IGlzIG5v dCByZWxhdGVkIHRvIFNSIHJvdXRpbmcuICAgU1Igcm91dGluZyBpcyByZWxhdGVkIHRvIEJHUC1M UyBhcyBhIHRyYW5zcG9ydCBtZWNoYW5pc20gZm9yIGluZm9ybWF0aW9uLg0KDQpJIGFncmVlIHRo YXQgUkZDNzc1MiBoYWQgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbi4gIEhvd2V2ZXIs IHRoYXQgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiBhbG1vc3QgZ290IHRoYXQgZHJh ZnQgcmVqZWN0ZWQgYnkgdGhlIElFU0cgYXQgdGhlIHRpbWUuICBBcyBteSBwcmV2aW91cyBtZXNz YWdlIHRvIHRoaXMgbGlzdCBpbmRpY2F0ZWQsIHdlIGdvdCBhZ3JlZW1lbnQgb24gUkZDNzc1MiBi YXNlZCBvbiBsaW1pdGluZyB0aGF0IGluZm9ybWF0aW9uIGFuZCB0aGUgYXNzdXJhbmNlIHRoYXQg QkdQLUxTIG5vZGVzIHdlcmUgZGVwbG95ZWQgb24gYSBzZXBhcmF0ZSBzZXQgb2Ygbm9kZXMuICBF eHBhbmRpbmcgdGhlIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gYmV5b25kIFJGQzc3 NTIgcmUtb3BlbnMgYWxsIHRoZSBzZWN1cml0eSBpc3N1ZXMgYW5kIHF1ZXN0aW9ucyBmcm9tIFJG Qzc3NTLigJlzIG9yaWdpbmFsIHJldmlldy4NCg0KW0xlczpdIFNvIGZhciwgeW91IGFyZSB0aGUg b25seSBwZXJzb24gd2hvIHNlZW1zIGF3YXJlIG9mIHRoaXMuIEkgYW0gbm90IHNheWluZyB5b3Ug YXJlIHdyb25nIOKAkyBJIGFtIGp1c3Qgc2F5aW5nIG15IHByaXZhdGUgYXR0ZW1wdHMgdG8gZ2V0 IG1vcmUgY29udGV4dCBmb3IgdGhpcyBoYXZlIHRodXMgZmFyIGZhaWxlZCDigJMgYW5kIHlvdSBo YXZlIG5vdCBwcm92aWRlZCBhbnkgZG9jdW1lbnRhdGlvbiBvZiB0aGlzLg0KSWYgeW91ciBzdGF0 ZW1lbnQgaXMgYWNjdXJhdGUgKGFnYWluIOKAkyBub3Qgc2F5aW5nIGl0IGlzbuKAmXQpIOKAkyBp dCBhbHNvIHNlZW1zIG1vc3QgdW5mb3J0dW5hdGUgKGFuZCBJIGFtIGJlaW5nIOKAnGtpbmTigJ0g aGVyZSkgdGhhdCB0aGlzIHdhcyBub3QgbWVudGlvbmVkIGluIHRoZSBjb3Vyc2Ugb2YgdGhlIGZv dXIgeWVhcnMgdGhhdCBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaGFzIHRha2VuIHRvIHByb2dy ZXNzIHRvIHRoaXMgcG9pbnQuDQoNClRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSByZXZpZXdlciBp cyBhc2tpbmcgdGhlc2Ugc2VjdXJpdHkgcXVlc3Rpb25zLiAgVGhlIHNlY3VyaXR5IGRpcmVjdG9y YXRlIGRvZXMgaGF2ZSBwZW9wbGUgd2l0aCBib3RoIHJvdXRpbmcgYW5kIHNlY3VyaXR5IGV4cGVy dHMuDQoNClNSIHJvdXRpbmcgaXMgYWxzbyBleHBhbmRpbmcgdGhlIGluZm9ybWF0aW9uIHBhc3Qg dGhlIG9yaWdpbmFsIFJGQzc3NTIuICAgVGhlIGV4cGFuc2lvbnMgcmVxdWVzdGVkIGJ5IFNSIHJv dXRpbmcgYWxzbyByZS1vcGVuIHRob3NlIG9yaWdpbmFsIHNlY3VyaXR5IHF1ZXN0aW9ucyBhbmQg aXNzdWVzLg0KDQpbTGVzOl0gSSBkbyBub3Qga25vdyB3aHkgeW91IG1lbnRpb24gU1IgaGVyZSBz aW5jZSB3ZSBib3RoIGFncmVlIHRoaXMgZHJhZnQgaXMgbm90IFNSIHJlbGF0ZWQuDQoNCk9uZSB3 YXkgdG8gYW5zd2VyIHRoZXNlIHF1ZXN0aW9ucyBpcyB0byBwcm92aWRlIGEgIFJGQzc3NTJiaXMg d2l0aCBhbiB1cGRhdGVkIHNlY3VyaXR5IHNlY3Rpb24uICBJZiB5b3UgYWdyZWUgd2l0aCB0aGlz IGFwcHJvYWNoLCBJIHN1Z2dlc3Qgc2ltcGx5IHJlZmVycmluZyB0byBhIFJGQzc3NTJiaXMgdGhh dCBpbiB5b3VyIHNlY3VyaXR5IHNlY3Rpb24uICAgSWYgeW91IGRpc2FncmVlIHRoYXQgYW4gdXBk YXRlIHRvIHRoZSBSRkM3NzUyYmlzIGlzIHJlcXVpcmVkLCB3ZSBjYW4gc3RhcnQgYSB0aHJlYWQg b24gdGhhdCBwb2ludC4NCg0KW0xlczpdIFRoZXJlIGlzIG5vIFJGQzc3NTJiaXMgZHJhZnQuIOKY uiAgU28geW91IGFyZSBhc2tpbmcgbWUgdG8gcmVmZXJlbmNlIGEgbm9uLWV4aXN0ZW50IGRvY3Vt ZW50Pw0KDQpJIHVuZGVyc3RhbmQgdGhhdCB5b3UgKGF0IGxlYXN0KSB3b3VsZCBsaWtlIHRvIGhh dmUgb25lIOKAkyB3aGljaCBpcyBwZXJmZWN0bHkgbGVnaXRpbWF0ZSDigJMgdGhvdWdoIHlvdSBz aG91bGQgZ28gdGhyb3VnaCB0aGUgbm9ybWFsIFdHIHByb2Nlc3MgdG8gdGFrZSB0aGlzIHdvcmsg b24g4oCTIGNvcnJlY3Q/DQoNCkJ1dCB0aGlzIGRvZGdlcyB0aGUgcXVlc3Rpb24gYXMgdG8gd2hl dGhlciBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaGFzIGEgZGVwZW5kZW5jeSBvbiBlbmhhbmNl ZCBzZWN1cml0eS4gU28gZmFyLCB5b3UgYXJlIHRoZSBvbmx5IHBlcnNvbiBtYWtpbmcgdGhpcyBj bGFpbSDigJMgYW5kIHNldmVyYWwgZm9sa3MgKGluY2x1ZGluZyBteXNlbGYpIGhhdmUgZXhwcmVz c2VkIGEgZGlmZmVyZW50IFBPVi4gSSB0aGluayB5b3UgYXQgbGVhc3QgaGF2ZSB0byBwcm92aWRl IGEganVzdGlmaWNhdGlvbiBmb3IgdGhpcyBkZXBlbmRlbmN5IGJlZm9yZSB3ZSBpbnRyb2R1Y2Ug aXQgYW5kIGdldCBzb21lIHN1cHBvcnQgZm9yIHlvdXIgcG9zaXRpb24g4oCTIHNpbmNlIHRoaXMg d2lsbCBtZWFuIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncCB3b3VsZCBiZSBzdHVjayBpbiBNSVNT UkVGIHN0YXRlIHVudGlsIHRoaXMgY3VycmVudGx5IG5vbi1leGlzdGVudCBkcmFmdCBiZWNvbWVz IGFuIFJGQy4NCg0KICAgTGVzDQoNCkRpZCB0aGlzIG1lc3NhZ2UgY2xhcmlmeSBteSBlYXJsaWVy IGJyaWVmIG1lc3NhZ2U/ICBEbyB5b3Ugd2FudCB0byBjb250aW51ZSB0byBkaXNjdXNzIHRoZSBu ZWVkIGZvciBSRkM3NzUyYmlzPw0KDQpDaGVlcmlseSwgU3VlDQoNCkZyb206IElkciBbbWFpbHRv Omlkci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgTGVzIEdpbnNiZXJnIChnaW5zYmVy ZykNClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAxMDo1OCBBTQ0KVG86IFN1c2FuIEhh cmVzOyAnUm9iZXJ0IFJhc3p1ayc7IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+ DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnPjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IHluaXIuaWV0 ZkBnbWFpbC5jb208bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+OyBzZWNkaXJAaWV0Zi5vcmc8 bWFpbHRvOnNlY2RpckBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNk aXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpTdWUg4oCT DQoNCk9uZSBvZiB1cyBpcyBjb25mdXNlZC4g4pi6DQoNCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cCBpcyBub3QgcmVsYXRlZCB0byBTZWdtZW50IFJvdXRpbmcuIFRob3NlIHdvcmRzIGRvIG5vdCBh cHBlYXIgYW55d2hlcmUgaW4gdGhlIGRvY3VtZW50LiBOb3IgaXMgdGhlcmUgYSByZWZlcmVuY2Ug dG8gYW55IFNSIGRvY3VtZW50Lg0KDQpGdXJ0aGVyLCBSRkMgNzc1MiBpbmNsdWRlcyB0cmFmZmlj IGVuZ2luZWVyaW5nIGluZm9ybWF0aW9uIChzZWUgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L3JmYzc3NTIjc2VjdGlvbi0zLjMuMiApIHNvIHRoZSBzdWdnZXN0aW9uIHRoYXQgd2UgYXJlIGlu dHJvZHVjaW5nIGEgbmV3IGF0dGFjayB2ZWN0b3IgYnkgZGVmaW5pbmcgc29tZSBhZGRpdGlvbmFs KHNpYykgVEUgY29kZXBvaW50cyBkb2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1lLg0KDQpJIGFwcHJl Y2lhdGUgdGhhdCB0aGVyZSBhcmUgb3RoZXIgZHJhZnRzIG9uIHlvdXIgbWluZCB3aGljaCBhcmUg U1IgcmVsYXRlZCDigJMgYnV0IHRoaXMgaXMgbm90IG9uZSBvZiB0aGVtLg0KDQpDb3VsZCB5b3Ug cGxlYXNlIHVwZGF0ZSB5b3VyIHJlc3BvbnNlIHdpdGggdGhlc2UgcG9pbnRzIGluIG1pbmQ/DQoN ClRoYW54Lg0KDQogICBMZXMNCg0KDQpGcm9tOiBTdXNhbiBIYXJlcyA8c2hhcmVzQG5kemguY29t PG1haWx0bzpzaGFyZXNAbmR6aC5jb20+Pg0KU2VudDogRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4 IDY6MjYgQU0NClRvOiAnUm9iZXJ0IFJhc3p1aycgPHJvYmVydEByYXN6dWsubmV0PG1haWx0bzpy b2JlcnRAcmFzenVrLm5ldD4+OyBrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0K Q2M6IGlldGZAaWV0Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyBzZWNkaXJAaWV0Zi5vcmc8 bWFpbHRvOnNlY2RpckBpZXRmLm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnluaXIu aWV0ZkBnbWFpbC5jb20+OyBpZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBpZXRmLm9yZz47IGRyYWZ0 LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC5hbGxAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGly IGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KUm9iZXJ0LCBC ZW5qYW1pbiwgYW5kIFlvYXY6DQoNCkkgYWdyZWUgdGhlc2UgY29udGV4dCBvZiB0aGVzZSBpc3N1 ZXMgYXJlIG5vdCBzcGVjaWZpYyB0byB0aGlzIGRyYWZ0LiAgSG93ZXZlciwgdHJhZmZpYyBlbmdp bmVlcmluZyBpbmZvcm1hdGlvbiBkb2VzIHByb3ZpZGUgaW5mb3JtYXRpb24gd2hpY2ggaXMgYSB0 ZW1wdGluZyBhdHRhY2sgdmVjdG9yLg0KDQpUaGUgb3JpZ2luYWwgUkZDNzc1MiBkZXNjcmliZWQg YSBkaWZmZXJlbnQgcHVycG9zZSB3aXRoIHJlc3RyaWN0ZWQgdXNhZ2UgdGhhdCBTUiByb3V0aW5n IGV4dGVuc2lvbnMgZG8gbm90IGFkaGVyZSB0byBpbiBCR1AuICAgU2luY2UgU3ByaW5nIFdHIHNo b3dzIHRoYXQgb3BlcmF0b3JzIGFyZSBpbnRlcmVzdGVkIGluIHRoZSBleHRlbmRlZCB1c2UsIGl0 IG1heSBiZSB0aW1lIHRvIGV4YW1pbmUgdGhlIFJGQzc3NTJiaXMgb3Igb3RoZXIgc29sdXRpb25z IHRoYXQgdGFrZXMgY2FyZSBvZiB0aGVzZSBzZWN1cml0eSBpc3N1ZXMuDQoNCk15IGpvYiBhcyBh IHNoZXBoZXJkIGlzIHRvIHBvaW50IG91dCB0aGVzZSBpc3N1ZXMgcGVyIGRyYWZ0IGZvciB0aGUg SUVTRyBhbmQgc2VjdXJpdHkgZGlyZWN0b3JhdGUgaW4gb3JkZXIgdG8gb2J0YWluIHRoZSBjb3Jy ZWN0IGZlZWRiYWNrLiAgQXMgYSBXRyBjaGFpciwgSSBoYXZlIHBvaW50ZWQgb3V0IHRoZXNlIGlz c3VlcywgYnV0IHRoZSBXRyBoYXMgdGhlc2UgZHJhZnRzIG9uIFdHIExDIHdpdGhvdXQgdGhlIGV4 dHJhIHNlY3VyaXR5Lg0KV2l0aG91dCBSRkM3NzUyYmlzIHdpdGggYWRkaXRpb25hbCBzZWN1cml0 eSBpbiB0aGUgYmFzZSBkb2N1bWVudCwgSSBhbSB3b3JraW5nIGFzIGEgc2hlcGhlcmQgbWFrZSB0 aGUgbWFuYWdlYWJpbGl0eSBhbmQgc2VjdXJpdHkgc2VjdGlvbnMgYXMgY2xlYXIgYXMgcG9zc2li bGUuDQoNCklmIHRoZSBmZWVkYmFjayBmcm9tIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSByZXZp ZXcgb3IgdGhlIElFU0cgaXMgdGhhdCB3ZSBuZWVkIHRvIG9idGFpbiBhIHNvbHV0aW9uIGZvciBS RkM3NzUyYmlzIHRoYXQgZGVzY3JpYmVzIGFuZCBoYW5kbGVzIHRoZXNlIHNlY3VyaXR5IGlzc3Vl cywgSSB3aWxsIGJlIGdsYWQgdG8gc3VwcG9ydCBmYXN0LXRyYWNraW5nIHRoaXMgaXNzdWUgd2l0 aGluIHRoZSBXRy4NCg0KSWYgYW4gb2ZmbGluZSBkaXNjdXNzaW9uIHdpdGggQmVuamFtaW4sIFlv YXYsIHRoZSBJRFIgY2hhaXJzLCBhbmQgQWx2YXJvIHdvdWxkIHNwZWVkIHRoaXMgYWxvbmcsIEkg Y2FuIHNldCB0aGlzIHVwIGVhcmx5IG5leHQgd2Vlay4gIEl0IHdvdWxkIGJlIGhlbHBmdWwgdG8g aGF2ZSB0aGlzIG9mZmxpbmUgZGlzY3Vzc2lvbiBiZWZvcmUgdGhlIElEUiBpbnRlcmltIHNlc3Np b24gb24gMTAvMjYuDQoNClRoYW5rIHlvdSBmb3IgYWxsIHlvdXIgY29tbWVudHMuDQoNClN1ZQ0K DQoNCkZyb206IElkciBbbWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2Yg Um9iZXJ0IFJhc3p1aw0KU2VudDogRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDI6NTIgQU0NClRv OiBrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pg0KQ2M6IGlldGZAaWV0Zi5vcmc8 bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRm Lm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+OyBp ZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBpZXRmLm9yZz47IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KSGVsbG8gQmVuamFtaW4sDQoNCk5vdCBzdXJl IGlmIHlvdSBoYXZlIHNwb3R0ZWQgc2ltaWxhciBjb21tZW50IG1hZGUgdG8gSURSIHJlZ2FyZGlu ZyB0aGlzIHRvcGljLCBidXQgeW91ciBjb21tZW50IHNlZW1zIHRvIGluZGljYXRlIHRoYXQgaGVy ZSB3ZSBhcmUgYWJvdXQgdG8gZGVmaW5lIHdheXMgdG8gY2FycnkgbmljZWx5IHNjb3BlZCBJR1Ag aW5mb3JtYXRpb24gaW50byBCR1AuIFdlbGwgdGhhdCBoYXMgYWxyZWFkeSBoYXBwZW5lZCB3aXRo IFJGQzc3NTIgYW5kIHlvdXIgY29tbWVudCBvciBmb3IgdGhhdCBtYXR0ZXIgWW9hdidzIHJlbWFy a3MgYXJlIGluZGVlZCBzcG90IG9uIGJ1dCB0byB0aGUgc2VjdXJpdHkgZGlzY3Vzc2lvbiBvbiBS RkM3NzUyIGFuZCBJTU8gbm90IGFueSBmb2xsb3cgdXAgZXh0ZW5zaW9ucyBvZiBpdC4NCg0KU3Vy ZSAtIGFzIG9ic2VydmVkIGJ5IFN1ZSAtIG9uZSBtYXkgYXJndWUgdGhhdCBwcm92aWRpbmcgbW9y ZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yayB0byB0aGUgcG90ZW50aWFsIGF0dGFja2Vy IG1ha2VzIHRoZSBuZXR3b3JrIHdlYWtlciwgYnV0IHRoZSBjdXJlIGZvciB0aGF0IGlzIHRvIHBy ZXZlbnQgdGhlIGxlYWtzIGFuZCByZWR1Y2UgcHJvYmFiaWxpdHkgb2YgaW50ZXJjZXB0aW5nIG5l dyBpbmZvcm1hdGlvbiBieSB1bmF1dGhvcml6ZWQgcGFydGllcy4NCg0KQkdQLUxTIGlzIGFscmVh ZHkgZGVmaW5lZCBpbiBhIG5ldyBTQUZJIHdoYXQgYnkgaXRzZWxmIGRvZXMgcHJvdmlkZSBuaWNl IGxldmVsIG9mIGlzb2xhdGlvbi4gUkZDNzc1MiBpcyBwcmV0dHkgY2xlYXIgb24gdGhhdCB0b28g YW5kIHNheXM6DQoNCiJCR1AgcGVlcmluZ3MgYXJlIG5vdCBhdXRvbWF0aWMgYW5kIHJlcXVpcmUg Y29uZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJlc3BvbnNpYmlsaXR5IG9mIHRoZSBuZXR3 b3JrIG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkgdHJ1c3RlZCBjb25zdW1lcnMgYXJlIGNv bmZpZ3VyZWQgdG8gcmVjZWl2ZSBzdWNoIGluZm9ybWF0aW9uLiINCg0KSWYgc29tZW9uZSB3b3Vs ZCBiZSBzdGlsbCBjb25jZXJuZWQgYWJvdXQgY29uZmlndXJhdGlvbiBtaXN0YWtlcyBhbmQgbmVn b3RpYXRpbmcgU0FGSSA3MSBvciA3MiB0byB0aG9zZSB3aG8gc2hvdWxkIG5vdCBnZXQgdGhpcyBk YXRhIEkgcmVjb21tZW5kIHdlIHJlaXNzdWUgdGhlIFJGQzc3NTIgYXMgLWJpcyB2ZXJzaW9uIGFu ZCByZXN0cmljdCB0aGUgc2NvcGUgb2YgdGhlIGRpc3RyaWJ1dGlvbiBldmVuIGZ1cnRoZXIgYnkg bWFuZGF0aW5nIGRlZmF1bHQgdXNlIG9mIE5PLUVYUE9SVCBjb21tdW5pdHkgd2l0aCBhYmlsaXR5 IHRvIG92ZXJ3cml0ZSBpdCBmb3IgdGhlIHNlbGVjdGl2ZSBlQkdQIHBlZXJzLiBPciBwZXJoYXBz IHdlIGNvdWxkIHByb2dyZXNzIEppbSdzIE9uZSBBZG1pbmlzdHJhdGl2ZSBEb21haW4gZHJhZnQg KGRyYWZ0LXV0dGFyby1pZHItb2FkLTAxKS4NCg0KSW4gZWl0aGVyIGNhc2Ugd2hpbGUgYm90aCBv ZiB5b3VyIGNvbW1lbnRzIGFyZSBncmVhdCB0aGV5IHNlZW1zIGEgYml0IGxhdGUgaW4gdGhlIGdh bWUgaGVyZSBvciBhdCBsZWFzdCB0YXJnZXRpbmcgd3JvbmcgZG9jdW1lbnQuDQoNCktpbmQgcmVn YXJkcywNClJvYmVydC4NCg0KDQpPbiBGcmksIE9jdCAxOSwgMjAxOCBhdCAyOjI3IEFNIEJlbmph bWluIEthZHVrIDxrYWR1a0BtaXQuZWR1PG1haWx0bzprYWR1a0BtaXQuZWR1Pj4gd3JvdGU6DQpP biBUaHUsIE9jdCAxOCwgMjAxOCBhdCAwNjowMDoxM1BNICswMDAwLCBMZXMgR2luc2JlcmcgKGdp bnNiZXJnKSB3cm90ZToNCj4gWW9hdiDigJMNCj4NCj4gSW4gcmVnYXJkcyB0byB0aGUgcmlza3Mg YXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5nIHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbiBjb3Zl cmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBhIHN0YXRlbWVudCBpbiB0aGUgSUdQIGRyYWZ0czoN Cj4NCj4gRnJvbSBSRkM3ODEwDQo+DQo+IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGluIHRo aXMgZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0b3IgdG8NCj4gICAgYWR2ZXJ0aXNlIHN0YXRlIGlu Zm9ybWF0aW9uIG9mIGxpbmtzIChiYW5kd2lkdGgsIGRlbGF5KSB0aGF0IGNvdWxkIGJlDQo+ICAg IHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90IHdhbnQgdG8gZGlzY2xvc2Uu 4oCdDQo+DQo+IEluIHJlZ2FyZHMgdG8gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBzZW5kaW5n IGluZm9ybWF0aW9uIHZpYSBCR1AtTFMgd2UgaGF2ZSBhIG51bWJlciBvZiBzdGF0ZW1lbnRzIGlu IFJGQyA3NzUyIOKAkyBtb3N0IHJlbGV2YW50IGlzOg0KPg0KPiDigJxBZGRpdGlvbmFsbHksIGl0 IG1heSBiZSBjb25zaWRlcmVkIHRoYXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZA0KPiAg ICBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVudCBjb25zdGl0dXRl cyBhIHJpc2sgdG8NCj4gICAgY29uZmlkZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3Ig Y29tbWVyY2lhbGx5IHNlbnNpdGl2ZQ0KPiAgICBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29y ay7igJ0NCj4NCj4gU28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJ R1AgUkZDcyBhbmQgUkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVy c3RhbmQgd2hhdCBlbHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuDQo+IENlcnRhaW5seSB0aGUg cmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBCR1AtTFMgdHJhbnNwb3J0IG1lY2hhbmlzbSBhcmUg bm90IGFsdGVyZWQgYnkgYWRkaW5nIHNvbWUgbmV3IFRMVnMg4oCTIGFuZCBzaW5jZSB0aGUgSUdQ IFJGQ3MgaGF2ZSBhbHJlYWR5IGNvdmVyZWQgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHRoZSBzcGVj aWZpYyBjbGFzcyBvZiBpbmZvcm1hdGlvbiAobm90IHNpbXBseSB0aGUgcmlza3MgYXNzb2NpYXRl ZCB3aXRoIHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRvIGhhdmUgdG8g cHJvdmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkgYmUgc2FpZCB0 aGF0IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuDQoNCk15IGFwb2xv Z2llcyBmb3IganVtcGluZyBpbiBpbiB0aGUgbWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQIFJGQ3Mg aGF2ZQ0KY292ZXJlZCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGEgc3BlY2lmaWMgY2xhc3Mg b2YgaW5mb3JtYXRpb24sICp1bmRlcg0KdGhlIGFzc3VtcHRpb24gdGhhdCB0aGUgdHJhbnNwb3J0 IG1lY2hhbmlzbSBpcyB3aXRoaW4gYSBzaW5nbGUgQVMgYW5kDQphZG1pbmlzdHJhdGl2ZSBkb21h aW4qLiAgWW9hdiBpcyBwb2ludGluZyBvdXQgdGhhdCB0aGUgcmlza3MgZm9yIHRoYXQNCmluZm9y bWF0aW9uIG1heSBjaGFuZ2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVy IGRvbWFpbiB0aGFuDQp0aGUgb25lIGZvciB3aGljaCB0aGUgcHJldmlvdXMgYW5hbHlzaXMgd2Fz IHBlcmZvcm1lZC4NCg0KLUJlbg0K --_000_44855683021a4ffbb8070364182d9d53XCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglw YW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmgyDQoJe21zby1zdHlsZS1wcmlvcml0eTo5Ow0K CW1zby1zdHlsZS1saW5rOiJIZWFkaW5nIDIgQ2hhciI7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjE4LjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7 fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw cmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZv cm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5IZWFk aW5nMkNoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhlYWRpbmcgMiBDaGFyIjsNCgltc28tc3R5bGUt cHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyAyIjsNCglmb250LXdlaWdodDpi b2xkO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwg UHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUt bGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0K cC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUt bmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0 OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxT dHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyNA0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0 OTdEO30NCnNwYW4uRW1haWxTdHlsZTI1DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjYNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN1ZSDigJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBub3QgcmVpbmZvcmNlIHlvdXIgaW5hcHByb3By aWF0ZSBpbnNlcnRpb24gb2YgdGhlIGRpc2N1c3Npb24gb2YgcG9zc2libGUgUkZDIDc3NTIgZGVm aWNpZW5jaWVzIGludG8gYSB0aHJlYWQgd2hpY2ggaXMgcmV2aWV3aW5nIGRyYWZ0LWlldGYtaWRy LXRlLXBtLWJncC4NCiBUaGlzIGlzIHdyb25nIOKAkyBwbGVhc2Ugc3RvcCBpdC48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdSB3YW50IHRvIGRpc2N1c3MgaXNz dWVzIHdpdGggUkZDIDc3NTIg4oCTIHBsZWFzZSBzdGFydCBhIHNlcGFyYXRlIHRocmVhZCDigJMg ZGlyZWN0ZWQgYXQgdGhlIFdHIChvZiBjb3Vyc2UpIOKAkyBhbmQgc3RhdGUgeW91ciBwb3NpdGlv biBhcyBhIFdHIG1lbWJlciBhcyB0byB3aGF0DQogeW91IGZlZWwgbmVlZHMgdG8gYmUgZG9uZS4g VGhlbiBvdGhlcnMgY2FuIGNvbW1lbnQgYW5kIHRoZSBXRyBjYW4gZGVjaWRlIHdoZXRoZXIgdGhl eSBhZ3JlZSB3b3JrIG5lZWRzIHRvIGJlIGRvbmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5BbHNvIC0gYW5kIGZvciB0aGUgdGhpcmQgdGltZSAtIGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncCBpcyBOT1QgU1IgcmVsYXRlZCDigJMgcGxlYXNlIGFsc28gc3RvcCBp bnNlcnRpbmcgYSBkaXNjdXNzaW9uIG9mIFNSL0JHUC1MUyBpbnRvIHRoZSByZXZpZXcgb2YgdGhp cyBkcmFmdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPihBcG9s b2dpZXMgZm9yIHRoZSBoYXJzaCB0b25lIOKAkyBidXQgaXQgaXMgYmVjb21pbmcgaW5jcmVhc2lu Z2x5IGZydXN0cmF0aW5nIHRvIHdhdGNoIHRoaXMgdGhyZWFkIGJlaW5nIG1pc2RpcmVjdGVkLik8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBM ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6 My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU3VzYW4gSGFyZXMgJmx0O3No YXJlc0BuZHpoLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTks IDIwMTggMjozMiBQTTxicj4NCjxiPlRvOjwvYj4gTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0 O2dpbnNiZXJnQGNpc2NvLmNvbSZndDs7ICdSb2JlcnQgUmFzenVrJyAmbHQ7cm9iZXJ0QHJhc3p1 ay5uZXQmZ3Q7OyBrYWR1a0BtaXQuZWR1PGJyPg0KPGI+Q2M6PC9iPiBpZHJAaWV0Zi5vcmc7IGRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IHluaXIu aWV0ZkBnbWFpbC5jb207IHNlY2RpckBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTog W0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1w bS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+TGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB3aWxsIHJlc3BvbmQgdG8gdGhpcyBpbmZvcm1hdGlvbiBw b2ludCBieSBwb2ludCBhZnRlciBJIGhhdmUgcmVzcG9uZGVkIHRvIEtldGFuIHdobyBzZW50IG1l IG1lc3NhZ2VzIHJlZ2FyZGluZyBoaXMgZHJhZnQgcHJpb3IgdG8geW91cnMuICZuYnNwOyZuYnNw O0hvd2V2ZXIsIEkgd291bGQNCiBsaWtlIHlvdXIgZmVlZGJhY2sgb24gd2hldGhlciB5b3UgYmVs aWV2ZSBSRkM3NzUyIGhhcyBzZWN1cml0eSB0aGF0IGlzIGVxdWl2YWxlbnQgdG8sIGxlc3MgdGhh biwgb3IgZ3JlYXRlciB0aGFuIGEgdHJ1c3RlZCBkb21haW4/DQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBzcHJpbmcgcm91dGluZyBhcmNoaXRlY3R1cmUg KFJGQzg0MDIpIGluZGljYXRlcyB0aGF0IGJlIGRlZmF1bHQgU1Igb3BlcmF0ZXMgd2l0aGluIGEg dHJ1c3RlZCBkb21haW4uJm5ic3A7ICZuYnNwO0l0IHNheXMgZnVydGhlcjoNCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+4oCcPC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpibGFjayI+VHJhZmZpYyBNVVNUIGJlIGZpbHRlcmVkIGF0IHRoZSBkb21haW4gYm91 bmRhcmllcy4gVGhlIHVzZSBvZiBiZXN0IHByYWN0aWNlcw0KIHRvIHJlZHVjZSB0aGUgcmlzayBv ZiB0YW1wZXJpbmcgd2l0aGluIHRoZSB0cnVzdGVkIGRvbWFpbiBpcyBpbXBvcnRhbnQuJm5ic3A7 IFN1Y2ggcHJhY3RpY2VzIGFyZSBkaXNjdXNzZWQgaW4gWzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM0MzgxIiB0aXRsZT0iJnF1b3Q7QW5hbHlzaXMgb2YgdGhlIFNlY3Vy aXR5IG9mIEJHUC9NUExTIElQIFZpcnR1YWwgUHJpdmF0ZSBOZXR3b3JrcyAoVlBOcykmcXVvdDsi PlJGQzQzODE8L2E+XSBhbmQgYXJlIGFwcGxpY2FibGUNCiB0byBib3RoIFNSLU1QTFMgYW5kIFNS djYu4oCdIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5JZiB5b3UgYmVs aWV2ZSB0aGF0IFJGQzc3NTIgZGVzY3JpYmVzIGEgdHJ1c3RlZCBkb21haW4gW3BlciBSRkM0Mzgx XSwNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+UkZDNzc2MiBkb2VzIG5vdCBzdGF0ZSB0aGF0IGl0IGlzIGEg dHJ1c3RlZCBkb21haW4uDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ SWYgeW91IGJlbGlldmUgdGhlIFJGQzc3NTIgaGFzIHN0cm9uZ2VyIHNlY3VyaXR5DQo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6YmxhY2siPnRoYW4gYSB0cnVzdGVkIGRvbWFpbiwgY2FuIHlvdSBsZXQgbWUga25vdw0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj53aHkgeW91IHRoaW5rIGl0IGlzIHN0cm9uZ2VyIHRoYW4gYSB0cnVzdGVk IGRvbWFpbi4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5J ZiB5b3UgYmVsaWV2ZSB0aGF0IFJGQzc3NTIgZGVzY3JpYmVzIHNlY3VyaXR5IHdoaWNoDQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6YmxhY2siPmlzIGxlc3MgdGhhbiBhIHRydXN0ZWQgZG9tYWluLCBwbGVhc2UgbGV0IG1l IGhvdyBpdCBpcyBsZXNzLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2si PlRoZSBSRkM3NzUyIHRleHQgaXMgYmVsb3cgZm9yIGVhc2Ugb2YgdGhlIElEUiBhbmQgc2VjZGly IHJlYWRlcnMuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+VGhhbmsg eW91IGZvciBwcm92aWRpbmcgdGhpcyBmZWVkYmFjaywNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj5TdWU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+LS0tLS0tLS0tLS0tPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlJG Qzc3NTIgc2VjdXJpdHkgc2VjdGlvbiAoc2VjdGlvbiA4LikgJm5ic3A7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNr Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjguJm5ic3A7IFNlY3VyaXR5IENvbnNpZGVyYXRpb25z PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBQcm9j ZWR1cmVzIGFuZCBwcm90b2NvbCBleHRlbnNpb25zIGRlZmluZWQgaW4gdGhpcyBkb2N1bWVudCBk byBub3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBhZmZlY3QgdGhlIEJHUCBzZWN1cml0 eSBtb2RlbC4mbmJzcDsgU2VlIHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9uczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7IHNlY3Rpb24gb2YgW1JGQzQyNzFdIGZvciBhIGRpc2N1c3Npb24g b2YgQkdQIHNlY3VyaXR5LiZuYnNwOyBBbHNvIHJlZmVyIHRvPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJz cDsmbmJzcDsgW1JGQzQyNzJdIGFuZCBbUkZDNjk1Ml0gZm9yIGFuYWx5c2lzIG9mIHNlY3VyaXR5 IGlzc3VlcyBmb3IgQkdQPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZu YnNwOyAmbmJzcDtJbiB0aGUgY29udGV4dCBvZiB0aGUgQkdQIHBlZXJpbmdzIGFzc29jaWF0ZWQg d2l0aCB0aGlzIGRvY3VtZW50LCBhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgQkdQIHNw ZWFrZXIgTVVTVCBOT1QgYWNjZXB0IHVwZGF0ZXMgZnJvbSBhIGNvbnN1bWVyIHBlZXIuJm5ic3A7 IFRoYXQgaXMsIGE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBwYXJ0aWNpcGF0aW5nIEJH UCBzcGVha2VyIHNob3VsZCBiZSBhd2FyZSBvZiB0aGUgbmF0dXJlIG9mIGl0czxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7IHJlbGF0aW9uc2hpcHMgZm9yIGxpbmstc3RhdGUgcmVsYXRpb25z aGlwcyBhbmQgc2hvdWxkIHByb3RlY3QgaXRzZWxmPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJz cDsgZnJvbSBwZWVycyBzZW5kaW5nIHVwZGF0ZXMgdGhhdCBlaXRoZXIgcmVwcmVzZW50IGVycm9u ZW91czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGluZm9ybWF0aW9uIGZlZWRiYWNrIGxv b3BzIG9yIGFyZSBmYWxzZSBpbnB1dC4mbmJzcDsgU3VjaCBwcm90ZWN0aW9uIGNhbjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7IGJlIGFjaGlldmVkIGJ5IG1hbnVhbCBjb25maWd1cmF0aW9u IG9mIGNvbnN1bWVyIHBlZXJzIGF0IHRoZSBCR1A8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNw OyBzcGVha2VyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw OyAmbmJzcDsmbmJzcDtBbiBvcGVyYXRvciBTSE9VTEQgZW1wbG95IGEgbWVjaGFuaXNtIHRvIHBy b3RlY3QgYSBCR1Agc3BlYWtlcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgYWdhaW5z dCBERG9TIGF0dGFja3MgZnJvbSBjb25zdW1lcnMuJm5ic3A7IFRoZSBwcmluY2lwYWwgYXR0YWNr IGEgY29uc3VtZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IG1heSBhcHBseSBpcyB0 byBhdHRlbXB0IHRvIHN0YXJ0IG11bHRpcGxlIHNlc3Npb25zIGVpdGhlcjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDsmbmJzcDsgc2VxdWVudGlhbGx5IG9yIHNpbXVsdGFuZW91c2x5LiZuYnNwOyBQ cm90ZWN0aW9uIGNhbiBiZSBhcHBsaWVkIGJ5PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNw OyBpbXBvc2luZyByYXRlIGxpbWl0cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBBZGRpdGlvbmFsbHksIGl0IG1heSBiZSBjb25zaWRlcmVk IHRoYXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDsmbmJzcDsgVEUgaW5mb3JtYXRpb24gYXMgZGVzY3JpYmVkIGluIHRoaXMgZG9jdW1lbnQgY29u c3RpdHV0ZXMgYSByaXNrIHRvPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBjb25maWRl bnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFsbHkgc2Vuc2l0aXZlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29y ay4mbmJzcDsgQkdQIHBlZXJpbmdzIGFyZSBub3QgYXV0b21hdGljIGFuZDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDsmbmJzcDsgcmVxdWlyZSBjb25maWd1cmF0aW9uOyB0aHVzLCBpdCBpcyB0aGUg cmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdvcms8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5i c3A7IG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkgdHJ1c3RlZCBjb25zdW1lcnMgYXJlIGNv bmZpZ3VyZWQgdG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHJlY2VpdmUgc3VjaCBp bmZvcm1hdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+IExlcyBHaW5zYmVy ZyAoZ2luc2JlcmcpIFs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5tYWlsdG86 Z2luc2JlcmdAY2lzY28uY29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9i ZXIgMTksIDIwMTggMToyOSBQTTxicj4NCjxiPlRvOjwvYj4gU3VzYW4gSGFyZXM7ICdSb2JlcnQg UmFzenVrJzsgPGEgaHJlZj0ibWFpbHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+ PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5v cmc8L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRm Lm9yZyI+DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmlldGZAaWV0Zi5vcmciPmlldGZAaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFp bHRvOnluaXIuaWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBnbWFpbC5jb208L2E+OyA8YSBocmVm PSJtYWlsdG86c2VjZGlyQGlldGYub3JnIj4NCnNlY2RpckBpZXRmLm9yZzwvYT48YnI+DQo8Yj5T dWJqZWN0OjwvYj4gUkU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJh ZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN1ZSDigJM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklubGluZS48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQu MHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiBTdXNhbiBIYXJlcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXJlc0BuZHpoLmNvbSI+c2hhcmVz QG5kemguY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9iZXIgMTks IDIwMTggMTA6MDggQU08YnI+DQo8Yj5Ubzo8L2I+IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpICZs dDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5naW5zYmVyZ0BjaXNjby5jb208 L2E+Jmd0OzsgJ1JvYmVydCBSYXN6dWsnICZsdDs8YSBocmVmPSJtYWlsdG86cm9iZXJ0QHJhc3p1 ay5uZXQiPnJvYmVydEByYXN6dWsubmV0PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86a2FkdWtA bWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0 bzppZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBp ZXRmLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5p ZXRmQGdtYWlsLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2Vj ZGlyQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0lkcl0gW3NlY2Rpcl0g U2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+TGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+SSBhcG9sb2dpemUgaWYgbXkgZW1haWwgbWVzc2FnZSB3YXMgdW5jbGVhci4gJm5ic3A7 Jm5ic3A7V2UgYm90aCBhZ3JlZSB0aGF0IHlvdXIgZHJhZnQgaXMgbm90IHJlbGF0ZWQgdG8gU1Ig cm91dGluZy4mbmJzcDsmbmJzcDsgU1Igcm91dGluZyBpcyByZWxhdGVkIHRvIEJHUC1MUyBhcyBh IHRyYW5zcG9ydCBtZWNoYW5pc20NCiBmb3IgaW5mb3JtYXRpb24uICZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhZ3JlZSB0aGF0IFJGQzc3NTIgaGFk IHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24uJm5ic3A7IEhvd2V2ZXIsIHRoYXQgdHJh ZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiBhbG1vc3QgZ290IHRoYXQgZHJhZnQgcmVqZWN0 ZWQgYnkgdGhlIElFU0cgYXQgdGhlIHRpbWUuJm5ic3A7DQogQXMgbXkgcHJldmlvdXMgbWVzc2Fn ZSB0byB0aGlzIGxpc3QgaW5kaWNhdGVkLCB3ZSBnb3QgYWdyZWVtZW50IG9uIFJGQzc3NTIgYmFz ZWQgb24gbGltaXRpbmcgdGhhdCBpbmZvcm1hdGlvbiBhbmQgdGhlIGFzc3VyYW5jZSB0aGF0IEJH UC1MUyBub2RlcyB3ZXJlIGRlcGxveWVkIG9uIGEgc2VwYXJhdGUgc2V0IG9mIG5vZGVzLiAmbmJz cDtFeHBhbmRpbmcgdGhlIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gYmV5b25kIFJG Qzc3NTIgcmUtb3BlbnMNCiBhbGwgdGhlIHNlY3VyaXR5IGlzc3VlcyBhbmQgcXVlc3Rpb25zIGZy b20gUkZDNzc1MuKAmXMgb3JpZ2luYWwgcmV2aWV3LiAmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPltMZXM6XSBTbyBmYXIsIHlvdSBhcmUgdGhl IG9ubHkgcGVyc29uIHdobyBzZWVtcyBhd2FyZSBvZiB0aGlzLiBJIGFtIG5vdCBzYXlpbmcgeW91 IGFyZSB3cm9uZyDigJMgSSBhbSBqdXN0IHNheWluZyBteSBwcml2YXRlIGF0dGVtcHRzIHRvIGdl dCBtb3JlIGNvbnRleHQNCiBmb3IgdGhpcyBoYXZlIHRodXMgZmFyIGZhaWxlZCDigJMgYW5kIHlv dSBoYXZlIG5vdCBwcm92aWRlZCBhbnkgZG9jdW1lbnRhdGlvbiBvZiB0aGlzLjxvOnA+PC9vOnA+ PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklmIHlvdXIgc3RhdGVtZW50IGlzIGFjY3VyYXRlIChhZ2Fp biDigJMgbm90IHNheWluZyBpdCBpc27igJl0KSDigJMgaXQgYWxzbyBzZWVtcyBtb3N0IHVuZm9y dHVuYXRlIChhbmQgSSBhbSBiZWluZyDigJxraW5k4oCdIGhlcmUpIHRoYXQgdGhpcyB3YXMgbm90 IG1lbnRpb25lZCBpbg0KIHRoZSBjb3Vyc2Ugb2YgdGhlIGZvdXIgeWVhcnMgdGhhdCBkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AgaGFzIHRha2VuIHRvIHByb2dyZXNzIHRvIHRoaXMgcG9pbnQuPG86 cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBzZWN1 cml0eSBkaXJlY3RvcmF0ZSByZXZpZXdlciBpcyBhc2tpbmcgdGhlc2Ugc2VjdXJpdHkgcXVlc3Rp b25zLiZuYnNwOyBUaGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgZG9lcyBoYXZlIHBlb3BsZSB3aXRo IGJvdGggcm91dGluZyBhbmQgc2VjdXJpdHkgZXhwZXJ0cy4gJm5ic3A7Jm5ic3A7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TUiByb3V0aW5nIGlzIGFsc28gZXhw YW5kaW5nIHRoZSBpbmZvcm1hdGlvbiBwYXN0IHRoZSBvcmlnaW5hbCBSRkM3NzUyLiZuYnNwOyZu YnNwOyBUaGUgZXhwYW5zaW9ucyByZXF1ZXN0ZWQgYnkgU1Igcm91dGluZyBhbHNvIHJlLW9wZW4g dGhvc2Ugb3JpZ2luYWwgc2VjdXJpdHkgcXVlc3Rpb25zDQogYW5kIGlzc3Vlcy4mbmJzcDsgPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5bTGVzOl0gSSBk byBub3Qga25vdyB3aHkgeW91IG1lbnRpb24gU1IgaGVyZSBzaW5jZSB3ZSBib3RoIGFncmVlIHRo aXMgZHJhZnQgaXMgbm90IFNSIHJlbGF0ZWQuPG86cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPk9uZSB3YXkgdG8gYW5zd2VyIHRoZXNlIHF1ZXN0aW9ucyBp cyB0byBwcm92aWRlIGEgJm5ic3A7UkZDNzc1MmJpcyB3aXRoIGFuIHVwZGF0ZWQgc2VjdXJpdHkg c2VjdGlvbi4mbmJzcDsgSWYgeW91IGFncmVlIHdpdGggdGhpcyBhcHByb2FjaCwgSSBzdWdnZXN0 IHNpbXBseSByZWZlcnJpbmcgdG8NCiBhIFJGQzc3NTJiaXMgdGhhdCBpbiB5b3VyIHNlY3VyaXR5 IHNlY3Rpb24uICZuYnNwOyZuYnNwO0lmIHlvdSBkaXNhZ3JlZSB0aGF0IGFuIHVwZGF0ZSB0byB0 aGUgUkZDNzc1MmJpcyBpcyByZXF1aXJlZCwgd2UgY2FuIHN0YXJ0IGEgdGhyZWFkIG9uIHRoYXQg cG9pbnQuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PltMZXM6XSBUaGVyZSBpcyBubyBSRkM3NzUyYmlzIGRyYWZ0Lg0KPC9zcGFuPjwvaT48L2I+PGI+ PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2Nv bG9yOiMxRjQ5N0QiPko8L3NwYW4+PC9pPjwvYj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+ICZuYnNwO1NvIHlvdSBhcmUgYXNraW5nIG1lIHRvIHJlZmVyZW5jZSBhIG5vbi1l eGlzdGVudCBkb2N1bWVudD88bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxp PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHVuZGVyc3RhbmQgdGhhdCB5b3UgKGF0 IGxlYXN0KSB3b3VsZCBsaWtlIHRvIGhhdmUgb25lIOKAkyB3aGljaCBpcyBwZXJmZWN0bHkgbGVn aXRpbWF0ZSDigJMgdGhvdWdoIHlvdSBzaG91bGQgZ28gdGhyb3VnaCB0aGUgbm9ybWFsIFdHIHBy b2Nlc3MgdG8gdGFrZSB0aGlzDQogd29yayBvbiDigJMgY29ycmVjdD88bzpwPjwvbzpwPjwvc3Bh bj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5C dXQgdGhpcyBkb2RnZXMgdGhlIHF1ZXN0aW9uIGFzIHRvIHdoZXRoZXIgZHJhZnQtaWV0Zi1pZHIt dGUtcG0tYmdwIGhhcyBhIGRlcGVuZGVuY3kgb24gZW5oYW5jZWQgc2VjdXJpdHkuIFNvIGZhciwg eW91IGFyZSB0aGUgb25seSBwZXJzb24gbWFraW5nIHRoaXMgY2xhaW0NCiDigJMgYW5kIHNldmVy YWwgZm9sa3MgKGluY2x1ZGluZyBteXNlbGYpIGhhdmUgZXhwcmVzc2VkIGEgZGlmZmVyZW50IFBP Vi4gSSB0aGluayB5b3UgYXQgbGVhc3QgaGF2ZSB0byBwcm92aWRlIGEganVzdGlmaWNhdGlvbiBm b3IgdGhpcyBkZXBlbmRlbmN5IGJlZm9yZSB3ZSBpbnRyb2R1Y2UgaXQgYW5kIGdldCBzb21lIHN1 cHBvcnQgZm9yIHlvdXIgcG9zaXRpb24g4oCTIHNpbmNlIHRoaXMgd2lsbCBtZWFuIGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncCB3b3VsZA0KIGJlIHN0dWNrIGluIE1JU1NSRUYgc3RhdGUgdW50aWwg dGhpcyBjdXJyZW50bHkgbm9uLWV4aXN0ZW50IGRyYWZ0IGJlY29tZXMgYW4gUkZDLjxvOnA+PC9v OnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPiZuYnNwOyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5EaWQgdGhpcyBtZXNzYWdlIGNsYXJpZnkg bXkgZWFybGllciBicmllZiBtZXNzYWdlPyAmbmJzcDtEbyB5b3Ugd2FudCB0byBjb250aW51ZSB0 byBkaXNjdXNzIHRoZSBuZWVkIGZvciBSRkM3NzUyYmlzPw0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5DaGVlcmlseSwgU3VlDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFo b21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1haWx0bzppZHItYm91bmNlc0Bp ZXRmLm9yZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFsZiBP ZiA8L2I+TGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBP Y3RvYmVyIDE5LCAyMDE4IDEwOjU4IEFNPGJyPg0KPGI+VG86PC9iPiBTdXNhbiBIYXJlczsgJ1Jv YmVydCBSYXN6dWsnOyA8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVk dTwvYT48YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlkckBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8 YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9yZzwvYT47DQo8YSBocmVm PSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47IDxh IGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBv ZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+U3VlIOKA kzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T25lIG9mIHVzIGlz IGNvbmZ1c2VkLg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OldpbmdkaW5ncztjb2xvcjojMUY0OTdEIj5KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncCBpcyBub3QgcmVsYXRlZCB0byBTZWdtZW50IFJvdXRpbmcu IFRob3NlIHdvcmRzIGRvIG5vdCBhcHBlYXIgYW55d2hlcmUgaW4gdGhlIGRvY3VtZW50LiBOb3Ig aXMgdGhlcmUgYSByZWZlcmVuY2UgdG8gYW55IFNSIGRvY3VtZW50LjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RnVydGhlciwgUkZDIDc3NTIgaW5jbHVkZXMgdHJh ZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiAoc2VlDQo8YSBocmVmPSJodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yIj5odHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yPC9hPiApIHNvIHRoZSBzdWdnZXN0aW9uIHRo YXQgd2UgYXJlIGludHJvZHVjaW5nIGEgbmV3IGF0dGFjayB2ZWN0b3IgYnkgZGVmaW5pbmcgc29t ZSBhZGRpdGlvbmFsKHNpYykgVEUgY29kZXBvaW50cyBkb2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1l LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBhcHByZWNpYXRl IHRoYXQgdGhlcmUgYXJlIG90aGVyIGRyYWZ0cyBvbiB5b3VyIG1pbmQgd2hpY2ggYXJlIFNSIHJl bGF0ZWQg4oCTIGJ1dCB0aGlzIGlzIG5vdCBvbmUgb2YgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkNvdWxkIHlvdSBwbGVhc2UgdXBkYXRlIHlvdXIgcmVz cG9uc2Ugd2l0aCB0aGVzZSBwb2ludHMgaW4gbWluZD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW54LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBTdXNhbiBIYXJlcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXJlc0BuZHpoLmNvbSI+ c2hhcmVzQG5kemguY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE9jdG9i ZXIgMTksIDIwMTggNjoyNiBBTTxicj4NCjxiPlRvOjwvYj4gJ1JvYmVydCBSYXN6dWsnICZsdDs8 YSBocmVmPSJtYWlsdG86cm9iZXJ0QHJhc3p1ay5uZXQiPnJvYmVydEByYXN6dWsubmV0PC9hPiZn dDs7DQo8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+ DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3Jn PC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNkaXJAaWV0Zi5vcmc8 L2E+OyA8YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWls LmNvbTwvYT47DQo8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5vcmc8L2E+ OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+ DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSRTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Um9iZXJ0LCBCZW5qYW1p biwgYW5kIFlvYXY6DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PkkgYWdyZWUgdGhlc2UgY29udGV4dCBvZiB0aGVzZSBpc3N1ZXMgYXJlIG5vdCBzcGVjaWZpYyB0 byB0aGlzIGRyYWZ0LiZuYnNwOyBIb3dldmVyLCB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0 aW9uIGRvZXMgcHJvdmlkZSBpbmZvcm1hdGlvbiB3aGljaCBpcyBhIHRlbXB0aW5nIGF0dGFjaw0K IHZlY3Rvci4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGUg b3JpZ2luYWwgUkZDNzc1MiBkZXNjcmliZWQgYSBkaWZmZXJlbnQgcHVycG9zZSB3aXRoIHJlc3Ry aWN0ZWQgdXNhZ2UgdGhhdCBTUiByb3V0aW5nIGV4dGVuc2lvbnMgZG8gbm90IGFkaGVyZSB0byBp biBCR1AuJm5ic3A7Jm5ic3A7IFNpbmNlIFNwcmluZyBXRyBzaG93cyB0aGF0IG9wZXJhdG9ycw0K IGFyZSBpbnRlcmVzdGVkIGluIHRoZSBleHRlbmRlZCB1c2UsIGl0IG1heSBiZSB0aW1lIHRvIGV4 YW1pbmUgdGhlIFJGQzc3NTJiaXMgb3Igb3RoZXIgc29sdXRpb25zIHRoYXQgdGFrZXMgY2FyZSBv ZiB0aGVzZSBzZWN1cml0eSBpc3N1ZXMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPk15IGpvYiBhcyBhIHNoZXBoZXJkIGlzIHRvIHBvaW50IG91dCB0 aGVzZSBpc3N1ZXMgcGVyIGRyYWZ0IGZvciB0aGUgSUVTRyBhbmQgc2VjdXJpdHkgZGlyZWN0b3Jh dGUgaW4gb3JkZXIgdG8gb2J0YWluIHRoZSBjb3JyZWN0IGZlZWRiYWNrLiAmbmJzcDtBcyBhIFdH IGNoYWlyLCBJIGhhdmUNCiBwb2ludGVkIG91dCB0aGVzZSBpc3N1ZXMsIGJ1dCB0aGUgV0cgaGFz IHRoZXNlIGRyYWZ0cyBvbiBXRyBMQyB3aXRob3V0IHRoZSBleHRyYSBzZWN1cml0eS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+V2l0aG91dCBSRkM3NzUyYmlzIHdpdGggYWRkaXRpb25hbCBzZWN1cml0eSBp biB0aGUgYmFzZSBkb2N1bWVudCwgSSBhbSB3b3JraW5nIGFzIGEgc2hlcGhlcmQgbWFrZSB0aGUg bWFuYWdlYWJpbGl0eSBhbmQgc2VjdXJpdHkgc2VjdGlvbnMgYXMgY2xlYXIgYXMgcG9zc2libGUu DQogJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB0 aGUgZmVlZGJhY2sgZnJvbSB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3IG9yIHRoZSBJ RVNHIGlzIHRoYXQgd2UgbmVlZCB0byBvYnRhaW4gYSBzb2x1dGlvbiBmb3IgUkZDNzc1MmJpcyB0 aGF0IGRlc2NyaWJlcyBhbmQgaGFuZGxlcyB0aGVzZSBzZWN1cml0eQ0KIGlzc3VlcywgSSB3aWxs IGJlIGdsYWQgdG8gc3VwcG9ydCBmYXN0LXRyYWNraW5nIHRoaXMgaXNzdWUgd2l0aGluIHRoZSBX Ry4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiBhbiBvZmZs aW5lIGRpc2N1c3Npb24gd2l0aCBCZW5qYW1pbiwgWW9hdiwgdGhlIElEUiBjaGFpcnMsIGFuZCBB bHZhcm8gd291bGQgc3BlZWQgdGhpcyBhbG9uZywgSSBjYW4gc2V0IHRoaXMgdXAgZWFybHkgbmV4 dCB3ZWVrLiZuYnNwOyBJdCB3b3VsZCBiZSBoZWxwZnVsIHRvIGhhdmUNCiB0aGlzIG9mZmxpbmUg ZGlzY3Vzc2lvbiBiZWZvcmUgdGhlIElEUiBpbnRlcmltIHNlc3Npb24gb24gMTAvMjYuIDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmsgeW91IGZvciBhbGwg eW91ciBjb21tZW50cy4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+U3VlDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5z LXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1h aWx0bzppZHItYm91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9h Pl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+Um9iZXJ0IFJhc3p1azxicj4NCjxiPlNlbnQ6PC9iPiBG cmlkYXksIE9jdG9iZXIgMTksIDIwMTggMjo1MiBBTTxicj4NCjxiPlRvOjwvYj4gPGEgaHJlZj0i bWFpbHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+PGJyPg0KPGI+Q2M6PC9iPiA8 YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmciPg0Kc2VjZGlyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBnbWFpbC5jb208L2E+Ow0KPGEg aHJlZj0ibWFpbHRvOmlkckBpZXRmLm9yZyI+aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1p ZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJ ZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5IZWxsbyBCZW5qYW1pbiw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk5vdCBzdXJlIGlmIHlvdSBoYXZlIHNwb3R0ZWQgc2ltaWxhciBjb21tZW50IG1hZGUg dG8gSURSIHJlZ2FyZGluZyB0aGlzIHRvcGljLCBidXQgeW91ciBjb21tZW50IHNlZW1zIHRvIGlu ZGljYXRlIHRoYXQgaGVyZSB3ZSBhcmUgYWJvdXQgdG8gZGVmaW5lIHdheXMgdG8gY2Fycnkgbmlj ZWx5IHNjb3BlZCBJR1AgaW5mb3JtYXRpb24gaW50byBCR1AuIFdlbGwgdGhhdCBoYXMgYWxyZWFk eSBoYXBwZW5lZCB3aXRoDQogUkZDNzc1MiBhbmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1h dHRlciBZb2F2J3MgcmVtYXJrcyBhcmUgaW5kZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0 eSBkaXNjdXNzaW9uIG9uIFJGQzc3NTIgYW5kIElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNp b25zIG9mIGl0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5TdXJlIC0gYXMgb2JzZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0 aGF0IHByb3ZpZGluZyBtb3JlIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBw b3RlbnRpYWwgYXR0YWNrZXIgbWFrZXMgdGhlIG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUg Zm9yIHRoYXQgaXMgdG8gcHJldmVudCB0aGUgbGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBv ZiBpbnRlcmNlcHRpbmcgbmV3IGluZm9ybWF0aW9uDQogYnkgdW5hdXRob3JpemVkIHBhcnRpZXMu Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkJHUC1MUyBpcyBhbHJlYWR5IGRlZmluZWQgaW4gYSBuZXcgU0FGSSB3aGF0IGJ5IGl0c2Vs ZiBkb2VzIHByb3ZpZGUgbmljZSBsZXZlbCBvZiBpc29sYXRpb24uIFJGQzc3NTIgaXMgcHJldHR5 IGNsZWFyIG9uIHRoYXQgdG9vIGFuZCBzYXlzOiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mcXVvdDtCR1AgcGVlcmluZ3MgYXJlIG5v dCBhdXRvbWF0aWMgYW5kIHJlcXVpcmUgY29uZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJl c3BvbnNpYmlsaXR5IG9mIHRoZSBuZXR3b3JrIG9wZXJhdG9yIHRvIGVuc3VyZSB0aGF0IG9ubHkg dHJ1c3RlZCBjb25zdW1lcnMgYXJlIGNvbmZpZ3VyZWQgdG8gcmVjZWl2ZSBzdWNoIGluZm9ybWF0 aW9uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5JZiBzb21lb25lIHdvdWxkIGJlIHN0aWxsIGNvbmNlcm5lZCBhYm91dCBjb25maWd1 cmF0aW9uIG1pc3Rha2VzIGFuZCBuZWdvdGlhdGluZyBTQUZJIDcxIG9yIDcyIHRvIHRob3NlIHdo byBzaG91bGQgbm90IGdldCB0aGlzIGRhdGEgSSByZWNvbW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZD Nzc1MiBhcyAtYmlzIHZlcnNpb24gYW5kIHJlc3RyaWN0IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJp YnV0aW9uIGV2ZW4gZnVydGhlcg0KIGJ5IG1hbmRhdGluZyBkZWZhdWx0IHVzZSBvZiBOTy1FWFBP UlQgY29tbXVuaXR5IHdpdGggYWJpbGl0eSB0byBvdmVyd3JpdGUgaXQgZm9yIHRoZSBzZWxlY3Rp dmUgZUJHUCBwZWVycy4gT3IgcGVyaGFwcyB3ZSBjb3VsZCBwcm9ncmVzcyBKaW0ncyBPbmUgQWRt aW5pc3RyYXRpdmUgRG9tYWluIGRyYWZ0IChkcmFmdC11dHRhcm8taWRyLW9hZC0wMSkuJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklu IGVpdGhlciBjYXNlIHdoaWxlIGJvdGggb2YgeW91ciBjb21tZW50cyBhcmUgZ3JlYXQgdGhleSBz ZWVtcyBhIGJpdCBsYXRlIGluIHRoZSBnYW1lIGhlcmUgb3IgYXQgbGVhc3QgdGFyZ2V0aW5nIHdy b25nIGRvY3VtZW50LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5LaW5kIHJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Sb2JlcnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6MjcgQU0g QmVuamFtaW4gS2FkdWsgJmx0OzxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0Bt aXQuZWR1PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gVGh1LCBPY3QgMTgsIDIwMTggYXQgMDY6MDA6MTNQTSAmIzQzOzAwMDAsIExlcyBHaW5z YmVyZyAoZ2luc2JlcmcpIHdyb3RlOjxicj4NCiZndDsgWW9hdiDigJM8YnI+DQomZ3Q7IDxicj4N CiZndDsgSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIGFkdmVydGlzaW5n IHRoZSBzcGVjaWZpYyBpbmZvcm1hdGlvbiBjb3ZlcmVkIGluIHRoaXMgZHJhZnQgd2UgaGF2ZSBh IHN0YXRlbWVudCBpbiB0aGUgSUdQIGRyYWZ0czo8YnI+DQomZ3Q7IDxicj4NCiZndDsgRnJvbSBS RkM3ODEwPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IOKAnFRoZSBzdWItVExWcyBpbnRyb2R1Y2VkIGlu IHRoaXMgZG9jdW1lbnQgYWxsb3cgYW4gb3BlcmF0b3IgdG88YnI+DQomZ3Q7Jm5ic3A7ICZuYnNw OyBhZHZlcnRpc2Ugc3RhdGUgaW5mb3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkp IHRoYXQgY291bGQgYmU8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBzZW5zaXRpdmUgYW5kIHRoYXQg YW4gb3BlcmF0b3IgbWF5IG5vdCB3YW50IHRvIGRpc2Nsb3NlLuKAnTxicj4NCiZndDsgPGJyPg0K Jmd0OyBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggc2VuZGluZyBpbmZv cm1hdGlvbiB2aWEgQkdQLUxTIHdlIGhhdmUgYSBudW1iZXIgb2Ygc3RhdGVtZW50cyBpbiBSRkMg Nzc1MiDigJMgbW9zdCByZWxldmFudCBpczo8YnI+DQomZ3Q7IDxicj4NCiZndDsg4oCcQWRkaXRp b25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0 ZSBhbmQ8YnI+DQomZ3Q7Jm5ic3A7ICZuYnNwOyBURSBpbmZvcm1hdGlvbiBhcyBkZXNjcmliZWQg aW4gdGhpcyBkb2N1bWVudCBjb25zdGl0dXRlcyBhIHJpc2sgdG88YnI+DQomZ3Q7Jm5ic3A7ICZu YnNwOyBjb25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBjb21tZXJjaWFsbHkg c2Vuc2l0aXZlPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDsgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5l dHdvcmsu4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFNvIGxvbmcgYXMgdGhlcmUgYXJlIHJlZmVy ZW5jZXMgdG8gYm90aCB0aGUgSUdQIFJGQ3MgYW5kIFJGQyA3NzUyIEkgYW0gdGhlcmVmb3JlIGhh cmQgcHJlc3NlZCB0byB1bmRlcnN0YW5kIHdoYXQgZWxzZSBjb3VsZCBiZSB1c2VmdWxseSBzYWlk Ljxicj4NCiZndDsgQ2VydGFpbmx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1M UyB0cmFuc3BvcnQgbWVjaGFuaXNtIGFyZSBub3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcg VExWcyDigJMgYW5kIHNpbmNlIHRoZSBJR1AgUkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNr cyBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qg c2ltcGx5IHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHRyYW5zcG9ydA0KIG1lY2hhbmlz bSkgeW91IGFyZSBnb2luZyB0byBoYXZlIHRvIHByb3ZpZGUgbW9yZSBzcGVjaWZpY3Mgb24gd2hh dCBjYW4gbWVhbmluZ2Z1bGx5IGJlIHNhaWQgdGhhdCBpcyBub3QgYWxyZWFkeSBjb3ZlcmVkIGlu IHRoZSByZWZlcmVuY2VzLjxicj4NCjxicj4NCk15IGFwb2xvZ2llcyBmb3IganVtcGluZyBpbiBp biB0aGUgbWlkZGxlLCBidXQgSUlVQyB0aGUgSUdQIFJGQ3MgaGF2ZTxicj4NCmNvdmVyZWQgdGhl IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBhIHNwZWNpZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uLCAq dW5kZXI8YnI+DQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQgbWVjaGFuaXNtIGlz IHdpdGhpbiBhIHNpbmdsZSBBUyBhbmQ8YnI+DQphZG1pbmlzdHJhdGl2ZSBkb21haW4qLiZuYnNw OyBZb2F2IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdDxicj4NCmluZm9y bWF0aW9uIG1heSBjaGFuZ2Ugd2hlbiB0aGUgZGlzdHJpYnV0aW9uIGlzIG92ZXIgYSBicm9hZGVy IGRvbWFpbiB0aGFuPGJyPg0KdGhlIG9uZSBmb3Igd2hpY2ggdGhlIHByZXZpb3VzIGFuYWx5c2lz IHdhcyBwZXJmb3JtZWQuPGJyPg0KPGJyPg0KLUJlbjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_44855683021a4ffbb8070364182d9d53XCHALN001ciscocom_-- From nobody Fri Oct 19 15:28:02 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BC02130E34 for ; Fri, 19 Oct 2018 15:27:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=raszuk.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rLaLD0UV8jIJ for ; Fri, 19 Oct 2018 15:27:53 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 167DE13104A for ; Fri, 19 Oct 2018 15:27:51 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id p3-v6so1633636qkb.5 for ; Fri, 19 Oct 2018 15:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raszuk.net; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2jYczE4HcbxNaJgUzTi4Fc0cWIl2qaMzvSLz/Cvqyt4=; b=TbwGCqtG0e2Hy3+PaT7Joof8Xe7UU4Pll85g3VhKKQxVE3nkNBzAXS/8kUq9UOu2Qs hZpim27VvX1744aowUePOJnLcRkfldfw+CejK0lQn7rQbt7RQPpovdU56TtcriwrtEGO Cw+nIIZ6RurLE7FS++kU7t/ZUgUfv3mRwF0k8+j5qF+0sj0tgpoWdbeAx8AUuffn22Li VR7Fdp1EljZyueen5BQK2RBZes1iYty0SDzZ6tqN/kdZOjSYhtlGtvtmbX8LWYvkcQU0 7xpjzTToFYhgx2aPH38HN5EV+yRzVZjBzHESYocdlq8R7Iw01/rj4oiBY0NHEuGldwDW PdZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2jYczE4HcbxNaJgUzTi4Fc0cWIl2qaMzvSLz/Cvqyt4=; b=QhfzjJMAk2dFQAcoCQhmfFIxIVeDVFJ642voArKizAoBaKz1YaYP6LPphF6j86AaBO gViafBLLbszINDSYcoOU3mmNsLpJRMtMn98GhqFXenJeE05hLeTj7k2EV2RQSGpm8nkQ b/SFEFsmttvpXSY2BBiGLn0VzPNWRYsrztv2J+8Zv5MnljSOuN4KtHrdPh1E8RxgUAfB AV/Ke8y/MA6SNFyT4p2FIr4A80JpnKlhb5y7eqXy9qvov8wyf5ABDrut84ypBhV5a7I3 fa1fUgH3RxEOBEa94ELMsBM3xLwlRA0nAv4TPpfgrmEmbu3Gky+qijUjteic6lovUp6T oRiQ== X-Gm-Message-State: ABuFfojrUscRF/r7zWor6RKhqlC0qOaqjRZBlr7gmYe8Qc0OkUiAihwp NZqkZQD6yQ3W3Oy92ai0s/Oe+GT8wypFh2+zrRc4AQ== X-Google-Smtp-Source: ACcGV61cnZ4/uAkcP6QbFsoJXFvzSNir21iClbkqbE22H0S9CMqmJEGcG1FeTraGqk3NsDnIJ1F5VP8CqtXtVNbfK98= X-Received: by 2002:a37:694:: with SMTP id 142-v6mr32868680qkg.189.1539988070098; Fri, 19 Oct 2018 15:27:50 -0700 (PDT) MIME-Version: 1.0 References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> In-Reply-To: <03e101d467f3$2bff9130$83feb390$@ndzh.com> From: Robert Raszuk Date: Sat, 20 Oct 2018 00:27:41 +0200 Message-ID: To: shares@ndzh.com Cc: "Les Ginsberg (ginsberg)" , kaduk@mit.edu, idr@ietf.org, draft-ietf-idr-te-pm-bgp.all@ietf.org, ietf@ietf.org, Yoav Nir , secdir@ietf.org Content-Type: multipart/alternative; boundary="000000000000e09fbd05789c6904" Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 22:27:54 -0000 --000000000000e09fbd05789c6904 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Sue, However, I would like your feedback on whether you believe RFC7752 has > security that is equivalent to, less than, or greater than a trusted > domain? > > > > The spring routing architecture (RFC8402) indicates that be default SR > operates within a trusted domain. > > > > =E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of be= st > practices to reduce the risk of tampering within the trusted domain is > important. Such practices are discussed in [RFC4381 > ] and are applicable to both SR-MPLS > and SRv6.=E2=80=9D > Reading your comments I am also similarly to Les's feelings quite not sure what the point here is. SR Architecture while completely irrelevant to this thread talks about trusted domain in the context of data plane. Bringing in L3VPNs out of the sudden only because some SR document referred to it's security analysis is also quite a bizarre maneuver. With control plane and especially with BGP the notion of trusted vs untrusted domain is not something anyone can just pick or state on what his or her believe is. The short answer is that BGP operates on a per AFI/SAFI basis and level of trust is directly related to the actual configuration applied including level of policy inserted when using such apparatus to distribute various forms of information. Same SAFI can be configured by one operator quite strictly limiting it to one AS and someone else will like to share his information with entire world publishing it to a looking glass. Are we here to restrict this ? What means of control is there to enforce such restrictions other then perhaps stating simple recommendation in an advisory fashion that one should be a bit careful when publishing content of his LSDB or TED beyond devices he trusts ? ** ** Note that even if TE infrastructure addresses or other information are accidentally leaked - there should be no great immediate harm - since well managed network prevents on ingress to the domain any flows which would aim at internal infrastructure address space. Thx, R. --000000000000e09fbd05789c6904 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Sue,

However, I would like your feedback on= whether you believe RFC7752 has security that is equivalent to, less than,= or greater than a trusted domain?

=C2=A0

The spring routing architecture (= RFC8402) indicates that be default SR operates within a trusted domain.=C2= =A0

<= /u>=C2=A0

Traffic MUST be filtered at the = domain boundaries. The use of best practices to reduce the risk of tamperin= g within the trusted domain is important.=C2=A0 Such practices are discusse= d in [RFC4381] and are applicable to both SR-MPLS and SRv6.= =E2=80=9D



=
Reading your comments I am also similarly to Les's feelings quite = not sure what the point here is.=C2=A0

SR Architec= ture while completely irrelevant to this thread talks about trusted domain = in the context of data plane. Bringing in L3VPNs out of the sudden only bec= ause some SR document referred to it's security analysis is also quite = a bizarre maneuver.=C2=A0

With control plane and e= specially with BGP the notion of trusted vs untrusted domain is not somethi= ng anyone can just pick or state on what his or her believe is.=C2=A0
=

The short answer is that BGP operates on a per AFI/SAFI= basis and level of trust is directly related to the actual configuration a= pplied including level of policy inserted when using such apparatus to dist= ribute various forms of information.=C2=A0

Same SA= FI can be configured by one operator quite strictly limiting it to one AS a= nd someone else will like to share his information with entire world publis= hing it to a looking glass. Are we here to restrict this ? What means of co= ntrol is there to enforce such restrictions other then perhaps stating simp= le recommendation in an advisory fashion that one should be a bit careful w= hen publishing content of his LSDB or TED beyond devices he trusts ? **

** Note that even if TE infrastructure addresses or o= ther information are accidentally leaked - there should be no great immedia= te harm - since well managed network prevents on ingress to the domain any = flows which would aim at internal infrastructure address space.=C2=A0
=

Thx,
R.


--000000000000e09fbd05789c6904-- From nobody Fri Oct 19 15:31:55 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4B3F130E34; Fri, 19 Oct 2018 15:31:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yA-vSKGH9FK3; Fri, 19 Oct 2018 15:31:45 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0082812F1AC; Fri, 19 Oct 2018 15:31:44 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> <44855683021a4ffbb8070364182d9d53@XCH-ALN-001.cisco.com> In-Reply-To: <44855683021a4ffbb8070364182d9d53@XCH-ALN-001.cisco.com> Date: Fri, 19 Oct 2018 18:31:38 -0400 Message-ID: <043b01d467fb$813ba910$83b2fb30$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_043C_01D467D9.FA2FD570" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BAE930AoAZRhPWMClJo7/QIHRbY5osfluzA= Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 22:31:48 -0000 This is a multipart message in MIME format. ------=_NextPart_000_043C_01D467D9.FA2FD570 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les: =20 I politely asked for viewpoint on RFC7752=E2=80=99s security since your = draft depends on RFC7752. You have impolitely and harshly refused to = comment on these points. =20 =20 I am focused on finding a resolution to the security directorates = comments on this draft on this thread. One resolution was to suggest a = general resolution by revising the RFC7752 draft. I have spent time = today providing background and reasons why this might be a good = resolution. I see from your comments that you are rejecting this = potential resolution. =20 =20 Propose a resolution to the secdir comments. Please note as your = shepherd and WG chair, stating =E2=80=9Csecurity directorate does not = understand BGP=E2=80=9D is not a resolution. =20 =20 IMHO as shepherd for your document Yoav has a valid point that on = vagueness of RFC7752 and the addition of new information. Please = continue to work with Yoav, Benjamin and the secdir to resolve their = concerns since my resolution has been rejected by you. =20 =20 Sue Hares =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 6:01 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 I will not reinforce your inappropriate insertion of the discussion of = possible RFC 7752 deficiencies into a thread which is reviewing = draft-ietf-idr-te-pm-bgp. This is wrong =E2=80=93 please stop it. =20 You want to discuss issues with RFC 7752 =E2=80=93 please start a = separate thread =E2=80=93 directed at the WG (of course) =E2=80=93 and = state your position as a WG member as to what you feel needs to be done. = Then others can comment and the WG can decide whether they agree work = needs to be done. =20 Also - and for the third time - draft-ietf-idr-te-pm-bgp is NOT SR = related =E2=80=93 please also stop inserting a discussion of SR/BGP-LS = into the review of this draft. =20 (Apologies for the harsh tone =E2=80=93 but it is becoming increasingly = frustrating to watch this thread being misdirected.) =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 2:32 PM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I will respond to this information point by point after I have responded = to Ketan who sent me messages regarding his draft prior to yours. = However, I would like your feedback on whether you believe RFC7752 has = security that is equivalent to, less than, or greater than a trusted = domain?=20 =20 The spring routing architecture (RFC8402) indicates that be default SR = operates within a trusted domain. It says further:=20 =20 =E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of = best practices to reduce the risk of tampering within the trusted domain = is important. Such practices are discussed in [RFC4381 = ] and are applicable to both = SR-MPLS and SRv6.=E2=80=9D=20 =20 If you believe that RFC7752 describes a trusted domain [per RFC4381],=20 RFC7762 does not state that it is a trusted domain.=20 =20 If you believe the RFC7752 has stronger security=20 than a trusted domain, can you let me know=20 why you think it is stronger than a trusted domain. =20 =20 If you believe that RFC7752 describes security which=20 is less than a trusted domain, please let me how it is less.=20 =20 The RFC7752 text is below for ease of the IDR and secdir readers.=20 =20 Thank you for providing this feedback,=20 =20 Sue =20 ------------ =20 RFC7752 security section (section 8.) =20 =20 8. Security Considerations =20 Procedures and protocol extensions defined in this document do not affect the BGP security model. See the Security Considerations section of [RFC4271] for a discussion of BGP security. Also refer to [RFC4272] and [RFC6952] for analysis of security issues for BGP =20 In the context of the BGP peerings associated with this document, a BGP speaker MUST NOT accept updates from a consumer peer. That is, a participating BGP speaker should be aware of the nature of its relationships for link-state relationships and should protect itself from peers sending updates that either represent erroneous information feedback loops or are false input. Such protection can be achieved by manual configuration of consumer peers at the BGP speaker. =20 An operator SHOULD employ a mechanism to protect a BGP speaker against DDoS attacks from consumers. The principal attack a consumer may apply is to attempt to start multiple sessions either sequentially or simultaneously. Protection can be applied by imposing rate limits. =20 Additionally, it may be considered that the export of link-state and TE information as described in this document constitutes a risk to confidentiality of mission-critical or commercially sensitive information about the network. BGP peerings are not automatic and require configuration; thus, it is the responsibility of the network operator to ensure that only trusted consumers are configured to receive such information. =20 =20 =20 From: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]=20 Sent: Friday, October 19, 2018 1:29 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 Inline. =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 10:08 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I apologize if my email message was unclear. We both agree that your = draft is not related to SR routing. SR routing is related to BGP-LS as = a transport mechanism for information. =20 =20 I agree that RFC7752 had traffic engineering information. However, that = traffic engineering information almost got that draft rejected by the = IESG at the time. As my previous message to this list indicated, we got = agreement on RFC7752 based on limiting that information and the = assurance that BGP-LS nodes were deployed on a separate set of nodes. = Expanding the traffic engineering information beyond RFC7752 re-opens = all the security issues and questions from RFC7752=E2=80=99s original = review. =20 =20 [Les:] So far, you are the only person who seems aware of this. I am not = saying you are wrong =E2=80=93 I am just saying my private attempts to = get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this. If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point. =20 The security directorate reviewer is asking these security questions. = The security directorate does have people with both routing and security = experts. =20 =20 SR routing is also expanding the information past the original RFC7752. = The expansions requested by SR routing also re-open those original = security questions and issues. =20 =20 [Les:] I do not know why you mention SR here since we both agree this = draft is not SR related. =20 One way to answer these questions is to provide a RFC7752bis with an = updated security section. If you agree with this approach, I suggest = simply referring to a RFC7752bis that in your security section. If you = disagree that an update to the RFC7752bis is required, we can start a = thread on that point.=20 =20 [Les:] There is no RFC7752bis draft. J So you are asking me to = reference a non-existent document? =20 I understand that you (at least) would like to have one =E2=80=93 which = is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 correct? =20 But this dodges the question as to whether draft-ietf-idr-te-pm-bgp has = a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an RFC. =20 Les =20 Did this message clarify my earlier brief message? Do you want to = continue to discuss the need for RFC7752bis?=20 =20 Cheerily, Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:58 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 One of us is confused. J =20 draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those words = do not appear anywhere in the document. Nor is there a reference to any = SR document. =20 Further, RFC 7752 includes traffic engineering information (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion = that we are introducing a new attack vector by defining some = additional(sic) TE codepoints does not make sense to me. =20 I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them. =20 Could you please update your response with these points in mind? =20 Thanx. =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 6:26 AM To: 'Robert Raszuk' ; kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_043C_01D467D9.FA2FD570 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

I politely asked for viewpoint on RFC7752=E2=80=99s security since = your draft depends on RFC7752. =C2=A0You have impolitely and harshly = refused to comment on these points.=C2=A0

 

I am focused on finding a resolution to the security directorates = comments on this draft on this thread. =C2=A0=C2=A0One resolution was to = suggest a general resolution by revising the RFC7752 draft.=C2=A0 = =C2=A0I have spent time today providing background and reasons why this = might be a good resolution. =C2=A0I see from your comments that you are = rejecting this potential resolution. =C2=A0

 

Propose a resolution to the secdir comments.=C2=A0 =C2=A0=C2=A0Please = note as your shepherd and WG chair, stating =C2=A0=E2=80=9Csecurity = directorate does not understand BGP=E2=80=9D is not a = resolution.=C2=A0=C2=A0

 

IMHO as shepherd for your document Yoav has a valid point that on = vagueness of RFC7752 and the addition of new information.=C2=A0 = =C2=A0Please continue to work with Yoav, Benjamin and the secdir to = resolve their concerns since my resolution has been rejected by = you.=C2=A0

 

Sue Hares

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg)
Sent: Friday, October 19, 2018 6:01 = PM
To: Susan Hares; 'Robert Raszuk'; = kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; = ietf@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; = ynir.ietf@gmail.com
Subject: Re: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

I will not reinforce your inappropriate insertion of the discussion = of possible RFC 7752 deficiencies into a thread which is reviewing = draft-ietf-idr-te-pm-bgp. This is wrong =E2=80=93 please stop = it.

 

You want to discuss issues with RFC 7752 =E2=80=93 please start a = separate thread =E2=80=93 directed at the WG (of course) =E2=80=93 and = state your position as a WG member as to what you feel needs to be done. = Then others can comment and the WG can decide whether they agree work = needs to be done.

 

Also - and for the third time - draft-ietf-idr-te-pm-bgp is NOT SR = related =E2=80=93 please also stop inserting a discussion of SR/BGP-LS = into the review of this draft.

 

(Apologies for the harsh tone =E2=80=93 but it is becoming = increasingly frustrating to watch this thread being = misdirected.)

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 2:32 PM
To: Les Ginsberg (ginsberg) = <ginsberg@cisco.com>; 'Robert Raszuk' <robert@raszuk.net>; = kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I will respond to this information point by point after I have = responded to Ketan who sent me messages regarding his draft prior to = yours.   However, I would like your feedback on whether you = believe RFC7752 has security that is equivalent to, less than, or = greater than a trusted domain?

 

The spring routing architecture (RFC8402) indicates that be default = SR operates within a trusted domain.   It says further: =

 

=E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of best = practices to reduce the risk of tampering within the trusted domain is = important.  Such practices are discussed in [RFC4381] and are applicable to both SR-MPLS and = SRv6.=E2=80=9D

 

If you believe that RFC7752 describes a trusted domain [per RFC4381], =

RFC7762 does not state that it is a trusted domain. =

 

If you believe the RFC7752 has stronger security =

than a trusted domain, can you let me know

why you think it is stronger than a trusted domain.  =

 

If you believe that RFC7752 describes security which =

is less than a trusted domain, please let me how it is less. =

 

The RFC7752 text is below for ease of the IDR and secdir readers. =

 

Thank you for providing this feedback,

 

Sue

 

------------

 

RFC7752 security section (section 8.)  

 

8.  Security Considerations

 

   Procedures and protocol extensions defined in this = document do not

   affect the BGP security model.  See the Security = Considerations

   section of [RFC4271] for a discussion of BGP = security.  Also refer to

   [RFC4272] and [RFC6952] for analysis of security issues = for BGP

 

   In the context of the BGP peerings associated with this = document, a

   BGP speaker MUST NOT accept updates from a consumer = peer.  That is, a

   participating BGP speaker should be aware of the nature of = its

   relationships for link-state relationships and should = protect itself

   from peers sending updates that either represent = erroneous

   information feedback loops or are false input.  Such = protection can

   be achieved by manual configuration of consumer peers at = the BGP

   speaker.

 

    An operator SHOULD employ a mechanism to protect a = BGP speaker

   against DDoS attacks from consumers.  The principal = attack a consumer

   may apply is to attempt to start multiple sessions = either

   sequentially or simultaneously.  Protection can be = applied by

   imposing rate limits.

 

   Additionally, it may be considered that the export of = link-state and

   TE information as described in this document constitutes = a risk to

   confidentiality of mission-critical or commercially = sensitive

   information about the network.  BGP peerings are = not automatic and

   require configuration; thus, it is the responsibility of = the network

   operator to ensure that only trusted consumers are = configured to

   receive such information.

 

 

 

From:= = Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com] =
Sent: Friday, October 19, 2018 1:29 PM
To: Susan = Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

Inline.

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 10:08 AM
To: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I apologize if my email message was unclear.   We both = agree that your draft is not related to SR routing.   SR = routing is related to BGP-LS as a transport mechanism for information. =  

 

I agree that RFC7752 had traffic engineering information.  = However, that traffic engineering information almost got that draft = rejected by the IESG at the time.  As my previous message to this = list indicated, we got agreement on RFC7752 based on limiting that = information and the assurance that BGP-LS nodes were deployed on a = separate set of nodes.  Expanding the traffic engineering = information beyond RFC7752 re-opens all the security issues and = questions from RFC7752=E2=80=99s original review. =  

 

[Les:] So far, you are the only person who seems aware of this. I am = not saying you are wrong =E2=80=93 I am just saying my private attempts = to get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this.

If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point.

 

The security directorate reviewer is asking these security = questions.  The security directorate does have people with both = routing and security experts.   

 

SR routing is also expanding the information past the original = RFC7752.   The expansions requested by SR routing also re-open = those original security questions and issues.  =

 

[Les:] I do not know why you mention SR here since we both agree this = draft is not SR related.

 

One way to answer these questions is to provide a  RFC7752bis = with an updated security section.  If you agree with this approach, = I suggest simply referring to a RFC7752bis that in your security = section.   If you disagree that an update to the RFC7752bis is = required, we can start a thread on that point.

 

[Les:] There is no RFC7752bis draft. J  So you are asking me to reference a non-existent = document?

 

I understand that you (at least) would like to have one =E2=80=93 = which is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 = correct?

 

But this dodges the question as to whether draft-ietf-idr-te-pm-bgp = has a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an = RFC.

 

   Les

 

Did this message clarify my earlier brief message?  Do you want = to continue to discuss the need for RFC7752bis?

 

Cheerily, Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:58 AM
To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

One of us is confused. J

 

draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those = words do not appear anywhere in the document. Nor is there a reference = to any SR document.

 

Further, RFC 7752 includes traffic engineering information (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion that we are = introducing a new attack vector by defining some additional(sic) TE = codepoints does not make sense to me.

 

I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them.

 

Could you please update your response with these points in = mind?

 

Thanx.

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 6:26 AM
To: 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: RE: [Idr] [secdir] Secdir = early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.  However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.   = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues. 

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. =  As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible.  

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.  = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Robert Raszuk
Sent: Friday, October 19, = 2018 2:52 AM
To: kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: Re: [Idr] [secdir] Secdir = early review of draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_043C_01D467D9.FA2FD570-- From nobody Fri Oct 19 15:41:29 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F052130FFC; Fri, 19 Oct 2018 15:41:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.225 X-Spam-Level: * X-Spam-Status: No, score=1.225 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, KHOP_DYNAMIC=1.999, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id za5xyviCQV2T; Fri, 19 Oct 2018 15:41:06 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 821FF130E34; Fri, 19 Oct 2018 15:41:06 -0700 (PDT) Received: from pps.filterd (m0108163.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9JMcjgg017868; Fri, 19 Oct 2018 15:41:03 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=JSJVAweFhdJSQbGsZfyBRDJyFXPgTrowfd+VyP32TcU=; b=grlqH04LBqiTxcaqFyYLfLPmVezFUD2dWCOLkNVYsYCoLq3dU+cvY6sC96hho1gMIqYA 5Yv0xxnXj4vUEfTnpvzY8+w50CfSaH6zHVEgRINM9jIzFouNFwvo3rD1yRDZs1LjHLIG SptDvfK4dXLRHsAZ5d3n+T0Pxtg5Ny7Y0h/uY3E9c5+rteIcWvrQWC6426nyQfdLx4Jw u+rtNlUF3twJencx9hPS6+Ib7xVmur5CGcy+YpB8Rduc2StHfD0/cL8OC4xrFKdT08A/ We8dHg1duZliYerjCYpRsMJ0ESV5qVgMnN9TAf7yp8TyJ6a+fILdJi/LulkerNsKeE4X Jg== Received: from nam04-co1-obe.outbound.protection.outlook.com (mail-co1nam04lp0056.outbound.protection.outlook.com [216.32.181.56]) by mx0b-00273201.pphosted.com with ESMTP id 2n7pvb842c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 19 Oct 2018 15:41:02 -0700 Received: from BN7PR05MB4354.namprd05.prod.outlook.com (52.133.223.33) by BN7PR05MB3986.namprd05.prod.outlook.com (52.132.217.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.13; Fri, 19 Oct 2018 22:40:57 +0000 Received: from BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012]) by BN7PR05MB4354.namprd05.prod.outlook.com ([fe80::c494:2955:fd6c:4012%4]) with mapi id 15.20.1250.028; Fri, 19 Oct 2018 22:40:57 +0000 From: John E Drake To: Susan Hares , "'Les Ginsberg (ginsberg)'" , 'Robert Raszuk' , "kaduk@mit.edu" CC: "ynir.ietf@gmail.com" , "idr@ietf.org" , "ietf@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZwyQN9RQyXdy5EeaDRo0vfHjgKUltrcAgABrlwCAAG4QAIAAGbsAgAAkTACAAAXsAIAAQ+uAgAAIAICAAAiqAIAAALgA Date: Fri, 19 Oct 2018 22:40:57 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> <44855683021a4ffbb8070364182d9d53@XCH-ALN-001.cisco.com> <043b01d467fb$813ba910$83b2fb30$@ndzh.com> In-Reply-To: <043b01d467fb$813ba910$83b2fb30$@ndzh.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [66.129.241.13] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN7PR05MB3986; 6:+x+OBhaOEkN9Yt6Oe2ASOpA+Cor5z+paAmGlCoOuBdXKDaq4YOd6swY9vHgipEL3kUFFsMVqb/3sO6EN6zPgFjCRNwzN8FwaLL6Jq+aT9l9/erEAyhv6wDYSZWbAglCqMQ3FNTpVxx0agfIJFvF081Dh8TyDZp01jcT9oSeyH536iSq/8lJ+0yw1qoMof44sXz1/poiN0hPSaVLMFZswEr8SfjsQwbJiFz1rxLWjTc3Eyel6mma1v0cPJQg5AL4PdyTTZqPsHnnKaCew1iwBY7gOhWrgHi7nD7vvWJMEjfgDyyE3fQqXbmqSj9+ynGyjuaDLebjZIm8UPnzz2T1GZ/eGrEyxXDont5WhMO3LQj75FHXTVDmHtKlCKzItIGhTT3SAnWYIln8oN0cNUz3sTY1XxMYUao2ChNIxs8LxP6r6WdngYEuUtvn0DpU1JLoWZVnZLsTiOoWuUKPg35yXUg==; 5:7EI8ROL1FKN1VuaNh0s2Ndsex4Z2Q8oVjZtw599xLBA7WmpJADWuBv8btKKW1WPqxXhGTiTYGg9qlgKbGIRr6QQFg9u0U5ToaNf0Pg+Xb9oSlgRf1ksy8HKSplOgFjen6aVGcU5ipGbAqhG7mhSd+aZrkh2b6XT7eFOeowPTIYE=; 7:Z0o9zsfzdDH2Sg/whovGKlLIxmqo2r4FMKeXNAYn1iWoqN+igVPz7nyrymL1EeX6r6ft71ykV+TyGLrGKi4VCyjvU2Ij11E2n2KVZ3MRuegRNdnBSCeHqlU9BY+VUK/eBQvm141NG84zgNoa0gTp0g== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 00be086e-2b5a-4797-e70f-08d63613eff7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:BN7PR05MB3986; x-ms-traffictypediagnostic: BN7PR05MB3986: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(95692535739014)(240460790083961)(85827821059158)(192374486261705)(269456686620040)(21748063052155)(28532068793085)(190501279198761)(227612066756510)(10436049006162); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(3231355)(944501410)(52105095)(10201501046)(93006095)(93001095)(6055026)(148016)(149066)(150057)(6041310)(20161123558120)(20161123564045)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:BN7PR05MB3986; BCL:0; PCL:0; RULEID:; SRVR:BN7PR05MB3986; x-forefront-prvs: 0830866D19 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(346002)(396003)(39860400002)(366004)(376002)(189003)(199004)(3846002)(66066001)(106356001)(97736004)(11346002)(39060400002)(476003)(14454004)(86362001)(446003)(33656002)(68736007)(54906003)(256004)(8676002)(110136005)(14444005)(81156014)(2900100001)(606006)(2501003)(229853002)(4326008)(19609705001)(6436002)(7736002)(5660300001)(2906002)(6506007)(26005)(9326002)(53546011)(5250100002)(76176011)(7696005)(81166006)(74316002)(6246003)(102836004)(186003)(25786009)(966005)(345774005)(316002)(478600001)(4744004)(55016002)(2171002)(53946003)(71200400001)(6116002)(9686003)(54896002)(6306002)(93886005)(790700001)(8936002)(486006)(105586002)(53936002)(71190400001)(236005)(99286004)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR05MB3986; H:BN7PR05MB4354.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-microsoft-antispam-message-info: ymK2nHwF82G8B0t3QDvX0gqYoWMEUmNPOIfqrr1hLl55JVzx563U7XdlBJzpVJZDoJf1DyB9f5p3NK+yZe0URp/8Zt4mN76gg+lQCW0G+Hem6iJOaQQ5mo5LprdxNwvGXnGunjpP/wBtdH55KxPYQeAhdmPKN1XTP+ZmwIAFhzm/g7DjBzni6xhddG9DLkmGohXVoUozbmv7YxyaKrni65SbFJV2g7wI78+GuSZz6jZsA5530BE34aGmI9rT4hiVAwZ4ENm+chziHxZerUuzHdy/PFhV6mmydOjRCMkgXaX5gL2FOi3qbaCb+fUxYhRGzhfaWMKr9s4Lx/GhxFvBlmtZ9gJl+3thtq1OGTRS90w= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN7PR05MB4354891AD79FD0F53777797DC7F90BN7PR05MB4354namp_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 00be086e-2b5a-4797-e70f-08d63613eff7 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2018 22:40:57.5672 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB3986 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-10-19_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1810190201 Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 22:41:12 -0000 --_000_BN7PR05MB4354891AD79FD0F53777797DC7F90BN7PR05MB4354namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkNvbW1lbnRzIGlubGluZQ0KDQpZb3VycyBJcnJlc3BlY3RpdmVseSwNCg0KSm9obg0K DQpGcm9tOiBJZHIgPGlkci1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgU3VzYW4gSGFy ZXMNClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA2OjMyIFBNDQpUbzogJ0xlcyBHaW5z YmVyZyAoZ2luc2JlcmcpJyA8Z2luc2JlcmdAY2lzY28uY29tPjsgJ1JvYmVydCBSYXN6dWsnIDxy b2JlcnRAcmFzenVrLm5ldD47IGthZHVrQG1pdC5lZHUNCkNjOiB5bmlyLmlldGZAZ21haWwuY29t OyBpZHJAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5h bGxAaWV0Zi5vcmc7IHNlY2RpckBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtJZHJdIFtzZWNkaXJd IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoNCkxl czoNCg0KSSBwb2xpdGVseSBhc2tlZCBmb3Igdmlld3BvaW50IG9uIFJGQzc3NTLigJlzIHNlY3Vy aXR5IHNpbmNlIHlvdXIgZHJhZnQgZGVwZW5kcyBvbiBSRkM3NzUyLiAgWW91IGhhdmUgaW1wb2xp dGVseSBhbmQgaGFyc2hseSByZWZ1c2VkIHRvIGNvbW1lbnQgb24gdGhlc2UgcG9pbnRzLg0KDQpJ IGFtIGZvY3VzZWQgb24gZmluZGluZyBhIHJlc29sdXRpb24gdG8gdGhlIHNlY3VyaXR5IGRpcmVj dG9yYXRlcyBjb21tZW50cyBvbiB0aGlzIGRyYWZ0IG9uIHRoaXMgdGhyZWFkLiAgIE9uZSByZXNv bHV0aW9uIHdhcyB0byBzdWdnZXN0IGEgZ2VuZXJhbCByZXNvbHV0aW9uIGJ5IHJldmlzaW5nIHRo ZSBSRkM3NzUyIGRyYWZ0LiAgIEkgaGF2ZSBzcGVudCB0aW1lIHRvZGF5IHByb3ZpZGluZyBiYWNr Z3JvdW5kIGFuZCByZWFzb25zIHdoeSB0aGlzIG1pZ2h0IGJlIGEgZ29vZCByZXNvbHV0aW9uLiAg SSBzZWUgZnJvbSB5b3VyIGNvbW1lbnRzIHRoYXQgeW91IGFyZSByZWplY3RpbmcgdGhpcyBwb3Rl bnRpYWwgcmVzb2x1dGlvbi4NCg0KW0pEXSAgV2hhdCBwYXJ0IG9mIOKAnHRoaXMgZHJhZnQgaGFz IG5vdGhpbmcgdG8gZG8gd2l0aCBzZWdtZW50IHJvdXRpbmfigJ0gZG8geW91IG5vdCB1bmRlcnN0 YW5k4oCdPw0KDQpQcm9wb3NlIGEgcmVzb2x1dGlvbiB0byB0aGUgc2VjZGlyIGNvbW1lbnRzLiAg ICBQbGVhc2Ugbm90ZSBhcyB5b3VyIHNoZXBoZXJkIGFuZCBXRyBjaGFpciwgc3RhdGluZyAg4oCc c2VjdXJpdHkgZGlyZWN0b3JhdGUgZG9lcyBub3QgdW5kZXJzdGFuZCBCR1DigJ0gaXMgbm90IGEg cmVzb2x1dGlvbi4NCg0KW0pEXSAgRnJvbSB3aG9tIGRpZCB0aGF0IGRpcmVjdCBxdW90ZSBjb21l PyAgSSBkb27igJl0IHJlY2FsbCBzZWVpbmcgaXQgb24gdGhlIGVtYWlsIHRocmVhZC4NCg0KSU1I TyBhcyBzaGVwaGVyZCBmb3IgeW91ciBkb2N1bWVudCBZb2F2IGhhcyBhIHZhbGlkIHBvaW50IHRo YXQgb24gdmFndWVuZXNzIG9mIFJGQzc3NTIgYW5kIHRoZSBhZGRpdGlvbiBvZiBuZXcgaW5mb3Jt YXRpb24uICAgUGxlYXNlIGNvbnRpbnVlIHRvIHdvcmsgd2l0aCBZb2F2LCBCZW5qYW1pbiBhbmQg dGhlIHNlY2RpciB0byByZXNvbHZlIHRoZWlyIGNvbmNlcm5zIHNpbmNlIG15IHJlc29sdXRpb24g aGFzIGJlZW4gcmVqZWN0ZWQgYnkgeW91Lg0KDQpbSkRdICBJIGp1c3QgcmUtcmVhZCB0aGUgZW50 aXJlIGVtYWlsIHRocmVhZCBvbiB0aGlzIGRyYWZ0IGFuZCBpdCBhcHBlYXJzIHRvIG1lIHRoYXQg dGhhdCB0aGUgYWJvdmUgaXMgZXhhY3RseSB3aGF0IExlcyB3YXMgZG9pbmcgYW5kIHRoYXQgaGUg d2FzIHF1aXRlIGNsb3NlIHRvIGEgcmVzb2x1dGlvbiBiZWZvcmUgeW91IGluamVjdGVkIFJGQyA3 NzUyYmlzIGFuZCBzZWdtZW50IHJvdXRpbmcgaW50byB0aGUgY29udmVyc2F0aW9uLg0KDQpTdWUg SGFyZXMNCg0KDQpGcm9tOiBJZHIgW21haWx0bzppZHItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVo YWxmIE9mIExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpDQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTks IDIwMTggNjowMSBQTQ0KVG86IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJhc3p1ayc7IGthZHVrQG1p dC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJA aWV0Zi5vcmc+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz47IGlldGZA aWV0Zi5vcmc8bWFpbHRvOmlldGZAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3Au YWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3Jn PjsgeW5pci5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT4NClN1Ympl Y3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC0xMw0KDQpTdWUg4oCTDQoNCkkgd2lsbCBub3QgcmVpbmZvcmNlIHlvdXIg aW5hcHByb3ByaWF0ZSBpbnNlcnRpb24gb2YgdGhlIGRpc2N1c3Npb24gb2YgcG9zc2libGUgUkZD IDc3NTIgZGVmaWNpZW5jaWVzIGludG8gYSB0aHJlYWQgd2hpY2ggaXMgcmV2aWV3aW5nIGRyYWZ0 LWlldGYtaWRyLXRlLXBtLWJncC4gVGhpcyBpcyB3cm9uZyDigJMgcGxlYXNlIHN0b3AgaXQuDQoN CllvdSB3YW50IHRvIGRpc2N1c3MgaXNzdWVzIHdpdGggUkZDIDc3NTIg4oCTIHBsZWFzZSBzdGFy dCBhIHNlcGFyYXRlIHRocmVhZCDigJMgZGlyZWN0ZWQgYXQgdGhlIFdHIChvZiBjb3Vyc2UpIOKA kyBhbmQgc3RhdGUgeW91ciBwb3NpdGlvbiBhcyBhIFdHIG1lbWJlciBhcyB0byB3aGF0IHlvdSBm ZWVsIG5lZWRzIHRvIGJlIGRvbmUuIFRoZW4gb3RoZXJzIGNhbiBjb21tZW50IGFuZCB0aGUgV0cg Y2FuIGRlY2lkZSB3aGV0aGVyIHRoZXkgYWdyZWUgd29yayBuZWVkcyB0byBiZSBkb25lLg0KDQpB bHNvIC0gYW5kIGZvciB0aGUgdGhpcmQgdGltZSAtIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncCBp cyBOT1QgU1IgcmVsYXRlZCDigJMgcGxlYXNlIGFsc28gc3RvcCBpbnNlcnRpbmcgYSBkaXNjdXNz aW9uIG9mIFNSL0JHUC1MUyBpbnRvIHRoZSByZXZpZXcgb2YgdGhpcyBkcmFmdC4NCg0KKEFwb2xv Z2llcyBmb3IgdGhlIGhhcnNoIHRvbmUg4oCTIGJ1dCBpdCBpcyBiZWNvbWluZyBpbmNyZWFzaW5n bHkgZnJ1c3RyYXRpbmcgdG8gd2F0Y2ggdGhpcyB0aHJlYWQgYmVpbmcgbWlzZGlyZWN0ZWQuKQ0K DQogICBMZXMNCg0KDQpGcm9tOiBTdXNhbiBIYXJlcyA8c2hhcmVzQG5kemguY29tPG1haWx0bzpz aGFyZXNAbmR6aC5jb20+Pg0KU2VudDogRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDI6MzIgUE0N ClRvOiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSA8Z2luc2JlcmdAY2lzY28uY29tPG1haWx0bzpn aW5zYmVyZ0BjaXNjby5jb20+PjsgJ1JvYmVydCBSYXN6dWsnIDxyb2JlcnRAcmFzenVrLm5ldDxt YWlsdG86cm9iZXJ0QHJhc3p1ay5uZXQ+Pjsga2FkdWtAbWl0LmVkdTxtYWlsdG86a2FkdWtAbWl0 LmVkdT4NCkNjOiBpZHJAaWV0Zi5vcmc8bWFpbHRvOmlkckBpZXRmLm9yZz47IGRyYWZ0LWlldGYt aWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJn cC5hbGxAaWV0Zi5vcmc+OyBpZXRmQGlldGYub3JnPG1haWx0bzppZXRmQGlldGYub3JnPjsgeW5p ci5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT47IHNlY2RpckBpZXRm Lm9yZzxtYWlsdG86c2VjZGlyQGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtJZHJdIFtzZWNkaXJd IFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzDQoNCkxl czoNCg0KSSB3aWxsIHJlc3BvbmQgdG8gdGhpcyBpbmZvcm1hdGlvbiBwb2ludCBieSBwb2ludCBh ZnRlciBJIGhhdmUgcmVzcG9uZGVkIHRvIEtldGFuIHdobyBzZW50IG1lIG1lc3NhZ2VzIHJlZ2Fy ZGluZyBoaXMgZHJhZnQgcHJpb3IgdG8geW91cnMuICAgSG93ZXZlciwgSSB3b3VsZCBsaWtlIHlv dXIgZmVlZGJhY2sgb24gd2hldGhlciB5b3UgYmVsaWV2ZSBSRkM3NzUyIGhhcyBzZWN1cml0eSB0 aGF0IGlzIGVxdWl2YWxlbnQgdG8sIGxlc3MgdGhhbiwgb3IgZ3JlYXRlciB0aGFuIGEgdHJ1c3Rl ZCBkb21haW4/DQoNClRoZSBzcHJpbmcgcm91dGluZyBhcmNoaXRlY3R1cmUgKFJGQzg0MDIpIGlu ZGljYXRlcyB0aGF0IGJlIGRlZmF1bHQgU1Igb3BlcmF0ZXMgd2l0aGluIGEgdHJ1c3RlZCBkb21h aW4uICAgSXQgc2F5cyBmdXJ0aGVyOg0KDQrigJxUcmFmZmljIE1VU1QgYmUgZmlsdGVyZWQgYXQg dGhlIGRvbWFpbiBib3VuZGFyaWVzLiBUaGUgdXNlIG9mIGJlc3QgcHJhY3RpY2VzIHRvIHJlZHVj ZSB0aGUgcmlzayBvZiB0YW1wZXJpbmcgd2l0aGluIHRoZSB0cnVzdGVkIGRvbWFpbiBpcyBpbXBv cnRhbnQuICBTdWNoIHByYWN0aWNlcyBhcmUgZGlzY3Vzc2VkIGluIFtSRkM0MzgxPGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5v cmdfaHRtbF9yZmM0MzgxJmQ9RHdNRmFRJmM9SEFrWXVoNjNyc3VocjZTY2JmaDBVakJYZU1LLW5k YjN2b0RUWGNXem9DSSZyPUNSQjJ0SmlRZVBrMGNULWg1TEdoRVdILXNfeFhYdXAzSHp2QlNNUmo1 VkUmbT1XQk9hMjRMLVNQU1BjODlhTDBCOEpnbmJkSVNtQ3lnTDVXRHFUMTY0MlpnJnM9blNZVzg1 bDdfcllXb3g0ZGdXSm1JUERHdFgxN3dodXpHUTBHRmdOc1duVSZlPT5dIGFuZCBhcmUgYXBwbGlj YWJsZSB0byBib3RoIFNSLU1QTFMgYW5kIFNSdjYu4oCdDQoNCklmIHlvdSBiZWxpZXZlIHRoYXQg UkZDNzc1MiBkZXNjcmliZXMgYSB0cnVzdGVkIGRvbWFpbiBbcGVyIFJGQzQzODFdLA0KUkZDNzc2 MiBkb2VzIG5vdCBzdGF0ZSB0aGF0IGl0IGlzIGEgdHJ1c3RlZCBkb21haW4uDQoNCklmIHlvdSBi ZWxpZXZlIHRoZSBSRkM3NzUyIGhhcyBzdHJvbmdlciBzZWN1cml0eQ0KdGhhbiBhIHRydXN0ZWQg ZG9tYWluLCBjYW4geW91IGxldCBtZSBrbm93DQp3aHkgeW91IHRoaW5rIGl0IGlzIHN0cm9uZ2Vy IHRoYW4gYSB0cnVzdGVkIGRvbWFpbi4NCg0KSWYgeW91IGJlbGlldmUgdGhhdCBSRkM3NzUyIGRl c2NyaWJlcyBzZWN1cml0eSB3aGljaA0KaXMgbGVzcyB0aGFuIGEgdHJ1c3RlZCBkb21haW4sIHBs ZWFzZSBsZXQgbWUgaG93IGl0IGlzIGxlc3MuDQoNClRoZSBSRkM3NzUyIHRleHQgaXMgYmVsb3cg Zm9yIGVhc2Ugb2YgdGhlIElEUiBhbmQgc2VjZGlyIHJlYWRlcnMuDQoNClRoYW5rIHlvdSBmb3Ig cHJvdmlkaW5nIHRoaXMgZmVlZGJhY2ssDQoNClN1ZQ0KDQotLS0tLS0tLS0tLS0NCg0KUkZDNzc1 MiBzZWN1cml0eSBzZWN0aW9uIChzZWN0aW9uIDguKQ0KDQo4LiAgU2VjdXJpdHkgQ29uc2lkZXJh dGlvbnMNCg0KICAgUHJvY2VkdXJlcyBhbmQgcHJvdG9jb2wgZXh0ZW5zaW9ucyBkZWZpbmVkIGlu IHRoaXMgZG9jdW1lbnQgZG8gbm90DQogICBhZmZlY3QgdGhlIEJHUCBzZWN1cml0eSBtb2RlbC4g IFNlZSB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCiAgIHNlY3Rpb24gb2YgW1JGQzQyNzFd IGZvciBhIGRpc2N1c3Npb24gb2YgQkdQIHNlY3VyaXR5LiAgQWxzbyByZWZlciB0bw0KICAgW1JG QzQyNzJdIGFuZCBbUkZDNjk1Ml0gZm9yIGFuYWx5c2lzIG9mIHNlY3VyaXR5IGlzc3VlcyBmb3Ig QkdQDQoNCiAgIEluIHRoZSBjb250ZXh0IG9mIHRoZSBCR1AgcGVlcmluZ3MgYXNzb2NpYXRlZCB3 aXRoIHRoaXMgZG9jdW1lbnQsIGENCiAgIEJHUCBzcGVha2VyIE1VU1QgTk9UIGFjY2VwdCB1cGRh dGVzIGZyb20gYSBjb25zdW1lciBwZWVyLiAgVGhhdCBpcywgYQ0KICAgcGFydGljaXBhdGluZyBC R1Agc3BlYWtlciBzaG91bGQgYmUgYXdhcmUgb2YgdGhlIG5hdHVyZSBvZiBpdHMNCiAgIHJlbGF0 aW9uc2hpcHMgZm9yIGxpbmstc3RhdGUgcmVsYXRpb25zaGlwcyBhbmQgc2hvdWxkIHByb3RlY3Qg aXRzZWxmDQogICBmcm9tIHBlZXJzIHNlbmRpbmcgdXBkYXRlcyB0aGF0IGVpdGhlciByZXByZXNl bnQgZXJyb25lb3VzDQogICBpbmZvcm1hdGlvbiBmZWVkYmFjayBsb29wcyBvciBhcmUgZmFsc2Ug aW5wdXQuICBTdWNoIHByb3RlY3Rpb24gY2FuDQogICBiZSBhY2hpZXZlZCBieSBtYW51YWwgY29u ZmlndXJhdGlvbiBvZiBjb25zdW1lciBwZWVycyBhdCB0aGUgQkdQDQogICBzcGVha2VyLg0KDQog ICAgQW4gb3BlcmF0b3IgU0hPVUxEIGVtcGxveSBhIG1lY2hhbmlzbSB0byBwcm90ZWN0IGEgQkdQ IHNwZWFrZXINCiAgIGFnYWluc3QgRERvUyBhdHRhY2tzIGZyb20gY29uc3VtZXJzLiAgVGhlIHBy aW5jaXBhbCBhdHRhY2sgYSBjb25zdW1lcg0KICAgbWF5IGFwcGx5IGlzIHRvIGF0dGVtcHQgdG8g c3RhcnQgbXVsdGlwbGUgc2Vzc2lvbnMgZWl0aGVyDQogICBzZXF1ZW50aWFsbHkgb3Igc2ltdWx0 YW5lb3VzbHkuICBQcm90ZWN0aW9uIGNhbiBiZSBhcHBsaWVkIGJ5DQogICBpbXBvc2luZyByYXRl IGxpbWl0cy4NCg0KICAgQWRkaXRpb25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRo ZSBleHBvcnQgb2YgbGluay1zdGF0ZSBhbmQNCiAgIFRFIGluZm9ybWF0aW9uIGFzIGRlc2NyaWJl ZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVzIGEgcmlzayB0bw0KICAgY29uZmlkZW50aWFs aXR5IG9mIG1pc3Npb24tY3JpdGljYWwgb3IgY29tbWVyY2lhbGx5IHNlbnNpdGl2ZQ0KICAgaW5m b3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsuICBCR1AgcGVlcmluZ3MgYXJlIG5vdCBhdXRvbWF0 aWMgYW5kDQogICByZXF1aXJlIGNvbmZpZ3VyYXRpb247IHRodXMsIGl0IGlzIHRoZSByZXNwb25z aWJpbGl0eSBvZiB0aGUgbmV0d29yaw0KICAgb3BlcmF0b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0 cnVzdGVkIGNvbnN1bWVycyBhcmUgY29uZmlndXJlZCB0bw0KICAgcmVjZWl2ZSBzdWNoIGluZm9y bWF0aW9uLg0KDQoNCg0KRnJvbTogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgW21haWx0bzpnaW5z YmVyZ0BjaXNjby5jb21dDQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggMToyOSBQTQ0K VG86IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJhc3p1ayc7IGthZHVrQG1pdC5lZHU8bWFpbHRvOmth ZHVrQG1pdC5lZHU+DQpDYzogaWRyQGlldGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBkcmFm dC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsgaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9y Zz47IHluaXIuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+OyBzZWNk aXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbSWRyXSBb c2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0x Mw0KDQpTdWUg4oCTDQoNCklubGluZS4NCg0KRnJvbTogU3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpo LmNvbTxtYWlsdG86c2hhcmVzQG5kemguY29tPj4NClNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwg MjAxOCAxMDowOCBBTQ0KVG86IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpIDxnaW5zYmVyZ0BjaXNj by5jb208bWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbT4+OyAnUm9iZXJ0IFJhc3p1aycgPHJvYmVy dEByYXN6dWsubmV0PG1haWx0bzpyb2JlcnRAcmFzenVrLm5ldD4+OyBrYWR1a0BtaXQuZWR1PG1h aWx0bzprYWR1a0BtaXQuZWR1Pg0KQ2M6IGlkckBpZXRmLm9yZzxtYWlsdG86aWRyQGlldGYub3Jn PjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0 Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZz47IGlldGZAaWV0Zi5vcmc8bWFpbHRvOmlldGZA aWV0Zi5vcmc+OyB5bmlyLmlldGZAZ21haWwuY29tPG1haWx0bzp5bmlyLmlldGZAZ21haWwuY29t Pjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTog W0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1w bS1iZ3AtMTMNCg0KTGVzOg0KDQpJIGFwb2xvZ2l6ZSBpZiBteSBlbWFpbCBtZXNzYWdlIHdhcyB1 bmNsZWFyLiAgIFdlIGJvdGggYWdyZWUgdGhhdCB5b3VyIGRyYWZ0IGlzIG5vdCByZWxhdGVkIHRv IFNSIHJvdXRpbmcuICAgU1Igcm91dGluZyBpcyByZWxhdGVkIHRvIEJHUC1MUyBhcyBhIHRyYW5z cG9ydCBtZWNoYW5pc20gZm9yIGluZm9ybWF0aW9uLg0KDQpJIGFncmVlIHRoYXQgUkZDNzc1MiBo YWQgdHJhZmZpYyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbi4gIEhvd2V2ZXIsIHRoYXQgdHJhZmZp YyBlbmdpbmVlcmluZyBpbmZvcm1hdGlvbiBhbG1vc3QgZ290IHRoYXQgZHJhZnQgcmVqZWN0ZWQg YnkgdGhlIElFU0cgYXQgdGhlIHRpbWUuICBBcyBteSBwcmV2aW91cyBtZXNzYWdlIHRvIHRoaXMg bGlzdCBpbmRpY2F0ZWQsIHdlIGdvdCBhZ3JlZW1lbnQgb24gUkZDNzc1MiBiYXNlZCBvbiBsaW1p dGluZyB0aGF0IGluZm9ybWF0aW9uIGFuZCB0aGUgYXNzdXJhbmNlIHRoYXQgQkdQLUxTIG5vZGVz IHdlcmUgZGVwbG95ZWQgb24gYSBzZXBhcmF0ZSBzZXQgb2Ygbm9kZXMuICBFeHBhbmRpbmcgdGhl IHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24gYmV5b25kIFJGQzc3NTIgcmUtb3BlbnMg YWxsIHRoZSBzZWN1cml0eSBpc3N1ZXMgYW5kIHF1ZXN0aW9ucyBmcm9tIFJGQzc3NTLigJlzIG9y aWdpbmFsIHJldmlldy4NCg0KW0xlczpdIFNvIGZhciwgeW91IGFyZSB0aGUgb25seSBwZXJzb24g d2hvIHNlZW1zIGF3YXJlIG9mIHRoaXMuIEkgYW0gbm90IHNheWluZyB5b3UgYXJlIHdyb25nIOKA kyBJIGFtIGp1c3Qgc2F5aW5nIG15IHByaXZhdGUgYXR0ZW1wdHMgdG8gZ2V0IG1vcmUgY29udGV4 dCBmb3IgdGhpcyBoYXZlIHRodXMgZmFyIGZhaWxlZCDigJMgYW5kIHlvdSBoYXZlIG5vdCBwcm92 aWRlZCBhbnkgZG9jdW1lbnRhdGlvbiBvZiB0aGlzLg0KSWYgeW91ciBzdGF0ZW1lbnQgaXMgYWNj dXJhdGUgKGFnYWluIOKAkyBub3Qgc2F5aW5nIGl0IGlzbuKAmXQpIOKAkyBpdCBhbHNvIHNlZW1z IG1vc3QgdW5mb3J0dW5hdGUgKGFuZCBJIGFtIGJlaW5nIOKAnGtpbmTigJ0gaGVyZSkgdGhhdCB0 aGlzIHdhcyBub3QgbWVudGlvbmVkIGluIHRoZSBjb3Vyc2Ugb2YgdGhlIGZvdXIgeWVhcnMgdGhh dCBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaGFzIHRha2VuIHRvIHByb2dyZXNzIHRvIHRoaXMg cG9pbnQuDQoNClRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSByZXZpZXdlciBpcyBhc2tpbmcgdGhl c2Ugc2VjdXJpdHkgcXVlc3Rpb25zLiAgVGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlIGRvZXMgaGF2 ZSBwZW9wbGUgd2l0aCBib3RoIHJvdXRpbmcgYW5kIHNlY3VyaXR5IGV4cGVydHMuDQoNClNSIHJv dXRpbmcgaXMgYWxzbyBleHBhbmRpbmcgdGhlIGluZm9ybWF0aW9uIHBhc3QgdGhlIG9yaWdpbmFs IFJGQzc3NTIuICAgVGhlIGV4cGFuc2lvbnMgcmVxdWVzdGVkIGJ5IFNSIHJvdXRpbmcgYWxzbyBy ZS1vcGVuIHRob3NlIG9yaWdpbmFsIHNlY3VyaXR5IHF1ZXN0aW9ucyBhbmQgaXNzdWVzLg0KDQpb TGVzOl0gSSBkbyBub3Qga25vdyB3aHkgeW91IG1lbnRpb24gU1IgaGVyZSBzaW5jZSB3ZSBib3Ro IGFncmVlIHRoaXMgZHJhZnQgaXMgbm90IFNSIHJlbGF0ZWQuDQoNCk9uZSB3YXkgdG8gYW5zd2Vy IHRoZXNlIHF1ZXN0aW9ucyBpcyB0byBwcm92aWRlIGEgIFJGQzc3NTJiaXMgd2l0aCBhbiB1cGRh dGVkIHNlY3VyaXR5IHNlY3Rpb24uICBJZiB5b3UgYWdyZWUgd2l0aCB0aGlzIGFwcHJvYWNoLCBJ IHN1Z2dlc3Qgc2ltcGx5IHJlZmVycmluZyB0byBhIFJGQzc3NTJiaXMgdGhhdCBpbiB5b3VyIHNl Y3VyaXR5IHNlY3Rpb24uICAgSWYgeW91IGRpc2FncmVlIHRoYXQgYW4gdXBkYXRlIHRvIHRoZSBS RkM3NzUyYmlzIGlzIHJlcXVpcmVkLCB3ZSBjYW4gc3RhcnQgYSB0aHJlYWQgb24gdGhhdCBwb2lu dC4NCg0KW0xlczpdIFRoZXJlIGlzIG5vIFJGQzc3NTJiaXMgZHJhZnQuIOKYuiAgU28geW91IGFy ZSBhc2tpbmcgbWUgdG8gcmVmZXJlbmNlIGEgbm9uLWV4aXN0ZW50IGRvY3VtZW50Pw0KDQpJIHVu ZGVyc3RhbmQgdGhhdCB5b3UgKGF0IGxlYXN0KSB3b3VsZCBsaWtlIHRvIGhhdmUgb25lIOKAkyB3 aGljaCBpcyBwZXJmZWN0bHkgbGVnaXRpbWF0ZSDigJMgdGhvdWdoIHlvdSBzaG91bGQgZ28gdGhy b3VnaCB0aGUgbm9ybWFsIFdHIHByb2Nlc3MgdG8gdGFrZSB0aGlzIHdvcmsgb24g4oCTIGNvcnJl Y3Q/DQoNCkJ1dCB0aGlzIGRvZGdlcyB0aGUgcXVlc3Rpb24gYXMgdG8gd2hldGhlciBkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AgaGFzIGEgZGVwZW5kZW5jeSBvbiBlbmhhbmNlZCBzZWN1cml0eS4g U28gZmFyLCB5b3UgYXJlIHRoZSBvbmx5IHBlcnNvbiBtYWtpbmcgdGhpcyBjbGFpbSDigJMgYW5k IHNldmVyYWwgZm9sa3MgKGluY2x1ZGluZyBteXNlbGYpIGhhdmUgZXhwcmVzc2VkIGEgZGlmZmVy ZW50IFBPVi4gSSB0aGluayB5b3UgYXQgbGVhc3QgaGF2ZSB0byBwcm92aWRlIGEganVzdGlmaWNh dGlvbiBmb3IgdGhpcyBkZXBlbmRlbmN5IGJlZm9yZSB3ZSBpbnRyb2R1Y2UgaXQgYW5kIGdldCBz b21lIHN1cHBvcnQgZm9yIHlvdXIgcG9zaXRpb24g4oCTIHNpbmNlIHRoaXMgd2lsbCBtZWFuIGRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncCB3b3VsZCBiZSBzdHVjayBpbiBNSVNTUkVGIHN0YXRlIHVu dGlsIHRoaXMgY3VycmVudGx5IG5vbi1leGlzdGVudCBkcmFmdCBiZWNvbWVzIGFuIFJGQy4NCg0K ICAgTGVzDQoNCkRpZCB0aGlzIG1lc3NhZ2UgY2xhcmlmeSBteSBlYXJsaWVyIGJyaWVmIG1lc3Nh Z2U/ICBEbyB5b3Ugd2FudCB0byBjb250aW51ZSB0byBkaXNjdXNzIHRoZSBuZWVkIGZvciBSRkM3 NzUyYmlzPw0KDQpDaGVlcmlseSwgU3VlDQoNCkZyb206IElkciBbbWFpbHRvOmlkci1ib3VuY2Vz QGlldGYub3JnXSBPbiBCZWhhbGYgT2YgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykNClNlbnQ6IEZy aWRheSwgT2N0b2JlciAxOSwgMjAxOCAxMDo1OCBBTQ0KVG86IFN1c2FuIEhhcmVzOyAnUm9iZXJ0 IFJhc3p1ayc7IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogaWRyQGll dGYub3JnPG1haWx0bzppZHJAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxs QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPjsg aWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IHluaXIuaWV0ZkBnbWFpbC5jb208 bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2Rp ckBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2 aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpTdWUg4oCTDQoNCk9uZSBvZiB1 cyBpcyBjb25mdXNlZC4g4pi6DQoNCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncCBpcyBub3QgcmVs YXRlZCB0byBTZWdtZW50IFJvdXRpbmcuIFRob3NlIHdvcmRzIGRvIG5vdCBhcHBlYXIgYW55d2hl cmUgaW4gdGhlIGRvY3VtZW50LiBOb3IgaXMgdGhlcmUgYSByZWZlcmVuY2UgdG8gYW55IFNSIGRv Y3VtZW50Lg0KDQpGdXJ0aGVyLCBSRkMgNzc1MiBpbmNsdWRlcyB0cmFmZmljIGVuZ2luZWVyaW5n IGluZm9ybWF0aW9uIChzZWUgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3NTIjc2Vj dGlvbi0zLjMuMjxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzc1Mi0yM3NlY3Rpb24tMkQzLjMuMiZkPUR3 TUZhUSZjPUhBa1l1aDYzcnN1aHI2U2NiZmgwVWpCWGVNSy1uZGIzdm9EVFhjV3pvQ0kmcj1DUkIy dEppUWVQazBjVC1oNUxHaEVXSC1zX3hYWHVwM0h6dkJTTVJqNVZFJm09V0JPYTI0TC1TUFNQYzg5 YUwwQjhKZ25iZElTbUN5Z0w1V0RxVDE2NDJaZyZzPVJYeDdoMkVQX1RVbU5GeGRTazZfV2dRMjdK c2RpdkEyMmJxTzN4eGo2M0UmZT0+ICkgc28gdGhlIHN1Z2dlc3Rpb24gdGhhdCB3ZSBhcmUgaW50 cm9kdWNpbmcgYSBuZXcgYXR0YWNrIHZlY3RvciBieSBkZWZpbmluZyBzb21lIGFkZGl0aW9uYWwo c2ljKSBURSBjb2RlcG9pbnRzIGRvZXMgbm90IG1ha2Ugc2Vuc2UgdG8gbWUuDQoNCkkgYXBwcmVj aWF0ZSB0aGF0IHRoZXJlIGFyZSBvdGhlciBkcmFmdHMgb24geW91ciBtaW5kIHdoaWNoIGFyZSBT UiByZWxhdGVkIOKAkyBidXQgdGhpcyBpcyBub3Qgb25lIG9mIHRoZW0uDQoNCkNvdWxkIHlvdSBw bGVhc2UgdXBkYXRlIHlvdXIgcmVzcG9uc2Ugd2l0aCB0aGVzZSBwb2ludHMgaW4gbWluZD8NCg0K VGhhbnguDQoNCiAgIExlcw0KDQoNCkZyb206IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb208 bWFpbHRvOnNoYXJlc0BuZHpoLmNvbT4+DQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTgg NjoyNiBBTQ0KVG86ICdSb2JlcnQgUmFzenVrJyA8cm9iZXJ0QHJhc3p1ay5uZXQ8bWFpbHRvOnJv YmVydEByYXN6dWsubmV0Pj47IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpD YzogaWV0ZkBpZXRmLm9yZzxtYWlsdG86aWV0ZkBpZXRmLm9yZz47IHNlY2RpckBpZXRmLm9yZzxt YWlsdG86c2VjZGlyQGlldGYub3JnPjsgeW5pci5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5p ZXRmQGdtYWlsLmNvbT47IGlkckBpZXRmLm9yZzxtYWlsdG86aWRyQGlldGYub3JnPjsgZHJhZnQt aWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUt cG0tYmdwLmFsbEBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIg ZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpSb2JlcnQsIEJl bmphbWluLCBhbmQgWW9hdjoNCg0KSSBhZ3JlZSB0aGVzZSBjb250ZXh0IG9mIHRoZXNlIGlzc3Vl cyBhcmUgbm90IHNwZWNpZmljIHRvIHRoaXMgZHJhZnQuICBIb3dldmVyLCB0cmFmZmljIGVuZ2lu ZWVyaW5nIGluZm9ybWF0aW9uIGRvZXMgcHJvdmlkZSBpbmZvcm1hdGlvbiB3aGljaCBpcyBhIHRl bXB0aW5nIGF0dGFjayB2ZWN0b3IuDQoNClRoZSBvcmlnaW5hbCBSRkM3NzUyIGRlc2NyaWJlZCBh IGRpZmZlcmVudCBwdXJwb3NlIHdpdGggcmVzdHJpY3RlZCB1c2FnZSB0aGF0IFNSIHJvdXRpbmcg ZXh0ZW5zaW9ucyBkbyBub3QgYWRoZXJlIHRvIGluIEJHUC4gICBTaW5jZSBTcHJpbmcgV0cgc2hv d3MgdGhhdCBvcGVyYXRvcnMgYXJlIGludGVyZXN0ZWQgaW4gdGhlIGV4dGVuZGVkIHVzZSwgaXQg bWF5IGJlIHRpbWUgdG8gZXhhbWluZSB0aGUgUkZDNzc1MmJpcyBvciBvdGhlciBzb2x1dGlvbnMg dGhhdCB0YWtlcyBjYXJlIG9mIHRoZXNlIHNlY3VyaXR5IGlzc3Vlcy4NCg0KTXkgam9iIGFzIGEg c2hlcGhlcmQgaXMgdG8gcG9pbnQgb3V0IHRoZXNlIGlzc3VlcyBwZXIgZHJhZnQgZm9yIHRoZSBJ RVNHIGFuZCBzZWN1cml0eSBkaXJlY3RvcmF0ZSBpbiBvcmRlciB0byBvYnRhaW4gdGhlIGNvcnJl Y3QgZmVlZGJhY2suICBBcyBhIFdHIGNoYWlyLCBJIGhhdmUgcG9pbnRlZCBvdXQgdGhlc2UgaXNz dWVzLCBidXQgdGhlIFdHIGhhcyB0aGVzZSBkcmFmdHMgb24gV0cgTEMgd2l0aG91dCB0aGUgZXh0 cmEgc2VjdXJpdHkuDQpXaXRob3V0IFJGQzc3NTJiaXMgd2l0aCBhZGRpdGlvbmFsIHNlY3VyaXR5 IGluIHRoZSBiYXNlIGRvY3VtZW50LCBJIGFtIHdvcmtpbmcgYXMgYSBzaGVwaGVyZCBtYWtlIHRo ZSBtYW5hZ2VhYmlsaXR5IGFuZCBzZWN1cml0eSBzZWN0aW9ucyBhcyBjbGVhciBhcyBwb3NzaWJs ZS4NCg0KSWYgdGhlIGZlZWRiYWNrIGZyb20gdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlIHJldmll dyBvciB0aGUgSUVTRyBpcyB0aGF0IHdlIG5lZWQgdG8gb2J0YWluIGEgc29sdXRpb24gZm9yIFJG Qzc3NTJiaXMgdGhhdCBkZXNjcmliZXMgYW5kIGhhbmRsZXMgdGhlc2Ugc2VjdXJpdHkgaXNzdWVz LCBJIHdpbGwgYmUgZ2xhZCB0byBzdXBwb3J0IGZhc3QtdHJhY2tpbmcgdGhpcyBpc3N1ZSB3aXRo aW4gdGhlIFdHLg0KDQpJZiBhbiBvZmZsaW5lIGRpc2N1c3Npb24gd2l0aCBCZW5qYW1pbiwgWW9h diwgdGhlIElEUiBjaGFpcnMsIGFuZCBBbHZhcm8gd291bGQgc3BlZWQgdGhpcyBhbG9uZywgSSBj YW4gc2V0IHRoaXMgdXAgZWFybHkgbmV4dCB3ZWVrLiAgSXQgd291bGQgYmUgaGVscGZ1bCB0byBo YXZlIHRoaXMgb2ZmbGluZSBkaXNjdXNzaW9uIGJlZm9yZSB0aGUgSURSIGludGVyaW0gc2Vzc2lv biBvbiAxMC8yNi4NCg0KVGhhbmsgeW91IGZvciBhbGwgeW91ciBjb21tZW50cy4NCg0KU3VlDQoN Cg0KRnJvbTogSWRyIFttYWlsdG86aWRyLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBS b2JlcnQgUmFzenVrDQpTZW50OiBGcmlkYXksIE9jdG9iZXIgMTksIDIwMTggMjo1MiBBTQ0KVG86 IGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+DQpDYzogaWV0ZkBpZXRmLm9yZzxt YWlsdG86aWV0ZkBpZXRmLm9yZz47IHNlY2RpckBpZXRmLm9yZzxtYWlsdG86c2VjZGlyQGlldGYu b3JnPjsgeW5pci5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbT47IGlk ckBpZXRmLm9yZzxtYWlsdG86aWRyQGlldGYub3JnPjsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdw LmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9y Zz4NClN1YmplY3Q6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRy YWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMw0KDQpIZWxsbyBCZW5qYW1pbiwNCg0KTm90IHN1cmUg aWYgeW91IGhhdmUgc3BvdHRlZCBzaW1pbGFyIGNvbW1lbnQgbWFkZSB0byBJRFIgcmVnYXJkaW5n IHRoaXMgdG9waWMsIGJ1dCB5b3VyIGNvbW1lbnQgc2VlbXMgdG8gaW5kaWNhdGUgdGhhdCBoZXJl IHdlIGFyZSBhYm91dCB0byBkZWZpbmUgd2F5cyB0byBjYXJyeSBuaWNlbHkgc2NvcGVkIElHUCBp bmZvcm1hdGlvbiBpbnRvIEJHUC4gV2VsbCB0aGF0IGhhcyBhbHJlYWR5IGhhcHBlbmVkIHdpdGgg UkZDNzc1MiBhbmQgeW91ciBjb21tZW50IG9yIGZvciB0aGF0IG1hdHRlciBZb2F2J3MgcmVtYXJr cyBhcmUgaW5kZWVkIHNwb3Qgb24gYnV0IHRvIHRoZSBzZWN1cml0eSBkaXNjdXNzaW9uIG9uIFJG Qzc3NTIgYW5kIElNTyBub3QgYW55IGZvbGxvdyB1cCBleHRlbnNpb25zIG9mIGl0Lg0KDQpTdXJl IC0gYXMgb2JzZXJ2ZWQgYnkgU3VlIC0gb25lIG1heSBhcmd1ZSB0aGF0IHByb3ZpZGluZyBtb3Jl IGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3JrIHRvIHRoZSBwb3RlbnRpYWwgYXR0YWNrZXIg bWFrZXMgdGhlIG5ldHdvcmsgd2Vha2VyLCBidXQgdGhlIGN1cmUgZm9yIHRoYXQgaXMgdG8gcHJl dmVudCB0aGUgbGVha3MgYW5kIHJlZHVjZSBwcm9iYWJpbGl0eSBvZiBpbnRlcmNlcHRpbmcgbmV3 IGluZm9ybWF0aW9uIGJ5IHVuYXV0aG9yaXplZCBwYXJ0aWVzLg0KDQpCR1AtTFMgaXMgYWxyZWFk eSBkZWZpbmVkIGluIGEgbmV3IFNBRkkgd2hhdCBieSBpdHNlbGYgZG9lcyBwcm92aWRlIG5pY2Ug bGV2ZWwgb2YgaXNvbGF0aW9uLiBSRkM3NzUyIGlzIHByZXR0eSBjbGVhciBvbiB0aGF0IHRvbyBh bmQgc2F5czoNCg0KIkJHUCBwZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQgcmVxdWlyZSBj b25maWd1cmF0aW9uOyB0aHVzLCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdv cmsgb3BlcmF0b3IgdG8gZW5zdXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29u ZmlndXJlZCB0byByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uIg0KDQpJZiBzb21lb25lIHdvdWxk IGJlIHN0aWxsIGNvbmNlcm5lZCBhYm91dCBjb25maWd1cmF0aW9uIG1pc3Rha2VzIGFuZCBuZWdv dGlhdGluZyBTQUZJIDcxIG9yIDcyIHRvIHRob3NlIHdobyBzaG91bGQgbm90IGdldCB0aGlzIGRh dGEgSSByZWNvbW1lbmQgd2UgcmVpc3N1ZSB0aGUgUkZDNzc1MiBhcyAtYmlzIHZlcnNpb24gYW5k IHJlc3RyaWN0IHRoZSBzY29wZSBvZiB0aGUgZGlzdHJpYnV0aW9uIGV2ZW4gZnVydGhlciBieSBt YW5kYXRpbmcgZGVmYXVsdCB1c2Ugb2YgTk8tRVhQT1JUIGNvbW11bml0eSB3aXRoIGFiaWxpdHkg dG8gb3ZlcndyaXRlIGl0IGZvciB0aGUgc2VsZWN0aXZlIGVCR1AgcGVlcnMuIE9yIHBlcmhhcHMg d2UgY291bGQgcHJvZ3Jlc3MgSmltJ3MgT25lIEFkbWluaXN0cmF0aXZlIERvbWFpbiBkcmFmdCAo ZHJhZnQtdXR0YXJvLWlkci1vYWQtMDEpLg0KDQpJbiBlaXRoZXIgY2FzZSB3aGlsZSBib3RoIG9m IHlvdXIgY29tbWVudHMgYXJlIGdyZWF0IHRoZXkgc2VlbXMgYSBiaXQgbGF0ZSBpbiB0aGUgZ2Ft ZSBoZXJlIG9yIGF0IGxlYXN0IHRhcmdldGluZyB3cm9uZyBkb2N1bWVudC4NCg0KS2luZCByZWdh cmRzLA0KUm9iZXJ0Lg0KDQoNCk9uIEZyaSwgT2N0IDE5LCAyMDE4IGF0IDI6MjcgQU0gQmVuamFt aW4gS2FkdWsgPGthZHVrQG1pdC5lZHU8bWFpbHRvOmthZHVrQG1pdC5lZHU+PiB3cm90ZToNCk9u IFRodSwgT2N0IDE4LCAyMDE4IGF0IDA2OjAwOjEzUE0gKzAwMDAsIExlcyBHaW5zYmVyZyAoZ2lu c2JlcmcpIHdyb3RlOg0KPiBZb2F2IOKAkw0KPg0KPiBJbiByZWdhcmRzIHRvIHRoZSByaXNrcyBh c3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0aW9uIGNvdmVy ZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1AgZHJhZnRzOg0K Pg0KPiBGcm9tIFJGQzc4MTANCj4NCj4g4oCcVGhlIHN1Yi1UTFZzIGludHJvZHVjZWQgaW4gdGhp cyBkb2N1bWVudCBhbGxvdyBhbiBvcGVyYXRvciB0bw0KPiAgICBhZHZlcnRpc2Ugc3RhdGUgaW5m b3JtYXRpb24gb2YgbGlua3MgKGJhbmR3aWR0aCwgZGVsYXkpIHRoYXQgY291bGQgYmUNCj4gICAg c2Vuc2l0aXZlIGFuZCB0aGF0IGFuIG9wZXJhdG9yIG1heSBub3Qgd2FudCB0byBkaXNjbG9zZS7i gJ0NCj4NCj4gSW4gcmVnYXJkcyB0byB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoIHNlbmRpbmcg aW5mb3JtYXRpb24gdmlhIEJHUC1MUyB3ZSBoYXZlIGEgbnVtYmVyIG9mIHN0YXRlbWVudHMgaW4g UkZDIDc3NTIg4oCTIG1vc3QgcmVsZXZhbnQgaXM6DQo+DQo+IOKAnEFkZGl0aW9uYWxseSwgaXQg bWF5IGJlIGNvbnNpZGVyZWQgdGhhdCB0aGUgZXhwb3J0IG9mIGxpbmstc3RhdGUgYW5kDQo+ICAg IFRFIGluZm9ybWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVz IGEgcmlzayB0bw0KPiAgICBjb25maWRlbnRpYWxpdHkgb2YgbWlzc2lvbi1jcml0aWNhbCBvciBj b21tZXJjaWFsbHkgc2Vuc2l0aXZlDQo+ICAgIGluZm9ybWF0aW9uIGFib3V0IHRoZSBuZXR3b3Jr LuKAnQ0KPg0KPiBTbyBsb25nIGFzIHRoZXJlIGFyZSByZWZlcmVuY2VzIHRvIGJvdGggdGhlIElH UCBSRkNzIGFuZCBSRkMgNzc1MiBJIGFtIHRoZXJlZm9yZSBoYXJkIHByZXNzZWQgdG8gdW5kZXJz dGFuZCB3aGF0IGVsc2UgY291bGQgYmUgdXNlZnVsbHkgc2FpZC4NCj4gQ2VydGFpbmx5IHRoZSBy aXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIGFyZSBu b3QgYWx0ZXJlZCBieSBhZGRpbmcgc29tZSBuZXcgVExWcyDigJMgYW5kIHNpbmNlIHRoZSBJR1Ag UkZDcyBoYXZlIGFscmVhZHkgY292ZXJlZCByaXNrcyBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNp ZmljIGNsYXNzIG9mIGluZm9ybWF0aW9uIChub3Qgc2ltcGx5IHRoZSByaXNrcyBhc3NvY2lhdGVk IHdpdGggdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20pIHlvdSBhcmUgZ29pbmcgdG8gaGF2ZSB0byBw cm92aWRlIG1vcmUgc3BlY2lmaWNzIG9uIHdoYXQgY2FuIG1lYW5pbmdmdWxseSBiZSBzYWlkIHRo YXQgaXMgbm90IGFscmVhZHkgY292ZXJlZCBpbiB0aGUgcmVmZXJlbmNlcy4NCg0KTXkgYXBvbG9n aWVzIGZvciBqdW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVDIHRoZSBJR1AgUkZDcyBo YXZlDQpjb3ZlcmVkIHRoZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYSBzcGVjaWZpYyBjbGFzcyBv ZiBpbmZvcm1hdGlvbiwgKnVuZGVyDQp0aGUgYXNzdW1wdGlvbiB0aGF0IHRoZSB0cmFuc3BvcnQg bWVjaGFuaXNtIGlzIHdpdGhpbiBhIHNpbmdsZSBBUyBhbmQNCmFkbWluaXN0cmF0aXZlIGRvbWFp biouICBZb2F2IGlzIHBvaW50aW5nIG91dCB0aGF0IHRoZSByaXNrcyBmb3IgdGhhdA0KaW5mb3Jt YXRpb24gbWF5IGNoYW5nZSB3aGVuIHRoZSBkaXN0cmlidXRpb24gaXMgb3ZlciBhIGJyb2FkZXIg ZG9tYWluIHRoYW4NCnRoZSBvbmUgZm9yIHdoaWNoIHRoZSBwcmV2aW91cyBhbmFseXNpcyB3YXMg cGVyZm9ybWVkLg0KDQotQmVuDQo= --_000_BN7PR05MB4354891AD79FD0F53777797DC7F90BN7PR05MB4354namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglw YW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmgyDQoJe21zby1zdHlsZS1wcmlvcml0eTo5Ow0K CW1zby1zdHlsZS1saW5rOiJIZWFkaW5nIDIgQ2hhciI7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjE4LjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7 fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw cmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZv cm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5IZWFk aW5nMkNoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhlYWRpbmcgMiBDaGFyIjsNCgltc28tc3R5bGUt cHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyAyIjsNCglmb250LXdlaWdodDpi b2xkO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwg UHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUt bGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0K cC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUt bmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0 OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxT dHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyNA0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0 OTdEO30NCnNwYW4uRW1haWxTdHlsZTI1DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjYNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyNw0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTI4DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYi IC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl bGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0K PC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i RU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5IaSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkNvbW1lbnRz IGlubGluZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PllvdXJzIElycmVzcGVjdGl2ZWx5LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Sm9objxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJs dWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5G cm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gSWRyICZsdDtpZHItYm91bmNlc0BpZXRm Lm9yZyZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+U3VzYW4gSGFyZXM8YnI+DQo8Yj5TZW50Ojwv Yj4gRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDY6MzIgUE08YnI+DQo8Yj5Ubzo8L2I+ICdMZXMg R2luc2JlcmcgKGdpbnNiZXJnKScgJmx0O2dpbnNiZXJnQGNpc2NvLmNvbSZndDs7ICdSb2JlcnQg UmFzenVrJyAmbHQ7cm9iZXJ0QHJhc3p1ay5uZXQmZ3Q7OyBrYWR1a0BtaXQuZWR1PGJyPg0KPGI+ Q2M6PC9iPiB5bmlyLmlldGZAZ21haWwuY29tOyBpZHJAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7 IGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc7IHNlY2RpckBpZXRmLm9yZzxi cj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmll dyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+TGVz OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBwb2xpdGVseSBh c2tlZCBmb3Igdmlld3BvaW50IG9uIFJGQzc3NTLigJlzIHNlY3VyaXR5IHNpbmNlIHlvdXIgZHJh ZnQgZGVwZW5kcyBvbiBSRkM3NzUyLiAmbmJzcDtZb3UgaGF2ZSBpbXBvbGl0ZWx5IGFuZCBoYXJz aGx5IHJlZnVzZWQgdG8gY29tbWVudCBvbiB0aGVzZSBwb2ludHMuJm5ic3A7DQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgYW0gZm9jdXNlZCBvbiBmaW5kaW5n IGEgcmVzb2x1dGlvbiB0byB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGVzIGNvbW1lbnRzIG9uIHRo aXMgZHJhZnQgb24gdGhpcyB0aHJlYWQuICZuYnNwOyZuYnNwO09uZSByZXNvbHV0aW9uIHdhcyB0 byBzdWdnZXN0IGEgZ2VuZXJhbCByZXNvbHV0aW9uDQogYnkgcmV2aXNpbmcgdGhlIFJGQzc3NTIg ZHJhZnQuJm5ic3A7ICZuYnNwO0kgaGF2ZSBzcGVudCB0aW1lIHRvZGF5IHByb3ZpZGluZyBiYWNr Z3JvdW5kIGFuZCByZWFzb25zIHdoeSB0aGlzIG1pZ2h0IGJlIGEgZ29vZCByZXNvbHV0aW9uLiAm bmJzcDtJIHNlZSBmcm9tIHlvdXIgY29tbWVudHMgdGhhdCB5b3UgYXJlIHJlamVjdGluZyB0aGlz IHBvdGVudGlhbCByZXNvbHV0aW9uLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPltKRF0mbmJzcDsgV2hhdCBwYXJ0IG9mIOKA nHRoaXMgZHJhZnQgaGFzIG5vdGhpbmcgdG8gZG8gd2l0aCBzZWdtZW50IHJvdXRpbmfigJ0gZG8g eW91IG5vdCB1bmRlcnN0YW5k4oCdPzwvc3Bhbj48L2k+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPlByb3Bvc2UgYSByZXNvbHV0aW9uIHRvIHRoZSBzZWNkaXIgY29tbWVudHMuJm5ic3A7ICZu YnNwOyZuYnNwO1BsZWFzZSBub3RlIGFzIHlvdXIgc2hlcGhlcmQgYW5kIFdHIGNoYWlyLCBzdGF0 aW5nICZuYnNwO+KAnHNlY3VyaXR5IGRpcmVjdG9yYXRlIGRvZXMgbm90IHVuZGVyc3RhbmQgQkdQ 4oCdIGlzIG5vdCBhIHJlc29sdXRpb24uJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPltKRF0mbmJzcDsgRnJvbSB3aG9t IGRpZCB0aGF0IGRpcmVjdCBxdW90ZSBjb21lPyZuYnNwOyBJIGRvbuKAmXQgcmVjYWxsIHNlZWlu ZyBpdCBvbiB0aGUgZW1haWwgdGhyZWFkLjwvc3Bhbj48L2k+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+SU1ITyBhcyBzaGVwaGVyZCBmb3IgeW91ciBkb2N1bWVudCBZb2F2IGhhcyBhIHZh bGlkIHBvaW50IHRoYXQgb24gdmFndWVuZXNzIG9mIFJGQzc3NTIgYW5kIHRoZSBhZGRpdGlvbiBv ZiBuZXcgaW5mb3JtYXRpb24uJm5ic3A7ICZuYnNwO1BsZWFzZSBjb250aW51ZSB0byB3b3JrIHdp dGggWW9hdiwNCiBCZW5qYW1pbiBhbmQgdGhlIHNlY2RpciB0byByZXNvbHZlIHRoZWlyIGNvbmNl cm5zIHNpbmNlIG15IHJlc29sdXRpb24gaGFzIGJlZW4gcmVqZWN0ZWQgYnkgeW91LiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5bSkRdJm5ic3A7IEkganVzdCByZS1yZWFkIHRoZSBlbnRpcmUgZW1haWwgdGhyZWFkIG9u IHRoaXMgZHJhZnQgYW5kIGl0IGFwcGVhcnMgdG8gbWUgdGhhdCB0aGF0IHRoZSBhYm92ZSBpcyBl eGFjdGx5IHdoYXQgTGVzIHdhcyBkb2luZyBhbmQgdGhhdCBoZSB3YXMgcXVpdGUNCiBjbG9zZSB0 byBhIHJlc29sdXRpb24gYmVmb3JlIHlvdSBpbmplY3RlZCBSRkMgNzc1MmJpcyBhbmQgc2VnbWVu dCByb3V0aW5nIGludG8gdGhlIGNvbnZlcnNhdGlvbi48L3NwYW4+PC9pPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPlN1ZSBIYXJlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBp biAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9t Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZHIgWzxhIGhyZWY9Im1haWx0bzppZHItYm91 bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJl aGFsZiBPZiA8L2I+TGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8Yj5TZW50OjwvYj4gRnJp ZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDY6MDEgUE08YnI+DQo8Yj5Ubzo8L2I+IFN1c2FuIEhhcmVz OyAnUm9iZXJ0IFJhc3p1ayc7IDxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0Bt aXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmlkckBpZXRmLm9yZyI+ aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNk aXJAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+aWV0ZkBpZXRm Lm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGll dGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8YSBo cmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWlsLmNvbTwvYT48 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZp ZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN1 ZSDigJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBu b3QgcmVpbmZvcmNlIHlvdXIgaW5hcHByb3ByaWF0ZSBpbnNlcnRpb24gb2YgdGhlIGRpc2N1c3Np b24gb2YgcG9zc2libGUgUkZDIDc3NTIgZGVmaWNpZW5jaWVzIGludG8gYSB0aHJlYWQgd2hpY2gg aXMgcmV2aWV3aW5nIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC4NCiBUaGlzIGlzIHdyb25nIOKA kyBwbGVhc2Ugc3RvcCBpdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPllvdSB3YW50IHRvIGRpc2N1c3MgaXNzdWVzIHdpdGggUkZDIDc3NTIg4oCTIHBsZWFzZSBz dGFydCBhIHNlcGFyYXRlIHRocmVhZCDigJMgZGlyZWN0ZWQgYXQgdGhlIFdHIChvZiBjb3Vyc2Up IOKAkyBhbmQgc3RhdGUgeW91ciBwb3NpdGlvbiBhcyBhIFdHIG1lbWJlciBhcyB0byB3aGF0DQog eW91IGZlZWwgbmVlZHMgdG8gYmUgZG9uZS4gVGhlbiBvdGhlcnMgY2FuIGNvbW1lbnQgYW5kIHRo ZSBXRyBjYW4gZGVjaWRlIHdoZXRoZXIgdGhleSBhZ3JlZSB3b3JrIG5lZWRzIHRvIGJlIGRvbmUu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5BbHNvIC0gYW5kIGZv ciB0aGUgdGhpcmQgdGltZSAtIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncCBpcyBOT1QgU1IgcmVs YXRlZCDigJMgcGxlYXNlIGFsc28gc3RvcCBpbnNlcnRpbmcgYSBkaXNjdXNzaW9uIG9mIFNSL0JH UC1MUyBpbnRvIHRoZSByZXZpZXcgb2YgdGhpcyBkcmFmdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPihBcG9sb2dpZXMgZm9yIHRoZSBoYXJzaCB0b25lIOKAkyBi dXQgaXQgaXMgYmVjb21pbmcgaW5jcmVhc2luZ2x5IGZydXN0cmF0aW5nIHRvIHdhdGNoIHRoaXMg dGhyZWFkIGJlaW5nIG1pc2RpcmVjdGVkLik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBMZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGlu IDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4gU3VzYW4gSGFyZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpzaGFyZXNAbmR6aC5jb20i PnNoYXJlc0BuZHpoLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3Rv YmVyIDE5LCAyMDE4IDI6MzIgUE08YnI+DQo8Yj5Ubzo8L2I+IExlcyBHaW5zYmVyZyAoZ2luc2Jl cmcpICZsdDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5naW5zYmVyZ0BjaXNj by5jb208L2E+Jmd0OzsgJ1JvYmVydCBSYXN6dWsnICZsdDs8YSBocmVmPSJtYWlsdG86cm9iZXJ0 QHJhc3p1ay5uZXQiPnJvYmVydEByYXN6dWsubmV0PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86 a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9 Im1haWx0bzppZHJAaWV0Zi5vcmciPmlkckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpk cmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRl LXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86aWV0ZkBpZXRmLm9yZyI+ aWV0ZkBpZXRmLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+ eW5pci5pZXRmQGdtYWlsLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpzZWNkaXJAaWV0Zi5vcmci Pg0Kc2VjZGlyQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0lkcl0gW3Nl Y2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTM8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+TGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+SSB3aWxsIHJlc3BvbmQgdG8gdGhpcyBpbmZvcm1hdGlvbiBwb2ludCBieSBw b2ludCBhZnRlciBJIGhhdmUgcmVzcG9uZGVkIHRvIEtldGFuIHdobyBzZW50IG1lIG1lc3NhZ2Vz IHJlZ2FyZGluZyBoaXMgZHJhZnQgcHJpb3IgdG8geW91cnMuICZuYnNwOyZuYnNwO0hvd2V2ZXIs IEkgd291bGQNCiBsaWtlIHlvdXIgZmVlZGJhY2sgb24gd2hldGhlciB5b3UgYmVsaWV2ZSBSRkM3 NzUyIGhhcyBzZWN1cml0eSB0aGF0IGlzIGVxdWl2YWxlbnQgdG8sIGxlc3MgdGhhbiwgb3IgZ3Jl YXRlciB0aGFuIGEgdHJ1c3RlZCBkb21haW4/DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPlRoZSBzcHJpbmcgcm91dGluZyBhcmNoaXRlY3R1cmUgKFJGQzg0MDIp IGluZGljYXRlcyB0aGF0IGJlIGRlZmF1bHQgU1Igb3BlcmF0ZXMgd2l0aGluIGEgdHJ1c3RlZCBk b21haW4uJm5ic3A7ICZuYnNwO0l0IHNheXMgZnVydGhlcjoNCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+4oCcPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+VHJhZmZpYyBNVVNUIGJlIGZpbHRlcmVkIGF0IHRoZSBkb21haW4gYm91bmRhcmllcy4g VGhlIHVzZSBvZiBiZXN0IHByYWN0aWNlcw0KIHRvIHJlZHVjZSB0aGUgcmlzayBvZiB0YW1wZXJp bmcgd2l0aGluIHRoZSB0cnVzdGVkIGRvbWFpbiBpcyBpbXBvcnRhbnQuJm5ic3A7IFN1Y2ggcHJh Y3RpY2VzIGFyZSBkaXNjdXNzZWQgaW4gWzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM0Mzgx JmFtcDtkPUR3TUZhUSZhbXA7Yz1IQWtZdWg2M3JzdWhyNlNjYmZoMFVqQlhlTUstbmRiM3ZvRFRY Y1d6b0NJJmFtcDtyPUNSQjJ0SmlRZVBrMGNULWg1TEdoRVdILXNfeFhYdXAzSHp2QlNNUmo1VkUm YW1wO209V0JPYTI0TC1TUFNQYzg5YUwwQjhKZ25iZElTbUN5Z0w1V0RxVDE2NDJaZyZhbXA7cz1u U1lXODVsN19yWVdveDRkZ1dKbUlQREd0WDE3d2h1ekdRMEdGZ05zV25VJmFtcDtlPSIgdGl0bGU9 IiZxdW90O0FuYWx5c2lzIG9mIHRoZSBTZWN1cml0eSBvZiBCR1AvTVBMUyBJUCBWaXJ0dWFsIFBy aXZhdGUgTmV0d29ya3MgKFZQTnMpJnF1b3Q7Ij5SRkM0MzgxPC9hPl0NCiBhbmQgYXJlIGFwcGxp Y2FibGUgdG8gYm90aCBTUi1NUExTIGFuZCBTUnY2LuKAnSA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpibGFjayI+SWYgeW91IGJlbGlldmUgdGhhdCBSRkM3NzUyIGRlc2NyaWJlcyBh IHRydXN0ZWQgZG9tYWluIFtwZXIgUkZDNDM4MV0sDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlJGQzc3NjIg ZG9lcyBub3Qgc3RhdGUgdGhhdCBpdCBpcyBhIHRydXN0ZWQgZG9tYWluLg0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJs YWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPklmIHlvdSBiZWxpZXZlIHRoZSBSRkM3NzUyIGhh cyBzdHJvbmdlciBzZWN1cml0eQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj50aGFuIGEgdHJ1c3RlZCBkb21h aW4sIGNhbiB5b3UgbGV0IG1lIGtub3cNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+d2h5IHlvdSB0aGluayBp dCBpcyBzdHJvbmdlciB0aGFuIGEgdHJ1c3RlZCBkb21haW4uJm5ic3A7DQo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Ymxh Y2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+SWYgeW91IGJlbGlldmUgdGhhdCBSRkM3NzUyIGRl c2NyaWJlcyBzZWN1cml0eSB3aGljaA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5pcyBsZXNzIHRoYW4gYSB0 cnVzdGVkIGRvbWFpbiwgcGxlYXNlIGxldCBtZSBob3cgaXQgaXMgbGVzcy4NCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5UaGUgUkZDNzc1MiB0ZXh0IGlzIGJlbG93IGZv ciBlYXNlIG9mIHRoZSBJRFIgYW5kIHNlY2RpciByZWFkZXJzLg0KPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPlRoYW5rIHlvdSBmb3IgcHJvdmlkaW5nIHRoaXMgZmVlZGJh Y2ssDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+U3VlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPi0tLS0tLS0tLS0tLTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5SRkM3NzUyIHNlY3VyaXR5IHNlY3Rpb24gKHNlY3Rp b24gOC4pICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj44LiZu YnNwOyBTZWN1cml0eSBDb25zaWRlcmF0aW9uczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgUHJvY2VkdXJlcyBhbmQgcHJvdG9jb2wgZXh0ZW5zaW9u cyBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQgZG8gbm90PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsm bmJzcDsgYWZmZWN0IHRoZSBCR1Agc2VjdXJpdHkgbW9kZWwuJm5ic3A7IFNlZSB0aGUgU2VjdXJp dHkgQ29uc2lkZXJhdGlvbnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBzZWN0aW9uIG9m IFtSRkM0MjcxXSBmb3IgYSBkaXNjdXNzaW9uIG9mIEJHUCBzZWN1cml0eS4mbmJzcDsgQWxzbyBy ZWZlciB0bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IFtSRkM0MjcyXSBhbmQgW1JGQzY5 NTJdIGZvciBhbmFseXNpcyBvZiBzZWN1cml0eSBpc3N1ZXMgZm9yIEJHUDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsgJm5ic3A7SW4gdGhlIGNvbnRleHQgb2Yg dGhlIEJHUCBwZWVyaW5ncyBhc3NvY2lhdGVkIHdpdGggdGhpcyBkb2N1bWVudCwgYTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7IEJHUCBzcGVha2VyIE1VU1QgTk9UIGFjY2VwdCB1cGRhdGVz IGZyb20gYSBjb25zdW1lciBwZWVyLiZuYnNwOyBUaGF0IGlzLCBhPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4m bmJzcDsmbmJzcDsgcGFydGljaXBhdGluZyBCR1Agc3BlYWtlciBzaG91bGQgYmUgYXdhcmUgb2Yg dGhlIG5hdHVyZSBvZiBpdHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyByZWxhdGlvbnNo aXBzIGZvciBsaW5rLXN0YXRlIHJlbGF0aW9uc2hpcHMgYW5kIHNob3VsZCBwcm90ZWN0IGl0c2Vs ZjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGZyb20gcGVlcnMgc2VuZGluZyB1cGRhdGVz IHRoYXQgZWl0aGVyIHJlcHJlc2VudCBlcnJvbmVvdXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZu YnNwOyBpbmZvcm1hdGlvbiBmZWVkYmFjayBsb29wcyBvciBhcmUgZmFsc2UgaW5wdXQuJm5ic3A7 IFN1Y2ggcHJvdGVjdGlvbiBjYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBiZSBhY2hp ZXZlZCBieSBtYW51YWwgY29uZmlndXJhdGlvbiBvZiBjb25zdW1lciBwZWVycyBhdCB0aGUgQkdQ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgc3BlYWtlci48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsgJm5ic3A7Jm5ic3A7QW4gb3BlcmF0b3IgU0hP VUxEIGVtcGxveSBhIG1lY2hhbmlzbSB0byBwcm90ZWN0IGEgQkdQIHNwZWFrZXI8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IGFnYWluc3QgRERvUyBhdHRhY2tzIGZyb20gY29uc3VtZXJz LiZuYnNwOyBUaGUgcHJpbmNpcGFsIGF0dGFjayBhIGNvbnN1bWVyPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOyZuYnNwOyBtYXkgYXBwbHkgaXMgdG8gYXR0ZW1wdCB0byBzdGFydCBtdWx0aXBsZSBz ZXNzaW9ucyBlaXRoZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHNlcXVlbnRpYWxs eSBvciBzaW11bHRhbmVvdXNseS4mbmJzcDsgUHJvdGVjdGlvbiBjYW4gYmUgYXBwbGllZCBieTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgaW1wb3NpbmcgcmF0ZSBsaW1pdHMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgQWRkaXRp b25hbGx5LCBpdCBtYXkgYmUgY29uc2lkZXJlZCB0aGF0IHRoZSBleHBvcnQgb2YgbGluay1zdGF0 ZSBhbmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IFRFIGluZm9ybWF0aW9uIGFzIGRl c2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0aXR1dGVzIGEgcmlzayB0bzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj4mbmJzcDsmbmJzcDsgY29uZmlkZW50aWFsaXR5IG9mIG1pc3Npb24tY3JpdGljYWwg b3IgY29tbWVyY2lhbGx5IHNlbnNpdGl2ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsg aW5mb3JtYXRpb24gYWJvdXQgdGhlIG5ldHdvcmsuJm5ic3A7IEJHUCBwZWVyaW5ncyBhcmUgbm90 IGF1dG9tYXRpYyBhbmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IHJlcXVpcmUgY29u ZmlndXJhdGlvbjsgdGh1cywgaXQgaXMgdGhlIHJlc3BvbnNpYmlsaXR5IG9mIHRoZSBuZXR3b3Jr PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyBvcGVyYXRvciB0byBlbnN1cmUgdGhhdCBv bmx5IHRydXN0ZWQgY29uc3VtZXJzIGFyZSBjb25maWd1cmVkIHRvPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOyZuYnNwOyByZWNlaXZlIHN1Y2ggaW5mb3JtYXRpb24uPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1 b3Q7LHNhbnMtc2VyaWYiPiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSBbPGEgaHJlZj0ibWFpbHRv OmdpbnNiZXJnQGNpc2NvLmNvbSI+bWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbTwvYT5dDQo8YnI+ DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDE6MjkgUE08YnI+DQo8Yj5U bzo8L2I+IFN1c2FuIEhhcmVzOyAnUm9iZXJ0IFJhc3p1ayc7IDxhIGhyZWY9Im1haWx0bzprYWR1 a0BtaXQuZWR1Ij5rYWR1a0BtaXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFp bHRvOmlkckBpZXRmLm9yZyI+aWRyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0 LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1pZHItdGUtcG0t YmdwLmFsbEBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRm QGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tIj55bmly LmlldGZAZ21haWwuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpz ZWNkaXJAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbSWRyXSBbc2VjZGly XSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5TdWUg4oCTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5JbmxpbmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUg MS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGlu IDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9t Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU3VzYW4gSGFyZXMgJmx0OzxhIGhyZWY9Im1h aWx0bzpzaGFyZXNAbmR6aC5jb20iPnNoYXJlc0BuZHpoLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5T ZW50OjwvYj4gRnJpZGF5LCBPY3RvYmVyIDE5LCAyMDE4IDEwOjA4IEFNPGJyPg0KPGI+VG86PC9i PiBMZXMgR2luc2JlcmcgKGdpbnNiZXJnKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmdpbnNiZXJnQGNp c2NvLmNvbSI+Z2luc2JlcmdAY2lzY28uY29tPC9hPiZndDs7ICdSb2JlcnQgUmFzenVrJyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOnJvYmVydEByYXN6dWsubmV0Ij5yb2JlcnRAcmFzenVrLm5ldDwvYT4m Z3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+PGJy Pg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5vcmc8 L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9y ZyI+DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmlldGZAaWV0Zi5vcmciPmlldGZAaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRv OnluaXIuaWV0ZkBnbWFpbC5jb20iPnluaXIuaWV0ZkBnbWFpbC5jb208L2E+OyA8YSBocmVmPSJt YWlsdG86c2VjZGlyQGlldGYub3JnIj4NCnNlY2RpckBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJq ZWN0OjwvYj4gUkU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQt aWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkxlczo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgYXBvbG9naXplIGlmIG15IGVtYWls IG1lc3NhZ2Ugd2FzIHVuY2xlYXIuICZuYnNwOyZuYnNwO1dlIGJvdGggYWdyZWUgdGhhdCB5b3Vy IGRyYWZ0IGlzIG5vdCByZWxhdGVkIHRvIFNSIHJvdXRpbmcuJm5ic3A7Jm5ic3A7IFNSIHJvdXRp bmcgaXMgcmVsYXRlZCB0byBCR1AtTFMgYXMgYSB0cmFuc3BvcnQgbWVjaGFuaXNtDQogZm9yIGlu Zm9ybWF0aW9uLiAmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkkgYWdyZWUgdGhhdCBSRkM3NzUyIGhhZCB0cmFmZmljIGVuZ2luZWVyaW5nIGluZm9ybWF0 aW9uLiZuYnNwOyBIb3dldmVyLCB0aGF0IHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24g YWxtb3N0IGdvdCB0aGF0IGRyYWZ0IHJlamVjdGVkIGJ5IHRoZSBJRVNHIGF0IHRoZSB0aW1lLiZu YnNwOw0KIEFzIG15IHByZXZpb3VzIG1lc3NhZ2UgdG8gdGhpcyBsaXN0IGluZGljYXRlZCwgd2Ug Z290IGFncmVlbWVudCBvbiBSRkM3NzUyIGJhc2VkIG9uIGxpbWl0aW5nIHRoYXQgaW5mb3JtYXRp b24gYW5kIHRoZSBhc3N1cmFuY2UgdGhhdCBCR1AtTFMgbm9kZXMgd2VyZSBkZXBsb3llZCBvbiBh IHNlcGFyYXRlIHNldCBvZiBub2Rlcy4gJm5ic3A7RXhwYW5kaW5nIHRoZSB0cmFmZmljIGVuZ2lu ZWVyaW5nIGluZm9ybWF0aW9uIGJleW9uZCBSRkM3NzUyIHJlLW9wZW5zDQogYWxsIHRoZSBzZWN1 cml0eSBpc3N1ZXMgYW5kIHF1ZXN0aW9ucyBmcm9tIFJGQzc3NTLigJlzIG9yaWdpbmFsIHJldmll dy4gJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5bTGVzOl0gU28gZmFyLCB5b3UgYXJlIHRoZSBvbmx5IHBlcnNvbiB3aG8gc2VlbXMgYXdhcmUg b2YgdGhpcy4gSSBhbSBub3Qgc2F5aW5nIHlvdSBhcmUgd3Jvbmcg4oCTIEkgYW0ganVzdCBzYXlp bmcgbXkgcHJpdmF0ZSBhdHRlbXB0cyB0byBnZXQgbW9yZSBjb250ZXh0DQogZm9yIHRoaXMgaGF2 ZSB0aHVzIGZhciBmYWlsZWQg4oCTIGFuZCB5b3UgaGF2ZSBub3QgcHJvdmlkZWQgYW55IGRvY3Vt ZW50YXRpb24gb2YgdGhpcy48bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB5b3Vy IHN0YXRlbWVudCBpcyBhY2N1cmF0ZSAoYWdhaW4g4oCTIG5vdCBzYXlpbmcgaXQgaXNu4oCZdCkg 4oCTIGl0IGFsc28gc2VlbXMgbW9zdCB1bmZvcnR1bmF0ZSAoYW5kIEkgYW0gYmVpbmcg4oCca2lu ZOKAnSBoZXJlKSB0aGF0IHRoaXMgd2FzIG5vdCBtZW50aW9uZWQgaW4NCiB0aGUgY291cnNlIG9m IHRoZSBmb3VyIHllYXJzIHRoYXQgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwIGhhcyB0YWtlbiB0 byBwcm9ncmVzcyB0byB0aGlzIHBvaW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj5UaGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmV2aWV3ZXIgaXMg YXNraW5nIHRoZXNlIHNlY3VyaXR5IHF1ZXN0aW9ucy4mbmJzcDsgVGhlIHNlY3VyaXR5IGRpcmVj dG9yYXRlIGRvZXMgaGF2ZSBwZW9wbGUgd2l0aCBib3RoIHJvdXRpbmcgYW5kIHNlY3VyaXR5IGV4 cGVydHMuICZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+U1Igcm91dGluZyBpcyBhbHNvIGV4cGFuZGluZyB0aGUgaW5mb3JtYXRpb24gcGFzdCB0 aGUgb3JpZ2luYWwgUkZDNzc1Mi4mbmJzcDsmbmJzcDsgVGhlIGV4cGFuc2lvbnMgcmVxdWVzdGVk IGJ5IFNSIHJvdXRpbmcgYWxzbyByZS1vcGVuIHRob3NlIG9yaWdpbmFsIHNlY3VyaXR5IHF1ZXN0 aW9ucw0KIGFuZCBpc3N1ZXMuJm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+W0xlczpdIEkgZG8gbm90IGtub3cgd2h5IHlvdSBtZW50aW9uIFNS IGhlcmUgc2luY2Ugd2UgYm90aCBhZ3JlZSB0aGlzIGRyYWZ0IGlzIG5vdCBTUiByZWxhdGVkLjxv OnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5PbmUgd2F5 IHRvIGFuc3dlciB0aGVzZSBxdWVzdGlvbnMgaXMgdG8gcHJvdmlkZSBhICZuYnNwO1JGQzc3NTJi aXMgd2l0aCBhbiB1cGRhdGVkIHNlY3VyaXR5IHNlY3Rpb24uJm5ic3A7IElmIHlvdSBhZ3JlZSB3 aXRoIHRoaXMgYXBwcm9hY2gsIEkgc3VnZ2VzdCBzaW1wbHkgcmVmZXJyaW5nIHRvDQogYSBSRkM3 NzUyYmlzIHRoYXQgaW4geW91ciBzZWN1cml0eSBzZWN0aW9uLiAmbmJzcDsmbmJzcDtJZiB5b3Ug ZGlzYWdyZWUgdGhhdCBhbiB1cGRhdGUgdG8gdGhlIFJGQzc3NTJiaXMgaXMgcmVxdWlyZWQsIHdl IGNhbiBzdGFydCBhIHRocmVhZCBvbiB0aGF0IHBvaW50Lg0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5bTGVzOl0gVGhlcmUgaXMgbm8gUkZDNzc1MmJp cyBkcmFmdC4NCjwvc3Bhbj48L2k+PC9iPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncztjb2xvcjojMUY0OTdEIj5KPC9zcGFuPjwvaT48L2I+ PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiAmbmJzcDtTbyB5b3UgYXJlIGFz a2luZyBtZSB0byByZWZlcmVuY2UgYSBub24tZXhpc3RlbnQgZG9jdW1lbnQ/PG86cD48L286cD48 L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9pPjwvYj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+SSB1bmRlcnN0YW5kIHRoYXQgeW91IChhdCBsZWFzdCkgd291bGQgbGlrZSB0byBoYXZlIG9u ZSDigJMgd2hpY2ggaXMgcGVyZmVjdGx5IGxlZ2l0aW1hdGUg4oCTIHRob3VnaCB5b3Ugc2hvdWxk IGdvIHRocm91Z2ggdGhlIG5vcm1hbCBXRyBwcm9jZXNzIHRvIHRha2UgdGhpcw0KIHdvcmsgb24g 4oCTIGNvcnJlY3Q/PG86cD48L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QnV0IHRoaXMgZG9kZ2VzIHRoZSBxdWVzdGlvbiBh cyB0byB3aGV0aGVyIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncCBoYXMgYSBkZXBlbmRlbmN5IG9u IGVuaGFuY2VkIHNlY3VyaXR5LiBTbyBmYXIsIHlvdSBhcmUgdGhlIG9ubHkgcGVyc29uIG1ha2lu ZyB0aGlzIGNsYWltDQog4oCTIGFuZCBzZXZlcmFsIGZvbGtzIChpbmNsdWRpbmcgbXlzZWxmKSBo YXZlIGV4cHJlc3NlZCBhIGRpZmZlcmVudCBQT1YuIEkgdGhpbmsgeW91IGF0IGxlYXN0IGhhdmUg dG8gcHJvdmlkZSBhIGp1c3RpZmljYXRpb24gZm9yIHRoaXMgZGVwZW5kZW5jeSBiZWZvcmUgd2Ug aW50cm9kdWNlIGl0IGFuZCBnZXQgc29tZSBzdXBwb3J0IGZvciB5b3VyIHBvc2l0aW9uIOKAkyBz aW5jZSB0aGlzIHdpbGwgbWVhbiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3Agd291bGQNCiBiZSBz dHVjayBpbiBNSVNTUkVGIHN0YXRlIHVudGlsIHRoaXMgY3VycmVudGx5IG5vbi1leGlzdGVudCBk cmFmdCBiZWNvbWVzIGFuIFJGQy48bzpwPjwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L2k+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgTGVzPG86cD48 L286cD48L3NwYW4+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9pPjwv Yj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+RGlkIHRoaXMgbWVzc2FnZSBjbGFyaWZ5IG15IGVhcmxpZXIgYnJpZWYgbWVzc2FnZT8gJm5i c3A7RG8geW91IHdhbnQgdG8gY29udGludWUgdG8gZGlzY3VzcyB0aGUgbmVlZCBmb3IgUkZDNzc1 MmJpcz8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Q2hlZXJp bHksIFN1ZQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYg MS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEm cXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj4gSWRyIFs8 YSBocmVmPSJtYWlsdG86aWRyLWJvdW5jZXNAaWV0Zi5vcmciPm1haWx0bzppZHItYm91bmNlc0Bp ZXRmLm9yZzwvYT5dDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkxlcyBHaW5zYmVyZyAoZ2luc2Jlcmcp PGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAxMDo1OCBBTTxicj4N CjxiPlRvOjwvYj4gU3VzYW4gSGFyZXM7ICdSb2JlcnQgUmFzenVrJzsgPGEgaHJlZj0ibWFpbHRv OmthZHVrQG1pdC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVm PSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86 ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmci PmlldGZAaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20i PnluaXIuaWV0ZkBnbWFpbC5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86c2VjZGlyQGlldGYub3Jn Ij4NCnNlY2RpckBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZHJdIFtz ZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN1ZSDigJM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPk9uZSBvZiB1cyBpcyBjb25mdXNlZC4NCjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3RCI+ Sjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5kcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AgaXMgbm90 IHJlbGF0ZWQgdG8gU2VnbWVudCBSb3V0aW5nLiBUaG9zZSB3b3JkcyBkbyBub3QgYXBwZWFyIGFu eXdoZXJlIGluIHRoZSBkb2N1bWVudC4gTm9yIGlzIHRoZXJlIGEgcmVmZXJlbmNlIHRvIGFueSBT UiBkb2N1bWVudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkZ1 cnRoZXIsIFJGQyA3NzUyIGluY2x1ZGVzIHRyYWZmaWMgZW5naW5lZXJpbmcgaW5mb3JtYXRpb24g KHNlZQ0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3JmYzc3NTItMjNzZWN0aW9uLTJEMy4zLjIm YW1wO2Q9RHdNRmFRJmFtcDtjPUhBa1l1aDYzcnN1aHI2U2NiZmgwVWpCWGVNSy1uZGIzdm9EVFhj V3pvQ0kmYW1wO3I9Q1JCMnRKaVFlUGswY1QtaDVMR2hFV0gtc194WFh1cDNIenZCU01SajVWRSZh bXA7bT1XQk9hMjRMLVNQU1BjODlhTDBCOEpnbmJkSVNtQ3lnTDVXRHFUMTY0MlpnJmFtcDtzPVJY eDdoMkVQX1RVbU5GeGRTazZfV2dRMjdKc2RpdkEyMmJxTzN4eGo2M0UmYW1wO2U9Ij4NCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NzUyI3NlY3Rpb24tMy4zLjI8L2E+ICkgc28gdGhl IHN1Z2dlc3Rpb24gdGhhdCB3ZSBhcmUgaW50cm9kdWNpbmcgYSBuZXcgYXR0YWNrIHZlY3RvciBi eSBkZWZpbmluZyBzb21lIGFkZGl0aW9uYWwoc2ljKSBURSBjb2RlcG9pbnRzIGRvZXMgbm90IG1h a2Ugc2Vuc2UgdG8gbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5JIGFwcHJlY2lhdGUgdGhhdCB0aGVyZSBhcmUgb3RoZXIgZHJhZnRzIG9uIHlvdXIgbWluZCB3 aGljaCBhcmUgU1IgcmVsYXRlZCDigJMgYnV0IHRoaXMgaXMgbm90IG9uZSBvZiB0aGVtLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Q291bGQgeW91IHBsZWFzZSB1 cGRhdGUgeW91ciByZXNwb25zZSB3aXRoIHRoZXNlIHBvaW50cyBpbiBtaW5kPzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbnguPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsgTGVzPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+ PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+IFN1c2FuIEhhcmVzICZsdDs8YSBocmVmPSJtYWlsdG86c2hh cmVzQG5kemguY29tIj5zaGFyZXNAbmR6aC5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+ IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCA2OjI2IEFNPGJyPg0KPGI+VG86PC9iPiAnUm9iZXJ0 IFJhc3p1aycgJmx0OzxhIGhyZWY9Im1haWx0bzpyb2JlcnRAcmFzenVrLm5ldCI+cm9iZXJ0QHJh c3p1ay5uZXQ8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzprYWR1a0BtaXQuZWR1Ij5rYWR1a0Bt aXQuZWR1PC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmci PmlldGZAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86c2VjZGlyQGlldGYub3JnIj4NCnNl Y2RpckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzp5bmlyLmlldGZAZ21haWwuY29tIj55 bmlyLmlldGZAZ21haWwuY29tPC9hPjsNCjxhIGhyZWY9Im1haWx0bzppZHJAaWV0Zi5vcmciPmlk ckBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3Au YWxsQGlldGYub3JnIj4NCmRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC5hbGxAaWV0Zi5vcmc8L2E+ PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2 aWV3IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5S b2JlcnQsIEJlbmphbWluLCBhbmQgWW9hdjoNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+SSBhZ3JlZSB0aGVzZSBjb250ZXh0IG9mIHRoZXNlIGlzc3VlcyBhcmUg bm90IHNwZWNpZmljIHRvIHRoaXMgZHJhZnQuJm5ic3A7IEhvd2V2ZXIsIHRyYWZmaWMgZW5naW5l ZXJpbmcgaW5mb3JtYXRpb24gZG9lcyBwcm92aWRlIGluZm9ybWF0aW9uIHdoaWNoIGlzIGEgdGVt cHRpbmcgYXR0YWNrDQogdmVjdG9yLiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPlRoZSBvcmlnaW5hbCBSRkM3NzUyIGRlc2NyaWJlZCBhIGRpZmZlcmVudCBwdXJw b3NlIHdpdGggcmVzdHJpY3RlZCB1c2FnZSB0aGF0IFNSIHJvdXRpbmcgZXh0ZW5zaW9ucyBkbyBu b3QgYWRoZXJlIHRvIGluIEJHUC4mbmJzcDsmbmJzcDsgU2luY2UgU3ByaW5nIFdHIHNob3dzIHRo YXQgb3BlcmF0b3JzDQogYXJlIGludGVyZXN0ZWQgaW4gdGhlIGV4dGVuZGVkIHVzZSwgaXQgbWF5 IGJlIHRpbWUgdG8gZXhhbWluZSB0aGUgUkZDNzc1MmJpcyBvciBvdGhlciBzb2x1dGlvbnMgdGhh dCB0YWtlcyBjYXJlIG9mIHRoZXNlIHNlY3VyaXR5IGlzc3Vlcy4mbmJzcDsNCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+TXkgam9iIGFzIGEgc2hlcGhlcmQgaXMg dG8gcG9pbnQgb3V0IHRoZXNlIGlzc3VlcyBwZXIgZHJhZnQgZm9yIHRoZSBJRVNHIGFuZCBzZWN1 cml0eSBkaXJlY3RvcmF0ZSBpbiBvcmRlciB0byBvYnRhaW4gdGhlIGNvcnJlY3QgZmVlZGJhY2su ICZuYnNwO0FzIGEgV0cgY2hhaXIsIEkgaGF2ZQ0KIHBvaW50ZWQgb3V0IHRoZXNlIGlzc3Vlcywg YnV0IHRoZSBXRyBoYXMgdGhlc2UgZHJhZnRzIG9uIFdHIExDIHdpdGhvdXQgdGhlIGV4dHJhIHNl Y3VyaXR5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5XaXRob3V0IFJGQzc3NTJiaXMgd2l0aCBhZGRpdGlv bmFsIHNlY3VyaXR5IGluIHRoZSBiYXNlIGRvY3VtZW50LCBJIGFtIHdvcmtpbmcgYXMgYSBzaGVw aGVyZCBtYWtlIHRoZSBtYW5hZ2VhYmlsaXR5IGFuZCBzZWN1cml0eSBzZWN0aW9ucyBhcyBjbGVh ciBhcyBwb3NzaWJsZS4NCiAmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPklmIHRoZSBmZWVkYmFjayBmcm9tIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSBy ZXZpZXcgb3IgdGhlIElFU0cgaXMgdGhhdCB3ZSBuZWVkIHRvIG9idGFpbiBhIHNvbHV0aW9uIGZv ciBSRkM3NzUyYmlzIHRoYXQgZGVzY3JpYmVzIGFuZCBoYW5kbGVzIHRoZXNlIHNlY3VyaXR5DQog aXNzdWVzLCBJIHdpbGwgYmUgZ2xhZCB0byBzdXBwb3J0IGZhc3QtdHJhY2tpbmcgdGhpcyBpc3N1 ZSB3aXRoaW4gdGhlIFdHLiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPklmIGFuIG9mZmxpbmUgZGlzY3Vzc2lvbiB3aXRoIEJlbmphbWluLCBZb2F2LCB0aGUgSURS IGNoYWlycywgYW5kIEFsdmFybyB3b3VsZCBzcGVlZCB0aGlzIGFsb25nLCBJIGNhbiBzZXQgdGhp cyB1cCBlYXJseSBuZXh0IHdlZWsuJm5ic3A7IEl0IHdvdWxkIGJlIGhlbHBmdWwgdG8gaGF2ZQ0K IHRoaXMgb2ZmbGluZSBkaXNjdXNzaW9uIGJlZm9yZSB0aGUgSURSIGludGVyaW0gc2Vzc2lvbiBv biAxMC8yNi4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGFu ayB5b3UgZm9yIGFsbCB5b3VyIGNvbW1lbnRzLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5TdWUNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFo b21hJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+IElk ciBbPGEgaHJlZj0ibWFpbHRvOmlkci1ib3VuY2VzQGlldGYub3JnIj5tYWlsdG86aWRyLWJvdW5j ZXNAaWV0Zi5vcmc8L2E+XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5Sb2JlcnQgUmFzenVrPGJyPg0K PGI+U2VudDo8L2I+IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxOCAyOjUyIEFNPGJyPg0KPGI+VG86 PC9iPiA8YSBocmVmPSJtYWlsdG86a2FkdWtAbWl0LmVkdSI+a2FkdWtAbWl0LmVkdTwvYT48YnI+ DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzppZXRmQGlldGYub3JnIj5pZXRmQGlldGYub3Jn PC9hPjsgPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQpzZWNkaXJAaWV0Zi5vcmc8 L2E+OyA8YSBocmVmPSJtYWlsdG86eW5pci5pZXRmQGdtYWlsLmNvbSI+eW5pci5pZXRmQGdtYWls LmNvbTwvYT47DQo8YSBocmVmPSJtYWlsdG86aWRyQGlldGYub3JnIj5pZHJAaWV0Zi5vcmc8L2E+ OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZyI+ DQpkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AuYWxsQGlldGYub3JnPC9hPjxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW0lkcl0gW3NlY2Rpcl0gU2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1p ZXRmLWlkci10ZS1wbS1iZ3AtMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhlbGxvIEJlbmphbWluLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm90IHN1cmUgaWYgeW91IGhhdmUgc3BvdHRlZCBzaW1pbGFy IGNvbW1lbnQgbWFkZSB0byBJRFIgcmVnYXJkaW5nIHRoaXMgdG9waWMsIGJ1dCB5b3VyIGNvbW1l bnQgc2VlbXMgdG8gaW5kaWNhdGUgdGhhdCBoZXJlIHdlIGFyZSBhYm91dCB0byBkZWZpbmUgd2F5 cyB0byBjYXJyeSBuaWNlbHkgc2NvcGVkIElHUCBpbmZvcm1hdGlvbiBpbnRvIEJHUC4gV2VsbCB0 aGF0IGhhcyBhbHJlYWR5IGhhcHBlbmVkIHdpdGgNCiBSRkM3NzUyIGFuZCB5b3VyIGNvbW1lbnQg b3IgZm9yIHRoYXQgbWF0dGVyIFlvYXYncyByZW1hcmtzIGFyZSBpbmRlZWQgc3BvdCBvbiBidXQg dG8gdGhlIHNlY3VyaXR5IGRpc2N1c3Npb24gb24gUkZDNzc1MiBhbmQgSU1PIG5vdCBhbnkgZm9s bG93IHVwIGV4dGVuc2lvbnMgb2YgaXQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1cmUgLSBhcyBvYnNlcnZlZCBieSBTdWUgLSBv bmUgbWF5IGFyZ3VlIHRoYXQgcHJvdmlkaW5nIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIG5l dHdvcmsgdG8gdGhlIHBvdGVudGlhbCBhdHRhY2tlciBtYWtlcyB0aGUgbmV0d29yayB3ZWFrZXIs IGJ1dCB0aGUgY3VyZSBmb3IgdGhhdCBpcyB0byBwcmV2ZW50IHRoZSBsZWFrcyBhbmQgcmVkdWNl IHByb2JhYmlsaXR5IG9mIGludGVyY2VwdGluZyBuZXcgaW5mb3JtYXRpb24NCiBieSB1bmF1dGhv cml6ZWQgcGFydGllcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+QkdQLUxTIGlzIGFscmVhZHkgZGVmaW5lZCBpbiBhIG5ldyBTQUZJ IHdoYXQgYnkgaXRzZWxmIGRvZXMgcHJvdmlkZSBuaWNlIGxldmVsIG9mIGlzb2xhdGlvbi4gUkZD Nzc1MiBpcyBwcmV0dHkgY2xlYXIgb24gdGhhdCB0b28gYW5kIHNheXM6Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90O0JHUCBw ZWVyaW5ncyBhcmUgbm90IGF1dG9tYXRpYyBhbmQgcmVxdWlyZSBjb25maWd1cmF0aW9uOyB0aHVz LCBpdCBpcyB0aGUgcmVzcG9uc2liaWxpdHkgb2YgdGhlIG5ldHdvcmsgb3BlcmF0b3IgdG8gZW5z dXJlIHRoYXQgb25seSB0cnVzdGVkIGNvbnN1bWVycyBhcmUgY29uZmlndXJlZCB0byByZWNlaXZl IHN1Y2ggaW5mb3JtYXRpb24uJnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHNvbWVvbmUgd291bGQgYmUgc3RpbGwgY29uY2VybmVk IGFib3V0IGNvbmZpZ3VyYXRpb24gbWlzdGFrZXMgYW5kIG5lZ290aWF0aW5nIFNBRkkgNzEgb3Ig NzIgdG8gdGhvc2Ugd2hvIHNob3VsZCBub3QgZ2V0IHRoaXMgZGF0YSBJIHJlY29tbWVuZCB3ZSBy ZWlzc3VlIHRoZSBSRkM3NzUyIGFzIC1iaXMgdmVyc2lvbiBhbmQgcmVzdHJpY3QgdGhlIHNjb3Bl IG9mIHRoZSBkaXN0cmlidXRpb24gZXZlbiBmdXJ0aGVyDQogYnkgbWFuZGF0aW5nIGRlZmF1bHQg dXNlIG9mIE5PLUVYUE9SVCBjb21tdW5pdHkgd2l0aCBhYmlsaXR5IHRvIG92ZXJ3cml0ZSBpdCBm b3IgdGhlIHNlbGVjdGl2ZSBlQkdQIHBlZXJzLiBPciBwZXJoYXBzIHdlIGNvdWxkIHByb2dyZXNz IEppbSdzIE9uZSBBZG1pbmlzdHJhdGl2ZSBEb21haW4gZHJhZnQgKGRyYWZ0LXV0dGFyby1pZHIt b2FkLTAxKS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SW4gZWl0aGVyIGNhc2Ugd2hpbGUgYm90aCBvZiB5b3VyIGNvbW1lbnRzIGFy ZSBncmVhdCB0aGV5IHNlZW1zIGEgYml0IGxhdGUgaW4gdGhlIGdhbWUgaGVyZSBvciBhdCBsZWFz dCB0YXJnZXRpbmcgd3JvbmcgZG9jdW1lbnQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPktpbmQgcmVnYXJkcyw8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJvYmVydC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJpLCBPY3QgMTksIDIw MTggYXQgMjoyNyBBTSBCZW5qYW1pbiBLYWR1ayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmthZHVrQG1p dC5lZHUiPmthZHVrQG1pdC5lZHU8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDttYXJnaW4t Ym90dG9tOjUuLjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUaHUsIE9jdCAxOCwgMjAx OCBhdCAwNjowMDoxM1BNICYjNDM7MDAwMCwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgd3JvdGU6 PGJyPg0KJmd0OyBZb2F2IOKAkzxicj4NCiZndDsgPGJyPg0KJmd0OyBJbiByZWdhcmRzIHRvIHRo ZSByaXNrcyBhc3NvY2lhdGVkIHdpdGggYWR2ZXJ0aXNpbmcgdGhlIHNwZWNpZmljIGluZm9ybWF0 aW9uIGNvdmVyZWQgaW4gdGhpcyBkcmFmdCB3ZSBoYXZlIGEgc3RhdGVtZW50IGluIHRoZSBJR1Ag ZHJhZnRzOjxicj4NCiZndDsgPGJyPg0KJmd0OyBGcm9tIFJGQzc4MTA8YnI+DQomZ3Q7IDxicj4N CiZndDsg4oCcVGhlIHN1Yi1UTFZzIGludHJvZHVjZWQgaW4gdGhpcyBkb2N1bWVudCBhbGxvdyBh biBvcGVyYXRvciB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGFkdmVydGlzZSBzdGF0ZSBpbmZv cm1hdGlvbiBvZiBsaW5rcyAoYmFuZHdpZHRoLCBkZWxheSkgdGhhdCBjb3VsZCBiZTxicj4NCiZn dDsmbmJzcDsgJm5ic3A7IHNlbnNpdGl2ZSBhbmQgdGhhdCBhbiBvcGVyYXRvciBtYXkgbm90IHdh bnQgdG8gZGlzY2xvc2Uu4oCdPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEluIHJlZ2FyZHMgdG8gdGhl IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBzZW5kaW5nIGluZm9ybWF0aW9uIHZpYSBCR1AtTFMgd2Ug aGF2ZSBhIG51bWJlciBvZiBzdGF0ZW1lbnRzIGluIFJGQyA3NzUyIOKAkyBtb3N0IHJlbGV2YW50 IGlzOjxicj4NCiZndDsgPGJyPg0KJmd0OyDigJxBZGRpdGlvbmFsbHksIGl0IG1heSBiZSBjb25z aWRlcmVkIHRoYXQgdGhlIGV4cG9ydCBvZiBsaW5rLXN0YXRlIGFuZDxicj4NCiZndDsmbmJzcDsg Jm5ic3A7IFRFIGluZm9ybWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50IGNvbnN0 aXR1dGVzIGEgcmlzayB0bzxicj4NCiZndDsmbmJzcDsgJm5ic3A7IGNvbmZpZGVudGlhbGl0eSBv ZiBtaXNzaW9uLWNyaXRpY2FsIG9yIGNvbW1lcmNpYWxseSBzZW5zaXRpdmU8YnI+DQomZ3Q7Jm5i c3A7ICZuYnNwOyBpbmZvcm1hdGlvbiBhYm91dCB0aGUgbmV0d29yay7igJ08YnI+DQomZ3Q7IDxi cj4NCiZndDsgU28gbG9uZyBhcyB0aGVyZSBhcmUgcmVmZXJlbmNlcyB0byBib3RoIHRoZSBJR1Ag UkZDcyBhbmQgUkZDIDc3NTIgSSBhbSB0aGVyZWZvcmUgaGFyZCBwcmVzc2VkIHRvIHVuZGVyc3Rh bmQgd2hhdCBlbHNlIGNvdWxkIGJlIHVzZWZ1bGx5IHNhaWQuPGJyPg0KJmd0OyBDZXJ0YWlubHkg dGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUgQkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g YXJlIG5vdCBhbHRlcmVkIGJ5IGFkZGluZyBzb21lIG5ldyBUTFZzIOKAkyBhbmQgc2luY2UgdGhl IElHUCBSRkNzIGhhdmUgYWxyZWFkeSBjb3ZlcmVkIHJpc2tzIGFzc29jaWF0ZWQgd2l0aCB0aGUg c3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24gKG5vdCBzaW1wbHkgdGhlIHJpc2tzIGFzc29j aWF0ZWQgd2l0aCB0aGUgdHJhbnNwb3J0DQogbWVjaGFuaXNtKSB5b3UgYXJlIGdvaW5nIHRvIGhh dmUgdG8gcHJvdmlkZSBtb3JlIHNwZWNpZmljcyBvbiB3aGF0IGNhbiBtZWFuaW5nZnVsbHkgYmUg c2FpZCB0aGF0IGlzIG5vdCBhbHJlYWR5IGNvdmVyZWQgaW4gdGhlIHJlZmVyZW5jZXMuPGJyPg0K PGJyPg0KTXkgYXBvbG9naWVzIGZvciBqdW1waW5nIGluIGluIHRoZSBtaWRkbGUsIGJ1dCBJSVVD IHRoZSBJR1AgUkZDcyBoYXZlPGJyPg0KY292ZXJlZCB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRo IGEgc3BlY2lmaWMgY2xhc3Mgb2YgaW5mb3JtYXRpb24sICp1bmRlcjxicj4NCnRoZSBhc3N1bXB0 aW9uIHRoYXQgdGhlIHRyYW5zcG9ydCBtZWNoYW5pc20gaXMgd2l0aGluIGEgc2luZ2xlIEFTIGFu ZDxicj4NCmFkbWluaXN0cmF0aXZlIGRvbWFpbiouJm5ic3A7IFlvYXYgaXMgcG9pbnRpbmcgb3V0 IHRoYXQgdGhlIHJpc2tzIGZvciB0aGF0PGJyPg0KaW5mb3JtYXRpb24gbWF5IGNoYW5nZSB3aGVu IHRoZSBkaXN0cmlidXRpb24gaXMgb3ZlciBhIGJyb2FkZXIgZG9tYWluIHRoYW48YnI+DQp0aGUg b25lIGZvciB3aGljaCB0aGUgcHJldmlvdXMgYW5hbHlzaXMgd2FzIHBlcmZvcm1lZC48YnI+DQo8 YnI+DQotQmVuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_BN7PR05MB4354891AD79FD0F53777797DC7F90BN7PR05MB4354namp_-- From nobody Fri Oct 19 16:01:45 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6917130E34; Fri, 19 Oct 2018 16:01:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MgbRYVlwERsM; Fri, 19 Oct 2018 16:01:28 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F385D12D4F2; Fri, 19 Oct 2018 16:01:27 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 19:01:21 -0400 Message-ID: <046201d467ff$a76ac220$f6404660$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0463_01D467DE.205C7D80" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BAE930AoAZRhPWOi7MisgA== Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 23:01:32 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0463_01D467DE.205C7D80 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Les:=20 =20 I am only going to respond to your many misconceptions inline. =20 =20 Most of the text below are comments which harshly personalizes the = discussion rather than consider that Yoav indicates some of the same = concern regarding the information that I had as your shepherd. =20 =20 You have rejected my suggested resolution of a RFC7752bis as a way to = resolve the security directorates concerns. I will add this fact to = shepherd=E2=80=99s report so that Alvaro and the IESG knows you have = rejected any resolution that involves revising RFC5572=E2=80=99s = security section. =20 =20 It is now up to you to propose a solution that will satisfy SEC-DIR = review. =20 =20 Cheerily, Sue=20 =20 =20 From: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]=20 Sent: Friday, October 19, 2018 1:29 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 Inline. =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 10:08 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I apologize if my email message was unclear. We both agree that your = draft is not related to SR routing. SR routing is related to BGP-LS as = a transport mechanism for information. =20 =20 I agree that RFC7752 had traffic engineering information. However, that = traffic engineering information almost got that draft rejected by the = IESG at the time. As my previous message to this list indicated, we got = agreement on RFC7752 based on limiting that information and the = assurance that BGP-LS nodes were deployed on a separate set of nodes. = Expanding the traffic engineering information beyond RFC7752 re-opens = all the security issues and questions from RFC7752=E2=80=99s original = review. =20 =20 [Les:] So far, you are the only person who seems aware of this. I am not = saying you are wrong =E2=80=93 I am just saying my private attempts to = get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this. If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point. =20 [Sue]: You are repeatedly making this a personal issue. As I have = stated in previous messages you were not at in-person authors meetings. = I cannot help if you do not attend IETF discussions with your shepherd = or your co-authors do not relay my concerns. I would ask that you stop = any further personal comments.=20 =20 The security directorate reviewer is asking these security questions. = The security directorate does have people with both routing and security = experts. =20 =20 SR routing is also expanding the information past the original RFC7752. = The expansions requested by SR routing also re-open those original = security questions and issues. =20 =20 [Les:] I do not know why you mention SR here since we both agree this = draft is not SR related. =20 [sue]: Why am I mentioning it? They have a reasonable solution to the = security consideration by considering everything as a trusted domain = (see RFC8402), and defining who the BGP peers are. Due to deployments, = I am trying to help you resolve this issue quickly. .=20 =20 One way to answer these questions is to provide a RFC7752bis with an = updated security section. If you agree with this approach, I suggest = simply referring to a RFC7752bis that in your security section. If you = disagree that an update to the RFC7752bis is required, we can start a = thread on that point.=20 =20 [Les:] There is no RFC7752bis draft. J So you are asking me to = reference a non-existent document? =20 [Sue]: I am looking for a solution that will technically resolve the = security concerns. After you agree in principle, I would go to Alvaro = and the IESG and see if we could get a fast-track for the solution. =20 =20 I understand that you (at least) would like to have one =E2=80=93 which = is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 correct? =20 [Sue]: I am willing to take this through a fast track IDR document = since it is for the security considerations only. I am willing to go = the extra mile and talk to Routing ADs and the security ADs about a = quick resolution.=20 =20 But this dodges the question as to whether draft-ietf-idr-te-pm-bgp has = a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV.=20 =20 [Sue]: Yoav had the same point of view on the potential security issues = in his original review so I am not the only person that believes there = is a problem. As I mentioned as a shepherd, I would let the SEC-DIR = provide an independent review on whether your security considerations = sections was sufficient. Yoav ruled =E2=80=9Cnot sufficient=E2=80=9D. = =20 At this point, please do not repeat this comment again as it is not = true. Restating it over and over does not make it true. Using words = like =E2=80=9Cdodges the issue=E2=80=9D are not words that progress a = consensus decision forward. =20 =20 I think you at least have to provide a justification for this dependency = before we introduce it and get some support for your position =E2=80=93 = since this will mean draft-ietf-idr-te-pm-bgp would be stuck in MISSREF = state until this currently non-existent draft becomes an RFC. =20 [Sue]: The solution could be easy =E2=80=93 but you are not willing to = listen regarding the proposed resolution. RFC8402 considers the BGP-LS = for Segment routing to be a trusted domain and provides some additional = comments on BGP peers. My suggestion would have been to revise RFC7752 = to be a trusted domain with some of the same wording. =20 =20 Les =20 Did this message clarify my earlier brief message? Do you want to = continue to discuss the need for RFC7752bis?=20 =20 Cheerily, Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:58 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 One of us is confused. J =20 draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those words = do not appear anywhere in the document. Nor is there a reference to any = SR document. =20 Further, RFC 7752 includes traffic engineering information (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion = that we are introducing a new attack vector by defining some = additional(sic) TE codepoints does not make sense to me. =20 I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them. =20 Could you please update your response with these points in mind? =20 Thanx. =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 6:26 AM To: 'Robert Raszuk' ; kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_0463_01D467DE.205C7D80 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Les:

 

I am only going to respond to your many misconceptions inline.=C2=A0 =

 

Most of the text below are comments which harshly personalizes the = discussion rather than consider that Yoav indicates some of the same = concern regarding the information that I had as your shepherd.=C2=A0 = =C2=A0

 

You have rejected my suggested resolution of a RFC7752bis as a way to = resolve the security directorates concerns.=C2=A0 I will add this fact = to shepherd=E2=80=99s report so that Alvaro and the IESG knows you have = rejected any resolution that involves revising RFC5572=E2=80=99s = security section.=C2=A0

 

It is now up to you to propose a solution that will satisfy SEC-DIR = review. =C2=A0

 

Cheerily, Sue

 

 

From:= = Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]
Sent: = Friday, October 19, 2018 1:29 PM
To: Susan Hares; 'Robert = Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

Inline.

 

From: Susan = Hares <shares@ndzh.com>
Sent: Friday, October 19, 2018 = 10:08 AM
To: Les Ginsberg (ginsberg) = <ginsberg@cisco.com>; 'Robert Raszuk' <robert@raszuk.net>; = kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: RE: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I apologize if my email message was unclear.   We both = agree that your draft is not related to SR routing.   SR = routing is related to BGP-LS as a transport mechanism for information. =  

 

I agree that RFC7752 had traffic engineering information.  = However, that traffic engineering information almost got that draft = rejected by the IESG at the time.  As my previous message to this = list indicated, we got agreement on RFC7752 based on limiting that = information and the assurance that BGP-LS nodes were deployed on a = separate set of nodes.  Expanding the traffic engineering = information beyond RFC7752 re-opens all the security issues and = questions from RFC7752=E2=80=99s original review. =  

 

[Les:] So far, you are the only person who seems aware of this. I am = not saying you are wrong =E2=80=93 I am just saying my private attempts = to get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this.

If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point.

 

[= Sue]: You are repeatedly making this a personal issue.=C2=A0 As I have = stated in previous messages you were not at in-person authors meetings. = I cannot help if you do not attend IETF discussions with your shepherd = or your co-authors do not relay my concerns. =C2=A0I would ask that you = stop any further personal comments.

 

The security directorate reviewer is asking these security = questions.  The security directorate does have people with both = routing and security experts.   

 

SR routing is also expanding the information past the original = RFC7752.   The expansions requested by SR routing also re-open = those original security questions and issues.  =

 

[Les:] I do not know why you mention SR here since we both agree this = draft is not SR related.

 

[= sue]:=C2=A0 Why am I mentioning it? =C2=A0They have a reasonable = solution to the security consideration by considering everything as a = trusted domain (see RFC8402), and defining who the BGP peers = are.=C2=A0=C2=A0 Due to deployments, I am trying to help you resolve = this issue quickly. .

 

One way to answer these questions is to provide a  RFC7752bis = with an updated security section.  If you agree with this approach, = I suggest simply referring to a RFC7752bis that in your security = section.   If you disagree that an update to the RFC7752bis is = required, we can start a thread on that point.

 

[Les:] There is no RFC7752bis draft. J  So you are asking me to reference a non-existent = document?

 

[= Sue]: I am looking for a solution that will technically resolve the = security concerns.=C2=A0 After you agree in principle, I would go to = Alvaro and the IESG and see if we could get a fast-track for the = solution.=C2=A0

 

I understand that you (at least) would like to have one =E2=80=93 = which is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 = correct?

<= o:p> 

[= Sue]:=C2=A0 I am willing to take this through a fast track IDR document = since it is for the security considerations only. =C2=A0I am willing to = go the extra mile and talk to Routing ADs and the security ADs about a = quick resolution.

 

But this dodges the question as to whether draft-ietf-idr-te-pm-bgp = has a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV.

<= o:p> 

[= Sue]: Yoav had the same point of view on the potential security issues = in his original review so I am not the only person that believes there = is a problem.=C2=A0 =C2=A0As I mentioned as a shepherd, I would let the = SEC-DIR provide an independent review on whether your security = considerations sections was sufficient. =C2=A0Yoav ruled =E2=80=9Cnot = sufficient=E2=80=9D.=C2=A0 =C2=A0

<= o:p> 

= At this point, =C2=A0please do not repeat this comment again as it is = not true. =C2=A0Restating it over and over does not make it true. = =C2=A0Using words like =E2=80=9Cdodges the issue=E2=80=9D are not words = that progress a consensus decision forward.=C2=A0=C2=A0 =

 

I think you at least have to provide a justification for this = dependency before we introduce it and get some support for your position = =E2=80=93 since this will mean draft-ietf-idr-te-pm-bgp would be stuck = in MISSREF state until this currently non-existent draft becomes an = RFC.

<= o:p> 

[= Sue]: =C2=A0The solution could be easy =E2=80=93 but you are not willing = to listen regarding the proposed resolution.=C2=A0 RFC8402 considers the = BGP-LS for Segment routing to be a trusted domain and provides some = additional comments on BGP peers. =C2=A0My suggestion would have been to = revise RFC7752 to be a trusted domain with some of the same = wording.=C2=A0 =C2=A0

 

   Les

 

Did this message clarify my earlier brief message?  Do you want = to continue to discuss the need for RFC7752bis?

 

Cheerily, Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:58 AM
To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

One of us is confused. J

 

draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those = words do not appear anywhere in the document. Nor is there a reference = to any SR document.

 

Further, RFC 7752 includes traffic engineering information (see https://tools.= ietf.org/html/rfc7752#section-3.3.2 ) so the suggestion that we are = introducing a new attack vector by defining some additional(sic) TE = codepoints does not make sense to me.

 

I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them.

 

Could you please update your response with these points in = mind?

 

Thanx.

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 6:26 AM
To: 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: RE: [Idr] [secdir] Secdir = early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.  However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.   = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues. 

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. =  As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible.  

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.  = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Robert Raszuk
Sent: Friday, October 19, = 2018 2:52 AM
To: kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: Re: [Idr] [secdir] Secdir = early review of draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les = Ginsberg (ginsberg) wrote:
> Yoav =E2=80=93
>
> In = regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP = drafts:
>
> From RFC7810
>
> =E2=80=9CThe = sub-TLVs introduced in this document allow an operator to
>  =   advertise state information of links (bandwidth, delay) that = could be
>    sensitive and that an operator may not = want to disclose.=E2=80=9D
>
> In regards to the risks = associated with sending information via BGP-LS we have a number of = statements in RFC 7752 =E2=80=93 most relevant is:
>
> = =E2=80=9CAdditionally, it may be considered that the export of = link-state and
>    TE information as described in this = document constitutes a risk to
>    confidentiality of = mission-critical or commercially sensitive
>    = information about the network.=E2=80=9D
>
> So long as = there are references to both the IGP RFCs and RFC 7752 I am therefore = hard pressed to understand what else could be usefully said.
> = Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the = references.

My apologies for jumping in in the middle, but IIUC = the IGP RFCs have
covered the risks associated with a specific class = of information, *under
the assumption that the transport mechanism is = within a single AS and
administrative domain*.  Yoav is pointing = out that the risks for that
information may change when the = distribution is over a broader domain than
the one for which the = previous analysis was = performed.

-Ben

------=_NextPart_000_0463_01D467DE.205C7D80-- From nobody Fri Oct 19 16:22:10 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15D36131096; Fri, 19 Oct 2018 16:22:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.936 X-Spam-Level: ** X-Spam-Status: No, score=2.936 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4RyNmIbn7hIT; Fri, 19 Oct 2018 16:21:58 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 913F9130ED9; Fri, 19 Oct 2018 16:21:57 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'John E Drake'" , "'Les Ginsberg \(ginsberg\)'" , "'Robert Raszuk'" , Cc: , , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> <44855683021a4ffbb8070364182d9d53@XCH-ALN-001.cisco.com> <043b01d467fb$813ba910$83b2fb30$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 19:21:50 -0400 Message-ID: <047501d46802$84930d40$8db927c0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0476_01D467E0.FD887220" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BAE930AoAZRhPWMClJo7/QIHRbY5AaMT4hcBo/mJ2KKtuYDw Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 23:22:01 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0476_01D467E0.FD887220 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable John:=20 =20 Per Les=E2=80=99s request we are trimming any discussion of my suggested = solution to let him focus on resolving the issues with the sec-dir = people. =20 =20 IMHO I do not think Les was close to resolving the issue main issue, but = we both can watch and read as he continues to discuss this point with = the secdir people. As WG chair, I will continue to support resolution = of secdir comments.=20 =20 Respectfully, Sue=20 =20 PS - Your personal comments regarding my email on SR or RFC7752 miss the = point that RFC8402 resolves many issues by declaring the SR area a = trusted domain.=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of John E Drake Sent: Friday, October 19, 2018 6:41 PM To: Susan Hares; 'Les Ginsberg (ginsberg)'; 'Robert Raszuk'; = kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hi, =20 Comments inline =20 Yours Irrespectively, =20 John =20 From: Idr On Behalf Of Susan Hares Sent: Friday, October 19, 2018 6:32 PM To: 'Les Ginsberg (ginsberg)' ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I politely asked for viewpoint on RFC7752=E2=80=99s security since your = draft depends on RFC7752. You have impolitely and harshly refused to = comment on these points. =20 =20 I am focused on finding a resolution to the security directorates = comments on this draft on this thread. One resolution was to suggest a = general resolution by revising the RFC7752 draft. I have spent time = today providing background and reasons why this might be a good = resolution. I see from your comments that you are rejecting this = potential resolution.=20 =20 [JD] What part of =E2=80=9Cthis draft has nothing to do with segment = routing=E2=80=9D do you not understand=E2=80=9D?=20 =20 Propose a resolution to the secdir comments. Please note as your = shepherd and WG chair, stating =E2=80=9Csecurity directorate does not = understand BGP=E2=80=9D is not a resolution.=20 =20 [JD] From whom did that direct quote come? I don=E2=80=99t recall = seeing it on the email thread. =20 =20 IMHO as shepherd for your document Yoav has a valid point that on = vagueness of RFC7752 and the addition of new information. Please = continue to work with Yoav, Benjamin and the secdir to resolve their = concerns since my resolution has been rejected by you.=20 =20 [JD] I just re-read the entire email thread on this draft and it = appears to me that that the above is exactly what Les was doing and that = he was quite close to a resolution before you injected RFC 7752bis and = segment routing into the conversation.=20 =20 Sue Hares =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 6:01 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ynir.ietf@gmail.com Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 I will not reinforce your inappropriate insertion of the discussion of = possible RFC 7752 deficiencies into a thread which is reviewing = draft-ietf-idr-te-pm-bgp. This is wrong =E2=80=93 please stop it. =20 You want to discuss issues with RFC 7752 =E2=80=93 please start a = separate thread =E2=80=93 directed at the WG (of course) =E2=80=93 and = state your position as a WG member as to what you feel needs to be done. = Then others can comment and the WG can decide whether they agree work = needs to be done. =20 Also - and for the third time - draft-ietf-idr-te-pm-bgp is NOT SR = related =E2=80=93 please also stop inserting a discussion of SR/BGP-LS = into the review of this draft. =20 (Apologies for the harsh tone =E2=80=93 but it is becoming increasingly = frustrating to watch this thread being misdirected.) =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 2:32 PM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I will respond to this information point by point after I have responded = to Ketan who sent me messages regarding his draft prior to yours. = However, I would like your feedback on whether you believe RFC7752 has = security that is equivalent to, less than, or greater than a trusted = domain?=20 =20 The spring routing architecture (RFC8402) indicates that be default SR = operates within a trusted domain. It says further:=20 =20 =E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of = best practices to reduce the risk of tampering within the trusted domain = is important. Such practices are discussed in [RFC4381 = = ] and are applicable to both SR-MPLS and SRv6.=E2=80=9D=20 =20 If you believe that RFC7752 describes a trusted domain [per RFC4381],=20 RFC7762 does not state that it is a trusted domain.=20 =20 If you believe the RFC7752 has stronger security=20 than a trusted domain, can you let me know=20 why you think it is stronger than a trusted domain. =20 =20 If you believe that RFC7752 describes security which=20 is less than a trusted domain, please let me how it is less.=20 =20 The RFC7752 text is below for ease of the IDR and secdir readers.=20 =20 Thank you for providing this feedback,=20 =20 Sue =20 ------------ =20 RFC7752 security section (section 8.) =20 =20 8. Security Considerations =20 Procedures and protocol extensions defined in this document do not affect the BGP security model. See the Security Considerations section of [RFC4271] for a discussion of BGP security. Also refer to [RFC4272] and [RFC6952] for analysis of security issues for BGP =20 In the context of the BGP peerings associated with this document, a BGP speaker MUST NOT accept updates from a consumer peer. That is, a participating BGP speaker should be aware of the nature of its relationships for link-state relationships and should protect itself from peers sending updates that either represent erroneous information feedback loops or are false input. Such protection can be achieved by manual configuration of consumer peers at the BGP speaker. =20 An operator SHOULD employ a mechanism to protect a BGP speaker against DDoS attacks from consumers. The principal attack a consumer may apply is to attempt to start multiple sessions either sequentially or simultaneously. Protection can be applied by imposing rate limits. =20 Additionally, it may be considered that the export of link-state and TE information as described in this document constitutes a risk to confidentiality of mission-critical or commercially sensitive information about the network. BGP peerings are not automatic and require configuration; thus, it is the responsibility of the network operator to ensure that only trusted consumers are configured to receive such information. =20 =20 =20 From: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com]=20 Sent: Friday, October 19, 2018 1:29 PM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 Inline. =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 10:08 AM To: Les Ginsberg (ginsberg) ; 'Robert Raszuk' = ; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Les: =20 I apologize if my email message was unclear. We both agree that your = draft is not related to SR routing. SR routing is related to BGP-LS as = a transport mechanism for information. =20 =20 I agree that RFC7752 had traffic engineering information. However, that = traffic engineering information almost got that draft rejected by the = IESG at the time. As my previous message to this list indicated, we got = agreement on RFC7752 based on limiting that information and the = assurance that BGP-LS nodes were deployed on a separate set of nodes. = Expanding the traffic engineering information beyond RFC7752 re-opens = all the security issues and questions from RFC7752=E2=80=99s original = review. =20 =20 [Les:] So far, you are the only person who seems aware of this. I am not = saying you are wrong =E2=80=93 I am just saying my private attempts to = get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this. If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point. =20 The security directorate reviewer is asking these security questions. = The security directorate does have people with both routing and security = experts. =20 =20 SR routing is also expanding the information past the original RFC7752. = The expansions requested by SR routing also re-open those original = security questions and issues. =20 =20 [Les:] I do not know why you mention SR here since we both agree this = draft is not SR related. =20 One way to answer these questions is to provide a RFC7752bis with an = updated security section. If you agree with this approach, I suggest = simply referring to a RFC7752bis that in your security section. If you = disagree that an update to the RFC7752bis is required, we can start a = thread on that point.=20 =20 [Les:] There is no RFC7752bis draft. J So you are asking me to = reference a non-existent document? =20 I understand that you (at least) would like to have one =E2=80=93 which = is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 correct? =20 But this dodges the question as to whether draft-ietf-idr-te-pm-bgp has = a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an RFC. =20 Les =20 Did this message clarify my earlier brief message? Do you want to = continue to discuss the need for RFC7752bis?=20 =20 Cheerily, Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Les Ginsberg = (ginsberg) Sent: Friday, October 19, 2018 10:58 AM To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu Cc: idr@ietf.org; draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Sue =E2=80=93 =20 One of us is confused. J =20 draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those words = do not appear anywhere in the document. Nor is there a reference to any = SR document. =20 Further, RFC 7752 includes traffic engineering information (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 = ) so the suggestion that we are introducing a new = attack vector by defining some additional(sic) TE codepoints does not = make sense to me. =20 I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them. =20 Could you please update your response with these points in mind? =20 Thanx. =20 Les =20 =20 From: Susan Hares =20 Sent: Friday, October 19, 2018 6:26 AM To: 'Robert Raszuk' ; kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Robert, Benjamin, and Yoav:=20 =20 I agree these context of these issues are not specific to this draft. = However, traffic engineering information does provide information which = is a tempting attack vector.=20 =20 The original RFC7752 described a different purpose with restricted usage = that SR routing extensions do not adhere to in BGP. Since Spring WG = shows that operators are interested in the extended use, it may be time = to examine the RFC7752bis or other solutions that takes care of these = security issues. =20 =20 My job as a shepherd is to point out these issues per draft for the IESG = and security directorate in order to obtain the correct feedback. As a = WG chair, I have pointed out these issues, but the WG has these drafts = on WG LC without the extra security. Without RFC7752bis with additional security in the base document, I am = working as a shepherd make the manageability and security sections as = clear as possible. =20 =20 If the feedback from the security directorate review or the IESG is that = we need to obtain a solution for RFC7752bis that describes and handles = these security issues, I will be glad to support fast-tracking this = issue within the WG.=20 =20 If an offline discussion with Benjamin, Yoav, the IDR chairs, and Alvaro = would speed this along, I can set this up early next week. It would be = helpful to have this offline discussion before the IDR interim session = on 10/26.=20 =20 Thank you for all your comments.=20 =20 Sue=20 =20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Robert Raszuk Sent: Friday, October 19, 2018 2:52 AM To: kaduk@mit.edu Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Benjamin, =20 Not sure if you have spotted similar comment made to IDR regarding this = topic, but your comment seems to indicate that here we are about to = define ways to carry nicely scoped IGP information into BGP. Well that = has already happened with RFC7752 and your comment or for that matter = Yoav's remarks are indeed spot on but to the security discussion on = RFC7752 and IMO not any follow up extensions of it.=20 =20 Sure - as observed by Sue - one may argue that providing more = information about the network to the potential attacker makes the = network weaker, but the cure for that is to prevent the leaks and reduce = probability of intercepting new information by unauthorized parties.=20 =20 BGP-LS is already defined in a new SAFI what by itself does provide nice = level of isolation. RFC7752 is pretty clear on that too and says:=20 =20 "BGP peerings are not automatic and require configuration; thus, it is = the responsibility of the network operator to ensure that only trusted = consumers are configured to receive such information." =20 If someone would be still concerned about configuration mistakes and = negotiating SAFI 71 or 72 to those who should not get this data I = recommend we reissue the RFC7752 as -bis version and restrict the scope = of the distribution even further by mandating default use of NO-EXPORT = community with ability to overwrite it for the selective eBGP peers. Or = perhaps we could progress Jim's One Administrative Domain draft = (draft-uttaro-idr-oad-01).=20 =20 In either case while both of your comments are great they seems a bit = late in the game here or at least targeting wrong document.=20 =20 Kind regards, Robert. =20 =20 On Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk wrote: On Thu, Oct 18, 2018 at 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote: > Yoav =E2=80=93 >=20 > In regards to the risks associated with advertising the specific = information covered in this draft we have a statement in the IGP drafts: >=20 > From RFC7810 >=20 > =E2=80=9CThe sub-TLVs introduced in this document allow an operator to > advertise state information of links (bandwidth, delay) that could = be > sensitive and that an operator may not want to disclose.=E2=80=9D >=20 > In regards to the risks associated with sending information via BGP-LS = we have a number of statements in RFC 7752 =E2=80=93 most relevant is: >=20 > =E2=80=9CAdditionally, it may be considered that the export of = link-state and > TE information as described in this document constitutes a risk to > confidentiality of mission-critical or commercially sensitive > information about the network.=E2=80=9D >=20 > So long as there are references to both the IGP RFCs and RFC 7752 I am = therefore hard pressed to understand what else could be usefully said. > Certainly the risks associated with the BGP-LS transport mechanism are = not altered by adding some new TLVs =E2=80=93 and since the IGP RFCs = have already covered risks associated with the specific class of = information (not simply the risks associated with the transport = mechanism) you are going to have to provide more specifics on what can = meaningfully be said that is not already covered in the references. My apologies for jumping in in the middle, but IIUC the IGP RFCs have covered the risks associated with a specific class of information, = *under the assumption that the transport mechanism is within a single AS and administrative domain*. Yoav is pointing out that the risks for that information may change when the distribution is over a broader domain = than the one for which the previous analysis was performed. -Ben ------=_NextPart_000_0476_01D467E0.FD887220 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

John:

 

Per Les=E2=80=99s request we are trimming any discussion of my = suggested solution to let him focus on resolving the issues with the = sec-dir people.=C2=A0 =C2=A0=C2=A0=C2=A0

 

IMHO I do not think Les was close to resolving the issue main issue, = but we both can watch and read as he continues to discuss this point = with the secdir people.=C2=A0 =C2=A0As WG chair, I will continue to = support resolution of secdir comments.

 

Respectfully, Sue

 

PS - Your personal comments regarding my email on SR or RFC7752 miss = the point that RFC8402 resolves many issues by declaring the SR area a = trusted domain.

=C2=A0

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of John E = Drake
Sent: Friday, October 19, 2018 6:41 PM
To: = Susan Hares; 'Les Ginsberg (ginsberg)'; 'Robert Raszuk'; = kaduk@mit.edu
Cc: idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; = ynir.ietf@gmail.com; secdir@ietf.org
Subject: Re: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Hi,

 

Comments inline

 

Yours Irrespectively,

 

John

 

From: Idr = <idr-bounces@ietf.org> On Behalf Of Susan = Hares
Sent: Friday, October 19, 2018 6:32 PM
To: = 'Les Ginsberg (ginsberg)' <ginsberg@cisco.com>; 'Robert Raszuk' = <robert@raszuk.net>; kaduk@mit.edu
Cc: = ynir.ietf@gmail.com; idr@ietf.org; ietf@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; = secdir@ietf.org
Subject: Re: [Idr] [secdir] Secdir early = review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I politely asked for viewpoint on RFC7752=E2=80=99s security since = your draft depends on RFC7752.  You have impolitely and harshly = refused to comment on these points. 

 

I am focused on finding a resolution to the security directorates = comments on this draft on this thread.   One resolution was to = suggest a general resolution by revising the RFC7752 draft.  =  I have spent time today providing background and reasons why this = might be a good resolution.  I see from your comments that you are = rejecting this potential resolution.

 

[JD]  What part of =E2=80=9Cthis draft has nothing to do with = segment routing=E2=80=9D do you not = understand=E2=80=9D? 

 

Propose a resolution to the secdir comments.    Please = note as your shepherd and WG chair, stating  =E2=80=9Csecurity = directorate does not understand BGP=E2=80=9D is not a = resolution. 

 

[JD]  From whom did that direct quote come?  I = don=E2=80=99t recall seeing it on the email thread. 

 

IMHO as shepherd for your document Yoav has a valid point that on = vagueness of RFC7752 and the addition of new information.  =  Please continue to work with Yoav, Benjamin and the secdir to = resolve their concerns since my resolution has been rejected by = you. 

 

[JD]  I just re-read the entire email thread on this draft and = it appears to me that that the above is exactly what Les was doing and = that he was quite close to a resolution before you injected RFC 7752bis = and segment routing into the conversation.

 

Sue Hares

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 6:01 PM
To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ynir.ietf@gmail.com
Subject= : Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

I will not reinforce your inappropriate insertion of the discussion = of possible RFC 7752 deficiencies into a thread which is reviewing = draft-ietf-idr-te-pm-bgp. This is wrong =E2=80=93 please stop = it.

 

You want to discuss issues with RFC 7752 =E2=80=93 please start a = separate thread =E2=80=93 directed at the WG (of course) =E2=80=93 and = state your position as a WG member as to what you feel needs to be done. = Then others can comment and the WG can decide whether they agree work = needs to be done.

 

Also - and for the third time - draft-ietf-idr-te-pm-bgp is NOT SR = related =E2=80=93 please also stop inserting a discussion of SR/BGP-LS = into the review of this draft.

 

(Apologies for the harsh tone =E2=80=93 but it is becoming = increasingly frustrating to watch this thread being = misdirected.)

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 2:32 PM
To: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I will respond to this information point by point after I have = responded to Ketan who sent me messages regarding his draft prior to = yours.   However, I would like your feedback on whether you = believe RFC7752 has security that is equivalent to, less than, or = greater than a trusted domain?

 

The spring routing architecture (RFC8402) indicates that be default = SR operates within a trusted domain.   It says further: =

 

=E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of best = practices to reduce the risk of tampering within the trusted domain is = important.  Such practices are discussed in [RFC4381] and = are applicable to both SR-MPLS and SRv6.=E2=80=9D =

 

If you believe that RFC7752 describes a trusted domain [per RFC4381], =

RFC7762 does not state that it is a trusted domain. =

 

If you believe the RFC7752 has stronger security =

than a trusted domain, can you let me know

why you think it is stronger than a trusted domain.  =

 

If you believe that RFC7752 describes security which =

is less than a trusted domain, please let me how it is less. =

 

The RFC7752 text is below for ease of the IDR and secdir readers. =

 

Thank you for providing this feedback,

 

Sue

 

------------

 

RFC7752 security section (section 8.)  

 

8.  Security Considerations

 

   Procedures and protocol extensions defined in this = document do not

   affect the BGP security model.  See the Security = Considerations

   section of [RFC4271] for a discussion of BGP = security.  Also refer to

   [RFC4272] and [RFC6952] for analysis of security issues = for BGP

 

   In the context of the BGP peerings associated with this = document, a

   BGP speaker MUST NOT accept updates from a consumer = peer.  That is, a

   participating BGP speaker should be aware of the nature of = its

   relationships for link-state relationships and should = protect itself

   from peers sending updates that either represent = erroneous

   information feedback loops or are false input.  Such = protection can

   be achieved by manual configuration of consumer peers at = the BGP

   speaker.

 

    An operator SHOULD employ a mechanism to protect a = BGP speaker

   against DDoS attacks from consumers.  The principal = attack a consumer

   may apply is to attempt to start multiple sessions = either

   sequentially or simultaneously.  Protection can be = applied by

   imposing rate limits.

 

   Additionally, it may be considered that the export of = link-state and

   TE information as described in this document constitutes = a risk to

   confidentiality of mission-critical or commercially = sensitive

   information about the network.  BGP peerings are = not automatic and

   require configuration; thus, it is the responsibility of = the network

   operator to ensure that only trusted consumers are = configured to

   receive such information.

 

 

 

From:= = Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com] =
Sent: Friday, October 19, 2018 1:29 PM
To: Susan = Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

Inline.

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 10:08 AM
To: Les = Ginsberg (ginsberg) <ginsberg@cisco.com>; 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = RE: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Les:

 

I apologize if my email message was unclear.   We both = agree that your draft is not related to SR routing.   SR = routing is related to BGP-LS as a transport mechanism for information. =  

 

I agree that RFC7752 had traffic engineering information.  = However, that traffic engineering information almost got that draft = rejected by the IESG at the time.  As my previous message to this = list indicated, we got agreement on RFC7752 based on limiting that = information and the assurance that BGP-LS nodes were deployed on a = separate set of nodes.  Expanding the traffic engineering = information beyond RFC7752 re-opens all the security issues and = questions from RFC7752=E2=80=99s original review. =  

 

[Les:] So far, you are the only person who seems aware of this. I am = not saying you are wrong =E2=80=93 I am just saying my private attempts = to get more context for this have thus far failed =E2=80=93 and you have = not provided any documentation of this.

If your statement is accurate (again =E2=80=93 not saying it = isn=E2=80=99t) =E2=80=93 it also seems most unfortunate (and I am being = =E2=80=9Ckind=E2=80=9D here) that this was not mentioned in the course = of the four years that draft-ietf-idr-te-pm-bgp has taken to progress to = this point.

 

The security directorate reviewer is asking these security = questions.  The security directorate does have people with both = routing and security experts.   

 

SR routing is also expanding the information past the original = RFC7752.   The expansions requested by SR routing also re-open = those original security questions and issues.  =

 

[Les:] I do not know why you mention SR here since we both agree this = draft is not SR related.

 

One way to answer these questions is to provide a  RFC7752bis = with an updated security section.  If you agree with this approach, = I suggest simply referring to a RFC7752bis that in your security = section.   If you disagree that an update to the RFC7752bis is = required, we can start a thread on that point.

 

[Les:] There is no RFC7752bis draft. J  So you are asking me to reference a non-existent = document?

 

I understand that you (at least) would like to have one =E2=80=93 = which is perfectly legitimate =E2=80=93 though you should go through the = normal WG process to take this work on =E2=80=93 = correct?

 

But this dodges the question as to whether draft-ietf-idr-te-pm-bgp = has a dependency on enhanced security. So far, you are the only person = making this claim =E2=80=93 and several folks (including myself) have = expressed a different POV. I think you at least have to provide a = justification for this dependency before we introduce it and get some = support for your position =E2=80=93 since this will mean = draft-ietf-idr-te-pm-bgp would be stuck in MISSREF state until this = currently non-existent draft becomes an = RFC.

 

   Les

 

Did this message clarify my earlier brief message?  Do you want = to continue to discuss the need for RFC7752bis?

 

Cheerily, Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Les Ginsberg (ginsberg)
Sent: Friday, = October 19, 2018 10:58 AM
To: Susan Hares; 'Robert Raszuk'; kaduk@mit.edu
Cc: idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org; ietf@ietf.org; ynir.ietf@gmail.com; secdir@ietf.org
Subject: = Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

Sue =E2=80=93

 

One of us is confused. J

 

draft-ietf-idr-te-pm-bgp is not related to Segment Routing. Those = words do not appear anywhere in the document. Nor is there a reference = to any SR document.

 

Further, RFC 7752 includes traffic engineering information (see https://tools.ietf.org/= html/rfc7752#section-3.3.2 ) so the suggestion that we are = introducing a new attack vector by defining some additional(sic) TE = codepoints does not make sense to me.

 

I appreciate that there are other drafts on your mind which are SR = related =E2=80=93 but this is not one of them.

 

Could you please update your response with these points in = mind?

 

Thanx.

 

   Les

 

 

From: Susan = Hares <shares@ndzh.com> =
Sent: Friday, October 19, 2018 6:26 AM
To: 'Robert = Raszuk' <robert@raszuk.net>; kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: RE: [Idr] [secdir] Secdir = early review of = draft-ietf-idr-te-pm-bgp-13

 

Robert, Benjamin, and Yoav:

 

I agree these context of these issues are not specific to this = draft.  However, traffic engineering information does provide = information which is a tempting attack vector.

 

The original RFC7752 described a different purpose with restricted = usage that SR routing extensions do not adhere to in BGP.   = Since Spring WG shows that operators are interested in the extended use, = it may be time to examine the RFC7752bis or other solutions that takes = care of these security issues. 

 

My job as a shepherd is to point out these issues per draft for the = IESG and security directorate in order to obtain the correct feedback. =  As a WG chair, I have pointed out these issues, but the WG has = these drafts on WG LC without the extra = security.

Without RFC7752bis with additional security in the base document, I = am working as a shepherd make the manageability and security sections as = clear as possible.  

 

If the feedback from the security directorate review or the IESG is = that we need to obtain a solution for RFC7752bis that describes and = handles these security issues, I will be glad to support fast-tracking = this issue within the WG.

 

If an offline discussion with Benjamin, Yoav, the IDR chairs, and = Alvaro would speed this along, I can set this up early next week.  = It would be helpful to have this offline discussion before the IDR = interim session on 10/26.

 

Thank you for all your comments.

 

Sue

 

 

From:= = Idr [mailto:idr-bounces@ietf.org] = On Behalf Of Robert Raszuk
Sent: Friday, October 19, = 2018 2:52 AM
To: kaduk@mit.edu
Cc: ietf@ietf.org; secdir@ietf.org; ynir.ietf@gmail.com; idr@ietf.org; draft-ietf-idr-te-p= m-bgp.all@ietf.org
Subject: Re: [Idr] [secdir] Secdir = early review of draft-ietf-idr-te-pm-bgp-13

 

Hello Benjamin,

 

Not sure if you have spotted similar comment made to = IDR regarding this topic, but your comment seems to indicate that here = we are about to define ways to carry nicely scoped IGP information into = BGP. Well that has already happened with RFC7752 and your comment or for = that matter Yoav's remarks are indeed spot on but to the security = discussion on RFC7752 and IMO not any follow up extensions of = it. 

 

Sure - as observed by Sue - one may argue that = providing more information about the network to the potential attacker = makes the network weaker, but the cure for that is to prevent the leaks = and reduce probability of intercepting new information by unauthorized = parties. 

 

BGP-LS is already defined in a new SAFI what by itself = does provide nice level of isolation. RFC7752 is pretty clear on that = too and says: 

 

"BGP peerings are not automatic and require = configuration; thus, it is the responsibility of the network operator to = ensure that only trusted consumers are configured to receive such = information."

 

If someone would be still concerned about = configuration mistakes and negotiating SAFI 71 or 72 to those who should = not get this data I recommend we reissue the RFC7752 as -bis version and = restrict the scope of the distribution even further by mandating default = use of NO-EXPORT community with ability to overwrite it for the = selective eBGP peers. Or perhaps we could progress Jim's One = Administrative Domain draft = (draft-uttaro-idr-oad-01). 

 

In either case while both of your comments are great = they seems a bit late in the game here or at least targeting wrong = document. 

 

Kind regards,

Robert.

 

 

On = Fri, Oct 19, 2018 at 2:27 AM Benjamin Kaduk <kaduk@mit.edu> = wrote:

On Thu, Oct 18, 2018 at = 06:00:13PM +0000, Les Ginsberg (ginsberg) wrote:
> Yoav = =E2=80=93
>
> In regards to the risks associated with = advertising the specific information covered in this draft we have a = statement in the IGP drafts:
>
> From RFC7810
> =
> =E2=80=9CThe sub-TLVs introduced in this document allow an = operator to
>    advertise state information of links = (bandwidth, delay) that could be
>    sensitive and that = an operator may not want to disclose.=E2=80=9D
>
> In = regards to the risks associated with sending information via BGP-LS we = have a number of statements in RFC 7752 =E2=80=93 most relevant = is:
>
> =E2=80=9CAdditionally, it may be considered that = the export of link-state and
>    TE information as = described in this document constitutes a risk to
>    = confidentiality of mission-critical or commercially = sensitive
>    information about the = network.=E2=80=9D
>
> So long as there are references to = both the IGP RFCs and RFC 7752 I am therefore hard pressed to understand = what else could be usefully said.
> Certainly the risks associated = with the BGP-LS transport mechanism are not altered by adding some new = TLVs =E2=80=93 and since the IGP RFCs have already covered risks = associated with the specific class of information (not simply the risks = associated with the transport mechanism) you are going to have to = provide more specifics on what can meaningfully be said that is not = already covered in the references.

My apologies for jumping in in = the middle, but IIUC the IGP RFCs have
covered the risks associated = with a specific class of information, *under
the assumption that the = transport mechanism is within a single AS and
administrative = domain*.  Yoav is pointing out that the risks for = that
information may change when the distribution is over a broader = domain than
the one for which the previous analysis was = performed.

-Ben

------=_NextPart_000_0476_01D467E0.FD887220-- From nobody Fri Oct 19 16:54:37 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C886C1310FC; Fri, 19 Oct 2018 16:54:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2FltK_QVj2w7; Fri, 19 Oct 2018 16:54:12 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 178461310B4; Fri, 19 Oct 2018 16:54:11 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Robert Raszuk'" Cc: "'Les Ginsberg \(ginsberg\)'" , , , , , "'Yoav Nir'" , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <00a601d467af$3c4b90f0$b4e2b2d0$@ndzh.com> <028b01d467ce$402b2400$c0816c00$@ndzh.com> <03e101d467f3$2bff9130$83feb390$@ndzh.com> In-Reply-To: Date: Fri, 19 Oct 2018 19:54:06 -0400 Message-ID: <04c301d46807$05d98bf0$118ca3d0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_04C4_01D467E5.7EC8D650" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAfFlXbIB67+5BAE930AoAZRhPWMClJo7/QFrm+9foszUiUA= Content-Language: en-us X-Antivirus: AVG (VPS 181019-4, 10/19/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2018 23:54:20 -0000 This is a multipart message in MIME format. ------=_NextPart_000_04C4_01D467E5.7EC8D650 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Robert:=20 =20 I disagree with many of your comment below. However, a discussion of = these points is no longer appropriate on this thread. Les has indicated = my suggested resolution of a revision to RFC7752 is not an acceptable = alternative. He wishes to focus on directly resolving these issues = with the secdir. This thread is closed to any further discussions on a = revision of RFC7752. =20 =20 If you wish to discuss these offline, you can send me email. If you = wish to discuss these on a different thread, please start that specific = thread. =20 =20 Sue =20 PS =E2=80=93 The point of my questions were to explore if recasting the = web of RFC7752 BGP peers as a trusted domain with the restrictions in = RFC8402 would resolve security concerns related to RFC7752. =20 =20 From: Robert Raszuk [mailto:robert@raszuk.net]=20 Sent: Friday, October 19, 2018 6:28 PM To: shares@ndzh.com Cc: Les Ginsberg (ginsberg); kaduk@mit.edu; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; Yoav Nir; = secdir@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 Hello Sue, =20 However, I would like your feedback on whether you believe RFC7752 has = security that is equivalent to, less than, or greater than a trusted = domain?=20 =20 The spring routing architecture (RFC8402) indicates that be default SR = operates within a trusted domain.=20 =20 =E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of = best practices to reduce the risk of tampering within the trusted domain = is important. Such practices are discussed in [RFC4381 = ] and are applicable to both = SR-MPLS and SRv6.=E2=80=9D =20 =20 Reading your comments I am also similarly to Les's feelings quite not = sure what the point here is.=20 =20 SR Architecture while completely irrelevant to this thread talks about = trusted domain in the context of data plane. Bringing in L3VPNs out of = the sudden only because some SR document referred to it's security = analysis is also quite a bizarre maneuver.=20 =20 With control plane and especially with BGP the notion of trusted vs = untrusted domain is not something anyone can just pick or state on what = his or her believe is.=20 =20 The short answer is that BGP operates on a per AFI/SAFI basis and level = of trust is directly related to the actual configuration applied = including level of policy inserted when using such apparatus to = distribute various forms of information.=20 =20 Same SAFI can be configured by one operator quite strictly limiting it = to one AS and someone else will like to share his information with = entire world publishing it to a looking glass. Are we here to restrict = this ? What means of control is there to enforce such restrictions other = then perhaps stating simple recommendation in an advisory fashion that = one should be a bit careful when publishing content of his LSDB or TED = beyond devices he trusts ? ** =20 ** Note that even if TE infrastructure addresses or other information = are accidentally leaked - there should be no great immediate harm - = since well managed network prevents on ingress to the domain any flows = which would aim at internal infrastructure address space.=20 =20 Thx, R. =20 =20 ------=_NextPart_000_04C4_01D467E5.7EC8D650 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Robert:

 

I disagree with many of your comment below. =C2=A0However,=C2=A0 a = discussion of these points is no longer appropriate on this thread. Les = has indicated my suggested resolution of a revision to RFC7752 is not an = acceptable alternative.=C2=A0 =C2=A0He wishes to focus on directly = resolving these issues with the secdir.=C2=A0 This thread is closed to = any further discussions on a revision of RFC7752.=C2=A0 =

 

If you wish to discuss these offline, you can send me email. = =C2=A0=C2=A0If you wish to discuss these on a different thread, please = start that specific thread. =C2=A0=C2=A0

=C2=A0

Sue

 

PS =E2=80=93 The point of my questions were to explore if recasting = the web of RFC7752 BGP peers as a trusted domain with the restrictions = in RFC8402 would resolve security concerns related to RFC7752. = =C2=A0

 

From:= = Robert Raszuk [mailto:robert@raszuk.net]
Sent: Friday, = October 19, 2018 6:28 PM
To: shares@ndzh.com
Cc: Les = Ginsberg (ginsberg); kaduk@mit.edu; idr@ietf.org; = draft-ietf-idr-te-pm-bgp.all@ietf.org; ietf@ietf.org; Yoav Nir; = secdir@ietf.org
Subject: Re: [Idr] [secdir] Secdir early = review of draft-ietf-idr-te-pm-bgp-13

 

Hello Sue,

 

However, I would like your feedback on whether you believe RFC7752 = has security that is equivalent to, less than, or greater than a trusted = domain?

 

The spring routing architecture (RFC8402) indicates that be default = SR operates within a trusted domain. 

 

=E2=80=9CTraffic MUST be filtered at the domain boundaries. The use of best = practices to reduce the risk of tampering within the trusted domain is = important.  Such practices are discussed in [RFC4381] and are applicable to both SR-MPLS = and SRv6.=E2=80=9D

 

 

Reading your comments I am also similarly to Les's = feelings quite not sure what the point here = is. 

 

SR Architecture while completely irrelevant to this = thread talks about trusted domain in the context of data plane. Bringing = in L3VPNs out of the sudden only because some SR document referred to = it's security analysis is also quite a bizarre = maneuver. 

 

With control plane and especially with BGP the notion = of trusted vs untrusted domain is not something anyone can just pick or = state on what his or her believe is. 

 

The short answer is that BGP operates on a per = AFI/SAFI basis and level of trust is directly related to the actual = configuration applied including level of policy inserted when using such = apparatus to distribute various forms of = information. 

 

Same SAFI can be configured by one operator quite = strictly limiting it to one AS and someone else will like to share his = information with entire world publishing it to a looking glass. Are we = here to restrict this ? What means of control is there to enforce such = restrictions other then perhaps stating simple recommendation in an = advisory fashion that one should be a bit careful when publishing = content of his LSDB or TED beyond devices he trusts ? = **

 

** Note that even if TE infrastructure addresses or = other information are accidentally leaked - there should be no great = immediate harm - since well managed network prevents on ingress to the = domain any flows which would aim at internal infrastructure address = space. 

 

Thx,
R.

 

 

------=_NextPart_000_04C4_01D467E5.7EC8D650-- From nobody Sun Oct 21 10:45:05 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 549751294D7; Sun, 21 Oct 2018 10:44:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IDi-Mev0zJLX; Sun, 21 Oct 2018 10:44:44 -0700 (PDT) Received: from mail-wm1-x333.google.com (mail-wm1-x333.google.com [IPv6:2a00:1450:4864:20::333]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82E1B1277C8; Sun, 21 Oct 2018 10:44:44 -0700 (PDT) Received: by mail-wm1-x333.google.com with SMTP id 193-v6so8033446wme.3; Sun, 21 Oct 2018 10:44:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=nWFYWvsGvmBpI9y6EwyTL/Ug2BsRvMfBukoF+t+OQOA=; b=bICUxXbMRFQwXMOmp4anhQkyN3Lt1EsLomq1VFhebzsi2MbLmrrpy2JoiM4malY3Cz 6RRRy4Wpr6MEQGtNu7IlXSwDLbBBjBn3ToqCOzLud2QWGOofCQ59QwZWRNcQkJMowJbJ l1IZEN58D/f5cwY2tPyen/KtV3WNg7d7LCkmHEqtpDuXzY81T0FC9uWG89KTV7NOkLXB JRmHEhtvYbQlS07mqckxnttEH+V7aFPDXsXOIxoXsS8RbZ/vpqKvn3KwMCz1HgSGJXzs gJoRMseWhNbHOqrTbcFj+JsJNnU8uKC+jO43mxPWYZVUZuwQhPQUUx2CVpFMG51OF0zw y5YQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=nWFYWvsGvmBpI9y6EwyTL/Ug2BsRvMfBukoF+t+OQOA=; b=MVz8Y+EdAN3CfSDCs4A4oUW7N64uYclyeQOBaIkuJkoXH48ZwzSiBVCez+C3/omFYW kF5Jmtx7J+G4lZyH+0HYEnbd4Qlj+AL4YrrCiuAktZ/WxBbhz3mXGWAcLCcY67yJ/iKD WRJ1YMCE0b9HFJCZtcZ6X/KrloFxF/IfhHSu3sv+OWogDo6+kghATNn2Pm0hpJ4P0Xsi eJxA8x7lEKSYyUFvEqdZUu/uccwZZwQY/t1JA7Z0LAvrz8/aSCQuRK6OoO0DVvIFAnSE zh5uXHkRq+ReSQLxLc2D81jAj+K4oD9nBVmbTLpeJiB6NMLSMf8CMpNEn3otLVSjpp+a TSiQ== X-Gm-Message-State: ABuFfoiAK7qDq4/U+iSaGyOKmFVwn620lghMVWyERYTW1i9QhfaVttqW 16rLLTuuAbd6rNUmmJTP1SU= X-Google-Smtp-Source: ACcGV60uRKlyrn9h5BvXdaNLH6ycrBKAKZMvzKgu7YX9tGGuZk+BKiW3cgMf/0PU9oTxQD4SByFWXg== X-Received: by 2002:a1c:8c46:: with SMTP id o67-v6mr12688382wmd.35.1540143882832; Sun, 21 Oct 2018 10:44:42 -0700 (PDT) Received: from [192.168.1.12] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id b71-v6sm13699853wma.13.2018.10.21.10.44.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 21 Oct 2018 10:44:41 -0700 (PDT) From: Yoav Nir Message-Id: <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BAF65A53-C2C8-474B-9AB7-839922543D4F" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Sun, 21 Oct 2018 20:44:39 +0300 In-Reply-To: Cc: Robert Raszuk , "kaduk@mit.edu" , "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "secdir@ietf.org" To: "Les Ginsberg (ginsberg)" References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Oct 2018 17:44:48 -0000 --Apple-Mail=_BAF65A53-C2C8-474B-9AB7-839922543D4F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 See inline. > On 19 Oct 2018, at 17:51, Les Ginsberg (ginsberg) = wrote: >=20 > Robert=E2=80=99s post addresses points I also want to make. > =20 > What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism =E2=80= =93 nor is the information being advertised here (some additional TE = related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = https://tools.ietf.org/html/rfc7752#section-3.3.2 = ). If this = information had already been defined in the IGPs at the time RFC 7752 = was written it would simply have been included as a section of RFC 7752 = and no additional changes to RFC 7752 would have been required. > =20 > In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. > =20 > I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. [YN] Right, and as such, I believe that this document should address the = part that it adds to RFC 7752. IOW it should state that the new IGP = information that will now be sent through BGP does not present = new/different risk to the information already defined in 7752. This is = information that has up until now only been sent in IS-IS and OSPF and = will not be sent in BGP, so we need a statement that it=E2=80=99s OK to = send these attributes in BGP as well. Of course, such a statement could = be challenged in WGLC or IETF LC, but it should be made. > The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. > =20 > I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document =E2=80=93= and it is safe to say it won=E2=80=99t be the last. It would be helpful = to all if we reached a common understanding or this discussion will take = place every time a BGP-LS extension document is being reviewed =E2=80=93 = which will cost us all time needlessly. > =20 > Les > =20 --Apple-Mail=_BAF65A53-C2C8-474B-9AB7-839922543D4F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 See = inline.

On 19 Oct 2018, at 17:51, Les Ginsberg = (ginsberg) <ginsberg@cisco.com> wrote:

Robert=E2=80=99s post = addresses points I also want to make.
 
What is being done here = is to add additional BGP-LS codepoints to advertise IGP information that = was not defined at the time RFC 7752 was written. We haven=E2=80=99t = changed the  BGP-LS transport mechanism =E2=80=93 nor is the = information being advertised here (some additional TE related link = attribute information) qualitatively different than a number of existing = TLVs defined in RFC 7752 (see https://tools.ietf.org/html/rfc7752#section-3.3.2 ). If this information had = already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been required.
 
In theory, we could = have simply updated RFC 7752 rather writing a separate draft, but = practically this would be a poor strategy as it would incorrectly = suggest that some change was being made to the existing text in RFC = 7752.
 
I appreciate that from = the POV of the Security Area you folks are not as intimately familiar = with the routing drafts and the relationship between them. It is = therefore understandable that you start looking at the new draft as a = standalone document =E2=80=93 and in that context your comments are = absolutely correct. But the document you are reviewing is most = accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. =

[YN] = Right, and as such, I believe that this document should address the part = that it adds to RFC 7752. IOW it should state that the new IGP = information that will now be sent through BGP does not present = new/different risk to the information already defined in 7752. This is = information that has up until now only been sent in IS-IS and OSPF and = will not be sent in BGP, so we need a statement that it=E2=80=99s OK to = send these attributes in BGP as well. Of course, such a statement could = be challenged in WGLC or IETF LC, but it should be made.

The issues you raise = have already been addressed in RFC 7752 and it is therefore very = appropriate that we address your concerns by including a reference to = the RFC 7752 security discussion.
 
I = think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document =E2=80=93= and it is safe to say it won=E2=80=99t be the last. It would be helpful = to all if we reached a common understanding or this discussion will take = place every time a BGP-LS extension document is being reviewed =E2=80=93 = which will cost us all time needlessly.
 
   Les
 

= --Apple-Mail=_BAF65A53-C2C8-474B-9AB7-839922543D4F-- From nobody Sun Oct 21 11:10:06 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF7B9130E83 for ; Sun, 21 Oct 2018 11:09:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.384 X-Spam-Level: X-Spam-Status: No, score=-3.384 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=epVBWeJH; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=ericsson.com header.b=N1sXBfMT Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xyQmQWD7sKby for ; Sun, 21 Oct 2018 11:09:55 -0700 (PDT) Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E49F8128766 for ; Sun, 21 Oct 2018 11:09:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1540145389; x=1542737389; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=u87jFWpTExA4fBAV3US2OSXi/sCOHKlBqOm2zPueij8=; b=epVBWeJH9Xg+fafbWFkc8McxNG7AXzIfbIkSwhWFJBTZ/eNvHz+11+xLgbLNS2Dc K7s9mzSGqDiZwwrnh9XBAy7/kW8w9xw8Rv0AVwp903ehfuyLryCMvJgeur8C4vsv TfH9Ac+aOQu+gUf6nNg8mkDPsOpfdjZe41B19uQNT9w=; X-AuditID: c1b4fb25-55bff700000018b4-8a-5bccc0ed21ab Received: from ESESSMB503.ericsson.se (Unknown_Domain [153.88.183.121]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 0B.36.06324.DE0CCCB5; Sun, 21 Oct 2018 20:09:49 +0200 (CEST) Received: from ESESSMR504.ericsson.se (153.88.183.126) by ESESSMB503.ericsson.se (153.88.183.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 21 Oct 2018 20:09:49 +0200 Received: from ESESBMB503.ericsson.se (153.88.183.170) by ESESSMR504.ericsson.se (153.88.183.126) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Sun, 21 Oct 2018 20:09:49 +0200 Received: from EUR03-AM5-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB503.ericsson.se (153.88.183.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Sun, 21 Oct 2018 20:09:49 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QHUUuwm0jwRiK4D1ais0MIPhnxO+HQeuAl3uWBJGj1c=; b=N1sXBfMTr9iE09FNyslAyFTY1TRt2DNX9/hCIEug1TCL7/KqTCsNS8fulWAE5Nu16GsONt8C1dgqSR1JVUyCSVlSspfKfXO1WKLA2GHlqXMMOel5eCU8ujFp9xasXtxiZGDh96T/74wyPxgPkPA6miS+VZ2Rf/EKH5ME2qzZ86M= Received: from HE1PR07MB4236.eurprd07.prod.outlook.com (20.176.166.145) by HE1PR07MB1371.eurprd07.prod.outlook.com (10.164.52.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.5; Sun, 21 Oct 2018 18:09:47 +0000 Received: from HE1PR07MB4236.eurprd07.prod.outlook.com ([fe80::b074:afe2:469c:dd95]) by HE1PR07MB4236.eurprd07.prod.outlook.com ([fe80::b074:afe2:469c:dd95%2]) with mapi id 15.20.1273.014; Sun, 21 Oct 2018 18:09:44 +0000 From: =?utf-8?B?QXJpIEtlcsOkbmVu?= To: Daniel Migault , "core@ietf.org" CC: "secdir@ietf.org" , "draft-ietf-core-too-many-reqs.all@ietf.org" , "ietf@ietf.org" , Jim Schaad Thread-Topic: [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 Thread-Index: AQHUXp4uT9p3k/kKcEqRctTF+ziW0KUVkX4AgBSDwYA= Date: Sun, 21 Oct 2018 18:09:44 +0000 Message-ID: <031D5D2F-69BA-4315-BC89-1F40363EF586@ericsson.com> References: <153895864367.4396.18138201518799857673@ietfa.amsl.com> <061801d45f27$602ef380$208cda80$@augustcellars.com> In-Reply-To: <061801d45f27$602ef380$208cda80$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ari.keranen@ericsson.com; x-originating-ip: [2001:14bb:180:9de9:c917:11cd:c0cb:e1a5] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR07MB1371; 6:G/LjbqX8Forbhvj3913oSYjUCrD/3dwxuIb0hEmeq6+79deWQjhpysl7qBYs5xR/y6gxQIUQaXxcBf5N7B44vOY2YOJi+z9QFbMCh7hGSoYgXfbXmc5xuc6YvL5rIqTBDbO8gqgf6YyK+eRhJw+zF8kD+dNvH17lQhmCxaZmsUtg/csU/BtfKgAm1AtNN7bdsTsCjhDVU36gPJN2fxiei/KCAniJFofcoqNbO2wgPhAVPX5pQsG0+lXycNQaux5TNZjpHwC3CXZxznlSIOGnZNEzs5oHMzeUxPKjKkoQInn0WR3PI8HQ5ylvskfl+W7D4+ZzueRKS6nnEFiBdlZS8USS5e/WzoVtPF0iUG3GGaumxHM9GPyLziMLsuV3U93+Q4i1bL+MyWi2PuoNGeFypEtyc/y5M6tz/Npt9R/+fWlkmfxronq9RygEJm+0fEM5H7JTx6IpvXMTBTqMGbckvA==; 5:U9EiMYXsixThk/fpRo5ZoV7i21sPtsr87rYtd9Fa0FpVVkzW//mL30cUc6or8t3LcfzCIhnKO4//ojDobE0g4o7j+7B502cMKLVOYV7QmF8Nu8YmObTMH9yITk1GZVzTQNW2cw1e094yHthR3o2DH3/aWTbXyziOqDaLDgUUA+4=; 7:ULaOi9JOzIYfsSj/r8gmimEU415Mpl29rJPUUDEWyAfbXxX1RAx+nih6YcQ1CeFyhoZfJyB6eJfy7gva5eoK5TLkbBIG5aD8cP2qmsh18FMMh2aB2v5mqkavBiT0BoXMT89k5KqGIdWVHgN5a+UjQA== x-ms-exchange-antispam-srfa-diagnostics: SOS;SOR; x-forefront-antispam-report: SFV:SKI; SCL:-1; SFV:NSPM; SFS:(10009020)(366004)(376002)(39860400002)(136003)(396003)(346002)(13464003)(189003)(199004)(14444005)(33656002)(110136005)(54906003)(606006)(316002)(25786009)(76176011)(105586002)(6506007)(53546011)(561944003)(102836004)(106356001)(85202003)(256004)(4326008)(99286004)(478600001)(345774005)(2900100001)(14454004)(2906002)(68736007)(36756003)(236005)(97736004)(6116002)(6512007)(54896002)(6306002)(6246003)(53936002)(7736002)(229853002)(6486002)(8676002)(81156014)(2501003)(82746002)(81166006)(83716004)(5250100002)(6436002)(8936002)(966005)(71190400001)(71200400001)(486006)(5660300001)(99936001)(86362001)(46003)(186003)(476003)(85182001)(446003)(2616005)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB1371; H:HE1PR07MB4236.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; x-ms-office365-filtering-correlation-id: 9e9740a4-13b8-49bb-3f82-08d637806132 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:HE1PR07MB1371; x-ms-traffictypediagnostic: HE1PR07MB1371: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(192374486261705)(158342451672863); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(102415395)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3231355)(944501410)(4983020)(52105095)(3002001)(93006095)(93001095)(148016)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201708071742011)(7699051)(76991095); SRVR:HE1PR07MB1371; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB1371; x-forefront-prvs: 083289FD26 received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 2xIoillKNk8AkZjyfV7CztyedgTqwMH93B5FakqJX+9FNC9Cwh3/djenqMd1srSHW9L31Nu2rSi1HT51wiRyyDLS5SfYlxd4yuaksFLYtckSk74ImX46udEr1aIfxC69ly+DEcQmTUyNIhq3mxpQhzTLAw+RfiCAn6DIuq6w++zVZs6vm0PAWUC3s7k41qfAIRFJ9xrttHBuh3L5sylcHldCz4NRtnFCmjyCfsB5gEl0XiDv4VHfGdvc/sjUZzACMCtTMrUXWYSPcaqC/mX2jYPaPpYB0zl52SvtStizKShuwbBOoUqUIiZcnkEeS//w8WwpZFVl1KGV/Gpv821E+PUDuoPT9gYeKP03f0tyNOo= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; boundary=Apple-Mail-A311F99D-D2B8-4576-8F7C-14596E8E1A78; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 9e9740a4-13b8-49bb-3f82-08d637806132 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Oct 2018 18:09:44.4434 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB1371 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA2WSeUhUURSHuW+bN4MTr3E7GWENFWnk2jKYmgZBRkEbEQrVqK9cx5hnoQVi pZgNiZlmTdYUWDptpllqlFurS6KZVpMIM25pPS1CbVokZ65G0H/fPef73Xvu5bKkIpNxY2M1 ybxWo05QMjLqwu6q1BVifWuEz2TZKlWtWEaqcg1XadXNwklGNVhuoFRfrpqpEHpjeVEhs7G4 2EpsJcJlgdF8QuxhXusdvE8Wk17wmDjYI6KUBxl1dDrSD6FTSMoCtxIyGtrIU0jGKrhnCIxD wwReTCAob68g/y5Od92yRxRcMQF1H8JsDYrLJaF68AqNrTwCen81zUQsCGqsQxJbhOGCoD+z lraxE7cDSnKeMzaJ5NoQiJcn7ZIjtw2ME+MIS9vheNuwBHMAfPt+m7AxxS2BkVGd3ZFz6yCv c4DEM6VCd+7naZ9lpVwIGAc22MqIc4HJ5lv2KMm5gqnfQOBbO4G5o4XB7AzDfVM09iNgpLlJ gusBUND7hsS8AF4bbMfKprmbgbYTs2FfeGGsI3HjLQPWvouUbQjgtsBIlz+udyB40to5s6sn jGecnAnHQ62um8hFvvp/BtTbH+Ysgh+XCpDeftG50HShn8LSXnj/yMxgdocqsYjE7AF1upIZ ZxHk68wSzMsge+IM/X99LViLLAjzKvj07Cv617mCHG4gZ4EXIhMP+Pl78drYKEFI0nhp+OQK NP0hGyp/LqlGnZ9DGxHHIqWDfP2d1ggFrT4spCY2osXT+1ju3mxHbpQmScMrneT6ly0RCnm0 OvUIr03aqz2UwAuNaD5LKV3l5jX3whXcAXUyH8/zB3ntbJdgpW7pKKvAMlQqet+trxSndu5/ Mnot2P169lGdzBCw0Gd0LKzUZcxPfBha2XO/4qlD6byfsh+Bjuca07oky1/Rxqqkj0vzg91M NXNcVo+m7V/qmnZk8LzUJbyq0KSLj/M6dsZC/pYGm9LirJeihBSPd2EfN0WailJydok7inOC skqi9mw+p6SEGLWvJ6kV1H8AgLcmJ5gDAAA= Archived-At: Subject: Re: [secdir] [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Oct 2018 18:09:57 -0000 --Apple-Mail-A311F99D-D2B8-4576-8F7C-14596E8E1A78 Content-Type: multipart/alternative; boundary=Apple-Mail-B37B20E9-8B8A-4DF5-B85C-E401F869282D Content-Transfer-Encoding: 7bit --Apple-Mail-B37B20E9-8B8A-4DF5-B85C-E401F869282D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 VGhhbmsgeW91IGZvciB0aGUgcmV2aWV3IERhbmllbCENCg0KSSBoYXZlIG5vdyBhZGRyZXNzZWQg eW91ciBjb21tZW50cyBpbiB0aGUgbGF0ZXN0IGRyYWZ0IHZlcnNpb24gaW4gR2l0aHViOg0KaHR0 cHM6Ly9naXRodWIuY29tL2NvcmUtd2cvdG9vLW1hbnktcmVxcy9wdWxsLzQvZmlsZXMNCg0KKiBD bGFyaWZpZWQgdGhlIHRleHQgaW4gc2VjdGlvbnMgNCBhbmQgNSByb3VnaGx5IGFzIHByb3Bvc2Vk DQoqIEFkZGVkIGEgbm90ZSBpbiBzZWN0aW9uIDUgdGhhdCBkcm9wcGluZyByZXF1ZXN0cyBtYXkg cmVzdWx0IGluIHJldHJpZXMgDQoqIEFkZGVkIGEgbm90ZSB0aGF0IHJlc3BvbnNlcyB3aXRob3V0 IGVuY3J5cHRpb24gY2FuIGxlYWsgaW5mb3JtYXRpb24gKGFncmVlIHdpdGggSmltIHRoYXQgaXTi gJlzIG5vdCBhIG1ham9yIHJpc2sgc28gZGlkbuKAmXQgYWRkIG5vcm1hdGl2ZSBsYW5ndWFnZSBv biB0aGlzKQ0KDQpJ4oCZbSBwbGFubmluZyB0byBzdWJtaXQgYSBuZXcgdmVyc2lvbiB0b21vcnJv dyBiZWZvcmUgdGhlIERMLg0KDQoNCkNoZWVycywNCkFyaQ0KDQo+IE9uIDggT2N0IDIwMTgsIGF0 IDE5LjUzLCBKaW0gU2NoYWFkIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPiB3cm90ZToNCj4gDQo+ IA0KPiANCj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+PiBGcm9tOiBjb3JlIDxjb3Jl LWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBEYW5pZWwgTWlnYXVsdA0KPj4gU2VudDog U3VuZGF5LCBPY3RvYmVyIDcsIDIwMTggNTozMSBQTQ0KPj4gVG86IHNlY2RpckBpZXRmLm9yZw0K Pj4gQ2M6IGRyYWZ0LWlldGYtY29yZS10b28tbWFueS1yZXFzLmFsbEBpZXRmLm9yZzsgaWV0ZkBp ZXRmLm9yZzsNCj4gY29yZUBpZXRmLm9yZw0KPj4gU3ViamVjdDogW2NvcmVdIFNlY2RpciBsYXN0 IGNhbGwgcmV2aWV3IG9mDQo+IGRyYWZ0LWlldGYtY29yZS10b28tbWFueS1yZXFzLTA0DQo+PiAN Cj4+IFJldmlld2VyOiBEYW5pZWwgTWlnYXVsdA0KPj4gUmV2aWV3IHJlc3VsdDogSGFzIE5pdHMN Cj4+IA0KPj4gSGksDQo+PiANCj4+IFJldmlld2VyOiBEYW5pZWwgTWlnYXVsdA0KPj4gUmV2aWV3 IHJlc3VsdDogSGFzIE5pdHMNCj4+IA0KPj4gSSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQg YXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUncw0KPiBvbmdvaW5nDQo+PiBlZmZv cnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElF U0cuIFRoZXNlDQo+PiBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVu ZWZpdCBvZiB0aGUgc2VjdXJpdHkgYXJlYQ0KPiBkaXJlY3RvcnMuDQo+PiBEb2N1bWVudCBlZGl0 b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBh bnkNCj4+IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy4NCj4+IA0KPj4gVGhlIGRvY3VtZW50IGlz IGNsZWFyIGFuZCBhbG1vc3QgcmVhZHkuICBNb3N0IG9mIG15IGNvbW1lbnRzIGNvbmNlcm5zIHRo ZQ0KPj4gIlNlY3VyaXR5IENvbnNpZGVyYXRpb25zIi4NCj4+IA0KPj4gWW91cnMsDQo+PiBEYW5p ZWwNCj4+IA0KPj4gNC4gIENvQVAgQ2xpZW50IEJlaGF2aW9yDQo+PiANCj4+ICAgQSBjbGllbnQg TVVTVCBOT1QgcmVseSBvbiBhIHNlcnZlciBiZWluZyBhYmxlIHRvIHNlbmQgdGhlIDQuMjkNCj4+ ICAgUmVzcG9uc2UgQ29kZSBpbiBhbiBvdmVybG9hZCBzaXR1YXRpb24gYmVjYXVzZSBhbiBvdmVy bG9hZGVkIHNlcnZlcg0KPj4gICBtYXkgbm90IGJlIGFibGUgdG8gcmVwbHkgdG8gYWxsIHJlcXVl c3RzIGF0IGFsbC4NCj4+IA0KPj4gPG1nbHQ+DQo+PiANCj4+IEkgYmVsaWV2ZSB0aGUgc2VudGVu Y2UgbWF5IGJlIHJlcGhyYXNlZC4gVGhpcyBpcyBqdXN0IGEgcHJvcG9zYWwuDQo+PiBPTEQNCj4+ ICAgbWF5IG5vdCBiZSBhYmxlIHRvIHJlcGx5IHRvIGFsbCByZXF1ZXN0cyBhdCBhbGwuDQo+PiBO RVcNCj4+ICAgbWF5IG5vdCBiZSBhYmxlIHRvIHJlcGx5IChhdCBhbGwpIHRvIHNvbWUgcmVxdWVz dHMuIC4NCj4+IA0KPj4gPC9tZ2x0Pg0KPj4gDQo+PiA1LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlv bnMNCj4+IA0KPj4gICBSZXBseWluZyB0byBDb0FQIHJlcXVlc3RzIHdpdGggYSBSZXNwb25zZSBD b2RlIGNvbnN1bWVzIHJlc291cmNlcw0KPj4gICBmcm9tIGEgc2VydmVyLiAgRm9yIGEgc2VydmVy IHVuZGVyIGF0dGFjayBpdCBtYXkgYmUgbW9yZSBhcHByb3ByaWF0ZQ0KPj4gICB0byBzaW1wbHkg ZHJvcCByZXF1ZXN0cyB3aXRob3V0IHJlc3BvbmRpbmcuDQo+PiANCj4+IDxtZ2x0Pg0KPj4gVGhl IGdhaW4gZnJvbSB0aGUgcmVzcG9uc2Ugd2l0aCBUb28gTWFueSBSZXF1ZXN0cyBSZXNwb25zZSBD b2RlIGlzIGFsbW9zdA0KPj4gdGhlIGN1cnJlbnQgcmVzcG9uc2UgYW5kIGFsbCAqc2ltaWxhciog cmVxdWVzdHMgZnJvbSB0aGF0IGNsaWVudCBkdXJpbmcNCj4gTWF4DQo+PiBBZ2UuIEkgc3VzcGVj dCB0aGF0IGlzIGxpa2VseSBhIGdhaW4gZXhjZXB0IHdoZW4gdGhlcmUgaXMgbm8gcmVzcG9uc2Vz DQo+IGZyb20gdGhlDQo+PiBzZXJ2ZXIgYW5kIGNsaWVudCBpcyBub3QgZXhwZWN0IHRvIHNlbmQg YSByZXF1ZXN0IGJlZm9yZSBNYXggQWdlLiBTaW1wbHkNCj4+IGRyb3BwaW5nIHRoZSByZXF1ZXN0 cyBtYXkgYWRkIHRoZSByZXRyeSB0cmFmZmljLCB0aG91Z2ggaXQgZGVwZW5kcyBvbiB0aGUNCj4+ IGFwcGxpY2F0aW9uLiBUaGF0IHNhaWQgeW91ciB0ZXh0IGlzIGNvcnJlY3QuIEkgYW0gd29uZGVy aW5nIGlmIGl0IHdvdWxkIGJlDQo+IGdvb2QgdG8NCj4+IGlsbHVzdHJhdGUgeW91ciBwdXJwb3Nl LiA8L21nbHQ+DQo+PiANCj4+ICAgSWYgYSBDb0FQIHJlcGx5IHdpdGggdGhlIFRvbyBNYW55IFJl cXVlc3RzIFJlc3BvbnNlIENvZGUgaXMgbm90DQo+PiAgIGF1dGhlbnRpY2F0ZWQgYW5kIGludGVn cml0eSBwcm90ZWN0ZWQsIGFuIGF0dGFja2VyIGNhbiBhdHRlbXB0IHRvDQo+PiANCj4+IEtlcmFu ZW4gICAgICAgICAgICAgICAgIEV4cGlyZXMgSmFudWFyeSAyNSwgMjAxOSAgICAgICAgICAgICAg ICBbUGFnZSAzXQ0KPj4gDQo+PiBJbnRlcm5ldC1EcmFmdCAgVG9vIE1hbnkgUmVxdWVzdHMgUmVz cG9uc2UgQ29kZSBmb3IgQ29BUCAgICAgICBKdWx5IDIwMTgNCj4+IA0KPj4gICBzcG9vZiBhIHJl cGx5IGFuZCBtYWtlIHRoZSBjbGllbnQgd2FpdCBmb3IgYW4gZXh0ZW5kZWQgcGVyaW9kIG9mIHRp bWUNCj4+ICAgYmVmb3JlIHRyeWluZyBhZ2Fpbi4NCj4+IA0KPj4gPG1nbHQ+DQo+PiBBIHNpbWls YXIgYXR0YWNrIG1heSBhbHNvIGNvbnNpc3RzIGluIGFuIGF0dGFja2VyIHRyaWdnZXJpbmcgbXVs dGlwbGUNCj4gcmVxdWVzdCBvcg0KPj4gdHJhbnNhY3Rpb25zIHdpdGggYSBzcG9vZmVkIElQIHNv IHRoZSBzZXJ2ZXIgZ2VuZXJhdGVzIHRoZSByZXBseSB0byB0aGUNCj4+IGxlZ2l0aW1hdGUgSVAu IFRoaXMgY291bGQgYmUgdXNlZCBpZiBhbiBhdHRhY2tlciBjYW5ub3QgZGlyZWN0bHkgc2VuZCB0 aGUNCj4gc3Bvb2ZlZA0KPj4gcmVzcG9uc2UgdG8gdGhlIGxlZ2l0aW1hdGUgY2xpZW50Lg0KPj4g DQo+PiBUaGUgcmVzcG9uc2UgY29kZSBwcm92aWRlcyBhbiBpbmZvcm1hdGlvbiBhYm91dCB0aGUg c3RhdGUgKG92ZXJsb2FkZWQpIG9mDQo+IHRoZQ0KPj4gc2VydmVyIHdoaWNoIGNhbiBiZSB1c2Vk IHRvIGluZmVyIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24uIFRoaXMgY291bGQNCj4gcG90ZW50aWFs bHkNCj4+IGJlIHVzZWQgYnkgYW4gYWN0aXZlIGF0dGFja2VyIGFtb25nIG90aGVyIHRvIGNvbmZp cm0gYW4gYXR0YWNrIGlzDQo+IGVmZmljaWVudCwNCj4+IHRoYXQgYSBzZXJ2ZXIgaXMgcmVjZWl2 aW5nIG11bHRpcGxlIHBhY2tldCBhdCBhIGdpdmVuIHRpbWUgd2hpY2ggbWF5IGJlDQo+IHVzZWQg dG8NCj4+IGlkZW50aWZ5IHNvbWUgdHJhZmZpYyBwYXR0ZXJucywgaWRlbnRpZnlpbmcgYSBidWcg YSB2ZXJzaW9uLi4uICBGb3IgYQ0KPiBwYXNzaXZlDQo+PiBhdHRhY2tlciwgdGhlIHJlc3BvbnNl IGNvZGUgbWF5IGFtb25nIG90aGVyIGluZGljYXRlIGFuIGFwcHJvcHJpYXRlZCB0aW1lDQo+IHRv DQo+PiB0cmlnZ2VyIGEgbGFyZ2VyIGF0dGFjay4uLi4NCj4+IA0KPj4gQmVjYXVzZSB0aGUgY29k ZSBlbmFibGUgYW4gYXR0YWNrZXIgdG8gZ2FpbiBzb21lIGtpbmQgb2YgY29udHJvbCBvZiB0aGUN Cj4gY2xpZW50LA0KPj4gYW5kIHJldmVhbHMgc29tZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgc3Rh dHVzIG9mIHRoZSBzZXJ2ZXIuIEkgd291bGQNCj4gc3VnZ2VzdCB0bw0KPj4gbWVudGlvbiB0aGF0 IFRvbyBNYW55IFJlc3BvbnNlIENvZGUgc2hvdWxkIG5vdCBiZSBjb25zaWRlcmVkIG91dHNpZGUN Cj4+IHVucHJvdGVjdGVkIGNoYW5uZWwuIFRoYXQgaXMgYSBzZXJ2ZXIgU0hPVUxEIE5PVCByZXBs eSB3aXRoIGEgVG9vIE1hbnkNCj4+IFJlcXVlc3RzIFJlc3BvbnNlIENvZGUgdW5sZXNzIHRoZSBj b21tdW5pY2F0aW9uIGlzIGVuY3J5cHRlZC4gQSBjbGllbnQNCj4+IFNIT1VMRCBpZ25vcmUgVG9v IE1hbnkgUmVzcG9uc2UgQ29kZSB1bmxlc3MgdGhlIGNvbW11bmljYXRpb24gaXMNCj4+IGVuY3J5 cHRlZC4NCj4+IA0KPj4gVGhlIHJlc3BvbnNlIHNlZW1zIHRvIG1lIHNtYWxsIGVub3VnaCBzbyBy ZWZsZWN0aW9uIGF0dGFja3MgbWF5IGJlIG91dCBvZg0KPj4gc2NvcGUuDQo+IA0KPiBJIGRvIG5v dCBiZWxpZXZlIHRoYXQgdGhpcyBpcyBhaW1lZCB0byBiZSBhbnkgdHlwZSBvZiBET1MgcHJldmVu dGlvbiB0b29sLg0KPiBJIHdvdWxkIGRpc2FncmVlIHRoYXQgdGhpcyBpcyBhIGh1Z2UgYXR0YWNr IHdpbmRvdy4gIFRoZSBjbGllbnQgd2lsbCBmaWx0ZXINCj4gdGhlIHNldCBvZiByZXNwb25zZSB0 aGF0IGl0IGlzIHJlY2VpdmluZyB0byBtYXRjaCBvbmx5IHJlcXVlc3RzIHRoYXQgaXQgaGFzDQo+ IG1hZGUuICBUaHVzIGEgZ2VuZXJhbCBmbG9vZCBhdHRhY2sgd291bGQgbm90IGJlIHVzZWZ1bCB1 bmxlc3MgaXQgd2FzDQo+IHRhcmdldGluZyB0aGUgc2FtZSBtZXNzYWdlcyBpZHMgKGFuZCB0b2tl bnMpIGFzIHJlcXVlc3RzIGZyb20gdGhlIGNsaWVudA0KPiB1bmRlciBhdHRhY2suICBCdXQgdGhl biB0aGVzZSB3b3VsZCBiZSBzZWVuIGJ5IHRoZSBzZXJ2ZXIgYXMgZHVwbGljYXRlDQo+IG1lc3Nh Z2VzIGFuZCBpZ25vcmVkIHcvbyBzZW5kaW5nIG91dCBhIHJlc3BvbnNlLg0KPiANCj4gSSBhbSBu b3Qgc3VyZSB0aGF0IEkgd291bGQgY29uc2lkZXIgdGhlIGZhY3QgdGhhdCB0aGUgc2VydmVyIGlz IGN1cnJlbnRseQ0KPiAibG9hZGVkIiBmb3Igc29tZSBtZWFzdXJlIGlzIGEgaHVnZSBsZWFrIG9m IGluZm9ybWF0aW9uLiAgSSBkb24ndCB0aGluayBJDQo+IHdvdWxkIGNhcmUgaWYgdGhhdCB3YXMg bGVha2VkLiANCj4gDQo+IEppbQ0KPiANCj4+IDwvbWdsdD4NCj4+IA0KPj4gX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+IGNvcmUgbWFpbGluZyBsaXN0 DQo+PiBjb3JlQGlldGYub3JnDQo+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2NvcmUNCj4gDQo= --Apple-Mail-B37B20E9-8B8A-4DF5-B85C-E401F869282D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPlRoYW5rIHlvdSBm b3IgdGhlIHJldmlldyBEYW5pZWwhPGRpdj48YnI+PC9kaXY+PGRpdj5JIGhhdmUgbm93IGFkZHJl c3NlZCB5b3VyIGNvbW1lbnRzIGluIHRoZSBsYXRlc3QgZHJhZnQgdmVyc2lvbiBpbiBHaXRodWI6 PC9kaXY+PGRpdj48YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vY29yZS13Zy90b28tbWFueS1y ZXFzL3B1bGwvNC9maWxlcyI+aHR0cHM6Ly9naXRodWIuY29tL2NvcmUtd2cvdG9vLW1hbnktcmVx cy9wdWxsLzQvZmlsZXM8L2E+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj4qIENsYXJpZmllZCB0 aGUgdGV4dCBpbiBzZWN0aW9ucyA0IGFuZCA1IHJvdWdobHkgYXMgcHJvcG9zZWQ8L2Rpdj48ZGl2 PiogQWRkZWQgYSBub3RlIGluIHNlY3Rpb24gNSB0aGF0IGRyb3BwaW5nIHJlcXVlc3RzIG1heSBy ZXN1bHQgaW4gcmV0cmllcyZuYnNwOzwvZGl2PjxkaXY+KiBBZGRlZCBhIG5vdGUgdGhhdCByZXNw b25zZXMgd2l0aG91dCBlbmNyeXB0aW9uIGNhbiBsZWFrIGluZm9ybWF0aW9uIChhZ3JlZSB3aXRo IEppbSB0aGF0IGl04oCZcyBub3QgYSBtYWpvciByaXNrIHNvIGRpZG7igJl0IGFkZCBub3JtYXRp dmUgbGFuZ3VhZ2Ugb24gdGhpcyk8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PknigJltIHBsYW5u aW5nIHRvIHN1Ym1pdCBhIG5ldyB2ZXJzaW9uIHRvbW9ycm93IGJlZm9yZSB0aGUgREwuPC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48ZGl2IGlkPSJBcHBsZU1haWxTaWdu YXR1cmUiPkNoZWVycyw8ZGl2PkFyaTwvZGl2PjwvZGl2PjxkaXY+PGJyPk9uIDggT2N0IDIwMTgs IGF0IDE5LjUzLCBKaW0gU2NoYWFkICZsdDs8YSBocmVmPSJtYWlsdG86aWV0ZkBhdWd1c3RjZWxs YXJzLmNvbSI+aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj48YnI+PC9k aXY+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPjwv c3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+LS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS08L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48 c3Bhbj5Gcm9tOiBjb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y29yZS1ib3VuY2VzQGlldGYub3Jn Ij5jb3JlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBPbiBCZWhhbGYgT2YgRGFuaWVsIE1pZ2F1 bHQ8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5T ZW50OiBTdW5kYXksIE9jdG9iZXIgNywgMjAxOCA1OjMxIFBNPC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+VG86IDxhIGhyZWY9Im1haWx0bzpzZWNk aXJAaWV0Zi5vcmciPnNlY2RpckBpZXRmLm9yZzwvYT48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5DYzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWll dGYtY29yZS10b28tbWFueS1yZXFzLmFsbEBpZXRmLm9yZyI+ZHJhZnQtaWV0Zi1jb3JlLXRvby1t YW55LXJlcXMuYWxsQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmlldGZAaWV0Zi5vcmci PmlldGZAaWV0Zi5vcmc8L2E+Ozwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxzcGFuPjxhIGhyZWY9 Im1haWx0bzpjb3JlQGlldGYub3JnIj5jb3JlQGlldGYub3JnPC9hPjwvc3Bhbj48YnI+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+U3ViamVjdDogW2NvcmVdIFNlY2RpciBsYXN0IGNhbGwg cmV2aWV3IG9mPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+ZHJhZnQtaWV0Zi1jb3JlLXRv by1tYW55LXJlcXMtMDQ8L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPjwv c3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPlJldmll d2VyOiBEYW5pZWwgTWlnYXVsdDwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPjxzcGFuPlJldmlldyByZXN1bHQ6IEhhcyBOaXRzPC9zcGFuPjxicj48L2Jsb2Nr cXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+SGksPC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+ PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+UmV2aWV3ZXI6IERhbmllbCBNaWdhdWx0PC9z cGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+UmV2aWV3 IHJlc3VsdDogSGFzIE5pdHM8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJj aXRlIj48c3Bhbj5JIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBz ZWN1cml0eSBkaXJlY3RvcmF0ZSdzPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+b25nb2lu Zzwvc3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ZWZmb3J0IHRvIHJldmll dyBhbGwgSUVURiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiBUaGVzZTwv c3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmNvbW1l bnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0 eSBhcmVhPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+ZGlyZWN0b3JzLjwvc3Bhbj48YnI+ PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+RG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hh aXJzIHNob3VsZCB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UgYW55PC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+b3RoZXIgbGFzdCBjYWxs IGNvbW1lbnRzLjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxz cGFuPlRoZSBkb2N1bWVudCBpcyBjbGVhciBhbmQgYWxtb3N0IHJlYWR5LiAmbmJzcDtNb3N0IG9m IG15IGNvbW1lbnRzIGNvbmNlcm5zIHRoZTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiJTZWN1cml0eSBDb25zaWRlcmF0aW9ucyIuPC9zcGFuPjxi cj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+WW91cnMsPC9zcGFuPjxi cj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+RGFuaWVsPC9zcGFu Pjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxi cj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+NC4gJm5ic3A7Q29B UCBDbGllbnQgQmVoYXZpb3I8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJj aXRlIj48c3Bhbj4gJm5ic3A7Jm5ic3A7QSBjbGllbnQgTVVTVCBOT1QgcmVseSBvbiBhIHNlcnZl ciBiZWluZyBhYmxlIHRvIHNlbmQgdGhlIDQuMjk8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4gJm5ic3A7Jm5ic3A7UmVzcG9uc2UgQ29kZSBpbiBh biBvdmVybG9hZCBzaXR1YXRpb24gYmVjYXVzZSBhbiBvdmVybG9hZGVkIHNlcnZlcjwvc3Bhbj48 YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiAmbmJzcDsmbmJz cDttYXkgbm90IGJlIGFibGUgdG8gcmVwbHkgdG8gYWxsIHJlcXVlc3RzIGF0IGFsbC48L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48L3NwYW4+PGJy PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4mbHQ7bWdsdCZndDs8 L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48L3Nw YW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5JIGJlbGll dmUgdGhlIHNlbnRlbmNlIG1heSBiZSByZXBocmFzZWQuIFRoaXMgaXMganVzdCBhIHByb3Bvc2Fs Ljwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPk9M RDwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiAm bmJzcDsmbmJzcDttYXkgbm90IGJlIGFibGUgdG8gcmVwbHkgdG8gYWxsIHJlcXVlc3RzIGF0IGFs bC48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5O RVc8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4g Jm5ic3A7Jm5ic3A7bWF5IG5vdCBiZSBhYmxlIHRvIHJlcGx5IChhdCBhbGwpIHRvIHNvbWUgcmVx dWVzdHMuIC48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48 c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bh bj4mbHQ7L21nbHQmZ3Q7PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+PHNwYW4+NS4gJm5ic3A7U2VjdXJpdHkgQ29uc2lkZXJhdGlvbnM8L3NwYW4+PGJyPjwvYmxv Y2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2tx dW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4gJm5ic3A7Jm5ic3A7UmVwbHlpbmcg dG8gQ29BUCByZXF1ZXN0cyB3aXRoIGEgUmVzcG9uc2UgQ29kZSBjb25zdW1lcyByZXNvdXJjZXM8 L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4gJm5i c3A7Jm5ic3A7ZnJvbSBhIHNlcnZlci4gJm5ic3A7Rm9yIGEgc2VydmVyIHVuZGVyIGF0dGFjayBp dCBtYXkgYmUgbW9yZSBhcHByb3ByaWF0ZTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiAmbmJzcDsmbmJzcDt0byBzaW1wbHkgZHJvcCByZXF1ZXN0 cyB3aXRob3V0IHJlc3BvbmRpbmcuPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PHNwYW4+Jmx0O21nbHQmZ3Q7PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+VGhlIGdhaW4gZnJvbSB0aGUgcmVzcG9uc2Ugd2l0aCBU b28gTWFueSBSZXF1ZXN0cyBSZXNwb25zZSBDb2RlIGlzIGFsbW9zdDwvc3Bhbj48YnI+PC9ibG9j a3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPnRoZSBjdXJyZW50IHJlc3BvbnNl IGFuZCBhbGwgKnNpbWlsYXIqIHJlcXVlc3RzIGZyb20gdGhhdCBjbGllbnQgZHVyaW5nPC9zcGFu Pjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+TWF4PC9zcGFuPjxicj48YmxvY2txdW90ZSB0eXBlPSJj aXRlIj48c3Bhbj5BZ2UuIEkgc3VzcGVjdCB0aGF0IGlzIGxpa2VseSBhIGdhaW4gZXhjZXB0IHdo ZW4gdGhlcmUgaXMgbm8gcmVzcG9uc2VzPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+ZnJv bSB0aGU8L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPnNlcnZlciBhbmQg Y2xpZW50IGlzIG5vdCBleHBlY3QgdG8gc2VuZCBhIHJlcXVlc3QgYmVmb3JlIE1heCBBZ2UuIFNp bXBseTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFu PmRyb3BwaW5nIHRoZSByZXF1ZXN0cyBtYXkgYWRkIHRoZSByZXRyeSB0cmFmZmljLCB0aG91Z2gg aXQgZGVwZW5kcyBvbiB0aGU8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj5hcHBsaWNhdGlvbi4gVGhhdCBzYWlkIHlvdXIgdGV4dCBpcyBjb3JyZWN0 LiBJIGFtIHdvbmRlcmluZyBpZiBpdCB3b3VsZCBiZTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxz cGFuPmdvb2QgdG88L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmlsbHVz dHJhdGUgeW91ciBwdXJwb3NlLiAmbHQ7L21nbHQmZ3Q7PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+ PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ICZuYnNwOyZuYnNwO0lmIGEgQ29BUCByZXBseSB3 aXRoIHRoZSBUb28gTWFueSBSZXF1ZXN0cyBSZXNwb25zZSBDb2RlIGlzIG5vdDwvc3Bhbj48YnI+ PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiAmbmJzcDsmbmJzcDth dXRoZW50aWNhdGVkIGFuZCBpbnRlZ3JpdHkgcHJvdGVjdGVkLCBhbiBhdHRhY2tlciBjYW4gYXR0 ZW1wdCB0bzwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxz cGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFu PktlcmFuZW4gJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7RXhwaXJlcyBK YW51YXJ5IDI1LCAyMDE5ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO1tQYWdlIDNd PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9z cGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+SW50ZXJu ZXQtRHJhZnQgJm5ic3A7VG9vIE1hbnkgUmVxdWVzdHMgUmVzcG9uc2UgQ29kZSBmb3IgQ29BUCAm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtKdWx5IDIwMTg8L3NwYW4+PGJyPjwv YmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxv Y2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4gJm5ic3A7Jm5ic3A7c3Bvb2Yg YSByZXBseSBhbmQgbWFrZSB0aGUgY2xpZW50IHdhaXQgZm9yIGFuIGV4dGVuZGVkIHBlcmlvZCBv ZiB0aW1lPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNw YW4+ICZuYnNwOyZuYnNwO2JlZm9yZSB0cnlpbmcgYWdhaW4uPC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+ PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+Jmx0O21nbHQmZ3Q7PC9zcGFuPjxicj48L2Js b2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+QSBzaW1pbGFyIGF0dGFjayBt YXkgYWxzbyBjb25zaXN0cyBpbiBhbiBhdHRhY2tlciB0cmlnZ2VyaW5nIG11bHRpcGxlPC9zcGFu Pjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+cmVxdWVzdCBvcjwvc3Bhbj48YnI+PGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+PHNwYW4+dHJhbnNhY3Rpb25zIHdpdGggYSBzcG9vZmVkIElQIHNvIHRoZSBz ZXJ2ZXIgZ2VuZXJhdGVzIHRoZSByZXBseSB0byB0aGU8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5sZWdpdGltYXRlIElQLiBUaGlzIGNvdWxkIGJl IHVzZWQgaWYgYW4gYXR0YWNrZXIgY2Fubm90IGRpcmVjdGx5IHNlbmQgdGhlPC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PHNwYW4+c3Bvb2ZlZDwvc3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+PHNwYW4+cmVzcG9uc2UgdG8gdGhlIGxlZ2l0aW1hdGUgY2xpZW50Ljwvc3Bhbj48YnI+PC9i bG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9j a3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPlRoZSByZXNwb25zZSBjb2RlIHBy b3ZpZGVzIGFuIGluZm9ybWF0aW9uIGFib3V0IHRoZSBzdGF0ZSAob3ZlcmxvYWRlZCkgb2Y8L3Nw YW4+PGJyPjwvYmxvY2txdW90ZT48c3Bhbj50aGU8L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPjxzcGFuPnNlcnZlciB3aGljaCBjYW4gYmUgdXNlZCB0byBpbmZlciBhZGRpdGlvbmFs IGluZm9ybWF0aW9uLiBUaGlzIGNvdWxkPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+cG90 ZW50aWFsbHk8L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmJlIHVzZWQg YnkgYW4gYWN0aXZlIGF0dGFja2VyIGFtb25nIG90aGVyIHRvIGNvbmZpcm0gYW4gYXR0YWNrIGlz PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PHNwYW4+ZWZmaWNpZW50LDwvc3Bhbj48YnI+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+dGhhdCBhIHNlcnZlciBpcyByZWNlaXZpbmcgbXVsdGlw bGUgcGFja2V0IGF0IGEgZ2l2ZW4gdGltZSB3aGljaCBtYXkgYmU8L3NwYW4+PGJyPjwvYmxvY2tx dW90ZT48c3Bhbj51c2VkIHRvPC9zcGFuPjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bh bj5pZGVudGlmeSBzb21lIHRyYWZmaWMgcGF0dGVybnMsIGlkZW50aWZ5aW5nIGEgYnVnIGEgdmVy c2lvbi4uLiAmbmJzcDtGb3IgYTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxzcGFuPnBhc3NpdmU8 L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmF0dGFja2VyLCB0aGUgcmVz cG9uc2UgY29kZSBtYXkgYW1vbmcgb3RoZXIgaW5kaWNhdGUgYW4gYXBwcm9wcmlhdGVkIHRpbWU8 L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48c3Bhbj50bzwvc3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PHNwYW4+dHJpZ2dlciBhIGxhcmdlciBhdHRhY2suLi4uPC9zcGFuPjxicj48L2Js b2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2Nr cXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+QmVjYXVzZSB0aGUgY29kZSBlbmFi bGUgYW4gYXR0YWNrZXIgdG8gZ2FpbiBzb21lIGtpbmQgb2YgY29udHJvbCBvZiB0aGU8L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48c3Bhbj5jbGllbnQsPC9zcGFuPjxicj48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj5hbmQgcmV2ZWFscyBzb21lIGluZm9ybWF0aW9uIGFib3V0IHRoZSBzdGF0 dXMgb2YgdGhlIHNlcnZlci4gSSB3b3VsZDwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxzcGFuPnN1 Z2dlc3QgdG88L3NwYW4+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPm1lbnRpb24g dGhhdCBUb28gTWFueSBSZXNwb25zZSBDb2RlIHNob3VsZCBub3QgYmUgY29uc2lkZXJlZCBvdXRz aWRlPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ dW5wcm90ZWN0ZWQgY2hhbm5lbC4gVGhhdCBpcyBhIHNlcnZlciBTSE9VTEQgTk9UIHJlcGx5IHdp dGggYSBUb28gTWFueTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPjxzcGFuPlJlcXVlc3RzIFJlc3BvbnNlIENvZGUgdW5sZXNzIHRoZSBjb21tdW5pY2F0aW9u IGlzIGVuY3J5cHRlZC4gQSBjbGllbnQ8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj48c3Bhbj5TSE9VTEQgaWdub3JlIFRvbyBNYW55IFJlc3BvbnNlIENvZGUg dW5sZXNzIHRoZSBjb21tdW5pY2F0aW9uIGlzPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ZW5jcnlwdGVkLjwvc3Bhbj48YnI+PC9ibG9ja3F1b3Rl PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPlRoZSByZXNwb25zZSBzZWVtcyB0byBtZSBzbWFs bCBlbm91Z2ggc28gcmVmbGVjdGlvbiBhdHRhY2tzIG1heSBiZSBvdXQgb2Y8L3NwYW4+PGJyPjwv YmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5zY29wZS48L3NwYW4+PGJy PjwvYmxvY2txdW90ZT48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPkkgZG8gbm90IGJlbGlldmUgdGhh dCB0aGlzIGlzIGFpbWVkIHRvIGJlIGFueSB0eXBlIG9mIERPUyBwcmV2ZW50aW9uIHRvb2wuPC9z cGFuPjxicj48c3Bhbj5JIHdvdWxkIGRpc2FncmVlIHRoYXQgdGhpcyBpcyBhIGh1Z2UgYXR0YWNr IHdpbmRvdy4gJm5ic3A7VGhlIGNsaWVudCB3aWxsIGZpbHRlcjwvc3Bhbj48YnI+PHNwYW4+dGhl IHNldCBvZiByZXNwb25zZSB0aGF0IGl0IGlzIHJlY2VpdmluZyB0byBtYXRjaCBvbmx5IHJlcXVl c3RzIHRoYXQgaXQgaGFzPC9zcGFuPjxicj48c3Bhbj5tYWRlLiAmbmJzcDtUaHVzIGEgZ2VuZXJh bCBmbG9vZCBhdHRhY2sgd291bGQgbm90IGJlIHVzZWZ1bCB1bmxlc3MgaXQgd2FzPC9zcGFuPjxi cj48c3Bhbj50YXJnZXRpbmcgdGhlIHNhbWUgbWVzc2FnZXMgaWRzIChhbmQgdG9rZW5zKSBhcyBy ZXF1ZXN0cyBmcm9tIHRoZSBjbGllbnQ8L3NwYW4+PGJyPjxzcGFuPnVuZGVyIGF0dGFjay4gJm5i c3A7QnV0IHRoZW4gdGhlc2Ugd291bGQgYmUgc2VlbiBieSB0aGUgc2VydmVyIGFzIGR1cGxpY2F0 ZTwvc3Bhbj48YnI+PHNwYW4+bWVzc2FnZXMgYW5kIGlnbm9yZWQgdy9vIHNlbmRpbmcgb3V0IGEg cmVzcG9uc2UuPC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPkkgYW0gbm90IHN1cmUg dGhhdCBJIHdvdWxkIGNvbnNpZGVyIHRoZSBmYWN0IHRoYXQgdGhlIHNlcnZlciBpcyBjdXJyZW50 bHk8L3NwYW4+PGJyPjxzcGFuPiJsb2FkZWQiIGZvciBzb21lIG1lYXN1cmUgaXMgYSBodWdlIGxl YWsgb2YgaW5mb3JtYXRpb24uICZuYnNwO0kgZG9uJ3QgdGhpbmsgSTwvc3Bhbj48YnI+PHNwYW4+ d291bGQgY2FyZSBpZiB0aGF0IHdhcyBsZWFrZWQuIDwvc3Bhbj48YnI+PHNwYW4+PC9zcGFuPjxi cj48c3Bhbj5KaW08L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+PHNwYW4+Jmx0Oy9tZ2x0Jmd0Ozwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPjxzcGFuPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+ PHNwYW4+Y29yZSBtYWlsaW5nIGxpc3Q8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj48c3Bhbj48YSBocmVmPSJtYWlsdG86Y29yZUBpZXRmLm9yZyI+Y29yZUBp ZXRmLm9yZzwvYT48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij48c3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Nv cmUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY29yZTwvYT48L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjwvYmxvY2txdW90ZT48L2Rp dj48L2JvZHk+PC9odG1sPg== --Apple-Mail-B37B20E9-8B8A-4DF5-B85C-E401F869282D-- --Apple-Mail-A311F99D-D2B8-4576-8F7C-14596E8E1A78 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMwDCCBfYw ggPeoAMCAQICEDcTcXMuXOfOJx3rdG/2/hgwDQYJKoZIhvcNAQELBQAwRzELMAkGA1UEBhMCU0Ux ETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYz MB4XDTE3MTIwNDE0MTM0NFoXDTIwMTIwNDE0MTM0M1owZTERMA8GA1UECgwIRXJpY3Nzb24xFTAT BgNVBAMMDEFyaSBLZXLDpG5lbjEnMCUGCSqGSIb3DQEJARYYYXJpLmtlcmFuZW5AZXJpY3Nzb24u Y29tMRAwDgYDVQQFEwdlYXJpa2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhSVX rojnPX+oZh2GIgZ/K+/xppl7EN60UI+Vq5SHm6C2ns9/vKek9EgrUV5Zqgqz4gncT1H/3BMA8XOP ONemPIcegFR2nxkG4v+S3rRxRMdMPgBJwkZQcSDLvT9R/ZgSPckmOtMFsWeoNxdZMUXWfZh52aFk MF3NlAnXy2UiMmbGAAkHVyUjScSDWAGeGXyZV1Cn5qvoaO/Fd9G4DX646nFrfLjNSnMX6FouZoLh rkBs6xE62vtRp3z+kLO6UC8CY9e8Qn/cm6xp9B+KrE2/Un99PpbuxLx0GMXq+/cuB4CdiPn+Ka2X 0E66sWiXRoiJz4COm182hV/akOGBjGfzTwIDAQABo4IBvjCCAbowSAYDVR0fBEEwPzA9oDugOYY3 aHR0cDovL2NybC50cnVzdC50ZWxpYS5jb20vZXJpY3Nzb25ubGluZGl2aWR1YWxjYXYzLmNybDCB ggYIKwYBBQUHAQEEdjB0MCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcDIudHJ1c3QudGVsaWEuY29t MEgGCCsGAQUFBzAChjxodHRwOi8vY2EudHJ1c3QudGVsaWFzb25lcmEuY29tL2VyaWNzc29ubmxp bmRpdmlkdWFsY2F2My5jZXIwIwYDVR0RBBwwGoEYYXJpLmtlcmFuZW5AZXJpY3Nzb24uY29tMFUG A1UdIAROMEwwSgYMKwYBBAGCDwIDAQESMDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vcmVwb3NpdG9y eS50cnVzdC50ZWxpYXNvbmVyYS5jb20vQ1BTMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcD AjAdBgNVHQ4EFgQU0dBcPI0/9JLIXr4Qwu+jTumFvcUwHwYDVR0jBBgwFoAUHHsZnpecdqwgPdjc 45Fq49stplMwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEBCwUAA4ICAQBVWCBhZPB3PkGIx4FF guinomjcmL1iZ+icJEWLJ/DyF7559hzn0jDNT14gFEVKJZ/zt6pxlkmNzBaMe6O7cy/NaynWoeeK uzM61w2tR+UUGhjs3evX20b7PZsT9uONk+K25IiAKhfbwiAtkukhydiDueJZefBHfEaKmGwQ87eZ Hent/5cu13L7WpT+sCNmhbfqZm5iTWVXqci30Z+G4fX/IhB3mnFMOPniPdM4u/8qsQrAIVBguSGj rOs6JykmTsOSNgY0vCZoNNHG56ExAcoNb59eLXGLv95JxXRicQuPFca4TceiMSQsHw5999r/lMgJ 8E3YdMBJcnRixumcDE9PKMTGYrOXea51DPrHnA/pMeEzSyW1fzAdVASFTnDS7It9P3KpZVgpOr70 YjTZL2TMP67UBa1+1tYrYJAgZQATjd9pkasJyGRP5+djPlvU+nJ/kfjmv+myawD0nreIULOeKUqW j0zjt9A8SyqkVa8N8TiN2hupKZBen9orty9igASFyPm86pH9s826bvBZ6BBl0Ox/Lfm9mXz6+1Gs oCT/puZR9qJrOpCgar4MXU4vuxCVvUdsyaQluWusF/wKyHrB0RUV7Lq96AFIjC06eZwAU33Y2Uqn bh/ysnEzXsz2lY0bo6yYIaHHKjiTUEefr2dddB9I3tB2oukZ+FB+kkvcuDCCBsIwggSqoAMCAQIC EFO4foPhnJkok7CbSRzsuOswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UECgwLVGVsaWFTb25lcmEx HzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMTUxMDI3MTIxNjQ2WhcNMjUxMDI3 MTIxNjQ2WjBHMQswCQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNz c29uIE5MIEluZGl2aWR1YWwgQ0EgdjMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDs 8t8AALhQ8qe72FS3xpP348GqO9TDRjS0s85eQ7Y0LTLZdmSz2cl+lYqs0zfSTm+7meisbhkqUXkL 7fFzoe4iIZCh/VuYUaW407CZlDCXes4n4TqTSuoklN6uOPhY7EC9ZVbXILlLhRummTdDdxhVW4Le o0awEhfLf98MvWxzwCHzMj8m6YOmNjx+f9TcJE3qaA0piuvSxlfpVdiCulPTlmsmV2RSBSAwqBsh ZYRcQBIDfqmdvkaoP9EzNKAh7yjthC0hpgHZyZMIs0eNo4v2PUmE0rhu+Zs0nujnwhljPA2/8b8v 9tGixD1zbtT7zoM2Ot1menJpFp4zJVSfdKVgtoWqg5t2H/E0XY1LwJez89W07nscEocyBmpC+zJA mKxKhzEWqIyP1UrZaEIFu+hO+s0Nm8sOUMa4TlG4rAUikc5U5TmUIGBRQGxulYhfAzqSYf8oLUML ky1DOa9eRu3sp0FdQDEzQlnF/h1L4AK1MOkX1vS+fLgOvBo5LRU1fLPUZQ7FKrDXC6nl2ldvEtlj HWstGBmqv25aEvAA+yrrplCh/kYvSBjvZibz9Obbwx4yqS77/NHN1iyZyVP2s52B2BLdvo4yhzk6 nRk8S/8zHaUUkBUrrvijPDaGK5FNVSaioGvkC7IKioITKffYLtT9XuirKrHlh3VzkazG46pAVwID AQABo4IBuDCCAbQwgYoGCCsGAQUFBwEBBH4wfDAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AudHJ1 c3QudGVsaWFzb25lcmEuY29tMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwb3NpdG9yeS50cnVzdC50 ZWxpYXNvbmVyYS5jb20vdGVsaWFzb25lcmFyb290Y2F2MS5jZXIwEgYDVR0TAQH/BAgwBgEB/wIB ADBVBgNVHSAETjBMMEoGDCsGAQQBgg8CAwEBAjA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9z aXRvcnkudHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8v Y3JsLTMudHJ1c3QudGVsaWFzb25lcmEuY29tL3RlbGlhc29uZXJhcm9vdGNhdjEuY3JsMB0GA1Ud JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBx7GZ6X nHasID3Y3OORauPbLaZTMB8GA1UdIwQYMBaAFPCPWTgAs/WPmpYM1ev6e6oX6BMSMA0GCSqGSIb3 DQEBCwUAA4ICAQBQWGvx1Yw7tC6rV0PIjKfDyxaanIX+NZLEGOkdQLKGW2gVLtDUJQEPRs5QtaZi ObNHCZ7mmSNMVek4lkt/0dqfVIFutVw/QkyFGwC99ZmNwXSX9z+OoMyoEBHGvw5RY6vRlZrj0uKv dASzYL4KMaB7m3NwurNDmmNbG52suRIZ76wBOEOddRZcZiTy50ZkBqYnnl2t3D3oBX2NZCQysshU cqRdUbkS13HTCIChMuTV9W0tzPXUOJoJlJlU9nd91IikhGEOrPwfixWms+C8sF0r9qN1uJGx6ELP OiFrLfNtcMNMMbAqRHwpSLxe3wcNkJGxv9T8LswLi1UrRIQ85AKjqzBnLSsjRGgbMgJ+xKtngmvE A155JmoKfUD7DRbP6Kp14/Y9XFbR/WuDj84bYNKXe4HdDc1P+UMYm16m2L6LkIIoRlx0A5mi+K7j ewuGqzFKkaPNmJ0RLCi+4d4/47Zs3DC3PUNOxdOEEHf4kkdWOaSIuj3TQYhNv+LsgF0uijiBmaz2 zUFDa2bcIkKakDZfAFM4HoHz8K2BZRaHKWhd3dZua/tlSiqokUFX2DxmHmZ1n5HM9OiaAIXP/Zo2 x10j/Yb1mM3i0bqGahxlHYzl/QyEG/dujp3lewuVjCI0mPDkZGphvxyqp4Jo8qS94EnOqBvxOgft Yug7OY9EKY+WkDGCAr0wggK5AgEBMFswRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29u MSUwIwYDVQQDDBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAhA3E3FzLlznzicd63Rv9v4Y MAkGBSsOAwIaBQCgggE3MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTE4MTAyMTE4MDk0M1owIwYJKoZIhvcNAQkEMRYEFPA8NzXhsVEuy3z67+YlYEzy7mTwMGoGCSsG AQQBgjcQBDFdMFswRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxF cmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAhA3E3FzLlznzicd63Rv9v4YMGwGCyqGSIb3DQEJ EAILMV2gWzBHMQswCQYDVQQGEwJTRTERMA8GA1UECgwIRXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNz c29uIE5MIEluZGl2aWR1YWwgQ0EgdjMCEDcTcXMuXOfOJx3rdG/2/hgwDQYJKoZIhvcNAQEBBQAE ggEAODV0e7/i+bBJ76muIADdrdemzleDhx8SPx5GcQ2Slv1uP0KW2mjcTeU7HAdjm5EnoD7FTkix EvQLMZvG+y5xaGriRluvJP+qs/AHll4RdWhubADLp6x6HuAioiT6YpxlZJrttcYiUzjhgsMu8Z1/ x743UF4wMMcHLBgWYk0w0I44tT4LFWxzWmiZSIUps966FGnnkIdVtySrt/JeNYMKn9LnKrguaro1 9HhKliPVLR+i7EdJjqq/8tmcQj0sG6Ps5au+Y4zIh3Pj96YTLesV6Ruu5j3H3c5FcwetNWc5VkIh K90LMS97H4hnSt9KjAvcOcLjCa5amXlTCu7s1xByLwAAAAAAAA== --Apple-Mail-A311F99D-D2B8-4576-8F7C-14596E8E1A78-- From nobody Sun Oct 21 13:33:10 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7B3F130DEE; Sun, 21 Oct 2018 13:33:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aYE3svPChysl; Sun, 21 Oct 2018 13:33:06 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F9371200D7; Sun, 21 Oct 2018 13:33:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=17594; q=dns/txt; s=iport; t=1540153985; x=1541363585; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=J83RDefrqaCsDynJ1mVF04lQiO0EMKyAk4NeqE7hmAg=; b=TUpcdxhbqdpprrxjGW6BwIssi0TSE8rpCUtrrF84owz2kMy78R7mYFSl PeQNEDEAyMpWie2J8F9Y7IwGHa6HIY847hocWT3uqoije4HhxlWNMITdN I9C0d09eUYQjCdX0hn8NCiispw/2fgVeNPz3VmOfwGSGLF+rfeT9ixqin c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AFAABO4cxb/5JdJa1iGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUQQBAQEBAQsBgQ1IL2Z/KAqDa4gYjBmCDYh6iFOFSIF?= =?us-ascii?q?6CwEBI4RJAheEcSE0DQ0BAwEBAgEBAm0cDIU6AQEBBCMKRQcQAgEIDgMEAQE?= =?us-ascii?q?oAwICAh8RFAkIAgQOBQgXgwOBHUwDFQ+kHYEuh24NghMFi1IXgUE/gRABgmQ?= =?us-ascii?q?uglZFAQECAYF1DxCCTYJXAopXg16GEolTLgkChmCCYoQKgxwfgVKEc4lpjFh?= =?us-ascii?q?4iGYCERSBJh04gVVwFYMnixmFPm8BAYpYgR8BAQ?= X-IronPort-AV: E=Sophos;i="5.54,409,1534809600"; d="scan'208,217";a="189383103" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Oct 2018 20:33:04 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id w9LKX40H008322 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sun, 21 Oct 2018 20:33:04 GMT Received: from xch-aln-001.cisco.com (173.36.7.11) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 21 Oct 2018 15:33:03 -0500 Received: from xch-aln-001.cisco.com ([173.36.7.11]) by XCH-ALN-001.cisco.com ([173.36.7.11]) with mapi id 15.00.1395.000; Sun, 21 Oct 2018 15:33:03 -0500 From: "Les Ginsberg (ginsberg)" To: Yoav Nir CC: Robert Raszuk , "kaduk@mit.edu" , "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW9XPWYyIUJa0CAw27zofyhmaUihppwgAGMV4D//8FaoIABtlGA///AT8CAAMKMAIAAa5YAgAAtaFCAA62rgP//2v5w Date: Sun, 21 Oct 2018 20:33:03 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> In-Reply-To: <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.24.113.215] Content-Type: multipart/alternative; boundary="_000_c204c2699675433cad9ac5342cdf0cc9XCHALN001ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Oct 2018 20:33:09 -0000 --_000_c204c2699675433cad9ac5342cdf0cc9XCHALN001ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW9hdiDigJMNCg0KVGhhbnggZm9yIHRoZSBzdWdnZXN0aW9uLiBJIGhhdmUganVzdCBwb3N0ZWQg VjE0IG9mIHRoZSBkcmFmdCB3aGljaCBJIGJlbGlldmUgYWRkcmVzc2VzIHlvdXIgY29uY2VybnMg 4oCTIHBsZWFzZSByZXZpZXcgYW5kIGNvbmZpcm0uDQoNCiAgIExlcw0KDQoNCkZyb206IFlvYXYg TmlyIDx5bmlyLmlldGZAZ21haWwuY29tPg0KU2VudDogU3VuZGF5LCBPY3RvYmVyIDIxLCAyMDE4 IDEwOjQ1IEFNDQpUbzogTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNiZXJnQGNpc2NvLmNv bT4NCkNjOiBSb2JlcnQgUmFzenVrIDxyb2JlcnRAcmFzenVrLm5ldD47IGthZHVrQG1pdC5lZHU7 IGlkckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pZHItdGUtcG0tYmdwLmFsbEBpZXRmLm9yZzsgaWV0 ZkBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW0lkcl0gW3NlY2Rpcl0g U2VjZGlyIGVhcmx5IHJldmlldyBvZiBkcmFmdC1pZXRmLWlkci10ZS1wbS1iZ3AtMTMNCg0KU2Vl IGlubGluZS4NCg0KDQpPbiAxOSBPY3QgMjAxOCwgYXQgMTc6NTEsIExlcyBHaW5zYmVyZyAoZ2lu c2JlcmcpIDxnaW5zYmVyZ0BjaXNjby5jb208bWFpbHRvOmdpbnNiZXJnQGNpc2NvLmNvbT4+IHdy b3RlOg0KDQpSb2JlcnTigJlzIHBvc3QgYWRkcmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0byBt YWtlLg0KDQpXaGF0IGlzIGJlaW5nIGRvbmUgaGVyZSBpcyB0byBhZGQgYWRkaXRpb25hbCBCR1At TFMgY29kZXBvaW50cyB0byBhZHZlcnRpc2UgSUdQIGluZm9ybWF0aW9uIHRoYXQgd2FzIG5vdCBk ZWZpbmVkIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuLiBXZSBoYXZlbuKAmXQgY2hh bmdlZCB0aGUgIEJHUC1MUyB0cmFuc3BvcnQgbWVjaGFuaXNtIOKAkyBub3IgaXMgdGhlIGluZm9y bWF0aW9uIGJlaW5nIGFkdmVydGlzZWQgaGVyZSAoc29tZSBhZGRpdGlvbmFsIFRFIHJlbGF0ZWQg bGluayBhdHRyaWJ1dGUgaW5mb3JtYXRpb24pIHF1YWxpdGF0aXZlbHkgZGlmZmVyZW50IHRoYW4g YSBudW1iZXIgb2YgZXhpc3RpbmcgVExWcyBkZWZpbmVkIGluIFJGQyA3NzUyIChzZWUgaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc3NTIjc2VjdGlvbi0zLjMuMiApLiBJZiB0aGlzIGlu Zm9ybWF0aW9uIGhhZCBhbHJlYWR5IGJlZW4gZGVmaW5lZCBpbiB0aGUgSUdQcyBhdCB0aGUgdGlt ZSBSRkMgNzc1MiB3YXMgd3JpdHRlbiBpdCB3b3VsZCBzaW1wbHkgaGF2ZSBiZWVuIGluY2x1ZGVk IGFzIGEgc2VjdGlvbiBvZiBSRkMgNzc1MiBhbmQgbm8gYWRkaXRpb25hbCBjaGFuZ2VzIHRvIFJG QyA3NzUyIHdvdWxkIGhhdmUgYmVlbiByZXF1aXJlZC4NCg0KSW4gdGhlb3J5LCB3ZSBjb3VsZCBo YXZlIHNpbXBseSB1cGRhdGVkIFJGQyA3NzUyIHJhdGhlciB3cml0aW5nIGEgc2VwYXJhdGUgZHJh ZnQsIGJ1dCBwcmFjdGljYWxseSB0aGlzIHdvdWxkIGJlIGEgcG9vciBzdHJhdGVneSBhcyBpdCB3 b3VsZCBpbmNvcnJlY3RseSBzdWdnZXN0IHRoYXQgc29tZSBjaGFuZ2Ugd2FzIGJlaW5nIG1hZGUg dG8gdGhlIGV4aXN0aW5nIHRleHQgaW4gUkZDIDc3NTIuDQoNCkkgYXBwcmVjaWF0ZSB0aGF0IGZy b20gdGhlIFBPViBvZiB0aGUgU2VjdXJpdHkgQXJlYSB5b3UgZm9sa3MgYXJlIG5vdCBhcyBpbnRp bWF0ZWx5IGZhbWlsaWFyIHdpdGggdGhlIHJvdXRpbmcgZHJhZnRzIGFuZCB0aGUgcmVsYXRpb25z aGlwIGJldHdlZW4gdGhlbS4gSXQgaXMgdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRoYXQgeW91 IHN0YXJ0IGxvb2tpbmcgYXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9jdW1lbnQg 4oCTIGFuZCBpbiB0aGF0IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVseSBjb3Jy ZWN0LiBCdXQgdGhlIGRvY3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNjdXJhdGVs eSBzZWVuIGFzIGFuIOKAnGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLg0KDQpbWU5dIFJpZ2h0LCBh bmQgYXMgc3VjaCwgSSBiZWxpZXZlIHRoYXQgdGhpcyBkb2N1bWVudCBzaG91bGQgYWRkcmVzcyB0 aGUgcGFydCB0aGF0IGl0IGFkZHMgdG8gUkZDIDc3NTIuIElPVyBpdCBzaG91bGQgc3RhdGUgdGhh dCB0aGUgbmV3IElHUCBpbmZvcm1hdGlvbiB0aGF0IHdpbGwgbm93IGJlIHNlbnQgdGhyb3VnaCBC R1AgZG9lcyBub3QgcHJlc2VudCBuZXcvZGlmZmVyZW50IHJpc2sgdG8gdGhlIGluZm9ybWF0aW9u IGFscmVhZHkgZGVmaW5lZCBpbiA3NzUyLiBUaGlzIGlzIGluZm9ybWF0aW9uIHRoYXQgaGFzIHVw IHVudGlsIG5vdyBvbmx5IGJlZW4gc2VudCBpbiBJUy1JUyBhbmQgT1NQRiBhbmQgd2lsbCBub3Qg YmUgc2VudCBpbiBCR1AsIHNvIHdlIG5lZWQgYSBzdGF0ZW1lbnQgdGhhdCBpdOKAmXMgT0sgdG8g c2VuZCB0aGVzZSBhdHRyaWJ1dGVzIGluIEJHUCBhcyB3ZWxsLiBPZiBjb3Vyc2UsIHN1Y2ggYSBz dGF0ZW1lbnQgY291bGQgYmUgY2hhbGxlbmdlZCBpbiBXR0xDIG9yIElFVEYgTEMsIGJ1dCBpdCBz aG91bGQgYmUgbWFkZS4NCg0KDQpUaGUgaXNzdWVzIHlvdSByYWlzZSBoYXZlIGFscmVhZHkgYmVl biBhZGRyZXNzZWQgaW4gUkZDIDc3NTIgYW5kIGl0IGlzIHRoZXJlZm9yZSB2ZXJ5IGFwcHJvcHJp YXRlIHRoYXQgd2UgYWRkcmVzcyB5b3VyIGNvbmNlcm5zIGJ5IGluY2x1ZGluZyBhIHJlZmVyZW5j ZSB0byB0aGUgUkZDIDc3NTIgc2VjdXJpdHkgZGlzY3Vzc2lvbi4NCg0KSSB0aGluayBpdCBpcyBp bXBvcnRhbnQgdGhhdCB5b3Ugbm90ZSB0aGlzIHJlbGF0aW9uc2hpcCwgYmVjYXVzZSB0aGUgbmF0 dXJlIG9mIEJHUC1MUyBpcyB0aGF0IHdoZW5ldmVyIElHUCBleHRlbnNpb25zIGFyZSBkZWZpbmVk IHRvIGFkdmVydGlzZSBuZXcgaW5mb3JtYXRpb24gaXQgaXMgbmVjZXNzYXJ5IHRvIGRlZmluZSBj b3JyZXNwb25kaW5nIEJHUC1MUyBjb2RlcG9pbnRzLiBUaGlzIGlzIG5vdCB0aGUgZmlyc3Qgc3Vj aCBCR1AtTFMgZXh0ZW5zaW9uIGRvY3VtZW50IOKAkyBhbmQgaXQgaXMgc2FmZSB0byBzYXkgaXQg d29u4oCZdCBiZSB0aGUgbGFzdC4gSXQgd291bGQgYmUgaGVscGZ1bCB0byBhbGwgaWYgd2UgcmVh Y2hlZCBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9yIHRoaXMgZGlzY3Vzc2lvbiB3aWxsIHRha2Ug cGxhY2UgZXZlcnkgdGltZSBhIEJHUC1MUyBleHRlbnNpb24gZG9jdW1lbnQgaXMgYmVpbmcgcmV2 aWV3ZWQg4oCTIHdoaWNoIHdpbGwgY29zdCB1cyBhbGwgdGltZSBuZWVkbGVzc2x5Lg0KDQogICBM ZXMNCg0KDQo= --_000_c204c2699675433cad9ac5342cdf0cc9XCHALN001ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtY29udmVy dGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFu LkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+WW9hdiDigJM8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW54IGZvciB0aGUgc3VnZ2VzdGlvbi4gSSBoYXZl IGp1c3QgcG9zdGVkIFYxNCBvZiB0aGUgZHJhZnQgd2hpY2ggSSBiZWxpZXZlIGFkZHJlc3NlcyB5 b3VyIGNvbmNlcm5zIOKAkyBwbGVhc2UgcmV2aWV3IGFuZCBjb25maXJtLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGlu IDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBZb2F2IE5pciAmbHQ7eW5pci5pZXRmQGdtYWlsLmNv bSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBTdW5kYXksIE9jdG9iZXIgMjEsIDIwMTggMTA6NDUg QU08YnI+DQo8Yj5Ubzo8L2I+IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpICZsdDtnaW5zYmVyZ0Bj aXNjby5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBSb2JlcnQgUmFzenVrICZsdDtyb2JlcnRAcmFz enVrLm5ldCZndDs7IGthZHVrQG1pdC5lZHU7IGlkckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pZHIt dGUtcG0tYmdwLmFsbEBpZXRmLm9yZzsgaWV0ZkBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnPGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3 IG9mIGRyYWZ0LWlldGYtaWRyLXRlLXBtLWJncC0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNlZSBpbmxpbmUuPG86cD48L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxOSBPY3QgMjAxOCwgYXQgMTc6NTEsIExlcyBHaW5z YmVyZyAoZ2luc2JlcmcpICZsdDs8YSBocmVmPSJtYWlsdG86Z2luc2JlcmdAY2lzY28uY29tIj5n aW5zYmVyZ0BjaXNjby5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Sb2Jl cnTigJlzIHBvc3QgYWRkcmVzc2VzIHBvaW50cyBJIGFsc28gd2FudCB0byBtYWtlLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+V2hhdCBpcyBiZWluZyBkb25lIGhlcmUgaXMgdG8gYWRkIGFkZGl0aW9uYWwgQkdQ LUxTIGNvZGVwb2ludHMgdG8gYWR2ZXJ0aXNlIElHUCBpbmZvcm1hdGlvbiB0aGF0IHdhcyBub3Qg ZGVmaW5lZCBhdCB0aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbi4gV2UgaGF2ZW7igJl0DQog Y2hhbmdlZCB0aGUgJm5ic3A7QkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g4oCTIG5vciBpcyB0 aGUgaW5mb3JtYXRpb24gYmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChzb21lIGFkZGl0aW9uYWwgVEUg cmVsYXRlZCBsaW5rIGF0dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVhbGl0YXRpdmVseSBkaWZmZXJl bnQgdGhhbiBhIG51bWJlciBvZiBleGlzdGluZyBUTFZzIGRlZmluZWQgaW4gUkZDIDc3NTIgKHNl ZTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1 MiNzZWN0aW9uLTMuMy4yPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+KS4NCiBJZiB0aGlzIGluZm9ybWF0aW9uIGhhZCBhbHJlYWR5IGJl ZW4gZGVmaW5lZCBpbiB0aGUgSUdQcyBhdCB0aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbiBp dCB3b3VsZCBzaW1wbHkgaGF2ZSBiZWVuIGluY2x1ZGVkIGFzIGEgc2VjdGlvbiBvZiBSRkMgNzc1 MiBhbmQgbm8gYWRkaXRpb25hbCBjaGFuZ2VzIHRvIFJGQyA3NzUyIHdvdWxkIGhhdmUgYmVlbiBy ZXF1aXJlZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkluIHRoZW9yeSwgd2UgY291bGQgaGF2ZSBzaW1wbHkg dXBkYXRlZCBSRkMgNzc1MiByYXRoZXIgd3JpdGluZyBhIHNlcGFyYXRlIGRyYWZ0LCBidXQgcHJh Y3RpY2FsbHkgdGhpcyB3b3VsZCBiZSBhIHBvb3Igc3RyYXRlZ3kgYXMgaXQgd291bGQgaW5jb3Jy ZWN0bHkgc3VnZ2VzdA0KIHRoYXQgc29tZSBjaGFuZ2Ugd2FzIGJlaW5nIG1hZGUgdG8gdGhlIGV4 aXN0aW5nIHRleHQgaW4gUkZDIDc3NTIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIGFwcHJlY2lhdGUgdGhh dCBmcm9tIHRoZSBQT1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91IGZvbGtzIGFyZSBub3QgYXMg aW50aW1hdGVseSBmYW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRyYWZ0cyBhbmQgdGhlIHJlbGF0 aW9uc2hpcCBiZXR3ZWVuIHRoZW0uIEl0IGlzDQogdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRo YXQgeW91IHN0YXJ0IGxvb2tpbmcgYXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9j dW1lbnQg4oCTIGFuZCBpbiB0aGF0IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVs eSBjb3JyZWN0LiBCdXQgdGhlIGRvY3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNj dXJhdGVseSBzZWVuIGFzIGFuIOKAnGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLg0KPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPltZTl0gUmlnaHQsIGFuZCBhcyBzdWNoLCBJIGJlbGlldmUgdGhh dCB0aGlzIGRvY3VtZW50IHNob3VsZCBhZGRyZXNzIHRoZSBwYXJ0IHRoYXQgaXQgYWRkcyB0byBS RkMgNzc1Mi4gSU9XIGl0IHNob3VsZCBzdGF0ZSB0aGF0IHRoZSBuZXcgSUdQIGluZm9ybWF0aW9u IHRoYXQgd2lsbCBub3cgYmUgc2VudCB0aHJvdWdoIEJHUCBkb2VzIG5vdCBwcmVzZW50IG5ldy9k aWZmZXJlbnQgcmlzayB0byB0aGUgaW5mb3JtYXRpb24NCiBhbHJlYWR5IGRlZmluZWQgaW4gNzc1 Mi4gVGhpcyBpcyBpbmZvcm1hdGlvbiB0aGF0IGhhcyB1cCB1bnRpbCBub3cgb25seSBiZWVuIHNl bnQgaW4gSVMtSVMgYW5kIE9TUEYgYW5kIHdpbGwgbm90IGJlIHNlbnQgaW4gQkdQLCBzbyB3ZSBu ZWVkIGEgc3RhdGVtZW50IHRoYXQgaXTigJlzIE9LIHRvIHNlbmQgdGhlc2UgYXR0cmlidXRlcyBp biBCR1AgYXMgd2VsbC4gT2YgY291cnNlLCBzdWNoIGEgc3RhdGVtZW50IGNvdWxkIGJlIGNoYWxs ZW5nZWQgaW4NCiBXR0xDIG9yIElFVEYgTEMsIGJ1dCBpdCBzaG91bGQgYmUgbWFkZS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48 L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBpc3N1ZXMgeW91IHJhaXNlIGhhdmUgYWxyZWFkeSBi ZWVuIGFkZHJlc3NlZCBpbiBSRkMgNzc1MiBhbmQgaXQgaXMgdGhlcmVmb3JlIHZlcnkgYXBwcm9w cmlhdGUgdGhhdCB3ZSBhZGRyZXNzIHlvdXIgY29uY2VybnMgYnkgaW5jbHVkaW5nIGEgcmVmZXJl bmNlIHRvIHRoZQ0KIFJGQyA3NzUyIHNlY3VyaXR5IGRpc2N1c3Npb24uPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5JIHRoaW5rIGl0IGlzIGltcG9ydGFudCB0aGF0IHlvdSBub3RlIHRoaXMgcmVsYXRpb25zaGlw LCBiZWNhdXNlIHRoZSBuYXR1cmUgb2YgQkdQLUxTIGlzIHRoYXQgd2hlbmV2ZXIgSUdQIGV4dGVu c2lvbnMgYXJlIGRlZmluZWQgdG8gYWR2ZXJ0aXNlIG5ldyBpbmZvcm1hdGlvbg0KIGl0IGlzIG5l Y2Vzc2FyeSB0byBkZWZpbmUgY29ycmVzcG9uZGluZyBCR1AtTFMgY29kZXBvaW50cy4gVGhpcyBp cyBub3QgdGhlIGZpcnN0IHN1Y2ggQkdQLUxTIGV4dGVuc2lvbiBkb2N1bWVudCDigJMgYW5kIGl0 IGlzIHNhZmUgdG8gc2F5IGl0IHdvbuKAmXQgYmUgdGhlIGxhc3QuIEl0IHdvdWxkIGJlIGhlbHBm dWwgdG8gYWxsIGlmIHdlIHJlYWNoZWQgYSBjb21tb24gdW5kZXJzdGFuZGluZyBvciB0aGlzIGRp c2N1c3Npb24gd2lsbCB0YWtlIHBsYWNlDQogZXZlcnkgdGltZSBhIEJHUC1MUyBleHRlbnNpb24g ZG9jdW1lbnQgaXMgYmVpbmcgcmV2aWV3ZWQg4oCTIHdoaWNoIHdpbGwgY29zdCB1cyBhbGwgdGlt ZSBuZWVkbGVzc2x5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7IExlczwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_c204c2699675433cad9ac5342cdf0cc9XCHALN001ciscocom_-- From nobody Sun Oct 21 16:26:55 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 274E4130DDB; Sun, 21 Oct 2018 16:26:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.947 X-Spam-Level: X-Spam-Status: No, score=0.947 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wBFe-bBw6IyW; Sun, 21 Oct 2018 16:26:46 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED6ED12F1A6; Sun, 21 Oct 2018 16:26:45 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.26.143; From: "Susan Hares" To: "'Yoav Nir'" , "'Les Ginsberg \(ginsberg\)'" Cc: , , "'Robert Raszuk'" , , , References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> In-Reply-To: <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> Date: Sun, 21 Oct 2018 19:26:40 -0400 Message-ID: <077e01d46995$85c7bb90$915732b0$@ndzh.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_077F_01D46973.FEB88C90" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQKgXenR4TO/OdN54mRvtkcFsKB91wGNvGOlAbtG730CGuBt5QG8teXZAq/npckCVX567AF47qlpAUeOFiECkA51CqMGun6Q Content-Language: en-us X-Antivirus: AVG (VPS 181021-4, 10/21/2018), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Oct 2018 23:26:48 -0000 This is a multipart message in MIME format. ------=_NextPart_000_077F_01D46973.FEB88C90 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Yoav: =20 Thank you providing suggested text to resolve your concerns and coming = to a resolution with the security issues with Les.=20 =20 Sue=20 =20 From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Yoav Nir Sent: Sunday, October 21, 2018 1:45 PM To: Les Ginsberg (ginsberg) Cc: idr@ietf.org; ietf@ietf.org; Robert Raszuk; secdir@ietf.org; = kaduk@mit.edu; draft-ietf-idr-te-pm-bgp.all@ietf.org Subject: Re: [Idr] [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13 =20 See inline. On 19 Oct 2018, at 17:51, Les Ginsberg (ginsberg) = wrote: =20 Robert=E2=80=99s post addresses points I also want to make. =20 What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see = = https://tools.ietf.org/html/rfc7752#section-3.3.2 ). If this information = had already been defined in the IGPs at the time RFC 7752 was written it = would simply have been included as a section of RFC 7752 and no = additional changes to RFC 7752 would have been required. =20 In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752. =20 I appreciate that from the POV of the Security Area you folks are not as = intimately familiar with the routing drafts and the relationship between = them. It is therefore understandable that you start looking at the new = draft as a standalone document =E2=80=93 and in that context your = comments are absolutely correct. But the document you are reviewing is = most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752.=20 =20 [YN] Right, and as such, I believe that this document should address the = part that it adds to RFC 7752. IOW it should state that the new IGP = information that will now be sent through BGP does not present = new/different risk to the information already defined in 7752. This is = information that has up until now only been sent in IS-IS and OSPF and = will not be sent in BGP, so we need a statement that it=E2=80=99s OK to = send these attributes in BGP as well. Of course, such a statement could = be challenged in WGLC or IETF LC, but it should be made. The issues you raise have already been addressed in RFC 7752 and it is = therefore very appropriate that we address your concerns by including a = reference to the RFC 7752 security discussion. =20 I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time needlessly. =20 Les =20 =20 ------=_NextPart_000_077F_01D46973.FEB88C90 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Yoav:

 

Thank you providing suggested text to resolve your concerns and = coming to a resolution with the security issues with Les. =

 

Sue

 

From:= = Idr [mailto:idr-bounces@ietf.org] On Behalf Of Yoav = Nir
Sent: Sunday, October 21, 2018 1:45 PM
To: Les = Ginsberg (ginsberg)
Cc: idr@ietf.org; ietf@ietf.org; Robert = Raszuk; secdir@ietf.org; kaduk@mit.edu; = draft-ietf-idr-te-pm-bgp.all@ietf.org
Subject: Re: [Idr] = [secdir] Secdir early review of = draft-ietf-idr-te-pm-bgp-13

 

See = inline.



On 19 = Oct 2018, at 17:51, Les Ginsberg (ginsberg) <ginsberg@cisco.com> = wrote:

 

Robert=E2=80=99s post addresses points I also want to = make.

 

What is being done here is to add additional BGP-LS codepoints to = advertise IGP information that was not defined at the time RFC 7752 was = written. We haven=E2=80=99t changed the  BGP-LS transport mechanism = =E2=80=93 nor is the information being advertised here (some additional = TE related link attribute information) qualitatively different than a = number of existing TLVs defined in RFC 7752 (see https://tools.ietf.org/html/rfc7752#section-3.3.2<= /span> ). If this = information had already been defined in the IGPs at the time RFC 7752 = was written it would simply have been included as a section of RFC 7752 = and no additional changes to RFC 7752 would have been = required.

 

In theory, we could have simply updated RFC 7752 rather writing a = separate draft, but practically this would be a poor strategy as it = would incorrectly suggest that some change was being made to the = existing text in RFC 7752.

 

I appreciate that from the POV of the Security Area you folks are not = as intimately familiar with the routing drafts and the relationship = between them. It is therefore understandable that you start looking at = the new draft as a standalone document =E2=80=93 and in that context = your comments are absolutely correct. But the document you are reviewing = is most accurately seen as an =E2=80=9Caddendum=E2=80=9D to RFC 7752. =

 

[YN] Right, and as such, I believe that this document = should address the part that it adds to RFC 7752. IOW it should state = that the new IGP information that will now be sent through BGP does not = present new/different risk to the information already defined in 7752. = This is information that has up until now only been sent in IS-IS and = OSPF and will not be sent in BGP, so we need a statement that = it=E2=80=99s OK to send these attributes in BGP as well. Of course, such = a statement could be challenged in WGLC or IETF LC, but it should be = made.



The issues you raise have already been addressed in RFC 7752 and it = is therefore very appropriate that we address your concerns by including = a reference to the RFC 7752 security = discussion.

 

I think it is important that you note this relationship, because the = nature of BGP-LS is that whenever IGP extensions are defined to = advertise new information it is necessary to define corresponding BGP-LS = codepoints. This is not the first such BGP-LS extension document = =E2=80=93 and it is safe to say it won=E2=80=99t be the last. It would = be helpful to all if we reached a common understanding or this = discussion will take place every time a BGP-LS extension document is = being reviewed =E2=80=93 which will cost us all time = needlessly.

 

   Les

 

 

------=_NextPart_000_077F_01D46973.FEB88C90-- From nobody Sun Oct 21 18:27:15 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EFA7120072; Sun, 21 Oct 2018 18:26:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5gVesqZL3727; Sun, 21 Oct 2018 18:26:52 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1019D12D4EE; Sun, 21 Oct 2018 18:26:52 -0700 (PDT) Received: from LHREML712-CAH.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 1D94EDB51A578; Mon, 22 Oct 2018 02:26:49 +0100 (IST) Received: from NKGEML412-HUB.china.huawei.com (10.98.56.73) by LHREML712-CAH.china.huawei.com (10.201.108.35) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 22 Oct 2018 02:26:49 +0100 Received: from NKGEML513-MBX.china.huawei.com ([169.254.1.10]) by nkgeml412-hub.china.huawei.com ([10.98.56.73]) with mapi id 14.03.0415.000; Mon, 22 Oct 2018 09:26:42 +0800 From: Qin Wu To: Yoav Nir , "Les Ginsberg (ginsberg)" CC: Robert Raszuk , "kaduk@mit.edu" , "idr@ietf.org" , "draft-ietf-idr-te-pm-bgp.all@ietf.org" , "ietf@ietf.org" , "secdir@ietf.org" Thread-Topic: [Idr] [secdir] Secdir early review of draft-ietf-idr-te-pm-bgp-13 Thread-Index: AQHUZZW/0K5XHEpKKkC6B03Mj9xH46UiBTIAgAEz0YCAABglAIABX4aAgAAW34CAAGv8AIAAa5YAgACGD4CAA1UEgIABBu3Q Date: Mon, 22 Oct 2018 01:26:41 +0000 Message-ID: References: <153972468642.9298.14442375581871750001@ietfa.amsl.com> <7655493D-9EF0-42FF-B2D3-B9CE4E78178D@gmail.com> <1FFA9449-D03C-4EB6-9D08-BA4A1AA93FE3@gmail.com> <92af26fef2da470d853f292c84f026a0@XCH-ALN-001.cisco.com> <20181019002642.GX19309@kduck.kaduk.org> <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> In-Reply-To: <14949BEE-1EC4-46A0-A1FD-8FE4BCD5D417@gmail.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.138.33.244] Content-Type: multipart/alternative; boundary="_000_B8F9A780D330094D99AF023C5877DABA9B0B8CE5nkgeml513mbxchi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] [Idr] Secdir early review of draft-ietf-idr-te-pm-bgp-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 01:26:54 -0000 --_000_B8F9A780D330094D99AF023C5877DABA9B0B8CE5nkgeml513mbxchi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIFlvYXYgZm9yIHByb3Bvc2VkIGNoYW5nZSw6LSkNCuWPkeS7tuS6ujogWW9hdiBOaXIg W21haWx0bzp5bmlyLmlldGZAZ21haWwuY29tXQ0K5Y+R6YCB5pe26Ze0OiAyMDE45bm0MTDmnIgy MuaXpSAxOjQ1DQrmlLbku7bkuro6IExlcyBHaW5zYmVyZyAoZ2luc2JlcmcpDQrmioTpgIE6IFJv YmVydCBSYXN6dWs7IGthZHVrQG1pdC5lZHU7IGlkckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pZHIt dGUtcG0tYmdwLmFsbEBpZXRmLm9yZzsgaWV0ZkBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnDQrk uLvpopg6IFJlOiBbSWRyXSBbc2VjZGlyXSBTZWNkaXIgZWFybHkgcmV2aWV3IG9mIGRyYWZ0LWll dGYtaWRyLXRlLXBtLWJncC0xMw0KDQpTZWUgaW5saW5lLg0KDQoNCk9uIDE5IE9jdCAyMDE4LCBh dCAxNzo1MSwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgPGdpbnNiZXJnQGNpc2NvLmNvbTxtYWls dG86Z2luc2JlcmdAY2lzY28uY29tPj4gd3JvdGU6DQoNClJvYmVydOKAmXMgcG9zdCBhZGRyZXNz ZXMgcG9pbnRzIEkgYWxzbyB3YW50IHRvIG1ha2UuDQoNCldoYXQgaXMgYmVpbmcgZG9uZSBoZXJl IGlzIHRvIGFkZCBhZGRpdGlvbmFsIEJHUC1MUyBjb2RlcG9pbnRzIHRvIGFkdmVydGlzZSBJR1Ag aW5mb3JtYXRpb24gdGhhdCB3YXMgbm90IGRlZmluZWQgYXQgdGhlIHRpbWUgUkZDIDc3NTIgd2Fz IHdyaXR0ZW4uIFdlIGhhdmVu4oCZdCBjaGFuZ2VkIHRoZSAgQkdQLUxTIHRyYW5zcG9ydCBtZWNo YW5pc20g4oCTIG5vciBpcyB0aGUgaW5mb3JtYXRpb24gYmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChz b21lIGFkZGl0aW9uYWwgVEUgcmVsYXRlZCBsaW5rIGF0dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVh bGl0YXRpdmVseSBkaWZmZXJlbnQgdGhhbiBhIG51bWJlciBvZiBleGlzdGluZyBUTFZzIGRlZmlu ZWQgaW4gUkZDIDc3NTIgKHNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNz ZWN0aW9uLTMuMy4yICkuIElmIHRoaXMgaW5mb3JtYXRpb24gaGFkIGFscmVhZHkgYmVlbiBkZWZp bmVkIGluIHRoZSBJR1BzIGF0IHRoZSB0aW1lIFJGQyA3NzUyIHdhcyB3cml0dGVuIGl0IHdvdWxk IHNpbXBseSBoYXZlIGJlZW4gaW5jbHVkZWQgYXMgYSBzZWN0aW9uIG9mIFJGQyA3NzUyIGFuZCBu byBhZGRpdGlvbmFsIGNoYW5nZXMgdG8gUkZDIDc3NTIgd291bGQgaGF2ZSBiZWVuIHJlcXVpcmVk Lg0KDQpJbiB0aGVvcnksIHdlIGNvdWxkIGhhdmUgc2ltcGx5IHVwZGF0ZWQgUkZDIDc3NTIgcmF0 aGVyIHdyaXRpbmcgYSBzZXBhcmF0ZSBkcmFmdCwgYnV0IHByYWN0aWNhbGx5IHRoaXMgd291bGQg YmUgYSBwb29yIHN0cmF0ZWd5IGFzIGl0IHdvdWxkIGluY29ycmVjdGx5IHN1Z2dlc3QgdGhhdCBz b21lIGNoYW5nZSB3YXMgYmVpbmcgbWFkZSB0byB0aGUgZXhpc3RpbmcgdGV4dCBpbiBSRkMgNzc1 Mi4NCg0KSSBhcHByZWNpYXRlIHRoYXQgZnJvbSB0aGUgUE9WIG9mIHRoZSBTZWN1cml0eSBBcmVh IHlvdSBmb2xrcyBhcmUgbm90IGFzIGludGltYXRlbHkgZmFtaWxpYXIgd2l0aCB0aGUgcm91dGlu ZyBkcmFmdHMgYW5kIHRoZSByZWxhdGlvbnNoaXAgYmV0d2VlbiB0aGVtLiBJdCBpcyB0aGVyZWZv cmUgdW5kZXJzdGFuZGFibGUgdGhhdCB5b3Ugc3RhcnQgbG9va2luZyBhdCB0aGUgbmV3IGRyYWZ0 IGFzIGEgc3RhbmRhbG9uZSBkb2N1bWVudCDigJMgYW5kIGluIHRoYXQgY29udGV4dCB5b3VyIGNv bW1lbnRzIGFyZSBhYnNvbHV0ZWx5IGNvcnJlY3QuIEJ1dCB0aGUgZG9jdW1lbnQgeW91IGFyZSBy ZXZpZXdpbmcgaXMgbW9zdCBhY2N1cmF0ZWx5IHNlZW4gYXMgYW4g4oCcYWRkZW5kdW3igJ0gdG8g UkZDIDc3NTIuDQoNCltZTl0gUmlnaHQsIGFuZCBhcyBzdWNoLCBJIGJlbGlldmUgdGhhdCB0aGlz IGRvY3VtZW50IHNob3VsZCBhZGRyZXNzIHRoZSBwYXJ0IHRoYXQgaXQgYWRkcyB0byBSRkMgNzc1 Mi4gSU9XIGl0IHNob3VsZCBzdGF0ZSB0aGF0IHRoZSBuZXcgSUdQIGluZm9ybWF0aW9uIHRoYXQg d2lsbCBub3cgYmUgc2VudCB0aHJvdWdoIEJHUCBkb2VzIG5vdCBwcmVzZW50IG5ldy9kaWZmZXJl bnQgcmlzayB0byB0aGUgaW5mb3JtYXRpb24gYWxyZWFkeSBkZWZpbmVkIGluIDc3NTIuIFRoaXMg aXMgaW5mb3JtYXRpb24gdGhhdCBoYXMgdXAgdW50aWwgbm93IG9ubHkgYmVlbiBzZW50IGluIElT LUlTIGFuZCBPU1BGIGFuZCB3aWxsIG5vdCBiZSBzZW50IGluIEJHUCwgc28gd2UgbmVlZCBhIHN0 YXRlbWVudCB0aGF0IGl04oCZcyBPSyB0byBzZW5kIHRoZXNlIGF0dHJpYnV0ZXMgaW4gQkdQIGFz IHdlbGwuIE9mIGNvdXJzZSwgc3VjaCBhIHN0YXRlbWVudCBjb3VsZCBiZSBjaGFsbGVuZ2VkIGlu IFdHTEMgb3IgSUVURiBMQywgYnV0IGl0IHNob3VsZCBiZSBtYWRlLg0KDQoNClRoZSBpc3N1ZXMg eW91IHJhaXNlIGhhdmUgYWxyZWFkeSBiZWVuIGFkZHJlc3NlZCBpbiBSRkMgNzc1MiBhbmQgaXQg aXMgdGhlcmVmb3JlIHZlcnkgYXBwcm9wcmlhdGUgdGhhdCB3ZSBhZGRyZXNzIHlvdXIgY29uY2Vy bnMgYnkgaW5jbHVkaW5nIGEgcmVmZXJlbmNlIHRvIHRoZSBSRkMgNzc1MiBzZWN1cml0eSBkaXNj dXNzaW9uLg0KDQpJIHRoaW5rIGl0IGlzIGltcG9ydGFudCB0aGF0IHlvdSBub3RlIHRoaXMgcmVs YXRpb25zaGlwLCBiZWNhdXNlIHRoZSBuYXR1cmUgb2YgQkdQLUxTIGlzIHRoYXQgd2hlbmV2ZXIg SUdQIGV4dGVuc2lvbnMgYXJlIGRlZmluZWQgdG8gYWR2ZXJ0aXNlIG5ldyBpbmZvcm1hdGlvbiBp dCBpcyBuZWNlc3NhcnkgdG8gZGVmaW5lIGNvcnJlc3BvbmRpbmcgQkdQLUxTIGNvZGVwb2ludHMu IFRoaXMgaXMgbm90IHRoZSBmaXJzdCBzdWNoIEJHUC1MUyBleHRlbnNpb24gZG9jdW1lbnQg4oCT IGFuZCBpdCBpcyBzYWZlIHRvIHNheSBpdCB3b27igJl0IGJlIHRoZSBsYXN0LiBJdCB3b3VsZCBi ZSBoZWxwZnVsIHRvIGFsbCBpZiB3ZSByZWFjaGVkIGEgY29tbW9uIHVuZGVyc3RhbmRpbmcgb3Ig dGhpcyBkaXNjdXNzaW9uIHdpbGwgdGFrZSBwbGFjZSBldmVyeSB0aW1lIGEgQkdQLUxTIGV4dGVu c2lvbiBkb2N1bWVudCBpcyBiZWluZyByZXZpZXdlZCDigJMgd2hpY2ggd2lsbCBjb3N0IHVzIGFs bCB0aW1lIG5lZWRsZXNzbHkuDQoNCiAgIExlcw0KDQoNCg== --_000_B8F9A780D330094D99AF023C5877DABA9B0B8CE5nkgeml513mbxchi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTIgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 5a6L5L2TOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQOWui+S9kyI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OuWui+S9kzt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0 eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNp dGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLmFwcGxl LWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgljb2xvcjojMUY0OTdEO30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1h cmdpbjo3Mi4wcHQgOTAuMHB0IDcyLjBwdCA5MC4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJaSC1DTiIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuNXB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztj b2xvcjojMUY0OTdEIj5UaGFua3MgWW9hdiBmb3IgcHJvcG9zZWQgY2hhbmdlLDotKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9w OnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+5Y+R5Lu25Lq6 PHNwYW4gbGFuZz0iRU4tVVMiPjo8L3NwYW4+PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiBZb2F2IE5pciBbbWFpbHRvOnluaXIuaWV0ZkBnbWFp bC5jb21dDQo8YnI+DQo8L3NwYW4+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPuWP kemAgeaXtumXtDxzcGFuIGxhbmc9IkVOLVVTIj46PC9zcGFuPjwvc3Bhbj48L2I+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4gMjAxODwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdCI+5bm0PHNwYW4gbGFuZz0iRU4tVVMiPjEwPC9zcGFuPuaciDxz cGFuIGxhbmc9IkVOLVVTIj4yMjwvc3Bhbj7ml6U8c3BhbiBsYW5nPSJFTi1VUyI+IDE6NDU8YnI+ DQo8L3NwYW4+PGI+5pS25Lu25Lq6PHNwYW4gbGFuZz0iRU4tVVMiPjo8L3NwYW4+PC9iPjxzcGFu IGxhbmc9IkVOLVVTIj4gTGVzIEdpbnNiZXJnIChnaW5zYmVyZyk8YnI+DQo8L3NwYW4+PGI+5oqE 6YCBPHNwYW4gbGFuZz0iRU4tVVMiPjo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gUm9i ZXJ0IFJhc3p1azsga2FkdWtAbWl0LmVkdTsgaWRyQGlldGYub3JnOyBkcmFmdC1pZXRmLWlkci10 ZS1wbS1iZ3AuYWxsQGlldGYub3JnOyBpZXRmQGlldGYub3JnOyBzZWNkaXJAaWV0Zi5vcmc8YnI+ DQo8L3NwYW4+PGI+5Li76aKYPHNwYW4gbGFuZz0iRU4tVVMiPjo8L3NwYW4+PC9iPjxzcGFuIGxh bmc9IkVOLVVTIj4gUmU6IFtJZHJdIFtzZWNkaXJdIFNlY2RpciBlYXJseSByZXZpZXcgb2YgZHJh ZnQtaWV0Zi1pZHItdGUtcG0tYmdwLTEzPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiPlNlZSBpbmxpbmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t VVMiPk9uIDE5IE9jdCAyMDE4LCBhdCAxNzo1MSwgTGVzIEdpbnNiZXJnIChnaW5zYmVyZykgJmx0 OzxhIGhyZWY9Im1haWx0bzpnaW5zYmVyZ0BjaXNjby5jb20iPmdpbnNiZXJnQGNpc2NvLmNvbTwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5Sb2JlcnTigJlzIHBvc3QgYWRkcmVz c2VzIHBvaW50cyBJIGFsc28gd2FudCB0byBtYWtlLjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OywmcXVvdDtzZXJp ZiZxdW90OyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xv cjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDsiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+V2hh dCBpcyBiZWluZyBkb25lIGhlcmUgaXMgdG8gYWRkIGFkZGl0aW9uYWwgQkdQLUxTIGNvZGVwb2lu dHMgdG8gYWR2ZXJ0aXNlIElHUCBpbmZvcm1hdGlvbiB0aGF0IHdhcyBub3QgZGVmaW5lZCBhdCB0 aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbi4NCiBXZSBoYXZlbuKAmXQgY2hhbmdlZCB0aGUg Jm5ic3A7QkdQLUxTIHRyYW5zcG9ydCBtZWNoYW5pc20g4oCTIG5vciBpcyB0aGUgaW5mb3JtYXRp b24gYmVpbmcgYWR2ZXJ0aXNlZCBoZXJlIChzb21lIGFkZGl0aW9uYWwgVEUgcmVsYXRlZCBsaW5r IGF0dHJpYnV0ZSBpbmZvcm1hdGlvbikgcXVhbGl0YXRpdmVseSBkaWZmZXJlbnQgdGhhbiBhIG51 bWJlciBvZiBleGlzdGluZyBUTFZzIGRlZmluZWQgaW4gUkZDIDc3NTIgKHNlZTxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMuMy4yIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzc1MiNzZWN0aW9uLTMu My4yPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+KS4NCiBJZiB0aGlzIGluZm9ybWF0aW9uIGhhZCBhbHJlYWR5IGJlZW4gZGVmaW5lZCBp biB0aGUgSUdQcyBhdCB0aGUgdGltZSBSRkMgNzc1MiB3YXMgd3JpdHRlbiBpdCB3b3VsZCBzaW1w bHkgaGF2ZSBiZWVuIGluY2x1ZGVkIGFzIGEgc2VjdGlvbiBvZiBSRkMgNzc1MiBhbmQgbm8gYWRk aXRpb25hbCBjaGFuZ2VzIHRvIFJGQyA3NzUyIHdvdWxkIGhhdmUgYmVlbiByZXF1aXJlZC48L3Nw YW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcg Um9tYW4mcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LCZx dW90O3NlcmlmJnF1b3Q7Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7O2NvbG9yOiMxRjQ5N0QiPkluIHRoZW9yeSwgd2UgY291bGQgaGF2ZSBzaW1wbHkgdXBkYXRl ZCBSRkMgNzc1MiByYXRoZXIgd3JpdGluZyBhIHNlcGFyYXRlIGRyYWZ0LCBidXQgcHJhY3RpY2Fs bHkgdGhpcyB3b3VsZCBiZSBhIHBvb3Igc3RyYXRlZ3kgYXMgaXQgd291bGQgaW5jb3JyZWN0bHkN CiBzdWdnZXN0IHRoYXQgc29tZSBjaGFuZ2Ugd2FzIGJlaW5nIG1hZGUgdG8gdGhlIGV4aXN0aW5n IHRleHQgaW4gUkZDIDc3NTIuPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7Ij48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPiZu YnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OywmcXVvdDtzZXJpZiZxdW90OyI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5JIGFwcHJlY2lhdGUgdGhh dCBmcm9tIHRoZSBQT1Ygb2YgdGhlIFNlY3VyaXR5IEFyZWEgeW91IGZvbGtzIGFyZSBub3QgYXMg aW50aW1hdGVseSBmYW1pbGlhciB3aXRoIHRoZSByb3V0aW5nIGRyYWZ0cyBhbmQgdGhlIHJlbGF0 aW9uc2hpcCBiZXR3ZWVuDQogdGhlbS4gSXQgaXMgdGhlcmVmb3JlIHVuZGVyc3RhbmRhYmxlIHRo YXQgeW91IHN0YXJ0IGxvb2tpbmcgYXQgdGhlIG5ldyBkcmFmdCBhcyBhIHN0YW5kYWxvbmUgZG9j dW1lbnQg4oCTIGFuZCBpbiB0aGF0IGNvbnRleHQgeW91ciBjb21tZW50cyBhcmUgYWJzb2x1dGVs eSBjb3JyZWN0LiBCdXQgdGhlIGRvY3VtZW50IHlvdSBhcmUgcmV2aWV3aW5nIGlzIG1vc3QgYWNj dXJhdGVseSBzZWVuIGFzIGFuIOKAnGFkZGVuZHVt4oCdIHRvIFJGQyA3NzUyLg0KPC9zcGFuPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+W1lOXSBSaWdodCwgYW5kIGFzIHN1Y2gsIEkgYmVs aWV2ZSB0aGF0IHRoaXMgZG9jdW1lbnQgc2hvdWxkIGFkZHJlc3MgdGhlIHBhcnQgdGhhdCBpdCBh ZGRzIHRvIFJGQyA3NzUyLiBJT1cgaXQgc2hvdWxkIHN0YXRlIHRoYXQgdGhlIG5ldyBJR1AgaW5m b3JtYXRpb24gdGhhdCB3aWxsIG5vdyBiZSBzZW50IHRocm91Z2ggQkdQIGRvZXMgbm90IHByZXNl bnQgbmV3L2RpZmZlcmVudA0KIHJpc2sgdG8gdGhlIGluZm9ybWF0aW9uIGFscmVhZHkgZGVmaW5l ZCBpbiA3NzUyLiBUaGlzIGlzIGluZm9ybWF0aW9uIHRoYXQgaGFzIHVwIHVudGlsIG5vdyBvbmx5 IGJlZW4gc2VudCBpbiBJUy1JUyBhbmQgT1NQRiBhbmQgd2lsbCBub3QgYmUgc2VudCBpbiBCR1As IHNvIHdlIG5lZWQgYSBzdGF0ZW1lbnQgdGhhdCBpdOKAmXMgT0sgdG8gc2VuZCB0aGVzZSBhdHRy aWJ1dGVzIGluIEJHUCBhcyB3ZWxsLiBPZiBjb3Vyc2UsIHN1Y2ggYSBzdGF0ZW1lbnQNCiBjb3Vs ZCBiZSBjaGFsbGVuZ2VkIGluIFdHTEMgb3IgSUVURiBMQywgYnV0IGl0IHNob3VsZCBiZSBtYWRl LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tVVMiPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fu cy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5UaGUgaXNzdWVzIHlvdSByYWlzZSBoYXZlIGFs cmVhZHkgYmVlbiBhZGRyZXNzZWQgaW4gUkZDIDc3NTIgYW5kIGl0IGlzIHRoZXJlZm9yZSB2ZXJ5 IGFwcHJvcHJpYXRlIHRoYXQgd2UgYWRkcmVzcyB5b3VyIGNvbmNlcm5zIGJ5IGluY2x1ZGluZyBh DQogcmVmZXJlbmNlIHRvIHRoZSBSRkMgNzc1MiBzZWN1cml0eSBkaXNjdXNzaW9uLjwvc3Bhbj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OywmcXVvdDtzZXJpZiZxdW90OyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fu cy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssJnF1b3Q7 c2VyaWYmcXVvdDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7 Y29sb3I6IzFGNDk3RCI+SSB0aGluayBpdCBpcyBpbXBvcnRhbnQgdGhhdCB5b3Ugbm90ZSB0aGlz IHJlbGF0aW9uc2hpcCwgYmVjYXVzZSB0aGUgbmF0dXJlIG9mIEJHUC1MUyBpcyB0aGF0IHdoZW5l dmVyIElHUCBleHRlbnNpb25zIGFyZSBkZWZpbmVkIHRvIGFkdmVydGlzZQ0KIG5ldyBpbmZvcm1h dGlvbiBpdCBpcyBuZWNlc3NhcnkgdG8gZGVmaW5lIGNvcnJlc3BvbmRpbmcgQkdQLUxTIGNvZGVw b2ludHMuIFRoaXMgaXMgbm90IHRoZSBmaXJzdCBzdWNoIEJHUC1MUyBleHRlbnNpb24gZG9jdW1l bnQg4oCTIGFuZCBpdCBpcyBzYWZlIHRvIHNheSBpdCB3b27igJl0IGJlIHRoZSBsYXN0LiBJdCB3 b3VsZCBiZSBoZWxwZnVsIHRvIGFsbCBpZiB3ZSByZWFjaGVkIGEgY29tbW9uIHVuZGVyc3RhbmRp bmcgb3IgdGhpcyBkaXNjdXNzaW9uDQogd2lsbCB0YWtlIHBsYWNlIGV2ZXJ5IHRpbWUgYSBCR1At TFMgZXh0ZW5zaW9uIGRvY3VtZW50IGlzIGJlaW5nIHJldmlld2VkIOKAkyB3aGljaCB3aWxsIGNv c3QgdXMgYWxsIHRpbWUgbmVlZGxlc3NseS48L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssJnF1b3Q7c2VyaWYmcXVv dDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7Ij48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZu YnNwOyBMZXM8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDsiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1V UyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_B8F9A780D330094D99AF023C5877DABA9B0B8CE5nkgeml513mbxchi_-- From nobody Mon Oct 22 00:02:13 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3576130DFB for ; Mon, 22 Oct 2018 00:01:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.364 X-Spam-Level: X-Spam-Status: No, score=-4.364 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.064, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=RvgNX4AY; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=ericsson.com header.b=dhW7spK6 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YweC_rhemL_d for ; Mon, 22 Oct 2018 00:01:57 -0700 (PDT) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93DF2130E05 for ; Mon, 22 Oct 2018 00:01:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1540191710; x=1542783710; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=p0PKHW/YlznyH3DFz2ckM+9eAnVJ0j4iuRzKskw4ajQ=; b=RvgNX4AYupzsPLyevZM30wIqYDEnsIVtyzxN/f8IRTCAfEMrHxaukpYi4PQJJEVx F/8bjOBbrl3M81OivvuCjmZQ81vmMGHHEGsULWbATK4Q9xW4ERwkVeaqQba/le4r GX+xfnc96wuwfnYtfHJQL2lZ3gxMguLLSmcwm8p7TR8=; X-AuditID: c1b4fb30-2bbff700000047d2-3e-5bcd75de3644 Received: from ESESBMB503.ericsson.se (Unknown_Domain [153.88.183.116]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id DA.5F.18386.ED57DCB5; Mon, 22 Oct 2018 09:01:50 +0200 (CEST) Received: from ESESSMR503.ericsson.se (153.88.183.112) by ESESBMB503.ericsson.se (153.88.183.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 22 Oct 2018 09:01:49 +0200 Received: from ESESBMB504.ericsson.se (153.88.183.171) by ESESSMR503.ericsson.se (153.88.183.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 22 Oct 2018 09:01:49 +0200 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB504.ericsson.se (153.88.183.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Mon, 22 Oct 2018 09:01:49 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FgdLw3gnFRIEFt3Is/KSi5Dxg1AuHykrEzNVEz2Yp5k=; b=dhW7spK6BCXSzr6aLGXFAsysmZ30laQ+/tQwOZL2AiXjgSJ91EKcfDuUjInKx2dVwIfP3lpM5YyX+3JfXTJlX7T22pRAFBcVSPz6KiweSRiX0IjEkRFUJfMTy0ufh3LMagQTmt1USCR7zRKMG7vPu3lvoZE5VPFoiJ8nVixcgMU= Received: from DM3PR15MB1002.namprd15.prod.outlook.com (10.166.160.10) by DM3PR15MB0650.namprd15.prod.outlook.com (10.164.33.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.29; Mon, 22 Oct 2018 07:01:46 +0000 Received: from DM3PR15MB1002.namprd15.prod.outlook.com ([fe80::2501:1ff1:91d0:8b6e]) by DM3PR15MB1002.namprd15.prod.outlook.com ([fe80::2501:1ff1:91d0:8b6e%4]) with mapi id 15.20.1250.028; Mon, 22 Oct 2018 07:01:42 +0000 From: Daniel Migault To: =?utf-8?B?QXJpIEtlcsOkbmVu?= , "core@ietf.org" CC: "secdir@ietf.org" , "draft-ietf-core-too-many-reqs.all@ietf.org" , "ietf@ietf.org" , Jim Schaad Thread-Topic: [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 Thread-Index: AQHUXydxRR2UxETJ3ES1rGo1Lxy5eaUqFC0AgADWWyA= Date: Mon, 22 Oct 2018 07:01:42 +0000 Message-ID: References: <153895864367.4396.18138201518799857673@ietfa.amsl.com> <061801d45f27$602ef380$208cda80$@augustcellars.com> <031D5D2F-69BA-4315-BC89-1F40363EF586@ericsson.com> In-Reply-To: <031D5D2F-69BA-4315-BC89-1F40363EF586@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=daniel.migault@ericsson.com; x-originating-ip: [199.91.196.135] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM3PR15MB0650; 6:/7gVOFmtTjAVTRF4D95K7SaGPpXlsROuiF4plyQk+Yavb9wLpVEadyaoVwYMNLs9X/WRyCd5qZkeZO+z3GhWdztM0AN/X4i4hVkOTK4Y+R4kyozYaTR6CgTiXngfyFKD1KXxsVEqCZzBNA5xoQWsemBgzkBAXbFNzUu2wBq/VN8E+/Fc5CGIApvRhkd9uluuDUgDSCOOnAwYmnlMgkNKswp/EBh0ozB6wDTYjT0Ip2/O0iaaht55PonWbNtlZqFO9Qi2hd7XSpruY3uxz7SgyZNRZ3WtnXs6ed7xvhOsPVtXrqJkiY2OhbTgwijF9UO2RI2kmsYE6A/6tkDmlsriVHQ4GotOLS6+R+SZptDjvKTKYrjvl4NXT2T+Kl5yhiN1vr0F7VofLhuN4wnPMEzYAZaJAC4CjrRByGveEJnaJqjECvfdtRlqM8s78PaX0BZg7pTx0lVzSlqEEfAoCsbpRA==; 5:vR78pSSSK088LZMGUp5FXyeGM606CWInRSv3gpHDid8093CD+5qcD2WVLGI/aRG+nI87MkkBCR2dZ13+PxhMSbtVCiEE/TjOdUnJtTPKkJFlzx6uGdkwpYZjCr1GJkJq/t++DPgMycIxNh04+uInYdkyX40CtKV6XhvJXS7w6Sg=; 7:eSD6wEpttHHLKi6nDkbz0LA0WL/3lMedC0m6/pwkrmPIgUMUOi6KDQa1ff2qG/Ta15Yd8894wCRo2FNaAIBnm8M/H5mAowLQUCsSstdnXsv9QFU/ZgyNYNWml6lOZHTrZjua6+QBFRM1mQoEjokFN8WB2XJuxCXFx7LTAv5Wmeq8XFD1pMMZcuubYpO8WyaxepoBGlPqmsg6Bp5zhbqKqZzozGBpRHRqxTW0PwEb0154dP86dZ0ul70YswPvJnFU x-ms-exchange-antispam-srfa-diagnostics: SOS;SOR; x-forefront-antispam-report: SFV:SKI; SCL:-1; SFV:NSPM; SFS:(10009020)(396003)(366004)(136003)(346002)(39850400004)(376002)(189003)(199004)(13464003)(99286004)(54906003)(110136005)(606006)(14454004)(966005)(478600001)(76176011)(7696005)(25786009)(2906002)(4326008)(790700001)(3846002)(6116002)(561944003)(7736002)(186003)(66574009)(446003)(486006)(44832011)(86362001)(476003)(33656002)(26005)(74316002)(2501003)(97736004)(5250100002)(2900100001)(66066001)(81166006)(256004)(8936002)(11346002)(99936001)(81156014)(106356001)(8676002)(105586002)(14444005)(229853002)(5660300001)(68736007)(53546011)(6506007)(54896002)(6306002)(6436002)(102836004)(55016002)(316002)(71200400001)(236005)(71190400001)(9686003)(345774005)(6246003)(53936002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM3PR15MB0650; H:DM3PR15MB1002.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; x-ms-office365-filtering-correlation-id: 7ca5d903-d96d-4344-7db0-08d637ec38fe x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:DM3PR15MB0650; x-ms-traffictypediagnostic: DM3PR15MB0650: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(248295561703944)(37575265505322)(166708455590820)(192374486261705)(158342451672863)(21748063052155)(28532068793085)(190501279198761)(227612066756510); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(102415395)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3002001)(3231355)(944501410)(4983020)(52105095)(148016)(149066)(150057)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(201708071742011)(7699051)(76991095); SRVR:DM3PR15MB0650; BCL:0; PCL:0; RULEID:; SRVR:DM3PR15MB0650; x-forefront-prvs: 08331F819E received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: SnNLBXTLhfArkAYkAcM3kSojQBH4dODSef+4Wqs02ot4q+luq5RrVA4QRFIeEda55NWftKMps3C3zW1SFuIliO9ElyC5oPvDNjkkv2/Ngg1pwVf3a/FsSXMrPWobZr2sbKIotlz/VNDhaL/67mrUCstAe/C/cNjGsNf+hyyA0TAbtCWi1yhfhM7XOAQMlmux8xpaANRAwsa3/p7HPWUqCY3MyUIhIcfr9NQTGBJ/6ymlqXh0UJ8nTdrWsATYL/0QBM4i7J6P+stU6z+pcSr06zVQv18DkXnZSXZk/jfrNLksvUQpE/zVMiwbaEfb5OjoEFD5WTeKJ48UQuLMEvcJsb40zVJ3jwHBShqMlfi3BAw= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0019_01D469B3.8CECAB10" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 7ca5d903-d96d-4344-7db0-08d637ec38fe X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Oct 2018 07:01:42.5640 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PR15MB0650 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA1WSW0iTYRjHe7+Tn6vR25r5sChq1YVZ5qRoiJ3ACw0KC4JQsWZ95HGTba7j hVpKZJGVZK50mVZODTNjtoucrbRcTtJOOMxyljXMUqnZKKzt+xbU3e/5P//n9PKypMRLy9hM tZ7TqlU5ckZEVe5u068eynemRFf3SpXt482kssxUQysbK6YZ5WiLiVJO1AxTm+mElisVTEJd nY9IIpJFcfu5nEwDp12zca8ow/fqIplnqycOdb+YIAuQuZQ4hUJZwGvB97qYOYVErAR3Ihg0 zSAh8CKwjNrogIsP6rp2CYk6Aqyj96hAQOEyEqY+3yeEzHkCGicaSCFwI3hSXh8SqGdwDJTY z/IsxWnQcbWSN5G4F8F49bQ/wbLz8Q5wvcsSPDuhqNfDy1IcC7+HFQGZwivgue8yv7gYp0Jp yy9KmNWM4KG3mO8fijdDf5WTDDDCC2Da0cQXkDgcXO9NwaulMNz3lBE4DDwjM7TgTwPv5GlS 0OXw6csAEngR9JtKg9we4i+OFFgBj802/hbAbgbsN7/RgaUBb4Pi2ghB70Mw5rgUHLYSnCcK g55ssB6PL0MK4z/rGflnOYfg8vdBxsgfOg+6K99TgikFOizFIQJHwoeBD9RfvlEzRhr9bUn/ iFpj4v9ygDfAJ8fbYOlSKC8dDvI6GOucRFfR7AYUpuN06bkHYmKiOG3mPp1Oo45Sc/o7yP8D H9z9GX0PeT5usSPMIvkc8QjnTJHQKoPucK4dLff3cd9ufIZklFqj5uRScWK4Py3erzp8hNNq 9mjzczidHS1kKXm4WLm9NVmCD6j0XDbH5XHav1mCDZUVoKz4DFHPtmV6VWxmV9TPQ0Tr/er8 qq0y85BZM5665ai25PuiVbZNCUWmrmzXqinLifz0ptRjcet3mYvqr7UWNsw9n9X25qQh/pH7 hybiVljPy6POWdZN1uSTTPqFG51tSyzuhsSaisXHacMTeVKSwzoSH37H03HmYNWU2zPw9bqr XE7pMlSKlaRWp/oDrMLQeYkDAAA= Archived-At: Subject: Re: [secdir] [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 07:02:01 -0000 ------=_NextPart_000_0019_01D469B3.8CECAB10 Content-Type: multipart/alternative; boundary="----=_NextPart_001_001A_01D469B3.8CECAB10" ------=_NextPart_001_001A_01D469B3.8CECAB10 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Ari! =20 I checked the version on github. It addresses my concerns also = considering Jim=E2=80=99s feed backs.=20 =20 Yours,=20 Daniel From: Ari Ker=C3=A4nen=20 Sent: Sunday, October 21, 2018 2:10 PM To: Daniel Migault ; core@ietf.org Cc: secdir@ietf.org; draft-ietf-core-too-many-reqs.all@ietf.org; = ietf@ietf.org; Jim Schaad Subject: Re: [core] Secdir last call review of = draft-ietf-core-too-many-reqs-04 =20 Thank you for the review Daniel! =20 I have now addressed your comments in the latest draft version in = Github: https://github.com/core-wg/too-many-reqs/pull/4/files =20 * Clarified the text in sections 4 and 5 roughly as proposed * Added a note in section 5 that dropping requests may result in retries = * Added a note that responses without encryption can leak information = (agree with Jim that it=E2=80=99s not a major risk so didn=E2=80=99t add = normative language on this) =20 I=E2=80=99m planning to submit a new version tomorrow before the DL. =20 =20 Cheers, Ari On 8 Oct 2018, at 19.53, Jim Schaad > wrote: -----Original Message----- From: core > On = Behalf Of Daniel Migault Sent: Sunday, October 7, 2018 5:31 PM To: secdir@ietf.org =20 Cc: draft-ietf-core-too-many-reqs.all@ietf.org = ; ietf@ietf.org = ; core@ietf.org =20 Subject: [core] Secdir last call review of draft-ietf-core-too-many-reqs-04 =20 Reviewer: Daniel Migault Review result: Has Nits =20 Hi, =20 Reviewer: Daniel Migault Review result: Has Nits =20 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. =20 The document is clear and almost ready. Most of my comments concerns = the "Security Considerations". =20 Yours, Daniel =20 4. CoAP Client Behavior =20 A client MUST NOT rely on a server being able to send the 4.29 Response Code in an overload situation because an overloaded server may not be able to reply to all requests at all. =20 =20 I believe the sentence may be rephrased. This is just a proposal. OLD may not be able to reply to all requests at all. NEW may not be able to reply (at all) to some requests. . =20 =20 5. Security Considerations =20 Replying to CoAP requests with a Response Code consumes resources from a server. For a server under attack it may be more appropriate to simply drop requests without responding. =20 The gain from the response with Too Many Requests Response Code is = almost the current response and all *similar* requests from that client during Max Age. I suspect that is likely a gain except when there is no responses from the server and client is not expect to send a request before Max Age. Simply dropping the requests may add the retry traffic, though it depends on = the application. That said your text is correct. I am wondering if it would = be good to illustrate your purpose. =20 If a CoAP reply with the Too Many Requests Response Code is not authenticated and integrity protected, an attacker can attempt to =20 Keranen Expires January 25, 2019 [Page 3] =20 Internet-Draft Too Many Requests Response Code for CoAP July 2018 =20 spoof a reply and make the client wait for an extended period of time before trying again. =20 A similar attack may also consists in an attacker triggering multiple request or transactions with a spoofed IP so the server generates the reply to the legitimate IP. This could be used if an attacker cannot directly send = the spoofed response to the legitimate client. =20 The response code provides an information about the state (overloaded) = of the server which can be used to infer additional information. This could potentially be used by an active attacker among other to confirm an attack is efficient, that a server is receiving multiple packet at a given time which may be used to identify some traffic patterns, identifying a bug a version... For a passive attacker, the response code may among other indicate an appropriated = time to trigger a larger attack.... =20 Because the code enable an attacker to gain some kind of control of the client, and reveals some information about the status of the server. I would suggest to mention that Too Many Response Code should not be considered outside unprotected channel. That is a server SHOULD NOT reply with a Too Many Requests Response Code unless the communication is encrypted. A client SHOULD ignore Too Many Response Code unless the communication is encrypted. =20 The response seems to me small enough so reflection attacks may be out = of scope. I do not believe that this is aimed to be any type of DOS prevention = tool. I would disagree that this is a huge attack window. The client will = filter the set of response that it is receiving to match only requests that it = has made. Thus a general flood attack would not be useful unless it was targeting the same messages ids (and tokens) as requests from the client under attack. But then these would be seen by the server as duplicate messages and ignored w/o sending out a response. I am not sure that I would consider the fact that the server is = currently "loaded" for some measure is a huge leak of information. I don't think = I would care if that was leaked.=20 Jim =20 _______________________________________________ core mailing list core@ietf.org =20 https://www.ietf.org/mailman/listinfo/core =20 ------=_NextPart_001_001A_01D469B3.8CECAB10 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Hi = Ari!

 

I checked the version on github. =C2=A0It addresses my = concerns also considering Jim=E2=80=99s feed backs.

 

Yours, =

Daniel

From: Ari Ker=C3=A4nen =
Sent: Sunday, October 21, 2018 2:10 PM
To: Daniel = Migault <daniel.migault@ericsson.com>; core@ietf.org
Cc: = secdir@ietf.org; draft-ietf-core-too-many-reqs.all@ietf.org; = ietf@ietf.org; Jim Schaad = <ietf@augustcellars.com>
Subject: Re: [core] Secdir last = call review of = draft-ietf-core-too-many-reqs-04

 

Thank you = for the review Daniel!

 

I = have now addressed your comments in the latest draft version in = Github:

=

 

* Clarified the text in sections 4 and 5 roughly as = proposed

* Added a note in = section 5 that dropping requests may result in = retries 

* Added a = note that responses without encryption can leak information (agree with = Jim that it=E2=80=99s not a major risk so didn=E2=80=99t add normative = language on this)

 

I=E2=80=99m planning to submit a new version tomorrow = before the DL.

 

 

Cheers,

Ari


On 8 Oct 2018, at = 19.53, Jim Schaad <ietf@augustcellars.com> = wrote:




-----Original = Message-----

From: core <core-bounces@ietf.org> On = Behalf Of Daniel Migault

Sent: Sunday, October 7, 2018 5:31 = PM

To: = secdir@ietf.org

Cc: draft-ietf-cor= e-too-many-reqs.all@ietf.org; ietf@ietf.org;

core@ietf.org

Subject: [core] Secdir last call review = of

draft-ietf-core-too-many-reqs-04

=

 

Reviewer: Daniel = Migault

Review result: Has = Nits

 

Hi,

 

Reviewer: Daniel = Migault

Review result: Has = Nits

 

I = have reviewed this document as part of the security = directorate's

ongoing

effort to review all IETF documents being processed by = the IESG. These

comments were written primarily for the benefit of the = security area

directors.

Document editors and WG chairs should treat these = comments just like any

other last call = comments.

 

The = document is clear and almost ready.  Most of my comments concerns = the

"Security = Considerations".

 

Yours,

Daniel

 

4. =  CoAP Client Behavior

 

  A client MUST NOT rely on a server being = able to send the 4.29

  Response Code in an overload situation = because an overloaded server

  may not be able to reply to all requests = at all.

 

<mglt>

 

I = believe the sentence may be rephrased. This is just a = proposal.

OLD

  may not be able to reply to all requests = at all.

NEW

  may not be able to reply (at all) to some = requests. .

 

</mglt>

 

5. =  Security Considerations

 

  Replying to CoAP requests with a Response = Code consumes resources

  from a server.  For a server under = attack it may be more appropriate

  to simply drop requests without = responding.

 

<mglt>

The = gain from the response with Too Many Requests Response Code is = almost

the = current response and all *similar* requests from that client = during

Max

Age. = I suspect that is likely a gain except when there is no = responses

from = the

server and client is not expect to send a request = before Max Age. Simply

dropping the requests may add the retry traffic, = though it depends on the

application. That said your text is correct. I am = wondering if it would be

good to

illustrate your purpose. = </mglt>

 

  If a CoAP reply with the Too Many Requests = Response Code is not

  authenticated and integrity protected, an = attacker can attempt to

 

Keranen =             &= nbsp;   Expires January 25, 2019 =             &= nbsp;  [Page 3]

 

Internet-Draft  Too Many Requests Response Code = for CoAP       July = 2018

 

  spoof a reply and make the client wait for = an extended period of time

  before trying = again.

 

<mglt>

A = similar attack may also consists in an attacker triggering = multiple

request = or

transactions with a spoofed IP so the server generates = the reply to the

legitimate IP. This could be used if an attacker = cannot directly send the

spoofed

response to the legitimate = client.

 

The = response code provides an information about the state (overloaded) = of

the

server which can be used to infer additional = information. This could

potentially

be = used by an active attacker among other to confirm an attack = is

efficient,

that = a server is receiving multiple packet at a given time which may = be

used = to

identify some traffic patterns, identifying a bug a = version...  For a

passive

attacker, the response code may among other indicate = an appropriated time

to

trigger a larger = attack....

 

Because the code enable an attacker to gain some kind = of control of the

client,

and = reveals some information about the status of the server. I = would

suggest = to

mention that Too Many Response Code should not be = considered outside

unprotected channel. That is a server SHOULD NOT reply = with a Too Many

Requests Response Code unless the communication is = encrypted. A client

SHOULD ignore Too Many Response Code unless the = communication is

encrypted.

 

The = response seems to me small enough so reflection attacks may be out = of

scope.


I do not believe that this is aimed to be any type = of DOS prevention tool.
I would disagree that this is a huge attack = window.  The client will filter
the set of response that it is = receiving to match only requests that it has
made.  Thus a = general flood attack would not be useful unless it was
targeting the = same messages ids (and tokens) as requests from the client
under = attack.  But then these would be seen by the server as = duplicate
messages and ignored w/o sending out a response.

I = am not sure that I would consider the fact that the server is = currently
"loaded" for some measure is a huge leak of = information.  I don't think I
would care if that was leaked. =

Jim


</mglt>

 

_______________________________________________

core = mailing list

core@ietf.org

https://www.ietf.org/= mailman/listinfo/core

 

------=_NextPart_001_001A_01D469B3.8CECAB10-- ------=_NextPart_000_0019_01D469B3.8CECAB10 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIVbTCCAyAw ggIIoAMCAQICAR0wDQYJKoZIhvcNAQEFBQAwOTELMAkGA1UEBhMCRkkxDzANBgNVBAoTBlNvbmVy YTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTAeFw0wMTA0MDYwNzI5NDBaFw0yMTA0MDYwNzI5 NDBaMDkxCzAJBgNVBAYTAkZJMQ8wDQYDVQQKEwZTb25lcmExGTAXBgNVBAMTEFNvbmVyYSBDbGFz czIgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCQF0o1ncrwDZbHRPoWN/xIvb1/ gC01O+FvqGepvwMcTYxvMkfVQWikEwTBNQyahEP8XB3/ibPoFxjNkV/7iePqv05dfBsm03V57eaE 41flrSnE9Doo56V7hDZps/1edr2jLZnTkE4jKH0YY/FUOyaddluXQrL/rvBO7N05lU6DBn/nSUDI xQGyVFpmHT38+ek8Cp6BuHDwAYvkI1R8yK74kB4AlnLUVM9hI7zq+50CldG2uXE6aQg/D7ThQseI 9T+YqKe6HOBxce9YV4FQelxrdEYOgwOYw46obvJ2Mm4ng8Jz89wY6LST6nVEawRgIHFXh53zvqCQ Iz2KJOHaIdvDAgMBAAGjMzAxMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0OBAoECEqgqliE0148MAsG A1UdDwQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAWs6H+RZyFVdLHdmb56ImMOyTZ9/WLdI0r/c4 pc6rFrmrL3w1y6zQD7RMK/yA72uMkV82dvfbsxsZ6vSyEf1hcUS/KLM6Hb+zQ+ifv9wxCHGwnY3W NEcykMZlJPegSnwEc485bxeMcrW9S8h6+HuDwyhOnAnqZz+yZwQbwxTa+OdJJJHQHWr6YTnva+ch dQYH2BK0ISBwQnGB2jyaNr6mWw1qbJofkXv5+e9Cuk5OnswMjZTc2UWcXuxCUGOu9F3EsRLcyjuo Lp0UWgV1t+zXY+K6NbYECJHo2p2c9ma1GKwKplQmNDPSG8HUfxo6jguqMm7b/E8ln9kyx5ZacKzf TDCCBX0wggRloAMCAQICEQDR4D5bSO3Hngk/QN7hYcOLMA0GCSqGSIb3DQEBBQUAMDkxCzAJBgNV BAYTAkZJMQ8wDQYDVQQKEwZTb25lcmExGTAXBgNVBAMTEFNvbmVyYSBDbGFzczIgQ0EwHhcNMDcx MDE4MTI1MjAxWhcNMTkxMDE3MDUwNDExWjA3MRQwEgYDVQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UE AwwWVGVsaWFTb25lcmEgUm9vdCBDQSB2MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB AMK+6yfwIaPzaSZVfp3FVRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65I tqwA3GV17CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+XZ75L jo1kB1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+/jXh7VB7qTCNGdMJ jmhnXb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs81Mt8Bz17Ww5OXOAFshSsCPN4D7c 3TxHoLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkmdtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+J Wov3F0fUTPHSiXk+TT2YqGHeOh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0h ADnJoWjiUIMusDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4 pgd7gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fsslESl1MpWtTw EhDcTwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQarMCpgKIv7NHfirZ1fpoeDVN AgMBAAGjggGAMIIBfDBOBggrBgEFBQcBAQRCMEAwPgYIKwYBBQUHMAKGMmh0dHA6Ly9jYS50cnVz dC50ZWxpYXNvbmVyYS5jb20vc29uZXJhY2xhc3MyY2EuY2VyMA8GA1UdEwEB/wQFMAMBAf8wGQYD VR0gBBIwEDAOBgwrBgEEAYIPAgMBAQIwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1 j5qWDNXr+nuqF+gTEjCBuQYDVR0fBIGxMIGuMG+gbaBrhmlsZGFwOi8vY3JsLTEudHJ1c3QudGVs aWFzb25lcmEuY29tL2NuPVNvbmVyYSUyMENsYXNzMiUyMENBLG89U29uZXJhLGM9Rkk/Y2VydGlm aWNhdGVyZXZvY2F0aW9ubGlzdDtiaW5hcnkwO6A5oDeGNWh0dHA6Ly9jcmwtMi50cnVzdC50ZWxp YXNvbmVyYS5jb20vc29uZXJhY2xhc3MyY2EuY3JsMBMGA1UdIwQMMAqACEqgqliE0148MA0GCSqG SIb3DQEBBQUAA4IBAQB7L2bVGhb4q6FZUtsGVNbneHh+Q5OmrXeyTfAHxWAg90PVlDgAY0+cBk4o PxOL9ZVGnhec070CdiGWHwrqqKER1uDC2H97BTr3jBzGl9mf/43MxbY7NJB9LHMONfDeF+V+8bMK ziBdedr0HocKuKtBbzbvChOkDOaAKZkqCVXEC4+x1AUwqx4++t6D3aSnC3+1CWt2+AXfXrIzjE6p AKqZcnJfrI2mqIatmAtaXvW12I8TyZR+ERIMcOVGIa4MYfxxSpz0TSSz94DWfLK3DlKiXaxT+Tqo k3yH1wZhC+6q/11vPLL52cPWk2HciFDaylK2u3watcxmk8kaxNEt6K5zMIIF/jCCA+agAwIBAgIQ Qh/R7+DSqWlmHqsycXYp3zANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJTRTERMA8GA1UECgwI RXJpY3Nzb24xJTAjBgNVBAMMHEVyaWNzc29uIE5MIEluZGl2aWR1YWwgQ0EgdjMwHhcNMTgwMjAy MTQxNDEzWhcNMjEwMjAyMTQxNDEyWjBqMREwDwYDVQQKDAhFcmljc3NvbjEXMBUGA1UEAwwORGFu aWVsIE1pZ2F1bHQxKjAoBgkqhkiG9w0BCQEWG2RhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbTEQ MA4GA1UEBRMHZW1pZ2RhbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI3FMJ2RjH/+ 8O6uOot6cYww1ygKkYoryQg4GCiwDzHFjgVnyn4WeccOkH2zGMXBlz+YlgQCfma/4PLjhxBgv2TM 1E8nZmMhgporLVzXnnib4VdGYlXIeSo5pmevHcJZGJIryyXMZDAZQLmOhsNPoikUlgRww05WY5yu cExrbI4VVDK9NK/nsuSalh6vM2gYjHEZ1WqBkcxZ23G4IFXgOBXxNFW8UeX+2d+pasMv1QCXkaw7 GGMsVWWoC8oYnq9liS/Frn5HNPzhAjTGUs7BrptNg68Afrl+1fPPLEzUgDeqnjapIxp/69bKy8Kr GiUYajHBzG5Q090tzGa8z24KF88CAwEAAaOCAcEwggG9MEgGA1UdHwRBMD8wPaA7oDmGN2h0dHA6 Ly9jcmwudHJ1c3QudGVsaWEuY29tL2VyaWNzc29ubmxpbmRpdmlkdWFsY2F2My5jcmwwgYIGCCsG AQUFBwEBBHYwdDAoBggrBgEFBQcwAYYcaHR0cDovL29jc3AyLnRydXN0LnRlbGlhLmNvbTBIBggr BgEFBQcwAoY8aHR0cDovL2NhLnRydXN0LnRlbGlhc29uZXJhLmNvbS9lcmljc3Nvbm5saW5kaXZp ZHVhbGNhdjMuY2VyMCYGA1UdEQQfMB2BG2RhbmllbC5taWdhdWx0QGVyaWNzc29uLmNvbTBVBgNV HSAETjBMMEoGDCsGAQQBgg8CAwEBEjA6MDgGCCsGAQUFBwIBFixodHRwczovL3JlcG9zaXRvcnku dHJ1c3QudGVsaWFzb25lcmEuY29tL0NQUzAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIw HQYDVR0OBBYEFNyko9wHLTi09ReoigWzIj4/2lKlMB8GA1UdIwQYMBaAFBx7GZ6XnHasID3Y3OOR auPbLaZTMA4GA1UdDwEB/wQEAwIFoDANBgkqhkiG9w0BAQsFAAOCAgEANKV5Bodbrj7DQx2SbgfV Ohabh7Poxx/9owscxKQnyqC4AL3QDPm4g0SrPeeiyWf06KBqIJla6NpW97Jc9ziY9C5HrbD7iTmp 7gIXs4lCjw233hqBXNGK/9DICkPUYn4fTYxVE47n0xX895cDcs50qzX3oieucJ2dzrFKbYOkLTqk SRlw7BjMmK9h3JffpNWymPZDzjdW6UYLts2ROIKig3rJULo89e4IyY+L5l6wfHWjej3Q7zkH3hRm 6QEfZxCykV3mgdtZ5kSSdvbnxG03U0GZ+V8AP9as1wjIXGjpQ0cx/d6rF4ladHgSkCbYx9nLPKiY AaiP6jcDW4dvlNHx7CDQgINcfioaXIZxN3WMzWT2lNga6D6Iv10vw78ByRIjZWu1itAccwcp6RXZ 4cL3LizpKsuHanDg0lObm3XkCfGrpQFBvrv0DWpCSUqcaLUI4KfwMko40q36cVSwQJ79EsPxqgQL +8lQw8CLIJRRGTge+swiHJElCFW7csBRF+nM2KXqDo1Pg4pohF7LaSe1xKt7emFecgX3MsrL6usI Pm9AN/F554rJAIUPha29xvid2EPX8jVlFnmjpaGY4OTHs+mchraL8zNUTCiCmjgD7g9ELUo++9Fz N7HtY4bCjD47xViukyqb6nMC8Bp7+rxK1Mi3n21CyhfOMSHk3MbO65kwggbCMIIEqqADAgECAhBT uH6D4ZyZKJOwm0kc7LjrMA0GCSqGSIb3DQEBCwUAMDcxFDASBgNVBAoMC1RlbGlhU29uZXJhMR8w HQYDVQQDDBZUZWxpYVNvbmVyYSBSb290IENBIHYxMB4XDTE1MTAyNzEyMTY0NloXDTI1MTAyNzEy MTY0NlowRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYDVQQDDBxFcmljc3Nv biBOTCBJbmRpdmlkdWFsIENBIHYzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7PLf AAC4UPKnu9hUt8aT9+PBqjvUw0Y0tLPOXkO2NC0y2XZks9nJfpWKrNM30k5vu5norG4ZKlF5C+3x c6HuIiGQof1bmFGluNOwmZQwl3rOJ+E6k0rqJJTerjj4WOxAvWVW1yC5S4Ubppk3Q3cYVVuC3qNG sBIXy3/fDL1sc8Ah8zI/JumDpjY8fn/U3CRN6mgNKYrr0sZX6VXYgrpT05ZrJldkUgUgMKgbIWWE XEASA36pnb5GqD/RMzSgIe8o7YQtIaYB2cmTCLNHjaOL9j1JhNK4bvmbNJ7o58IZYzwNv/G/L/bR osQ9c27U+86DNjrdZnpyaRaeMyVUn3SlYLaFqoObdh/xNF2NS8CXs/PVtO57HBKHMgZqQvsyQJis SocxFqiMj9VK2WhCBbvoTvrNDZvLDlDGuE5RuKwFIpHOVOU5lCBgUUBsbpWIXwM6kmH/KC1DC5Mt QzmvXkbt7KdBXUAxM0JZxf4dS+ACtTDpF9b0vny4DrwaOS0VNXyz1GUOxSqw1wup5dpXbxLZYx1r LRgZqr9uWhLwAPsq66ZQof5GL0gY72Ym8/Tm28MeMqku+/zRzdYsmclT9rOdgdgS3b6OMoc5Op0Z PEv/Mx2lFJAVK674ozw2hiuRTVUmoqBr5AuyCoqCEyn32C7U/V7oqyqx5Yd1c5GsxuOqQFcCAwEA AaOCAbgwggG0MIGKBggrBgEFBQcBAQR+MHwwLQYIKwYBBQUHMAGGIWh0dHA6Ly9vY3NwLnRydXN0 LnRlbGlhc29uZXJhLmNvbTBLBggrBgEFBQcwAoY/aHR0cDovL3JlcG9zaXRvcnkudHJ1c3QudGVs aWFzb25lcmEuY29tL3RlbGlhc29uZXJhcm9vdGNhdjEuY2VyMBIGA1UdEwEB/wQIMAYBAf8CAQAw VQYDVR0gBE4wTDBKBgwrBgEEAYIPAgMBAQIwOjA4BggrBgEFBQcCARYsaHR0cHM6Ly9yZXBvc2l0 b3J5LnRydXN0LnRlbGlhc29uZXJhLmNvbS9DUFMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2Ny bC0zLnRydXN0LnRlbGlhc29uZXJhLmNvbS90ZWxpYXNvbmVyYXJvb3RjYXYxLmNybDAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQcexmel5x2 rCA92NzjkWrj2y2mUzAfBgNVHSMEGDAWgBTwj1k4ALP1j5qWDNXr+nuqF+gTEjANBgkqhkiG9w0B AQsFAAOCAgEAUFhr8dWMO7Quq1dDyIynw8sWmpyF/jWSxBjpHUCyhltoFS7Q1CUBD0bOULWmYjmz Rwme5pkjTFXpOJZLf9Han1SBbrVcP0JMhRsAvfWZjcF0l/c/jqDMqBARxr8OUWOr0ZWa49Lir3QE s2C+CjGge5tzcLqzQ5pjWxudrLkSGe+sAThDnXUWXGYk8udGZAamJ55drdw96AV9jWQkMrLIVHKk XVG5Etdx0wiAoTLk1fVtLcz11DiaCZSZVPZ3fdSIpIRhDqz8H4sVprPgvLBdK/ajdbiRsehCzzoh ay3zbXDDTDGwKkR8KUi8Xt8HDZCRsb/U/C7MC4tVK0SEPOQCo6swZy0rI0RoGzICfsSrZ4JrxANe eSZqCn1A+w0Wz+iqdeP2PVxW0f1rg4/OG2DSl3uB3Q3NT/lDGJtepti+i5CCKEZcdAOZoviu43sL hqsxSpGjzZidESwovuHeP+O2bNwwtz1DTsXThBB3+JJHVjmkiLo900GITb/i7IBdLoo4gZms9s1B Q2tm3CJCmpA2XwBTOB6B8/CtgWUWhyloXd3Wbmv7ZUoqqJFBV9g8Zh5mdZ+RzPTomgCFz/2aNsdd I/2G9ZjN4tG6hmocZR2M5f0MhBv3bo6d5XsLlYwiNJjw5GRqYb8cqqeCaPKkveBJzqgb8ToH7WLo OzmPRCmPlpAxggMCMIIC/gIBATBbMEcxCzAJBgNVBAYTAlNFMREwDwYDVQQKDAhFcmljc3NvbjEl MCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MwIQQh/R7+DSqWlmHqsycXYp3zAJ BgUrDgMCGgUAoIIBfDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0x ODEwMjIwNzAxMzhaMCMGCSqGSIb3DQEJBDEWBBRNRRwVJZnd8PuIFFoX0daISZjyejBDBgkqhkiG 9w0BCQ8xNjA0MAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUr DgMCGjBqBgkrBgEEAYI3EAQxXTBbMEcxCzAJBgNVBAYTAlNFMREwDwYDVQQKDAhFcmljc3NvbjEl MCMGA1UEAwwcRXJpY3Nzb24gTkwgSW5kaXZpZHVhbCBDQSB2MwIQQh/R7+DSqWlmHqsycXYp3zBs BgsqhkiG9w0BCRACCzFdoFswRzELMAkGA1UEBhMCU0UxETAPBgNVBAoMCEVyaWNzc29uMSUwIwYD VQQDDBxFcmljc3NvbiBOTCBJbmRpdmlkdWFsIENBIHYzAhBCH9Hv4NKpaWYeqzJxdinfMA0GCSqG SIb3DQEBAQUABIIBADJWxvi1dYL5x6zIL7Be2Mc1M08v5U/wqKAvpVxLuy3PCQSBXJ/Sfw/WDda0 kLvkXpS6uNgTScmJ4qfrRVWOIvirziHkByGY/djd6oMlNYLCzMgpUmYcSZ/Ns2GxuwfN/PKiokNa isWooiq6jlUzCE/TBmvlMErJC88DEJ20OiMXhfvRu1nBw2HhAwdf0pIaTih1LvD1U1rrdjnWE3Dl S2ves6nRHVGOrKzS9T5uVvCEE7Euu4ba4G93+u//2QGLSZfmMKUrBQtvAaW9AOrmrPR8NmsCnuAD UJhAqkz1Kp+k5cNVvDvvKxLu4OR1wrwNYhbfS+KZngnCVLfOEBXyT54AAAAAAAA= ------=_NextPart_000_0019_01D469B3.8CECAB10-- From nobody Mon Oct 22 13:46:05 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 53695130F1D; Mon, 22 Oct 2018 13:45:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Kyle Rose To: Cc: sipcore@ietf.org, ietf@ietf.org, draft-ietf-sipcore-originating-cdiv-parameter.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154024115730.13565.4561513275762767750@ietfa.amsl.com> Date: Mon, 22 Oct 2018 13:45:57 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-sipcore-originating-cdiv-parameter-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Oct 2018 20:46:03 -0000 Reviewer: Kyle Rose Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Background: SIP currently provides no standard way to indicate that an invite via diversion from the original terminating user (e.g., via busy response or an unconditional call forward) is the result of diversion rather than a new origination, making it impossible in the absence of proprietary signaling to distinguish between the two cases. This draft adds an orig-cdiv signal to the P-Served-User header to indicate an invite resulting from a diversion, allowing an application server to take different actions in the two cases. Security evaluation: The addition of a new actionable signal is properly noted as the main security consideration of this change, along with a reminder that the P-Served-User header must be implemented as a privileged channel within a single trust domain and not transited into a domain from an untrusted entity. Other comments: As a reviewer new to SIP, I found the document very easy to follow. The introduction contained basic background about the use case, a clear explanation of the problem, and a high-level overview of the proposed solution. The normative section of the document was very clearly illustrated by the later examples section, containing two typical use-cases with clear diagrams. This is a model internet draft. From nobody Tue Oct 23 20:21:43 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D711130F4A; Tue, 23 Oct 2018 01:29:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1540283394; bh=c29rE/BHqlLSRHrC7ng/4QyZRCyhx3QzRSUdN1irra4=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=o1fy6d467fytk4h9/iu340OhdBUcLM1+jnIdO0Tepk6RU7hkwyPQgueXsOWLC/yMS Wwe4jxFnVJY+MtjiVnDZt//G6QVBPX3NjpAtfis2bn6MxHbMZ2wJZ53JNRdpCzb0Ic 3N3BLG9PJMqxyZbsOu+2mLLB5T2TGC6avQlEOmTA= X-Mailbox-Line: From new-work-bounces@ietf.org Tue Oct 23 01:29:54 2018 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DEDDB130F11; Tue, 23 Oct 2018 01:29:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1540283394; bh=c29rE/BHqlLSRHrC7ng/4QyZRCyhx3QzRSUdN1irra4=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=o1fy6d467fytk4h9/iu340OhdBUcLM1+jnIdO0Tepk6RU7hkwyPQgueXsOWLC/yMS Wwe4jxFnVJY+MtjiVnDZt//G6QVBPX3NjpAtfis2bn6MxHbMZ2wJZ53JNRdpCzb0Ic 3N3BLG9PJMqxyZbsOu+2mLLB5T2TGC6avQlEOmTA= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 821BA130F06 for ; Tue, 23 Oct 2018 01:29:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EH5Yq_1pQ4ID for ; Tue, 23 Oct 2018 01:29:47 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B51B130F5B for ; Tue, 23 Oct 2018 01:28:55 -0700 (PDT) Received: from [91.217.168.196] (helo=jiaxueyuandeMacBook-Pro.local) by raoul.w3.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1gEs3Z-0003rA-Mv for new-work@ietf.org; Tue, 23 Oct 2018 08:28:53 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <4e43f5d1-bdb9-4a43-f3f6-74eb2329abe4@w3.org> Date: Tue, 23 Oct 2018 10:28:52 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Tue, 23 Oct 2018 20:21:42 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Web Fonts Working Group (until 2018-11-20) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Oct 2018 08:29:56 -0000 CkhlbGxvLAoKVG9kYXkgVzNDIEFkdmlzb3J5IENvbW1pdHRlZSBSZXByZXNlbnRhdGl2ZXMgcmVj ZWl2ZWQgYSBQcm9wb3NhbAp0byByZXZpZXcgYSBkcmFmdCBjaGFydGVyIGZvciB0aGUgV2ViIEZv bnRzIFdvcmtpbmcgR3JvdXA6CiDCoCBodHRwczovL3d3dy53My5vcmcvRm9udHMvV0cvd2ViZm9u dHMtMjAxOC1hYy5odG1sCgpBcyBwYXJ0IG9mIGVuc3VyaW5nIHRoYXQgdGhlIGNvbW11bml0eSBp cyBhd2FyZSBvZiBwcm9wb3NlZCB3b3JrCmF0IFczQywgdGhpcyBkcmFmdCBjaGFydGVyIGlzIHB1 YmxpYyBkdXJpbmcgdGhlIEFkdmlzb3J5CkNvbW1pdHRlZSByZXZpZXcgcGVyaW9kLgoKVzNDIGlu dml0ZXMgcHVibGljIGNvbW1lbnRzIHRocm91Z2ggMjAxOC0xMS0yMCBvbiB0aGUKcHJvcG9zZWQg Y2hhcnRlci4gUGxlYXNlIHNlbmQgY29tbWVudHMgdG8KcHVibGljLW5ldy13b3JrQHczLm9yZywg d2hpY2ggaGFzIGEgcHVibGljIGFyY2hpdmU6CiDCoCBodHRwOi8vbGlzdHMudzMub3JnL0FyY2hp dmVzL1B1YmxpYy9wdWJsaWMtbmV3LXdvcmsvCgpPdGhlciB0aGFuIGNvbW1lbnRzIHNlbnQgaW4g Zm9ybWFsIHJlc3BvbnNlcyBieSBXM0MgQWR2aXNvcnkKQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZl cywgVzNDIGNhbm5vdCBndWFyYW50ZWUgYSByZXNwb25zZSB0bwpjb21tZW50cy4gSWYgeW91IHdv cmsgZm9yIGEgVzNDIE1lbWJlciBbMV0sIHBsZWFzZSBjb29yZGluYXRlCnlvdXIgY29tbWVudHMg d2l0aCB5b3VyIEFkdmlzb3J5IENvbW1pdHRlZSBSZXByZXNlbnRhdGl2ZS4gRm9yCmV4YW1wbGUs IHlvdSBtYXkgd2lzaCB0byBtYWtlIHB1YmxpYyBjb21tZW50cyB2aWEgdGhpcyBsaXN0IGFuZApo YXZlIHlvdXIgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlIHJlZmVyIHRvIGl0IGZy b20gaGlzCm9yIGhlciBmb3JtYWwgcmV2aWV3IGNvbW1lbnRzLgoKSWYgeW91IHNob3VsZCBoYXZl IGFueSBxdWVzdGlvbnMgb3IgbmVlZCBmdXJ0aGVyIGluZm9ybWF0aW9uLCBwbGVhc2UKY29udGFj dCBDaHJpcyBMaWxsZXksIDxjaHJpc0B3My5vcmc+LgoKVGhhbmsgeW91LAoKWHVleXVhbiBKaWEs IFczQyBNYXJrZXRpbmcgJiBDb21tdW5pY2F0aW9ucwoKWzFdIGh0dHA6Ly93d3cudzMub3JnL0Nv bnNvcnRpdW0vTWVtYmVyL0xpc3QKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCm5ldy13b3JrIG1haWxpbmcgbGlzdApuZXctd29ya0BpZXRmLm9yZwpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL25ldy13b3JrCg== From nobody Tue Oct 23 21:01:39 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16128130DE0; Tue, 23 Oct 2018 21:01:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l0UBawk7MNx8; Tue, 23 Oct 2018 21:01:33 -0700 (PDT) Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8679F130DDD; Tue, 23 Oct 2018 21:01:33 -0700 (PDT) Received: by mail-pf1-x42c.google.com with SMTP id l81-v6so1752464pfg.3; Tue, 23 Oct 2018 21:01:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=/IHRqapklx5M3Kom1h3JcsBjZR4dnQPYvXP5vbBFno4=; b=JrB9gpS4AfViUaJjPSQqQZDIdElJGzxiA9UP1v8JNgMvwnK1MAPiFGq4Gei/t3oi84 /W7axmFrGi8yz3ahORpINHfexs78Hv8P1EQ5kjwh9udMikk6jlmwyv3ChfbBcILLy84m 2pZtqKEiMBiDyhR34/2CLtjTiFOWoAwvuGH4t3kfHl+AE2macsW8FxTivyjyE9pOmAgs Woa3B1saTYFJAUQorFrg0b4/Po1yDDjnIFlh1lDTXCR2HXvx+u59O2tto3cfDqDx4nb8 t0BbkBaiTEWdkBkZ3loq/Qm0UCp50BNZFgleM7hBfUjKr6qrhfu3gcZ/8qPwYBZgkrBe w8bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/IHRqapklx5M3Kom1h3JcsBjZR4dnQPYvXP5vbBFno4=; b=rn3l7mN03e3aUWwKcbapE7FPwxPyEzGNoL63eP2mOkY/W3uRCIfb71o9DM5ZOUjUzS Mo7RI9HkBpGJrtRFmT6umynxG10BKqTFgRyr/kD6A1o74bUbfC4+4d8Aibt1MmQ8jnzw aGkTW7OjOFHMudihwhBLN/xBSZ3jH03KE5slI37yJRrtaf7X+P9JfgsqHRkIgjJJ/fRf 0pxW55o28olCdT//lwgfRGQdnDw20uMQUaUji61UP7oxixiOPc5hQq11JSzGy/Sgdo/m P0jl76aipG1H41C0gL8Z1kH3bGvR2zsMNeNqtj+L6FWqmHjn2t++Q+qXeG60dvGQM7TA vEKA== X-Gm-Message-State: AGRZ1gJv3RHAOgy1GmhC53CkWAtFrRjPoR6Zi3IsKCIc3poFImC/O+JB Vllqwx0GKvjrg9CbaZ+5GP2umJ62ZOriu0uTrLzMO9XV X-Google-Smtp-Source: AJdET5efPfJmqpAENU3W7ylMd/grsycZimfAHy9WZrWvcHDdbBI4NiwU7G/C9PIQgvZsjoR6yaDiLNezzVSi9d1YY7c= X-Received: by 2002:aa7:8001:: with SMTP id j1-v6mr1028976pfi.73.1540353692886; Tue, 23 Oct 2018 21:01:32 -0700 (PDT) MIME-Version: 1.0 From: =?UTF-8?Q?Magnus_Nystr=C3=B6m?= Date: Tue, 23 Oct 2018 21:00:48 -0700 Message-ID: To: secdir@ietf.org, draft-ietf-nvo3-geneve@ietf.org Content-Type: multipart/alternative; boundary="000000000000b16deb0578f18a6c" Archived-At: Subject: [secdir] Secdir review (early review) of draft-ietf-nvo3-geneve X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2018 04:01:35 -0000 --000000000000b16deb0578f18a6c Content-Type: text/plain; charset="UTF-8" I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes "Geneve," a protocol for GEneric NEtwork Virtualization Encapsulation. The document is written in a clear manner and with a thorough Security Considerations section. I have just a few questions/comments: - Section 3.4: The "MUST ignore" for the reserved bits should presumably state "SHALL be ignored for this version of the Geneve protocol." - as I imagine that in a future version, these bits may not be ignored? - Section 3.5.1: I wonder about the simultaneous requirement that one option must not affect the parsing or interpretation of another option but that the sequencing (order) of options may be significant - they seem to be contradictory since if the sequencing *is* significant, then some option must be impacted by a previous one's value? From a security perspective, I also wonder if there could be security consequences of re-ordering options (and how to tell if someone did re-order - see below)? - Section 6.2, shouldn't such an Option be defined to reduce the risk of under-specified or subpar specifications of such integrity mechanisms? Or also from an interop perspective? Thanks. -- Magnus --000000000000b16deb0578f18a6c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors.=C2=A0 Document editors and WG chairs should treat<= br> these comments just like any other last call comments.

This document describes "Geneve," a protocol = for GEneric NEtwork Virtualization Encapsulation. The document is written i= n a clear manner and with a thorough Security Considerations section. I hav= e just a few questions/comments:

- Section 3.4: Th= e "MUST ignore" for the reserved bits should presumably state &qu= ot;SHALL be ignored for this version of the Geneve protocol." - as I i= magine that in a future version, these bits may not be ignored?
-= Section 3.5.1: I wonder about the simultaneous requirement that one option= must not affect the parsing or interpretation of another option but that t= he sequencing (order) of options may be significant - they seem to be contr= adictory since if the sequencing *is* significant, then some option must be= impacted by a previous one's value? From a security perspective, I als= o wonder if there could be security consequences of re-ordering options (an= d how to tell if someone did re-order - see below)?
- Section 6.2, shouldn't such an Option be defined to reduce the risk= of under-specified or subpar specifications of such integrity mechanisms? = Or also from an interop perspective?

Thanks.
-- Magnus
--000000000000b16deb0578f18a6c-- From nobody Wed Oct 24 09:06:37 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E8DF130E0E; Wed, 24 Oct 2018 09:06:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Phillip Hallam-Baker To: Cc: detnet@ietf.org, ietf@ietf.org, draft-ietf-detnet-use-cases.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154039718506.6853.7266750048073148979@ietfa.amsl.com> Date: Wed, 24 Oct 2018 09:06:25 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-detnet-use-cases-19 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2018 16:06:25 -0000 Reviewer: Phillip Hallam-Baker Review result: Ready I have reviewed the document, and it is ready for publication. The document is an analysis of the use cases and (now) properly refers to a separate security considerations section. The use cases document is ready for publication and this should go forward now. However the security considerations document is still a work in progress, no document shepherd assigned. Which is of course right and proper for a security considerations relating to the final proposal. And of course it is useful to nail down the use cases before looking at the security considerations. But the use cases having deferred security to the external document risks creating a deadlock situation. It is important that the document contain a link to the security considerations to be supplied but this should not hold up publication as an RFC. My only comment on the referenced SC document at this stage is that it might be that the term 'deterministic networking' overstates the requirements evidenced by the use cases. In many of the cited use cases, what is required is a higher degree of confidence that the network characteristics meet certain requirements than an absolute guarantee. It might be that 'predictable networking' provides a better description of those requirements. From nobody Wed Oct 24 12:58:03 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B892124C04; Wed, 24 Oct 2018 12:57:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dolby.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GATFvMqh3tNU; Wed, 24 Oct 2018 12:57:46 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680138.outbound.protection.outlook.com [40.107.68.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EDFF1276D0; Wed, 24 Oct 2018 12:57:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dolby.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/cblNCwnj1n8i86w5j31zM6czdm+t7Yv9VanxxsusfU=; b=CvJ9a8WLIVEam/J3KPVyiTTxp33AVfbRsXZTFBmmygNMABcD+K7uvukR6LWmI+6ez+Wj+/bl6f82du9YrP90ViHQm3b6JHwUDNw3ZwHu3mVg1JIjFOkQNQ1gDcwioMUtUWFzuK7TQ73i9eGwcN4I44Nzr0uERuPcB1TguhgNEII= Received: from BL0PR06MB4548.namprd06.prod.outlook.com (20.177.145.145) by BL0PR06MB4609.namprd06.prod.outlook.com (20.177.145.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1273.19; Wed, 24 Oct 2018 19:57:44 +0000 Received: from BL0PR06MB4548.namprd06.prod.outlook.com ([fe80::f06d:40fc:302a:4d8]) by BL0PR06MB4548.namprd06.prod.outlook.com ([fe80::f06d:40fc:302a:4d8%3]) with mapi id 15.20.1250.028; Wed, 24 Oct 2018 19:57:43 +0000 From: "Grossman, Ethan A." To: Phillip Hallam-Baker , "secdir@ietf.org" CC: "detnet@ietf.org" , "ietf@ietf.org" , "draft-ietf-detnet-use-cases.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-detnet-use-cases-19 Thread-Index: AQHUa7OHygCoWERxgE2KW1ed/V/+46Uuz4HA Date: Wed, 24 Oct 2018 19:57:43 +0000 Message-ID: References: <154039718506.6853.7266750048073148979@ietfa.amsl.com> In-Reply-To: <154039718506.6853.7266750048073148979@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=eagros@dolby.com; x-originating-ip: [8.39.141.5] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BL0PR06MB4609; 6:GmeKlSgdave8yyVXSEC012EhVHkWdMWfB6AIeGP5EUMan+LbKKPWpLoN/L8pgDqma2iru1xF4hAzef0+c5sOH3CSxRaoysx8y5ZyqqJi+Qe06WlO4pI56SeCMvQG/V0KeolHCCR/dOmYJUjpSd8Y2GIbVQV6IHtbjbmkPoB97Z/fGHFAPq7kNsx71YdpN2dk2ooH0BVLERlyTfHobbiP8xFFxeMK35J72Bwmv/caVeU/EcQORXUFMuchaNdDtC6Lc+tj+ZY6IqNs+WHJT6GbFj6hPAfyEHk0t1uoa1VVpEOBzyAKsbGP7BWq9dPjKLbQjaoKDO4Xk5LWUWiJuzP/bowA4LF+cUVR/65XxIiXbQqVzxs7kvISNhRSCkYrPQN8cwxl5uJ4S7heCkzmupTauztV6pFxaVvgjKb0iN/iJI0I8+LqOxgL+UooOVe4NaZtY52c8M+3p4x2dNdFEx1wxg==; 5:SD1GkZqdwu2r9iqwyauNKzSiSojnv9nkYMeF79ZuULnstaxYLdMP7m/uXpsxgR7xGguN/v8CdDMGZ/+1fZXUGNwoqSCzIWJtFqNcE/I8rgO5kUHZ+ukyiwlPkjNgGqE3bx1zdoghXD4ZuKgtghiAbzRRKdT5BMTJB9ZlX+M2cHI=; 7:/2IB4BN367fwVZauvOdLI1SypJ29+mKh54/Wt/dUepGTEW3ddziURST1QyM7942l5OzcS8V2iNwMlfz3DU0vcSnsdkigQ9BtXhJJvGznU2SVTwn+3BSdLB2VfoBXz3uuc0DySOw9B3VzinNHBvV0nw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 7d5c2245-7346-4121-72f2-08d639eaf66f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:BL0PR06MB4609; x-ms-traffictypediagnostic: BL0PR06MB4609: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3231355)(944501410)(52105095)(3002001)(148016)(149066)(150057)(6041310)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:BL0PR06MB4609; BCL:0; PCL:0; RULEID:; SRVR:BL0PR06MB4609; x-forefront-prvs: 083526BF8A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(136003)(366004)(346002)(376002)(396003)(189003)(199004)(13464003)(229853002)(186003)(478600001)(5660300001)(25786009)(14454004)(4326008)(105586002)(106356001)(26005)(54906003)(3846002)(6116002)(110136005)(53546011)(6436002)(2906002)(561944003)(102836004)(316002)(33656002)(2900100001)(39060400002)(305945005)(99286004)(7736002)(74316002)(8676002)(6506007)(9686003)(55016002)(476003)(7696005)(6246003)(81156014)(8936002)(76176011)(81166006)(53936002)(68736007)(66066001)(256004)(14444005)(97736004)(86362001)(486006)(5250100002)(2501003)(11346002)(71200400001)(446003)(71190400001); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR06MB4609; H:BL0PR06MB4548.namprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: dolby.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: yVueAokepd/ajIvvXywGm8Hjxa0PXJN2vsNxvNWfizX/3MKQ5uzKwzuzrgnG3meWNGs+qZCGWgPqf+Dx8/QX8RABoUWAXKh0h9DeWK7PSmtKLKIiqe9uTezzI4PZs5wLlWz20PnW6su0vyePagvvJ0jugNx+COk6B55ofipP0CcH8sfd+nKjsg2qQilxjAFxsd0EfQD2eU06iu5uLcjpkW9ju0ND8H84PUIjlh0RKAKTm7WOQ5JeJTNN/n67uJe2wjKr49PseNLJGCArUWb8/SFjiOx1gWHMzfAJBlUlCx6Zn92RZK/p3IYMMUzdY8OKx9K/S9uVuZIl+/eCW+eaZkSWdTZtuvyqes+DEo/qIPg= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: dolby.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7d5c2245-7346-4121-72f2-08d639eaf66f X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2018 19:57:43.7102 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 05408d25-cd0d-40c8-8962-5462de64a318 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR06MB4609 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-detnet-use-cases-19 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2018 19:57:50 -0000 VGhhbmtzIFBoaWxsaXAuIEdpdmVuIHRoYXQgdGhlIGxpbmsgaW4gdGhlIFVzZSBDYXNlcyBkcmFm dCB0byB0aGUgU2VjdXJpdHkgZHJhZnQgaXMgaW5mb3JtYXRpb25hbCBvbmx5IHRoZW4gaXQgY2Fu J3QgY2F1c2UgYSBwdWJsaWNhdGlvbiBkZWFkbG9jaywgY29ycmVjdD8gDQpUaGFua3MsDQpFdGhh biAoYXMgRGV0TmV0IFVzZSBDYXNlcyBkcmFmdCBlZGl0b3IpLg0KDQotLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogUGhpbGxpcCBIYWxsYW0tQmFrZXIgPGhhbGxhbUBnbWFpbC5jb20+ IA0KU2VudDogV2VkbmVzZGF5LCBPY3RvYmVyIDI0LCAyMDE4IDk6MDYgQU0NClRvOiBzZWNkaXJA aWV0Zi5vcmcNCkNjOiBkZXRuZXRAaWV0Zi5vcmc7IGlldGZAaWV0Zi5vcmc7IGRyYWZ0LWlldGYt ZGV0bmV0LXVzZS1jYXNlcy5hbGxAaWV0Zi5vcmcNClN1YmplY3Q6IFNlY2RpciBsYXN0IGNhbGwg cmV2aWV3IG9mIGRyYWZ0LWlldGYtZGV0bmV0LXVzZS1jYXNlcy0xOQ0KDQpSZXZpZXdlcjogUGhp bGxpcCBIYWxsYW0tQmFrZXINClJldmlldyByZXN1bHQ6IFJlYWR5DQoNCkkgaGF2ZSByZXZpZXdl ZCB0aGUgZG9jdW1lbnQsIGFuZCBpdCBpcyByZWFkeSBmb3IgcHVibGljYXRpb24uIFRoZSBkb2N1 bWVudCBpcyBhbiBhbmFseXNpcyBvZiB0aGUgdXNlIGNhc2VzIGFuZCAobm93KSBwcm9wZXJseSBy ZWZlcnMgdG8gYSBzZXBhcmF0ZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uLg0KDQpU aGUgdXNlIGNhc2VzIGRvY3VtZW50IGlzIHJlYWR5IGZvciBwdWJsaWNhdGlvbiBhbmQgdGhpcyBz aG91bGQgZ28gZm9yd2FyZCBub3cuDQpIb3dldmVyIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9u cyBkb2N1bWVudCBpcyBzdGlsbCBhIHdvcmsgaW4gcHJvZ3Jlc3MsIG5vIGRvY3VtZW50IHNoZXBo ZXJkIGFzc2lnbmVkLiBXaGljaCBpcyBvZiBjb3Vyc2UgcmlnaHQgYW5kIHByb3BlciBmb3IgYSBz ZWN1cml0eSBjb25zaWRlcmF0aW9ucyByZWxhdGluZyB0byB0aGUgZmluYWwgcHJvcG9zYWwuIEFu ZCBvZiBjb3Vyc2UgaXQgaXMgdXNlZnVsIHRvIG5haWwgZG93biB0aGUgdXNlIGNhc2VzIGJlZm9y ZSBsb29raW5nIGF0IHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucy4gQnV0IHRoZSB1c2UgY2Fz ZXMgaGF2aW5nIGRlZmVycmVkIHNlY3VyaXR5IHRvIHRoZSBleHRlcm5hbCBkb2N1bWVudCByaXNr cyBjcmVhdGluZyBhIGRlYWRsb2NrIHNpdHVhdGlvbi4NCg0KSXQgaXMgaW1wb3J0YW50IHRoYXQg dGhlIGRvY3VtZW50IGNvbnRhaW4gYSBsaW5rIHRvIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9u cyB0byBiZSBzdXBwbGllZCBidXQgdGhpcyBzaG91bGQgbm90IGhvbGQgdXAgcHVibGljYXRpb24g YXMgYW4gUkZDLg0KDQpNeSBvbmx5IGNvbW1lbnQgb24gdGhlIHJlZmVyZW5jZWQgU0MgZG9jdW1l bnQgYXQgdGhpcyBzdGFnZSBpcyB0aGF0IGl0IG1pZ2h0IGJlIHRoYXQgdGhlIHRlcm0gJ2RldGVy bWluaXN0aWMgbmV0d29ya2luZycgb3ZlcnN0YXRlcyB0aGUgcmVxdWlyZW1lbnRzIGV2aWRlbmNl ZCBieSB0aGUgdXNlIGNhc2VzLiBJbiBtYW55IG9mIHRoZSBjaXRlZCB1c2UgY2FzZXMsIHdoYXQg aXMgcmVxdWlyZWQgaXMgYSBoaWdoZXIgZGVncmVlIG9mIGNvbmZpZGVuY2UgdGhhdCB0aGUgbmV0 d29yayBjaGFyYWN0ZXJpc3RpY3MgbWVldCBjZXJ0YWluIHJlcXVpcmVtZW50cyB0aGFuIGFuIGFi c29sdXRlIGd1YXJhbnRlZS4gSXQgbWlnaHQgYmUgdGhhdCAncHJlZGljdGFibGUgbmV0d29ya2lu ZycgcHJvdmlkZXMgYSBiZXR0ZXIgZGVzY3JpcHRpb24gb2YgdGhvc2UgcmVxdWlyZW1lbnRzLg0K DQo= From nobody Thu Oct 25 13:02:37 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 261681274D0 for ; Thu, 25 Oct 2018 13:02:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: X-Test-IDTracker: no X-IETF-IDTracker: 6.87.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu Message-ID: <154049775515.27867.7620093680521521831.idtracker@ietfa.amsl.com> Date: Thu, 25 Oct 2018 13:02:35 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Oct 2018 20:02:35 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2018-10-25 Reviewer LC end Draft Steve Hanna 2018-10-10 draft-ietf-ospf-lls-interface-id-08 Taylor Yu 2018-10-09 draft-murchison-tzdist-tzif-15 For telechat 2018-11-21 Reviewer LC end Draft Kathleen Moriarty 2018-10-19 draft-ietf-ntp-mac-05 Last calls: Reviewer LC end Draft John Bradley 2018-09-25 draft-ietf-dnsop-attrleaf-fix-05 John Bradley 2018-06-18 draft-ietf-bfd-multipoint-active-tail-09 Daniel Franke 2018-06-28 draft-ietf-netconf-rfc7895bis-07 Daniel Gillmor 2018-06-25 draft-ietf-dnsop-session-signal-18 Daniel Gillmor 2018-03-19 draft-gutmann-scep-10 Phillip Hallam-Baker 2018-10-11 draft-ietf-softwire-yang-11 Steve Hanna 2018-10-03 draft-ietf-detnet-problem-statement-07 Matthew Miller 2018-10-12 draft-ietf-httpbis-rand-access-live-03 Russ Mundy 2017-09-14 draft-spinosa-urn-lex-13 Magnus Nystrom 2018-11-13 draft-op3ft-leaptofrogans-uri-scheme-03 Hilarie Orman 2018-11-01 draft-ietf-perc-srtp-ekt-diet-09 Radia Perlman 2018-11-01 draft-ietf-perc-double-10 Derrell Piper 2018-10-29 draft-ietf-pce-segment-routing-14 Vincent Roca 2018-10-29 draft-ietf-pce-gmpls-pcep-extensions-12 Joseph Salowey 2018-11-20 draft-wilde-sunset-header-07 Stefan Santesson 2018-11-20 draft-wilde-service-link-rel-06 Yaron Sheffer 2018-11-16 draft-ietf-ospf-ospfv3-segment-routing-extensions-16 Rifaat Shekh-Yusef 2018-11-08 draft-ietf-dmarc-rfc7601bis-03 Melinda Shore 2018-11-06 draft-ietf-dmarc-arc-protocol-18 Valery Smyslov 2018-11-05 draft-ietf-regext-change-poll-10 Takeshi Takahashi 2018-11-02 draft-ietf-stir-passport-shaken-04 Samuel Weiler 2018-05-21 draft-ietf-bfd-multipoint-18 Klaas Wierenga 2018-09-06 draft-ietf-softwire-mesh-multicast-23 Paul Wouters 2018-09-06 draft-ietf-dnsop-kskroll-sentinel-17 Dacheng Zhang 2018-10-05 draft-ietf-iasa2-trust-update-02 Early review requests: Reviewer Due Draft Daniel Franke 2018-01-31 draft-ietf-intarea-provisioning-domains-00 Robert Sparks 2018-11-25 draft-ietf-babel-hmac-00 Sean Turner 2018-11-25 draft-ietf-babel-dtls-01 Carl Wallace 2018-11-09 draft-ietf-idr-bgpls-segment-routing-epe-17 Next in the reviewer rotation: Samuel Weiler Brian Weis Klaas Wierenga Christopher Wood Paul Wouters Liang Xia Taylor Yu Dacheng Zhang Derek Atkins John Bradley From nobody Fri Oct 26 14:51:52 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85A8B127148; Fri, 26 Oct 2018 14:51:36 -0700 (PDT) X-Quarantine-ID: <2bQcDY1VYh3G> X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char 9C hex): Received: ...s kaduk@ATHENA.MIT.EDU)\n\t\234by outgoing.mit[...] X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2bQcDY1VYh3G; Fri, 26 Oct 2018 14:51:35 -0700 (PDT) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E28CA1276D0; Fri, 26 Oct 2018 14:51:34 -0700 (PDT) X-AuditID: 1209190f-e9bff70000004c47-42-5bd38c64259e Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-4.mit.edu (Symantec Messaging Gateway) with SMTP id 09.3B.19527.56C83DB5; Fri, 26 Oct 2018 17:51:33 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-4.mit.edu (8.14.7/8.9.2) with ESMTP id w9QLpRFQ016063; Fri, 26 Oct 2018 17:51:29 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) œby outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id w9QLpNqR015671 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 26 Oct 2018 17:51:25 -0400 Date: Fri, 26 Oct 2018 16:51:23 -0500 From: Benjamin Kaduk To: "Grossman, Ethan A." Cc: Phillip Hallam-Baker , "secdir@ietf.org" , "detnet@ietf.org" , "ietf@ietf.org" , "draft-ietf-detnet-use-cases.all@ietf.org" Message-ID: <20181026215122.GS45914@kduck.kaduk.org> References: <154039718506.6853.7266750048073148979@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmplleLIzCtJLcpLzFFi42IRYrdT103tuRxt8OSkgsXvT7NZLKY1fmSz 6Hu8nd3i6vLjTBbPNs5nsfiw8CGLA5vHvolHWDx2zrrL7rFkyU+mAOYoLpuU1JzMstQifbsE royHX1ayFLQyVWzoa2BqYLzE2MXIySEhYCJx8d9z9i5GLg4hgTVMErN+/mKDcDYySiw+dhLK ucsksX7tYXaQFhYBVYm7K+eD2WwCKhIN3ZeZuxg5OEQEtCWOn7YAqWcW6GCSuHX3KhNIjbCA m8TSzz/ZQGxeoHWPF55mhBg6lVFixr6fjBAJQYmTM5+wgNjMAloSN/69ZAIZyiwgLbH8HwdI mFMgVuLy3vlgJaICyhJ7+w6xT2AUmIWkexaS7lkI3QsYmVcxyqbkVunmJmbmFKcm6xYnJ+bl pRbpmujlZpbopaaUbmIEhTanJP8OxjkN3ocYBTgYlXh4FxhcjhZiTSwrrsw9xCjJwaQkyjux AyjEl5SfUpmRWJwRX1Sak1p8iFGCg1lJhPdaAVCONyWxsiq1KB8mJc3BoiTOO6FlcbSQQHpi SWp2ampBahFMVoaDQ0mC93IXUKNgUWp6akVaZk4JQpqJgxNkOA/Q8D8gNbzFBYm5xZnpEPlT jIpS4rxtIAkBkERGaR5cLyj1SGTvr3nFKA70ijDvK5AqHmDagut+BTSYCWjwDIULIINLEhFS Ug2MXDFNjl+rm17mVb6LsMud25yRpsu4jCfmwP/6DedSLklvLluiVaCS/EHwU3s3u7X8kU+3 HSY0moR6xc19Pm+H59bCsOY9s3ZcOHAuvfHuIhP1whPZxZGG0x93SXrNXbfznme916PUy3kO Bhfy3x4xvhOvEiioYm/j25j3oEv2pnrgIQWeLRJKLMUZiYZazEXFiQDyY3doGAMAAA== Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-detnet-use-cases-19 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Oct 2018 21:51:37 -0000 On Wed, Oct 24, 2018 at 07:57:43PM +0000, Grossman, Ethan A. wrote: > Thanks Phillip. Given that the link in the Use Cases draft to the Security draft is informational only then it can't cause a publication deadlock, correct? That's correct. -Benjamin From nobody Fri Oct 26 15:06:56 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B141F130E26 for ; Fri, 26 Oct 2018 15:06:54 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char 9C hex): Received: ...s kaduk@ATHENA.MIT.EDU)\n\t\234by outgoing.mit[...] X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yThZMsqrzzZh for ; Fri, 26 Oct 2018 15:06:53 -0700 (PDT) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67D68127148 for ; Fri, 26 Oct 2018 15:06:53 -0700 (PDT) X-AuditID: 12074423-473ff70000000f03-c9-5bd38ffaaaeb Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-6.mit.edu (Symantec Messaging Gateway) with SMTP id 14.AA.03843.BFF83DB5; Fri, 26 Oct 2018 18:06:51 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.14.7/8.9.2) with ESMTP id w9QM6njm000301 for ; Fri, 26 Oct 2018 18:06:50 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) œby outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id w9QM6k5B019802 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 26 Oct 2018 18:06:49 -0400 Date: Fri, 26 Oct 2018 17:06:46 -0500 From: Benjamin Kaduk To: secdir@ietf.org Message-ID: <20181026220646.GU45914@kduck.kaduk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLIsWRmVeSWpSXmKPExsUixCmqrPu7/3K0wZU+bYsPCx+yODB6LFny kymAMYrLJiU1J7MstUjfLoErY8mPu8wFERUzn/1haWB07mLk5JAQMJFYPrObtYuRi0NIYA2T RPv6HkYI5zijxJ/ds5kgnM9MEp8WvmAHaWERUJWYuGIWE4jNJqAi0dB9mRnEFhEQlrh98AEr iC0sYCzx58INFhCbF2jF3YNb2CFsQYmTM5+AxZkFtCRu/HsJNIcDyJaWWP6PAyQsKqAssbfv EPsERt5ZSDpmIemYhdCxgJF5FaNsSm6Vbm5iZk5xarJucXJiXl5qka6ZXm5miV5qSukmRlAY sbso72B82ed9iFGAg1GJh3eBweVoIdbEsuLK3EOMkhxMSqK8a/uAQnxJ+SmVGYnFGfFFpTmp xYcYJTiYlUR4rxUA5XhTEiurUovyYVLSHCxK4rwTWxZHCwmkJ5akZqemFqQWwWRlODiUJHiF gPEiJFiUmp5akZaZU4KQZuLgBBnOAzS8BKSGt7ggMbc4Mx0if4rRmGPV97/TmTm6fgBJIZa8 /LxUKXFeNZBSAZDSjNI8uGmgVCCRvb/mFaM40HPCvKtBPuEBphG4ea+AVjEBrZqhcAFkVUki QkqqgbF3xXr2rX5rkjafkjjbM+vXlVUx8b2u5W+sqg8uTm3V85btis+25rD6dWbrwrolB7fI 2Z8UevWtX8UyarfaBCH2DcZdNXzzl7h89f4clrwtK+5czUQJ2/tlX6y4N4qUXLu1b+WDBUWV u819Z0i/SHc5M3f25vYpItIO+ZWaDNzhs7lZY/iq7ZVYijMSDbWYi4oTAVjmcIjgAgAA Archived-At: Subject: [secdir] IETF 103 Bangkok secdir lunch in "Pagoda" X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Oct 2018 22:06:55 -0000 Hi folks, We've got the room "Pagoda" for our regular Tuesday secdir lunch. -Ben From nobody Sat Oct 27 11:04:02 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F01CE130E17; Sat, 27 Oct 2018 11:04:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BBrwnDsdCg_i; Sat, 27 Oct 2018 11:03:59 -0700 (PDT) Received: from Mail.Yoyodyne.COM (mail.yoyodyne.com [139.60.72.138]) by ietfa.amsl.com (Postfix) with SMTP id 897D9130E2F; Sat, 27 Oct 2018 11:03:59 -0700 (PDT) Received: from [IPv6:2603:3024:1748::4] ([2603:3024:1748::4]) by Mail.Yoyodyne.COM via Internet for (and others); Sat, 27 Oct 2018 11:03:58 PDT From: Derrell Piper Content-Type: multipart/signed; boundary="Apple-Mail=_4131F4F0-8A27-41FA-B2BF-E653543E6F56"; protocol="application/pkcs7-signature"; micalg=sha-256 Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Message-Id: <49BB50CA-D57F-4CED-93DA-60E951DC7CE6@electric-loft.org> Date: Sat, 27 Oct 2018 11:03:54 -0700 To: secdir@ietf.org, ietf@ietf.org, draft-ietf-pce-segment-routing.all@ietf.org X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: [secdir] draft-ietf-pce-segment-routing-14 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Oct 2018 18:04:01 -0000 --Apple-Mail=_4131F4F0-8A27-41FA-B2BF-E653543E6F56 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii Reviewer: Derrell Piper Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Background: This is a minor edit to the introduction and updates references with no substantive change. Security Evaluation: This update is not security relevant. --Apple-Mail=_4131F4F0-8A27-41FA-B2BF-E653543E6F56 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCkkw ggTpMIID0aADAgECAgRMDowbMA0GCSqGSIb3DQEBCwUAMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5l dDFAMD4GA1UECxQ3d3d3LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGlt aXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UE AxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgpMB4XDTExMTExMTE1 MjU1MVoXDTIxMTExMTIzMjc1MFowgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJ bmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZl cmVuY2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3Qg Q2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpYPyALmJw k4z2GWJLrTZYlw5O/p2PAC4//myCDUGGIyPWk82D/o9D4eLrbSgbEbsB+uuATnNe3lrFqjozsYve eNIk+9EUvZRNkl+YNFn/2IY2HHe4YWJWWPuAVQ8DKYR96NCzpt/1Irgkv+QDrHksTX5aqBIPAfjN EJPPLRyzdGuH277CsWcjDujjxxDFAzi3yAVFoIvsJBXdyxw4X2aZCLP315HcX5cHYtxBnI7RxjX2 U6d3rmgUNaRnEz5JjW6+nyCjn6h3Gbw4u1XTYM6g/q+33EwZmpNz6Je+BT9/d/JppfedXvTg+A6w Ivs+qDYabkTEj6Rq1baljNyc87AHAgMBAAGjggEOMIIBCjAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0T AQH/BAgwBgEB/wIBADAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVu dHJ1c3QubmV0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwuZW50cnVzdC5uZXQvMjA0OGNh LmNybDA7BgNVHSAENDAyMDAGBFUdIAAwKDAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5lbnRydXN0 Lm5ldC9ycGEwHQYDVR0OBBYEFEeQpKEKQyC/0HRUuJT6xHu1thwFMB8GA1UdIwQYMBaAFFXkgdER gL7YibkIozH5oSQJFrlwMA0GCSqGSIb3DQEBCwUAA4IBAQBRNMJxm4DOQpk8ZWRM0mdOp4ztTrBK BziTwUc5VbZR0WIBIGejvX4gL5Rhj8Y3/xbcABb9RUBAfkGHHIxhIyf12Jj9JTA7oavzcvrNMJ20 wrbKtOLFeUu0cFCRuxdhT0dWMJ0Z3g8bPbWd7Gu7hjIYZ5/Fhc/Hw3duZwZ1t0CpyLtuhIhJhaSO Zez4sXqT0VvgLb0AXWhWd9zzoHrnx23FqW620NhJlH6CTDbMH+JptP6NT5Xr/uGFFJhkVnYDhHx6 wMjd4KBhnYvnbYbSdamln6CWcEXVwBk2ioUtrIHjYEFYxEd7jqvZEtAu20Z5KHvMK67Tgqp0Cqgy kXqbEa+bMIIFWDCCBECgAwIBAgIQWNtWl/PBatkAAAAATDOHTjANBgkqhkiG9w0BAQsFADCBpTEL MAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0 Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMTAg RW50cnVzdCwgSW5jLjEiMCAGA1UEAxMZRW50cnVzdCBDbGFzcyAxIENsaWVudCBDQTAeFw0xODAx MDQwMDA4MzNaFw0xOTAxMDQwMDM4MTlaMIGfMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0 ZWQxNzA1BgNVBAsTLkVudHJ1c3QgQ2xhc3MgMSBJZGVudGl0eSBDZXJ0aWZpY2F0aW9uIFNlcnZp Y2UxHjAcBgNVBAMMFWRkcEBlbGVjdHJpYy1sb2Z0Lm9yZzEkMCIGCSqGSIb3DQEJARYVZGRwQGVs ZWN0cmljLWxvZnQub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsL6ViuKJF51D +828PaM6LljWtmv45mqJJv9SEveROr561YpEPYP6MMJWVSkqm2c0c5lzZ2zj5ldU0k8yZUJotqvx qd+jmhSBGxs0Q7Iy4sryUI9WH/cRT8XTP6xDpXsFSE8/z6HcpgqZqj6hPLpE9mu0j/xOHXr4HQ3Q bWV+HQii5AuiUaDh9v0TNZoWxWXG9nOA96kYP4HTT87V1kq2fqE/VW4HsYJPB9fdzDTQd78b9IUl QhGgm7DuuuqSQrR35QIcnuHqD+aTcjXVxwgexqZ6okT1Rpnn2mKPYhWzSFCRegJsvzcpCMQC9FzE jib3mqZmOsvCZcIDc/Ts/vsmvQIDAQABo4IBhjCCAYIwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW MBQGCCsGAQUFBwMCBggrBgEFBQcDBDBCBgNVHSAEOzA5MDcGC2CGSAGG+mwKAQQBMCgwJgYIKwYB BQUHAgEWGmh0dHA6Ly93d3cuZW50cnVzdC5uZXQvcnBhMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6 Ly9jcmwuZW50cnVzdC5uZXQvY2xhc3MxY2EuY3JsMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcw AYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNQYIKwYBBQUHMAKGKWh0dHA6Ly9haWEuZW50cnVz dC5uZXQvMjA0OGNsYXNzMXNoYTIuY2VyMCAGA1UdEQQZMBeBFWRkcEBlbGVjdHJpYy1sb2Z0Lm9y ZzAfBgNVHSMEGDAWgBRHkKShCkMgv9B0VLiU+sR7tbYcBTAdBgNVHQ4EFgQUdCSxtGYuaYzdvfQZ wpGK1ckRnWIwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEABBE6v90UWWFOib6CPRJqkCbr Mvt/n3jtcwFTzJMUaG9qI6ucOW2eG7xmpulomLXd/OPUoXFcsUVpf/dqDpAsPyXNdL264Kc22tQE RA0uOFl7i7RJwPfONZnppMD5llua7kDIc/8QVMX6oL9dAfQLDdjIIbntDSUudIPqIMWQUoNExhio sJUfquX5xRuBpcafq0b2aAke6+fRI5YoNE8k2q4cVKh/CKzK6qwjT6W04+xERvWm68QvzDr4rXqD 5B0Umg7cZ0f6xsKsnU6tpxJWwBVY2wQCpfb8cKJO89OPDQVnvHiBvkXFZNXT28YCD2/cS2trkSEp yGv1KrbXETce5zGCA/EwggPtAgEBMIG6MIGlMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVz dCwgSW5jLjE5MDcGA1UECxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkg cmVmZXJlbmNlMR8wHQYDVQQLExYoYykgMjAxMCBFbnRydXN0LCBJbmMuMSIwIAYDVQQDExlFbnRy dXN0IENsYXNzIDEgQ2xpZW50IENBAhBY21aX88Fq2QAAAABMM4dOMA0GCWCGSAFlAwQCAQUAoIIC BzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODEwMjcxODAzNTVa MC8GCSqGSIb3DQEJBDEiBCCsyuWu0jgqVLcaFvknZ7kamQ6bEaeIAgBJa0wHhHCyGjCBywYJKwYB BAGCNxAEMYG9MIG6MIGlMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcG A1UECxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJlbmNlMR8w HQYDVQQLExYoYykgMjAxMCBFbnRydXN0LCBJbmMuMSIwIAYDVQQDExlFbnRydXN0IENsYXNzIDEg Q2xpZW50IENBAhBY21aX88Fq2QAAAABMM4dOMIHNBgsqhkiG9w0BCRACCzGBvaCBujCBpTELMAkG A1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0Lm5l dC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMTAgRW50 cnVzdCwgSW5jLjEiMCAGA1UEAxMZRW50cnVzdCBDbGFzcyAxIENsaWVudCBDQQIQWNtWl/PBatkA AAAATDOHTjANBgkqhkiG9w0BAQEFAASCAQCLCSnGpp/LgOAffs3IfScWDolr7OZ0KdzhqFxB2Npb W/iBTxnejgpB9HvSQd+b2w5vF5nrS0Z049CPXAfbY6zChb8yvkAV2HoLxWrEnfvrzs3e7qfqgOXs CIw3LOS2ou36vKkt3qI0IL68UWrhtDvCfPkoigTrPQ+b7hoc+ds+pfpK/zSgri1nA3nRZtWXFsHM rVe9M0kF3s2RWYUforUUymqRHLLJsQFi9arQoww18LZQdoynVC8KFpO15TYPSRwfabPuMD3Qopl2 z9UyPGTLbVKPBbtx0NSNQUSXTc6FQhvSZ9D7UvdMSF9dYTA/cWvpGKFQgvCUEbksBS8OVBe6AAAA AAAA --Apple-Mail=_4131F4F0-8A27-41FA-B2BF-E653543E6F56-- From nobody Mon Oct 29 06:36:11 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51BFF130F26; Mon, 29 Oct 2018 06:36:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.2 X-Spam-Level: X-Spam-Status: No, score=-0.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=1.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=smyslov.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G0yUFrCOxJSF; Mon, 29 Oct 2018 06:36:07 -0700 (PDT) Received: from direct.host-care.com (direct.host-care.com [198.136.54.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8618E130F23; Mon, 29 Oct 2018 06:35:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=smyslov.net ; s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID :Date:Subject:Cc:To:From:Sender:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Ho1DXOGzzVGRY8CkU1hgeqU9Trc30QhmfSGtcKzrVcE=; b=JztMPpEtal5L0FL712JHHDREXQ uVwwtG+5Cc1asm926i2zz4zvddzggG5EVFrFghKsoFrat1f7VCbytVmIE2PBm+Noqzj+SIGMG0Y/S 7dVtXDOtlcbWrsGZGC6zyLEDxWW/dhEPtLMpGlOha27FuWGwPMxn7EUeZL3UkzWmz3gJWoS52Y6UT wKM3afEgMh2Kxy1T6HN+TFIKWcxv8zh2LMwex1rQVRiS9fG9fe3W6L8D0NhXzxqYgaOVfcrdl3ge+ Sje9MkZfrq2MBZyA1PwaFT/7cugUi3Plfh7QR4asNz4LgLl2dVwdYEI6VjmWcAsnE8H5LdscBAm0x VhMtp6ug==; Received: from [82.138.51.4] (port=49366 helo=buildpc) by direct.host-care.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim 4.91) (envelope-from ) id 1gH7hk-0007OW-Pd; Mon, 29 Oct 2018 09:35:41 -0400 From: "Valery Smyslov" To: Cc: , , Date: Mon, 29 Oct 2018 16:35:22 +0300 Message-ID: <04a001d46f8c$3fd204e0$bf760ea0$@smyslov.net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Content-Language: ru Thread-Index: AdRvXnGNFd6CotSYRDG5mWUsUy7B6w== X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - direct.host-care.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - smyslov.net X-Get-Message-Sender-Via: direct.host-care.com: authenticated_id: valery@smyslov.net X-Authenticated-Sender: direct.host-care.com: valery@smyslov.net X-Source: X-Source-Args: X-Source-Dir: Archived-At: Subject: [secdir] Secdir Last Call assignment: draft-ietf-regext-change-poll X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Oct 2018 13:36:09 -0000 Reviewer: Valery Smyslov Review result: Ready with Nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft defines an extension for an Extensible Provisioning Protocol (EPP, RFC 5730) that allows servers to notify clients about operations which were not initiated by clients, but which modify state of client-sponsored objects. The extension is defined using standard EPP mechanism for adding extensions, so Security Considerations from RFC 5730 are applied and no new ones are added. Keeping long message queues consume server resources and can potentially be a surface for DoS attack, however as far as I understand unauthorized entities cannot cause server to perform actions resulted in operations on other clients' objects, so it seems that it is not a security issue here. Nevertheless adding a few words that it is not a security issue would be helpful. General comment not related to security. It seems to me that the protocol description is inconsistent. The Introduction Section states, that this extension only extends the response to the EPP command. However, Section 3 of this specification, which describes the EPP Command Mapping, extends only the response to the EPP command with poll message, and the command is not mentioned there at all. I'm not familiar with the EPP protocol, but I believe that and are different commands, so unless I've missed something, it seems that the protocol description is inconsistent (or incomplete). Since it is not related to security, I think the document is Ready (from security perspective), but this inconsistency must either be fixed or some clarification be provided. From nobody Mon Oct 29 06:57:29 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85561130F26; Mon, 29 Oct 2018 06:57:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nArD7q3hxo94; Mon, 29 Oct 2018 06:57:11 -0700 (PDT) Received: from mail2.verisign.com (mail2.verisign.com [72.13.63.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91D5E128CFD; Mon, 29 Oct 2018 06:57:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=5700; q=dns/txt; s=VRSN; t=1540821430; h=from:to:cc:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:subject; bh=DzfcxFzHyBdBk91I12JkGrMqpFdewqjifhzU9u1OE0o=; b=H3Dd8l2xQit663kUdN66OmVu+lhxwWoeA0U3PdbzUxVHm2u0KBqZKzkD yMq3LI7kQdRvC4hZmVgZeFp7Rn6XB4eB/C+nljma6y0qqpzM61Yx1fZEx ypqemTc974MssndoylNZFQu7eNAP8FzsZbQq8ROV6yU7/JY/7KgzWYDZR x3+FKlekEGAbRC4G38AUGw6pMoWg/3yp49Gvu6iqJtX8rt96IpF943U6F hXJmXvYwtWq/cgX8dCSH9Runpf/V2ceDJR2XWEim/qM7zfXckkpmPWChi 2S4pYI44gWO3EuAVwzfO49kl0nqxTP/AO0M31YGF/XbZ/tgUMdKSDbU71 A==; X-IronPort-AV: E=Sophos;i="5.54,440,1534809600"; d="scan'208";a="6145577" IronPort-PHdr: =?us-ascii?q?9a23=3AjhmxRxMICyZ1l7I15OIl6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0K/3+psbcNUDSrc9gkEXOFd2Cra4c1KyO6+jJYi8p2d65qncMcZhBBVcuqP?= =?us-ascii?q?49uEgeOvODElDxN/XwbiY3T4xoXV5h+GynYwAOQJ6tL1LdrWev4jEMBx7xKRR6?= =?us-ascii?q?JvjvGo7Vks+7y/2+94fcbglUhjexe69+IAmrpgjNq8cahpdvJLwswRXTuHtIfO?= =?us-ascii?q?pWxWJsJV2Nmhv3+9m98p1+/SlOovwt78FPX7n0cKQ+VrxYES8pM3sp683xtBnM?= =?us-ascii?q?VhWA630BWWgLiBVIAgzF7BbnXpfttybxq+Rw1DWGMcDwULs5Xymp4aV2Rx/ykC?= =?us-ascii?q?oJNyA3/nzLisJ+j6xbrhCuqBJ+w4HIb4+aO+Fzfr/GctMfWWZNQtxcWi5HD4ih?= =?us-ascii?q?b4UPFe0BPeNAooXzplUOqga+BQ2xC+/31zRGgmX53agk3OQ6Hw3NwQstH9ABsH?= =?us-ascii?q?TTsdX1MLodXPurzKbW1zXDbuhW2Tby6IjOaBwuvfaMXbdpfMfX1EIhGQTFjlCK?= =?us-ascii?q?pozkOTOYzvoNvHaB7+phTuKvimEnqwdwojip2sggkJXGhoUQyl3C6C53w541KM?= =?us-ascii?q?WlREJne9KoDZldui+AO4drQs4vTXtktSk5x7EepJK3YDIGxIklyhLDcfCLboeF?= =?us-ascii?q?7xH5WOqMIjp0nHxld6y8ihqu9EWtz/fzW8qw3VlRqydInMfAuW0M2hHW8ceKTv?= =?us-ascii?q?pw80Wk1DuB2Q3e6PxLLEYpnqTBMZEh2KQ/lp8LvETGGS/5hVv5gbeNdkUh5uio?= =?us-ascii?q?8+PnYqj6ppOEN497lAX+MqM2l8GiHeo2KhUCUGiD9+qz1bLv4VD1TK9UjvIqla?= =?us-ascii?q?nZqojaKd4BqaGkGQNVzJwj6w25Dzu8zNsYmnwHIEpEeBKBkYfpJ0nDLO3kAful?= =?us-ascii?q?nlihkjlmy+rbMrDhDJjBNHfOnbT5cbZ48UFcyQ4zzd5F55JTD7EMOPDzWkD2tN?= =?us-ascii?q?zFCh82Lhe5w/j5B9Vn14MeQmOPAqCfMK/IrVCI4ecvL/GWZIAJoDb9N+Ql5/n2?= =?us-ascii?q?gH8ng1Adebem3YEXaX2jBfRmJkWYYWHogtcGD2cGpAw+Q/L2iFeaSz5ce26yX7?= =?us-ascii?q?4g5jE8EI+mFpnMSZywj7yAxie2BZxWaX5aClCCC3vocJ+EW/gUYiKIPsBhiiAE?= =?us-ascii?q?VaSmS4I5yB6urhX1y7R7LubN+y0Xq47j1NZs6+3Jix4y+iJ7DsuB022UU250nn?= =?us-ascii?q?kHRzk53K9huEB90lCD0ax8g/BCD9NT4/dJXxw7NZHC0+x6Bcr+WgXbfteGUFym?= =?us-ascii?q?WMmpASktTtItxN8De1x9FMutjh/d0CuqH6QYl72VC5wo/KLQxX/xJ9xyy3zezq?= =?us-ascii?q?kuk0EmQtdTNW2hnqN/9hbcB5LHk0iClqala7gc3CDX+GeE12qOsxIQbAklG7vM?= =?us-ascii?q?WX0Fd2PNqMXi4kTcCbmjFf5vZhVIzcOYO4NRb8zyiVJYAvHuJIKaKyiqlmy8BA?= =?us-ascii?q?ygx76QYsztYWpXlHHGBUMIkho7/HuaO045HCj38EzECzk7X33ofkfgtaFcoXa2?= =?us-ascii?q?VQV8mwOFaFBl25Kr9wQUnv2TTbUY2bdS63RpkCl9AFvoh4GeMNGHvQc0JKg=3D?= X-IPAS-Result: =?us-ascii?q?A2EYAADRENdb/zCZrQpiAxwBAQEEAQEHBAEBgVEHAQELAYJ?= =?us-ascii?q?qgScKg2uIGI1/l0WBPzsMARMMD4Q+AheDNzQNDQEDAQEBAQEBAgEBAoEFDII2I?= =?us-ascii?q?hJLLwkBMgEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQgCCAdHARo?= =?us-ascii?q?GIxE+BxACAQgaAiYCAgIwFRABAQQBDQWDIQGqD4EuihOBC4gUgl+BQj6BEScME?= =?us-ascii?q?4JMhGgiCwomgj0xgiYCjmCQKQMGAoZoijKCHo4pjHCKBQIEAgQFAhSBQ4IOcBV?= =?us-ascii?q?lAYJBCYV8ilJvDSSLVYEfAQE?= Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1531.3; Mon, 29 Oct 2018 09:57:08 -0400 Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%5]) with mapi id 15.01.1531.003; Mon, 29 Oct 2018 09:57:08 -0400 From: "Gould, James" To: "valery@smyslov.net" , "secdir@ietf.org" CC: "draft-ietf-regext-change-poll.all@ietf.org" , "regext@ietf.org" , "ietf@ietf.org" Thread-Topic: [EXTERNAL] Secdir Last Call assignment: draft-ietf-regext-change-poll Thread-Index: AdRvXnGNFd6CotSYRDG5mWUsUy7B6wAMNZ4A Date: Mon, 29 Oct 2018 13:57:08 +0000 Message-ID: <89648AE8-724C-4814-9826-FD28C8CBD652@verisign.com> References: <04a001d46f8c$3fd204e0$bf760ea0$@smyslov.net> In-Reply-To: <04a001d46f8c$3fd204e0$bf760ea0$@smyslov.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.f.0.180709 x-originating-ip: [10.170.148.18] Content-Type: text/plain; charset="utf-8" Content-ID: <159781F298D37846B8AF299F7B65020F@verisign.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Secdir Last Call assignment: draft-ietf-regext-change-poll X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Oct 2018 13:57:14 -0000 VGhhbmsgeW91IGZvciB0aGUgcmV2aWV3IGFuZCBmZWVkYmFjay4gIEkgY2FuIHVuZGVyc3RhbmQg dGhlIGNvbmZ1c2lvbiBpZiB5b3UncmUgbm90IGZhbWlsaWFyIHdpdGggdGhlIEVQUCBwcm90b2Nv bC4gIEkgYXR0ZW1wdCB0byBjbGFyaWZ5IHRoaW5ncyBiZWxvdy4gIA0KDQpUaGUgaW5mbyBjb21t YW5kIGFuZCB0aGUgcG9sbCBjb21tYW5kIGFyZSBkaWZmZXJlbnQgY29tbWFuZHMsIGJ1dCB3aGVy ZSB0aGUgY29uZnVzaW9uIGxpZXMgaXMgd2l0aCB0aGUgcmVzcG9uc2UuICBBIHBvbGwgcmVzcG9u c2UgY2FuIGJlIGFueSBFUFAgcmVzcG9uc2UsIHNpbmNlIHRoZSBpbmZvcm1hdGlvbiBmb3IgYSBw b2xsIHJlc3BvbnNlIGlzIGJ1aWx0IGludG8gdGhlIGdlbmVyYWwgRVBQIHJlc3BvbnNlIHdpdGgg dGhlIDxtc2dRPiBlbGVtZW50IChzZWN0aW9uIDIuNiBvZiBSRkMgNTczMCksIHNvIGFueSBFUFAg cmVzcG9uc2UgImhhcyBhIiByZWxhdGlvbnNoaXAgd2l0aCB0aGUgcG9sbCBxdWV1ZSBpbmZvcm1h dGlvbi4gIEEgY29uY3JldGUgRVBQIHJlc3BvbnNlLCB3aGljaCBpbiB0aGlzIGNhc2UgaXMgYW4g aW5mbyByZXNwb25zZSwgZXh0ZW5kcyAoImlzIGEiIHJlbGF0aW9uc2hpcCkgdGhlIEVQUCBnZW5l cmFsIHJlc3BvbnNlLCBzbyBhIGNvbmNyZXRlIEVQUCByZXNwb25zZSBjYW4gYmUgdXNlZCBpbiB0 aGUgcmVzcG9uc2UgdG8gYW4gRVBQIGNvbW1hbmQgb3IgYW4gRVBQIHBvbGwgY29tbWFuZC4gIElu IHRoZSBjYXNlIG9mIHRoZSBkcmFmdC1pZXRmLXJlZ2V4dC1jaGFuZ2UtcG9sbCwgaXQgc3BlY2lm aWVzIHRoZSB1c2Ugb2YgdGhlIGluZm8gcmVzcG9uc2Ugb2Ygb3RoZXIgRVBQIG9iamVjdHMgKGUu Zy4sIGRvbWFpbiBpbiBSRkMgNTczMSwgaG9zdCBpbiBSRkMgNTczMiwgb3IgY29udGFjdCBpbiBS RkMgNTczMykgd2l0aCB0aGUgQ2hhbmdlIFBvbGwgRXh0ZW5zaW9uIHRoYXQgZGVmaW5lcyB0aGUg c2VydmVyLXNpZGUgb3BlcmF0aW9uIG1ldGEtZGF0YSBvZiB3aGF0LCB3aGVuLCB3aG8sIGFuZCB3 aHkuICBBIGNvbmNyZXRlIGV4YW1wbGUgaXMgdGhlIHNlcnZlciBhZGRpbmcgYSBzZXJ2ZXIgc3Rh dHVzIG9uIGEgZG9tYWluIG5hbWUsIGFzIGRlZmluZWQgaW4gUkZDIDU3MzEsIHdoZXJlIGl0IGNh biBpbnNlcnQgYW4gRVBQIHBvbGwgbWVzc2FnZSBpbiB0aGUgZm9ybSBvZiBhIGRvbWFpbiBpbmZv IHJlc3BvbnNlIHRoYXQgaW5jbHVkZXMgdGhlIGFkZGVkIHNlcnZlciBzdGF0dXMsIHdpdGggdGhl IHBvbGwgbWVzc2FnZSA8bXNnUT4gZWxlbWVudCBwb3B1bGF0ZWQsIGFuZCB3aXRoIHRoZSBDaGFu Z2UgUG9sbCBFeHRlbnNpb24gYWRkZWQuICBUaGUgcmVzcG9uc2VzIG9mIGRyYWZ0LWlldGYtcmVn ZXh0LWNoYW5nZS1wb2xsIGFyZSBhc3NvY2lhdGVkIHdpdGggcG9sbCByZXNwb25zZXMsIHdoZXJl IHRoZSBjb25jcmV0ZSBwb2xsIHJlc3BvbnNlcyB1c2VkIGFyZSBpbmZvIHJlc3BvbnNlcyB3aXRo IHRoZSBDaGFuZ2UgUG9sbCBleHRlbnNpb24uICBBIGNsaWVudCB3b3VsZCByZXF1ZXN0IHRoZSBw b2xsIG1lc3NhZ2UgdXNpbmcgdGhlIEVQUCBSRkMgNTczMCBwb2xsIGNvbW1hbmQgYW5kIHdvdWxk IHJlY2VpdmUgdGhlIHBvbGwgbWVzc2FnZSBpbiB0aGUgZm9ybSBvZiBhbiBpbmZvIHJlc3BvbnNl LCB3aXRoIHRoZSBwb2xsIHF1ZXVlIGluZm9ybWF0aW9uIGluY2x1ZGVkLCBhbmQgd2l0aCB0aGUg Q2hhbmdlIFBvbGwgZXh0ZW5zaW9uLg0KDQpJIGhvcGUgdGhpcyBoZWxwcy4gICANCg0KVGhhbmtz LA0KICANCuKAlA0KIA0KSkcNCg0KDQoNCkphbWVzIEdvdWxkDQpEaXN0aW5ndWlzaGVkIEVuZ2lu ZWVyDQpqZ291bGRAVmVyaXNpZ24uY29tDQoNCjcwMy05NDgtMzI3MQ0KMTIwNjEgQmx1ZW1vbnQg V2F5DQpSZXN0b24sIFZBIDIwMTkwDQoNClZlcmlzaWduLmNvbSA8aHR0cDovL3ZlcmlzaWduaW5j LmNvbS8+IA0KDQrvu79PbiAxMC8yOS8xOCwgOTozNiBBTSwgIlZhbGVyeSBTbXlzbG92IiA8dmFs ZXJ5QHNteXNsb3YubmV0PiB3cm90ZToNCg0KICAgIFJldmlld2VyOiBWYWxlcnkgU215c2xvdgkN CiAgICBSZXZpZXcgcmVzdWx0OiBSZWFkeSB3aXRoIE5pdHMNCiAgICANCiAgICBJIGhhdmUgcmV2 aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdz IA0KICAgIG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwgSUVURiBkb2N1bWVudHMgYmVpbmcg cHJvY2Vzc2VkIGJ5IHRoZSANCiAgICBJRVNHLiAgVGhlc2UgY29tbWVudHMgd2VyZSB3cml0dGVu IHByaW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlIA0KICAgIHNlY3VyaXR5IGFyZWEgZGly ZWN0b3JzLiAgRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdCANCiAg ICB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UgYW55IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy4N CiAgICANCiAgICBUaGlzIGRyYWZ0IGRlZmluZXMgYW4gZXh0ZW5zaW9uIGZvciBhbiBFeHRlbnNp YmxlIFByb3Zpc2lvbmluZyBQcm90b2NvbCAoRVBQLCBSRkMgNTczMCkNCiAgICB0aGF0IGFsbG93 cyBzZXJ2ZXJzIHRvIG5vdGlmeSBjbGllbnRzIGFib3V0IG9wZXJhdGlvbnMgd2hpY2ggd2VyZSBu b3QgDQogICAgaW5pdGlhdGVkIGJ5IGNsaWVudHMsIGJ1dCB3aGljaCBtb2RpZnkgc3RhdGUgb2Yg Y2xpZW50LXNwb25zb3JlZCBvYmplY3RzLg0KICAgIA0KICAgIFRoZSBleHRlbnNpb24gaXMgZGVm aW5lZCB1c2luZyBzdGFuZGFyZCBFUFAgbWVjaGFuaXNtIGZvciBhZGRpbmcgZXh0ZW5zaW9ucywN CiAgICBzbyBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBmcm9tIFJGQyA1NzMwIGFyZSBhcHBsaWVk IGFuZCBubyBuZXcgb25lcyBhcmUgYWRkZWQuIA0KICAgIEtlZXBpbmcgbG9uZyBtZXNzYWdlIHF1 ZXVlcyBjb25zdW1lIHNlcnZlciByZXNvdXJjZXMgYW5kIGNhbg0KICAgIHBvdGVudGlhbGx5IGJl IGEgc3VyZmFjZSBmb3IgRG9TIGF0dGFjaywgaG93ZXZlciBhcyBmYXIgYXMgSSB1bmRlcnN0YW5k DQogICAgdW5hdXRob3JpemVkIGVudGl0aWVzIGNhbm5vdCBjYXVzZSBzZXJ2ZXIgdG8gcGVyZm9y bSBhY3Rpb25zIHJlc3VsdGVkIGluIA0KICAgIG9wZXJhdGlvbnMgb24gb3RoZXIgY2xpZW50cycg b2JqZWN0cywgc28gaXQgc2VlbXMgdGhhdCBpdCBpcyBub3QgYSBzZWN1cml0eSBpc3N1ZSBoZXJl Lg0KICAgIE5ldmVydGhlbGVzcyBhZGRpbmcgYSBmZXcgd29yZHMgdGhhdCBpdCBpcyBub3QgYSBz ZWN1cml0eSBpc3N1ZSB3b3VsZCBiZSBoZWxwZnVsLg0KICAgIA0KICAgIEdlbmVyYWwgY29tbWVu dCBub3QgcmVsYXRlZCB0byBzZWN1cml0eS4gSXQgc2VlbXMgdG8gbWUgdGhhdCB0aGUgcHJvdG9j b2wgZGVzY3JpcHRpb24NCiAgICBpcyBpbmNvbnNpc3RlbnQuIFRoZSBJbnRyb2R1Y3Rpb24gU2Vj dGlvbiBzdGF0ZXMsIHRoYXQgdGhpcyBleHRlbnNpb24gb25seSBleHRlbmRzIA0KICAgIHRoZSBy ZXNwb25zZSB0byB0aGUgRVBQIDxwb2xsPiBjb21tYW5kLiBIb3dldmVyLCBTZWN0aW9uIDMgb2Yg dGhpcyBzcGVjaWZpY2F0aW9uLCANCiAgICB3aGljaCBkZXNjcmliZXMgdGhlIEVQUCBDb21tYW5k IE1hcHBpbmcsIGV4dGVuZHMgb25seSB0aGUgcmVzcG9uc2UgDQogICAgdG8gdGhlIEVQUCA8aW5m bz4gY29tbWFuZCB3aXRoIHBvbGwgbWVzc2FnZSwgYW5kIHRoZSA8cG9sbD4gY29tbWFuZCBpcyBu b3QgbWVudGlvbmVkIA0KICAgIHRoZXJlIGF0IGFsbC4gSSdtIG5vdCBmYW1pbGlhciB3aXRoIHRo ZSBFUFAgcHJvdG9jb2wsIGJ1dCBJIGJlbGlldmUgdGhhdCA8aW5mbz4gYW5kIDxwb2xsPiANCiAg ICBhcmUgZGlmZmVyZW50IGNvbW1hbmRzLCBzbyB1bmxlc3MgSSd2ZSBtaXNzZWQgc29tZXRoaW5n LCBpdCBzZWVtcyB0aGF0IHRoZSBwcm90b2NvbCANCiAgICBkZXNjcmlwdGlvbiBpcyBpbmNvbnNp c3RlbnQgKG9yIGluY29tcGxldGUpLiBTaW5jZSBpdCBpcyBub3QgcmVsYXRlZCB0byBzZWN1cml0 eSwgDQogICAgSSB0aGluayB0aGUgZG9jdW1lbnQgaXMgUmVhZHkgKGZyb20gc2VjdXJpdHkgcGVy c3BlY3RpdmUpLCBidXQgdGhpcyBpbmNvbnNpc3RlbmN5IA0KICAgIG11c3QgZWl0aGVyIGJlIGZp eGVkIG9yIHNvbWUgY2xhcmlmaWNhdGlvbiBiZSBwcm92aWRlZC4NCiAgICANCiAgICANCiAgICAN Cg0K From nobody Mon Oct 29 07:21:09 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BB68130F4D; Mon, 29 Oct 2018 07:20:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.199 X-Spam-Level: X-Spam-Status: No, score=-0.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=1.5, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=smyslov.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id foeejNe3nLBL; Mon, 29 Oct 2018 07:20:50 -0700 (PDT) Received: from direct.host-care.com (direct.host-care.com [198.136.54.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FF39130F52; Mon, 29 Oct 2018 07:20:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=smyslov.net ; s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID :Date:Subject:In-Reply-To:References:Cc:To:From:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=IH3Csz6NR9gMlUTeSjp9PscAY7Jzzmo03JhEHoiydAs=; b=050Ob6uMFNFYwErcBVF8T7ARc1 D6Dag+IQrJ6N+YSh6BoI4ClmfJ6CBJ941m+x+j4NrWnoFwVSmrJjoQzTOCxvAi8hBKN5KUugDGF58 bPBLSlrJw+gRgEFyQypEPZrkwTDiGqD21K/QCVVGFF0NWssMAsPzVfS4aWmF8PYyrLB8fI82w55QS Ce6w1cFVJR7j0TTDGF6uYjnnu1uQh2tdiJrHqhC5W4WhQXCR/24pb4cqPOOsUjMvi17pYawUypxx+ FDsTS1U07/1hE3+rJvMMyWw3C5CJeYzWFq2UTxzpPKvWCC1ZRnUH073g/YaCHVgpt2TXB4nWEVgQf mue7QL3A==; Received: from [82.138.51.4] (port=49486 helo=buildpc) by direct.host-care.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim 4.91) (envelope-from ) id 1gH8PO-0007dl-Mf; Mon, 29 Oct 2018 10:20:47 -0400 From: "Valery Smyslov" To: "'Gould, James'" , Cc: , , References: <04a001d46f8c$3fd204e0$bf760ea0$@smyslov.net> <89648AE8-724C-4814-9826-FD28C8CBD652@verisign.com> In-Reply-To: <89648AE8-724C-4814-9826-FD28C8CBD652@verisign.com> Date: Mon, 29 Oct 2018 17:20:28 +0300 Message-ID: <04a101d46f92$8cb5f3b0$a621db10$@smyslov.net> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Content-Language: ru Thread-Index: AQII0fAx4acx+8pUzkGjGvBMP9n4CwKvge2ipLgA21A= X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - direct.host-care.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - smyslov.net X-Get-Message-Sender-Via: direct.host-care.com: authenticated_id: valery@smyslov.net X-Authenticated-Sender: direct.host-care.com: valery@smyslov.net X-Source: X-Source-Args: X-Source-Dir: Archived-At: Subject: Re: [secdir] Secdir Last Call assignment: draft-ietf-regext-change-poll X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Oct 2018 14:20:53 -0000 Hi James, thank you for clarification. I presume all these things are clear for = those who are familiar with EPP, and probably most of potential readers of this document fall into this = category, but if you can add short explanation for the others it would be great.=20 Regards, Valery Smyslov. > Thank you for the review and feedback. I can understand the confusion = if you're not familiar with the EPP > protocol. I attempt to clarify things below. >=20 > The info command and the poll command are different commands, but = where the confusion lies is with the > response. A poll response can be any EPP response, since the = information for a poll response is built into the > general EPP response with the element (section 2.6 of RFC = 5730), so any EPP response "has a" > relationship with the poll queue information. A concrete EPP = response, which in this case is an info response, > extends ("is a" relationship) the EPP general response, so a concrete = EPP response can be used in the response > to an EPP command or an EPP poll command. In the case of the = draft-ietf-regext-change-poll, it specifies the > use of the info response of other EPP objects (e.g., domain in RFC = 5731, host in RFC 5732, or contact in RFC > 5733) with the Change Poll Extension that defines the server-side = operation meta-data of what, when, who, > and why. A concrete example is the server adding a server status on a = domain name, as defined in RFC 5731, > where it can insert an EPP poll message in the form of a domain info = response that includes the added server > status, with the poll message element populated, and with the = Change Poll Extension added. The > responses of draft-ietf-regext-change-poll are associated with poll = responses, where the concrete poll > responses used are info responses with the Change Poll extension. A = client would request the poll message > using the EPP RFC 5730 poll command and would receive the poll message = in the form of an info response, > with the poll queue information included, and with the Change Poll = extension. >=20 > I hope this helps. >=20 > Thanks, >=20 > =E2=80=94 >=20 > JG >=20 >=20 >=20 > James Gould > Distinguished Engineer > jgould@Verisign.com >=20 > 703-948-3271 > 12061 Bluemont Way > Reston, VA 20190 >=20 > Verisign.com >=20 > =EF=BB=BFOn 10/29/18, 9:36 AM, "Valery Smyslov" = wrote: >=20 > Reviewer: Valery Smyslov > Review result: Ready with Nits >=20 > I have reviewed this document as part of the security = directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of = the > security area directors. Document editors and WG chairs should = treat > these comments just like any other last call comments. >=20 > This draft defines an extension for an Extensible Provisioning = Protocol (EPP, RFC 5730) > that allows servers to notify clients about operations which were = not > initiated by clients, but which modify state of client-sponsored = objects. >=20 > The extension is defined using standard EPP mechanism for adding = extensions, > so Security Considerations from RFC 5730 are applied and no new = ones are added. > Keeping long message queues consume server resources and can > potentially be a surface for DoS attack, however as far as I = understand > unauthorized entities cannot cause server to perform actions = resulted in > operations on other clients' objects, so it seems that it is not a = security issue here. > Nevertheless adding a few words that it is not a security issue = would be helpful. >=20 > General comment not related to security. It seems to me that the = protocol description > is inconsistent. The Introduction Section states, that this = extension only extends > the response to the EPP command. However, Section 3 of this = specification, > which describes the EPP Command Mapping, extends only the response > to the EPP command with poll message, and the = command is not mentioned > there at all. I'm not familiar with the EPP protocol, but I = believe that and > are different commands, so unless I've missed something, it seems = that the protocol > description is inconsistent (or incomplete). Since it is not = related to security, > I think the document is Ready (from security perspective), but = this inconsistency > must either be fixed or some clarification be provided. >=20 >=20 >=20 From nobody Tue Oct 30 18:12:42 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17C021292F1; Tue, 30 Oct 2018 18:12:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lBRY-LxMKWGF; Tue, 30 Oct 2018 18:12:37 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 018CB1277CC; Tue, 30 Oct 2018 18:12:36 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 Oct 2018 18:12:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.54,446,1534834800"; d="scan'208,217"; a="92530154" Received: from orsmsx103.amr.corp.intel.com ([10.22.225.130]) by FMSMGA003.fm.intel.com with ESMTP; 30 Oct 2018 18:12:35 -0700 Received: from orsmsx152.amr.corp.intel.com (10.22.226.39) by ORSMSX103.amr.corp.intel.com (10.22.225.130) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 30 Oct 2018 18:12:35 -0700 Received: from orsmsx116.amr.corp.intel.com ([169.254.7.124]) by ORSMSX152.amr.corp.intel.com ([169.254.8.87]) with mapi id 14.03.0415.000; Tue, 30 Oct 2018 18:12:35 -0700 From: "Ganga, Ilango S" To: =?utf-8?B?TWFnbnVzIE55c3Ryw7Zt?= , "secdir@ietf.org" , "draft-ietf-nvo3-geneve@ietf.org" Thread-Topic: Secdir review (early review) of draft-ietf-nvo3-geneve Thread-Index: AQHUa05O1lkJPkWghUmTeaMFlyPdI6U4khKA Date: Wed, 31 Oct 2018 01:12:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiODhiYzg2MDYtZmZmMy00ZGEzLTg2MWUtMThmYTNmNmY3ODI3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoibnFpb29wRjlxTVF3NWdtSEhQcEFaSHR2TW9xd3lyNWMxVUJMVUk2amVHRU9NdktORmxkYVpBWUd0bXJHeUNXRSJ9 x-ctpclassification: CTP_NT x-originating-ip: [10.22.254.140] Content-Type: multipart/alternative; boundary="_000_C5A274B25007804B800CB5B289727E3583D0AC78ORSMSX116amrcor_" MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Secdir review (early review) of draft-ietf-nvo3-geneve X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 01:12:41 -0000 --_000_C5A274B25007804B800CB5B289727E3583D0AC78ORSMSX116amrcor_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWFnbnVzLA0KDQpUaGFua3MgZm9yIHlvdXIgcmV2aWV3IGFuZCBmZWVkYmFjay4gUGxlYXNl IHNlZSBpbmxpbmUgZm9yIG15IHJlc3BvbnNlcy4NCg0KUmVnYXJkcywNCklsYW5nbw0KDQoNCkZy b206IE1hZ251cyBOeXN0csO2bSBbbWFpbHRvOm1hZ251c25AZ21haWwuY29tXQ0KU2VudDogVHVl c2RheSwgT2N0b2JlciAyMywgMjAxOCA5OjAxIFBNDQpUbzogc2VjZGlyQGlldGYub3JnOyBkcmFm dC1pZXRmLW52bzMtZ2VuZXZlQGlldGYub3JnDQpTdWJqZWN0OiBTZWNkaXIgcmV2aWV3IChlYXJs eSByZXZpZXcpIG9mIGRyYWZ0LWlldGYtbnZvMy1nZW5ldmUNCg0KSSBoYXZlIHJldmlld2VkIHRo aXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUncw0Kb25nb2lu ZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkg dGhlDQpJRVNHLiBUaGVzZSBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUg YmVuZWZpdCBvZiB0aGUNCnNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiAgRG9jdW1lbnQgZWRpdG9y cyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdA0KdGhlc2UgY29tbWVudHMganVzdCBsaWtlIGFu eSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzICJH ZW5ldmUsIiBhIHByb3RvY29sIGZvciBHRW5lcmljIE5FdHdvcmsgVmlydHVhbGl6YXRpb24gRW5j YXBzdWxhdGlvbi4gVGhlIGRvY3VtZW50IGlzIHdyaXR0ZW4gaW4gYSBjbGVhciBtYW5uZXIgYW5k IHdpdGggYSB0aG9yb3VnaCBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uLiBJIGhhdmUg anVzdCBhIGZldyBxdWVzdGlvbnMvY29tbWVudHM6DQoNCi0gU2VjdGlvbiAzLjQ6IFRoZSAiTVVT VCBpZ25vcmUiIGZvciB0aGUgcmVzZXJ2ZWQgYml0cyBzaG91bGQgcHJlc3VtYWJseSBzdGF0ZSAi U0hBTEwgYmUgaWdub3JlZCBmb3IgdGhpcyB2ZXJzaW9uIG9mIHRoZSBHZW5ldmUgcHJvdG9jb2wu IiAtIGFzIEkgaW1hZ2luZSB0aGF0IGluIGEgZnV0dXJlIHZlcnNpb24sIHRoZXNlIGJpdHMgbWF5 IG5vdCBiZSBpZ25vcmVkPw0KDQo8SWxhbmdvPiBJbiB0aGVvcnksIGEgZnV0dXJlIHZlcnNpb24g bWF5IGNoYW5nZSB0aGUgYmVoYXZpb3Igb2YgYW55IG9mIHRoZSBoZWFkZXIgZmllbGRzIGluY2x1 ZGluZyB0aGUgcmVzZXJ2ZWQgYml0cy4gIFRoZSBoZWFkZXIgZGVmaW5pdGlvbiBpcyBmb3IgdGhp cyB2ZXJzaW9uIG9mIHRoZSBwcm90b2NvbC4NCg0KUGxlYXNlIHNlZSBpZiB0aGUgZm9sbG93aW5n IHRleHQgd291bGQgc2F0aXNmeSB0aGUgaW50ZW50IG9mIHlvdXIgY29tbWVudC4NCuKAnFJlc2Vy dmVkIGZpZWxkIHdoaWNoIE1VU1QgYmUgemVybyBvbiB0cmFuc21pc3Npb24gYW5kIE1VU1QgYmUg aWdub3JlZCBvbiByZWNlaXB0LuKAnQ0KDQpPciBsZXQgdXMga25vdyBpZiB5b3Ugc3RpbGwgd2Fu dCB0byBoYXZlIHRoaXMgcXVhbGlmaWVkIHdpdGgg4oCcZm9yIHRoaXMgdmVyc2lvbiBvZiB0aGUg cHJvdG9jb2zigJ0NCjwvPg0KDQotIFNlY3Rpb24gMy41LjE6IEkgd29uZGVyIGFib3V0IHRoZSBz aW11bHRhbmVvdXMgcmVxdWlyZW1lbnQgdGhhdCBvbmUgb3B0aW9uIG11c3Qgbm90IGFmZmVjdCB0 aGUgcGFyc2luZyBvciBpbnRlcnByZXRhdGlvbiBvZiBhbm90aGVyIG9wdGlvbiBidXQgdGhhdCB0 aGUgc2VxdWVuY2luZyAob3JkZXIpIG9mIG9wdGlvbnMgbWF5IGJlIHNpZ25pZmljYW50IC0gdGhl eSBzZWVtIHRvIGJlIGNvbnRyYWRpY3Rvcnkgc2luY2UgaWYgdGhlIHNlcXVlbmNpbmcgKmlzKiBz aWduaWZpY2FudCwgdGhlbiBzb21lIG9wdGlvbiBtdXN0IGJlIGltcGFjdGVkIGJ5IGEgcHJldmlv dXMgb25lJ3MgdmFsdWU/IEZyb20gYSBzZWN1cml0eSBwZXJzcGVjdGl2ZSwgSSBhbHNvIHdvbmRl ciBpZiB0aGVyZSBjb3VsZCBiZSBzZWN1cml0eSBjb25zZXF1ZW5jZXMgb2YgcmUtb3JkZXJpbmcg b3B0aW9ucyAoYW5kIGhvdyB0byB0ZWxsIGlmIHNvbWVvbmUgZGlkIHJlLW9yZGVyIC0gc2VlIGJl bG93KT8NCg0KPElsYW5nbz4gWW91IHJhaXNlIGEgZ29vZCBwb2ludC4gVGhlIGludGVudCBvZiB0 aGlzIHN0YXRlbWVudCBpcywgcGFyc2luZyBhbmQgaW50ZXJwcmV0YXRpb24gb2Ygb3B0aW9ucyBz aG91bGQgbm90IGJlIGRlcGVuZGVudCBvbiBvbmUgYW5vdGhlci4gV2UgYXJlIGRpc2N1c3Npbmcg YW1vbmcgdGhlIGF1dGhvcnMgdG8gc2VlIGhvdyB3ZSBjYW4gaW5jbHVkZSBhcHByb3ByaWF0ZSBj bGFyaWZ5aW5nIHN0YXRlbWVudHMgdG8gYWRkcmVzcyB5b3VyIHBvaW50LiBJIHdpbGwgdXBkYXRl IHlvdSBzaG9ydGx5Lg0KPC8+DQoNCi0gU2VjdGlvbiA2LjIsIHNob3VsZG4ndCBzdWNoIGFuIE9w dGlvbiBiZSBkZWZpbmVkIHRvIHJlZHVjZSB0aGUgcmlzayBvZiB1bmRlci1zcGVjaWZpZWQgb3Ig c3VicGFyIHNwZWNpZmljYXRpb25zIG9mIHN1Y2ggaW50ZWdyaXR5IG1lY2hhbmlzbXM/IE9yIGFs c28gZnJvbSBhbiBpbnRlcm9wIHBlcnNwZWN0aXZlPw0KDQo8SWxhbmdvPiBVc2luZyBhIEdlbmV2 ZSBvcHRpb24gZm9yIHRoZSBwdXJwb3NlIG9mIGRhdGEgaW50ZWdyaXR5IGlzIG1vcmUgb2YgYW4g b3B0aW1pemF0aW9uLiBPdGhlcndpc2UgZGF0YSBpbnRlZ3JpdHkgY291bGQgYmUgcHJvdmlkZWQg YnkgdXNpbmcgZXhpc3RpbmcgbWVjaGFuaXNtcyBsaWtlIElQc2VjIChhcyBzdGF0ZWQgaW4gc2Vj b25kIHBhcmFncmFwaCBvZiA2LjIpLiBXZSBpbmNsdWRlZCB0aGUgbGFzdCBwYXJhZ3JhcGggdG8g c2hvdyBvdGhlciBwb3NzaWJpbGl0aWVzLiBXZSBjb3VsZCByZW1vdmUgdGhpcyBwYXJhZ3JhcGgg aWYgaXQgbWF5IGNhdXNlIGFueSBjb25mdXNpb24uDQoNCldlIHdvdWxkIGxpa2UgdG8ga2VlcCB0 aGUgR2VuZXZlIGJhc2Ugc3BlY2lmaWNhdGlvbiBpbmRlcGVuZGVudCBvZiBvcHRpb25zIHNwZWNp ZmljYXRpb25zLCBvcHRpb25zIGNvdWxkIGJlIGEgZGVmaW5lZCBpbiBhIGZ1dHVyZSBzdGFuZGFy ZHMgYWN0aW9uLg0KPC8+DQoNCg0KVGhhbmtzLg0KLS0gTWFnbnVzDQo= --_000_C5A274B25007804B800CB5B289727E3583D0AC78ORSMSX116amrcor_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBz cGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTcNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVm YXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxv OmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwh W2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZs aW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWFnbnVzLDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmtzIGZvciB5b3VyIHJldmll dyBhbmQgZmVlZGJhY2suIFBsZWFzZSBzZWUgaW5saW5lIGZvciBteSByZXNwb25zZXMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5JbGFuZ288bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21wb3NlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9hPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9fX19fcmVwbHlzZXBhcmF0b3IiPjwv YT48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBN YWdudXMgTnlzdHLDtm0gW21haWx0bzptYWdudXNuQGdtYWlsLmNvbV0NCjxicj4NCjxiPlNlbnQ6 PC9iPiBUdWVzZGF5LCBPY3RvYmVyIDIzLCAyMDE4IDk6MDEgUE08YnI+DQo8Yj5Ubzo8L2I+IHNl Y2RpckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1udm8zLWdlbmV2ZUBpZXRmLm9yZzxicj4NCjxiPlN1 YmplY3Q6PC9iPiBTZWNkaXIgcmV2aWV3IChlYXJseSByZXZpZXcpIG9mIGRyYWZ0LWlldGYtbnZv My1nZW5ldmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGhhdmUgcmV2 aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdz PGJyPg0Kb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBw cm9jZXNzZWQgYnkgdGhlPGJyPg0KSUVTRy4gVGhlc2UgY29tbWVudHMgd2VyZSB3cml0dGVuIHBy aW1hcmlseSBmb3IgdGhlIGJlbmVmaXQgb2YgdGhlPGJyPg0Kc2VjdXJpdHkgYXJlYSBkaXJlY3Rv cnMuJm5ic3A7IERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQ8YnI+ DQp0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UgYW55IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy48 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgZG9jdW1l bnQgZGVzY3JpYmVzICZxdW90O0dlbmV2ZSwmcXVvdDsgYSBwcm90b2NvbCBmb3IgR0VuZXJpYyBO RXR3b3JrIFZpcnR1YWxpemF0aW9uIEVuY2Fwc3VsYXRpb24uIFRoZSBkb2N1bWVudCBpcyB3cml0 dGVuIGluIGEgY2xlYXIgbWFubmVyIGFuZCB3aXRoIGEgdGhvcm91Z2ggU2VjdXJpdHkgQ29uc2lk ZXJhdGlvbnMgc2VjdGlvbi4gSSBoYXZlIGp1c3QgYSBmZXcgcXVlc3Rpb25zL2NvbW1lbnRzOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tIFNl Y3Rpb24gMy40OiBUaGUgJnF1b3Q7TVVTVCBpZ25vcmUmcXVvdDsgZm9yIHRoZSByZXNlcnZlZCBi aXRzIHNob3VsZCBwcmVzdW1hYmx5IHN0YXRlICZxdW90O1NIQUxMIGJlIGlnbm9yZWQgZm9yIHRo aXMgdmVyc2lvbiBvZiB0aGUgR2VuZXZlIHByb3RvY29sLiZxdW90OyAtIGFzIEkgaW1hZ2luZSB0 aGF0IGluIGEgZnV0dXJlIHZlcnNpb24sIHRoZXNlIGJpdHMgbWF5IG5vdCBiZSBpZ25vcmVkPzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbHQ7SWxhbmdvJmd0OyBJbiB0aGVv cnksIGEgZnV0dXJlIHZlcnNpb24gbWF5IGNoYW5nZSB0aGUgYmVoYXZpb3Igb2YgYW55IG9mIHRo ZSBoZWFkZXIgZmllbGRzIGluY2x1ZGluZyB0aGUgcmVzZXJ2ZWQgYml0cy4gJm5ic3A7VGhlIGhl YWRlciBkZWZpbml0aW9uIGlzIGZvciB0aGlzIHZlcnNpb24NCiBvZiB0aGUgcHJvdG9jb2wuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5QbGVhc2Ugc2VlIGlmIHRo ZSBmb2xsb3dpbmcgdGV4dCB3b3VsZCBzYXRpc2Z5IHRoZSBpbnRlbnQgb2YgeW91ciBjb21tZW50 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOiMxRjQ5N0QiPuKAnFJlc2VydmVkIGZpZWxkIHdoaWNoIE1VU1QgYmUgemVybyBvbiB0cmFu c21pc3Npb24gYW5kDQo8L3NwYW4+PHU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6IzAwQjA1MCI+TVVTVCBiZTwv c3Bhbj48L3U+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6IzFGNDk3RCI+IGlnbm9yZWQgb24gcmVjZWlwdC7igJ08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T3IgbGV0IHVzIGtub3cgaWYgeW91 IHN0aWxsIHdhbnQgdG8gaGF2ZSB0aGlzIHF1YWxpZmllZCB3aXRoIOKAnGZvciB0aGlzIHZlcnNp b24gb2YgdGhlIHByb3RvY29s4oCdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZsdDsvJmd0OzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4tIFNlY3Rpb24gMy41LjE6IEkgd29uZGVyIGFib3V0IHRoZSBz aW11bHRhbmVvdXMgcmVxdWlyZW1lbnQgdGhhdCBvbmUgb3B0aW9uIG11c3Qgbm90IGFmZmVjdCB0 aGUgcGFyc2luZyBvciBpbnRlcnByZXRhdGlvbiBvZiBhbm90aGVyIG9wdGlvbiBidXQgdGhhdCB0 aGUgc2VxdWVuY2luZyAob3JkZXIpIG9mIG9wdGlvbnMgbWF5IGJlIHNpZ25pZmljYW50IC0gdGhl eSBzZWVtIHRvIGJlIGNvbnRyYWRpY3Rvcnkgc2luY2UNCiBpZiB0aGUgc2VxdWVuY2luZyAqaXMq IHNpZ25pZmljYW50LCB0aGVuIHNvbWUgb3B0aW9uIG11c3QgYmUgaW1wYWN0ZWQgYnkgYSBwcmV2 aW91cyBvbmUncyB2YWx1ZT8gRnJvbSBhIHNlY3VyaXR5IHBlcnNwZWN0aXZlLCBJIGFsc28gd29u ZGVyIGlmIHRoZXJlIGNvdWxkIGJlIHNlY3VyaXR5IGNvbnNlcXVlbmNlcyBvZiByZS1vcmRlcmlu ZyBvcHRpb25zIChhbmQgaG93IHRvIHRlbGwgaWYgc29tZW9uZSBkaWQgcmUtb3JkZXIgLSBzZWUg YmVsb3cpPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbHQ7SWxhbmdvJmd0 OyBZb3UgcmFpc2UgYSBnb29kIHBvaW50LiBUaGUgaW50ZW50IG9mIHRoaXMgc3RhdGVtZW50IGlz LCBwYXJzaW5nIGFuZCBpbnRlcnByZXRhdGlvbiBvZiBvcHRpb25zIHNob3VsZCBub3QgYmUgZGVw ZW5kZW50IG9uIG9uZSBhbm90aGVyLiBXZSBhcmUgZGlzY3Vzc2luZw0KIGFtb25nIHRoZSBhdXRo b3JzIHRvIHNlZSBob3cgd2UgY2FuIGluY2x1ZGUgYXBwcm9wcmlhdGUgY2xhcmlmeWluZyBzdGF0 ZW1lbnRzIHRvIGFkZHJlc3MgeW91ciBwb2ludC4gSSB3aWxsIHVwZGF0ZSB5b3Ugc2hvcnRseS48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+Jmx0Oy8mZ3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0g U2VjdGlvbiA2LjIsIHNob3VsZG4ndCBzdWNoIGFuIE9wdGlvbiBiZSBkZWZpbmVkIHRvIHJlZHVj ZSB0aGUgcmlzayBvZiB1bmRlci1zcGVjaWZpZWQgb3Igc3VicGFyIHNwZWNpZmljYXRpb25zIG9m IHN1Y2ggaW50ZWdyaXR5IG1lY2hhbmlzbXM/IE9yIGFsc28gZnJvbSBhbiBpbnRlcm9wIHBlcnNw ZWN0aXZlPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbHQ7SWxhbmdvJmd0 OyBVc2luZyBhIEdlbmV2ZSBvcHRpb24gZm9yIHRoZSBwdXJwb3NlIG9mIGRhdGEgaW50ZWdyaXR5 IGlzIG1vcmUgb2YgYW4gb3B0aW1pemF0aW9uLiBPdGhlcndpc2UgZGF0YSBpbnRlZ3JpdHkgY291 bGQgYmUgcHJvdmlkZWQgYnkgdXNpbmcgZXhpc3RpbmcgbWVjaGFuaXNtcw0KIGxpa2UgSVBzZWMg KGFzIHN0YXRlZCBpbiBzZWNvbmQgcGFyYWdyYXBoIG9mIDYuMikuIFdlIGluY2x1ZGVkIHRoZSBs YXN0IHBhcmFncmFwaCB0byBzaG93IG90aGVyIHBvc3NpYmlsaXRpZXMuIFdlIGNvdWxkIHJlbW92 ZSB0aGlzIHBhcmFncmFwaCBpZiBpdCBtYXkgY2F1c2UgYW55IGNvbmZ1c2lvbi48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPldlIHdvdWxkIGxpa2UgdG8ga2VlcCB0 aGUgR2VuZXZlIGJhc2Ugc3BlY2lmaWNhdGlvbiBpbmRlcGVuZGVudCBvZiBvcHRpb25zIHNwZWNp ZmljYXRpb25zLCBvcHRpb25zIGNvdWxkIGJlIGEgZGVmaW5lZCBpbiBhIGZ1dHVyZSBzdGFuZGFy ZHMgYWN0aW9uLiAmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jmx0Oy8mZ3Q7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0gTWFnbnVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_C5A274B25007804B800CB5B289727E3583D0AC78ORSMSX116amrcor_-- From nobody Wed Oct 31 10:56:49 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D91B130DC2; Wed, 31 Oct 2018 10:56:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Rifaat Shekh-Yusef To: Cc: dmarc@ietf.org, draft-ietf-dmarc-rfc7601bis.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154100859354.5360.795312478907721541@ietfa.amsl.com> Date: Wed, 31 Oct 2018 10:56:33 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-dmarc-rfc7601bis-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 17:56:34 -0000 Reviewer: Rifaat Shekh-Yusef Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Section 7.1. Forged Header Fields In addition to a recommended solution, this section has list a potential alternative solutions which the document then states that it is not appropriate for this document to specify which mechanism should be used. Since an implementer is not expected to do anything with this information, it might be more appropriate for this to be moved to an appendix at the end of document. Section 7.2. Misleading Results, First paragraph, last sentence "In particular, this issue is not resolved by forged header field removal discussed above." which seems to be in conflict with the following statement from section 5: "For simplicity and maximum security, a border MTA could remove all instances of this header field on mail crossing into its trust boundary." Section 7.2. Misleading Results, Second paragraph "Hence, MUAs and downstream filters must take some care with use of this header even after possibly malicious headers are scrubbed." How do you expect an MUA or downstream filter to act on "take some care"? Can you elaborate on that? 7.3. Header Field Position This section explains that headers fields are *not* guaranteed to be in a specific order. The section then states that "there will be *some* indication..." Since the order is not guaranteed, what do you expect an implementer to take away from this? 7.8. Intentionally Malformed Header Fields This is a general issue with any header. Is there anything specific to this header that an implementer should pay attention to? Regards, Rifaat From nobody Wed Oct 31 11:25:18 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F002112F1A5; Wed, 31 Oct 2018 11:25:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bJpI56l-a78; Wed, 31 Oct 2018 11:25:14 -0700 (PDT) Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 828AE12D4F2; Wed, 31 Oct 2018 11:25:10 -0700 (PDT) Received: by mail-lf1-x130.google.com with SMTP id d7-v6so12414969lfi.2; Wed, 31 Oct 2018 11:25:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=aC9u11AzXB3eFl4ieG8X0ka2VD/LPLJY94L4j90OSZM=; b=lMQGOZ8TrOBXQAP4F5BT4WDbXPbzMO0DKqa+r1Z1HvI6qYvSrJ5yGtWwkRZO0VUxy3 z5bVbzbEmewfxpaqTuVRK/ewmIaZbqDK6tiC1YqwcE2zXrNjG6QjridBXza0gjqEKNed PN92O53T5KcXt7u0BSyqIDgv4x0c+LuXOVvr9BmzctwvQbK6SpZ3l+ZsI7G5JBvGivcj ZbpWMvZVvFAJ41D4AEbzR6iMrHoYywyFDlBT39bMQFdYKeJnJce+EMrngrmerA9T5lRl EoCuxGL75S2yQMPUdTBpINm7a4lX4JSfejqc5oY994elUl4jtdd3m5oY3pC8Zas8jduK fFnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=aC9u11AzXB3eFl4ieG8X0ka2VD/LPLJY94L4j90OSZM=; b=poAHJFhIbR5FKpQ9WxaQdL2h3bHfcM2veflxsEwUh5tn2mSA9w62ELaJ+Axsk43bF4 /B47OM+YUx9qJierSwFvwEeNsxlQDcuU4wbc4iIhyhRZupSRniY6KcqBRoj0tfs5vwP0 pe8QY+C9wslEEoRNtD6jDMJWjtio4U+a0rMuErOryaQSHbZcDzPPwb4UJMtt1HfmVtln yp+oyMg6XVLHuRX/8kqEBEiso/Aj/DaRXbN8ruoMB3FtjWMNx1vkHQFmQRTLDtNfZmIS V7CGtG3BnkeHjcInmOcyRsEVuW8rzWkHkKumZRDhmN1mS216Ya0abxJozV4TQJnnBsT8 xnog== X-Gm-Message-State: AGRZ1gJsK4ITrGnZUbdbIpXmKtVDXdXRmUMywaLTiAR4omeC/J/OML+o +/frLafHHQi2Z0LInSyILM+If+tMJMLqVcztwTlnEAkg X-Google-Smtp-Source: AJdET5eBCFPvgq6c9Fs8n4k55UxVfZS9UyfTyTLzoC4hAt4iTNKTgMXkxrr7yxT8Dnkdd5dbhQ077FHd+0VkIVMaAOE= X-Received: by 2002:a19:9609:: with SMTP id y9mr2479383lfd.114.1541010308350; Wed, 31 Oct 2018 11:25:08 -0700 (PDT) MIME-Version: 1.0 From: Radia Perlman Date: Wed, 31 Oct 2018 11:24:57 -0700 Message-ID: To: secdir@ietf.org, The IESG , draft-ietf-perc-double.all@ietf.org Content-Type: multipart/alternative; boundary="00000000000006498a05798a6cdf" Archived-At: Subject: [secdir] Secdir review of draft-ietf-perc-double-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 18:25:17 -0000 --00000000000006498a05798a6cdf Content-Type: text/plain; charset="UTF-8" I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document specifies a syntax for doubly encrypting Secure Real Time Protocol (SRTP) packets so that the inner (media) content is encrypted with a key known only to the endpoints while some header content is encrypted with a separate key known by both the endpoints and network relay points called Media Distributors (with the outer encryption key (usually) changing on each hop). Below are details for consideration by the authors and other potential security reviewers. Substantive comments: Page 2 First paragraph: AES-GCM is the only specified cryptographic mode, but may not be the appropriate mode to use in distributing this content because there may be cases where we want to guarantee the integrity of the data end-to-end while allowing intermediaries to see the content. To support this case, it might make sense to allow the encryption and integrity protection keys to be separate so that an intermediary might be given the encryption key but not the integrity protection key. As noted in section 8, the inner payload ends up being encrypted twice (which is a substantial waste of resources). It might make more sense to include the inner encrypted payload as additional authenticated data in the outer invocation of AES-GCM to avoid that overhead. Page 5 section 3.1 Key Derivation: This section specifies how the end-to-end and hop-by-hop keys must be derived from a single "master key". But this could only be true at the source node and would imply the intermediaries are not allowed to see the master key and the destination would not need to see the master key (because by the time the destination receives the message the key used for the outer encryption would be different. I would expect that the inner and outer keys would be negotiated independently and there would be no master key from which they are all derived. Page 5 Section 4: If the set of RTP header fields is fixed and there is a fixed ordering to them, this is OK. But it wasn't obvious to me how to reflect in the OHB the difference between a new header field being added. And if fields are deleted (and therefore added to the OHB), it's not obvious in what order they should be reinserted by the ultimate recipient. Page 6 Section 5: The second paragraph says the extensions are truncated when computing the inner checksum while the third paragraph says there is information in the OHB to reconstruct the original extensions to allow verification of the inner checksum. Either of these two techniques could be used, but the source and destinations must use the same one. Or is this specifying that some combination be used? Page 9 paragraph 1 says: "A Media Distributor that decrypts, modifies, and re-encrypts packets in this way MUST use an independent key for each recipient, SHOULD use an independent salt for each recipient, ..." This represents substantial additional work for the Media Distributor. If it is important to use an independent key for each recipient, some justification should be noted. The likely one is that it prevents one recipient from undetectably modifying the copy of data sent to another recipient. This protection is not needed in all scenarios, and so perhaps should be optional. Editorial Comments / Typos: Page 2 Second paragraph: There may be a word missing. What is "the double"? Also, throughout the document the protocol is referred to as "double", which if intended should probably be listed in section 2. Page 2 Last line: If multiple Media Distributors are allowed, hop by hop also refers to the path between two Media Distributors. Page 8 Section 5.2 bullet 2: -> Page 11 section 7.1 paragraph 1 I suspect there is a word or two missing. "it MUST be encrypted the packet in repair mode" sounds like something Yoda would say. Page 13 section 9 last paragraph says: "If the MD doesn't modify any header fields, then an MD that supports AES-GCM could be unused unmodified." This should say something like ...could use the same key and relay packets unmodified. --00000000000006498a05798a6cdf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

I have reviewed this document as part of the security directorate's on= going effort to review all IETF documents being processed by the IESG.=C2= =A0 These comments were written primarily for the benefit of the security a= rea directors.=C2=A0 Document editors and WG chairs should treat these comm= ents just like any other last call comments.

This = document specifies a syntax for doubly encrypting Secure Real Time Protocol= (SRTP) packets so that the inner (media) content is encrypted with a key k= nown only to the endpoints while some header content is encrypted with a se= parate key known by both the endpoints and network relay points called Medi= a Distributors (with the outer encryption key (usually) changing on each ho= p).

Below are details for consideration by the aut= hors and other potential security reviewers.

Subst= antive comments:

Page 2 First paragraph:
AES-GCM is the only specified cryptographic mode, but may not be the appro= priate mode to use in distributing this content because there may be cases = where we want to guarantee the integrity of the data end-to-end while allow= ing intermediaries to see the content. To support this case, it might make = sense to allow the encryption and integrity protection keys to be separate = so that an intermediary might be given the encryption key but not the integ= rity protection key.

As noted in section 8, the in= ner payload ends up being encrypted twice (which is a substantial waste of = resources). It might make more sense to include the inner encrypted payload= as additional authenticated data in the outer invocation of AES-GCM to avo= id that overhead.

Page 5 section 3.1 Key Derivatio= n:
This section specifies how the end-to-end and hop-by-hop keys = must be derived from a single "master key". But this could only b= e true at the source node and would imply the intermediaries are not allowe= d to see the master key and the destination would not need to see the maste= r key (because by the time the destination receives the message the key use= d for the outer encryption would be different.

I w= ould expect that the inner and outer keys would be negotiated independently= and there would be no master key from which they are all derived.

Page 5 Section 4:
If the set of RTP header field= s is fixed and there is a fixed ordering to them, this is OK. But it wasn&#= 39;t obvious to me how to reflect in the OHB the difference between a new h= eader field being added. And if fields are deleted (and therefore added to = the OHB), it's not obvious in what order they should be reinserted by t= he ultimate recipient.

Page 6 Section 5:
The second paragraph says the extensions are truncated when computing the = inner checksum while the third paragraph says there is information in the O= HB to reconstruct the original extensions to allow verification of the inne= r checksum. Either of these two techniques could be used, but the source an= d destinations must use the same one. Or is this specifying that some combi= nation be used?

Page 9 paragraph 1 says:
"A Media Distributor that decrypts, modifies, and re-encrypts packets=
=C2=A0 =C2=A0in this way MUST use an independent key for each re= cipient, SHOULD
=C2=A0 =C2=A0use an independent salt for each rec= ipient, ..."
This represents substantial additional work for= the Media Distributor. If it is important to use an independent key for ea= ch recipient, some justification should be noted. The likely one is that it= prevents one recipient from undetectably modifying the copy of data sent t= o another recipient. This protection is not needed in all scenarios, and so= perhaps should be optional.


Editor= ial Comments / Typos:

Page 2 Second paragraph:
There may be a word missing. What is "the double"? Also, t= hroughout the document the=C2=A0 protocol is referred to as "double&qu= ot;, which if intended should probably be listed in section 2.=C2=A0
<= div>
Page 2 Last line:
If multiple Media Distributo= rs are allowed, hop by hop also refers to the path between two Media Distri= butors.

Page 8 Section 5.2 bullet 2:
<= ;fields are allowed> -> <fields that are allowed>
Page 11 section 7.1 paragraph 1
I suspect there is a = word or two missing. "it MUST be encrypted the packet in repair mode&q= uot; sounds like something Yoda would say.

Page 13= section 9 last paragraph says:
"If the MD doesn't modif= y any header fields,
=C2=A0 =C2=A0then an MD that supports AES-GC= M could be unused unmodified."
This should say something lik= e ...could use the same key and relay packets unmodified.

--00000000000006498a05798a6cdf-- From nobody Wed Oct 31 11:34:06 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EDD212F1A5; Wed, 31 Oct 2018 11:34:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9DEbKms8na3H; Wed, 31 Oct 2018 11:34:02 -0700 (PDT) Received: from mail-pl1-x630.google.com (mail-pl1-x630.google.com [IPv6:2607:f8b0:4864:20::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9A93128BCC; Wed, 31 Oct 2018 11:34:02 -0700 (PDT) Received: by mail-pl1-x630.google.com with SMTP id o19-v6so7666942pll.12; Wed, 31 Oct 2018 11:34:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:mime-version:to:from:subject:date:importance :thread-topic:in-reply-to:references; bh=Kg1oPeqG7P8UvkVVGmZmFDhCE5719MQ3q+7DrXX0SOo=; b=NBThFUIYUFK6G1o4eM3FVZTBsA6tiInMqr6rWiLsz/T+i2qUARM8yuvP6cruQq3NK9 FsFCJupVJi+5xI/xjORc2+AOMIOSFTAbMMEMPUNerPKtNX87wyFckzwWHBC6RkG96pYO 4G2HxkHWqjj2UDwQ/Xp+xVM7T2XrZLjUgUnwNEtJ29YDK4KEIYSAb++565v0pLCuV/YG YXmI2w1u65Jp0Rxzl5ZIxYRaG2+b889StOTccAse38Hw8BS4mc2jdi3xmcpK7SI1L2hK Rzb+lTu1A8xOjml/qzdtrkz+KU6jEnNp6Oy9qsZSuSA1jFYdwW7LUeJF81IGlyBzF2x7 MDFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:mime-version:to:from:subject:date :importance:thread-topic:in-reply-to:references; bh=Kg1oPeqG7P8UvkVVGmZmFDhCE5719MQ3q+7DrXX0SOo=; b=pZtwurV9VlgQdMmisswZDW4kbU5e0WqEfZ4wQZe3nwtX+be4b08nLE58FIUqoakOTr V0hemjjxjSZgpqXNjzcoGAJUlD6/X6yl8RgtAYnyrk28mGDw4qDdryE1dIG7X+OsF4kb MttA39qu695LlCEiBuZxkaTkENYI2QCJtXB09x7+mnKv1IlPWRhkTuXCraDRrnuxAEn+ fjgsqWlEoQTfzafofZxFSt4GBKY/c2CxBIFs4i9M0rfrZH/f1Z9a0qHDMgM0AZOYRYZf 17pz5y6COn5vhIihlhn+cRgClkW/6rwI9s3xRl4gdYqy8CppX+irzP7W1GkopEV8bsoV 0UzQ== X-Gm-Message-State: AGRZ1gI8+lyg23KvrvEFhUfHAohTNCuL7xOUja9w1NgygA1aQE0KANvZ qo7FMIvNbXr6V4vyYo0p10mRwtjN X-Google-Smtp-Source: AJdET5cyo0KIyOAmGrYeVX4Ti8iqXIG80YdpCfQSYS/WJc3SU5/AypFX5mrQ7Hl5Va7h+HZgL3N6Yw== X-Received: by 2002:a17:902:2d24:: with SMTP id o33-v6mr3124193plb.32.1541010842064; Wed, 31 Oct 2018 11:34:02 -0700 (PDT) Received: from ?IPv6:::ffff:10.69.41.130? ([167.220.63.2]) by smtp.gmail.com with ESMTPSA id r124-v6sm39621286pfr.151.2018.10.31.11.34.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 31 Oct 2018 11:34:01 -0700 (PDT) Message-ID: <5bd9f599.1c69fb81.4fed7.d7cd@mx.google.com> MIME-Version: 1.0 To: "Ganga, Ilango S" , "secdir@ietf.org" , "draft-ietf-nvo3-geneve@ietf.org" From: =?utf-8?Q?Magnus_Nystr=C3=B6m?= Date: Wed, 31 Oct 2018 11:34:01 -0700 Importance: normal X-Priority: 3 Thread-Topic: Secdir review (early review) of draft-ietf-nvo3-geneve In-Reply-To: References: Content-Type: multipart/alternative; boundary="_33233C1B-BE0D-4EF2-9ADA-8BCD22F66AEB_" Archived-At: Subject: Re: [secdir] Secdir review (early review) of draft-ietf-nvo3-geneve X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 18:34:05 -0000 --_33233C1B-BE0D-4EF2-9ADA-8BCD22F66AEB_ Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Hi Ilango, For 3.4, I think this may be sufficient.=20 For 6.2, I will defer to the IETF director/telechat discussion that will oc= cur at some point for this draft. If the intent is interoperability and rob= ustness of such an option, then I would recommend it to be specified in the= IETF, but I can also see how you would prefer that such specification work= occurs outside this particular draft =E2=80=93 which should be doable. Per= haps staying silent on the option alternative and just recommend leveraging= layer-provided infrastructure such as ipsec may be best for now? I'll await your suggested updated language for 3.5.1. Thanks, Sent from my Windows 10 phone From: Ganga, Ilango S Sent: Tuesday, October 30, 2018 18:12 To: Magnus Nystr=C3=B6m; secdir@ietf.org; draft-ietf-nvo3-geneve@ietf.org Subject: RE: Secdir review (early review) of draft-ietf-nvo3-geneve Hi Magnus, Thanks for your review and feedback. Please see inline for my responses. Regards, Ilango From: Magnus Nystr=C3=B6m [mailto:magnusn@gmail.com]=20 Sent: Tuesday, October 23, 2018 9:01 PM To: secdir@ietf.org; draft-ietf-nvo3-geneve@ietf.org Subject: Secdir review (early review) of draft-ietf-nvo3-geneve I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors.=C2=A0 Document editors and WG chairs should treat these comments just like any other last call comments. This document describes "Geneve," a protocol for GEneric NEtwork Virtualiza= tion Encapsulation. The document is written in a clear manner and with a th= orough Security Considerations section. I have just a few questions/comment= s: - Section 3.4: The "MUST ignore" for the reserved bits should presumably st= ate "SHALL be ignored for this version of the Geneve protocol." - as I imag= ine that in a future version, these bits may not be ignored? In theory, a future version may change the behavior of any of the = header fields including the reserved bits. =C2=A0The header definition is f= or this version of the protocol. Please see if the following text would satisfy the intent of your comment. =E2=80=9CReserved field which MUST be zero on transmission and MUST be igno= red on receipt.=E2=80=9D Or let us know if you still want to have this qualified with =E2=80=9Cfor t= his version of the protocol=E2=80=9D - Section 3.5.1: I wonder about the simultaneous requirement that one optio= n must not affect the parsing or interpretation of another option but that = the sequencing (order) of options may be significant - they seem to be cont= radictory since if the sequencing *is* significant, then some option must b= e impacted by a previous one's value? From a security perspective, I also w= onder if there could be security consequences of re-ordering options (and h= ow to tell if someone did re-order - see below)? You raise a good point. The intent of this statement is, parsing a= nd interpretation of options should not be dependent on one another. We are= discussing among the authors to see how we can include appropriate clarify= ing statements to address your point. I will update you shortly. - Section 6.2, shouldn't such an Option be defined to reduce the risk of un= der-specified or subpar specifications of such integrity mechanisms? Or als= o from an interop perspective? Using a Geneve option for the purpose of data integrity is more of= an optimization. Otherwise data integrity could be provided by using exist= ing mechanisms like IPsec (as stated in second paragraph of 6.2). We includ= ed the last paragraph to show other possibilities. We could remove this par= agraph if it may cause any confusion. We would like to keep the Geneve base specification independent of options = specifications, options could be a defined in a future standards action. = =C2=A0 Thanks. -- Magnus --_33233C1B-BE0D-4EF2-9ADA-8BCD22F66AEB_ Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="utf-8"

Hi Ilango,

F= or 3.4, I think this may be sufficient.

 = ;

For 6.2, I will defer to the IETF director/= telechat discussion that will occur at some point for this draft. If the in= tent is interoperability and robustness of such an option, then I would rec= ommend it to be specified in the IETF, but I can also see how you would pre= fer that such specification work occurs outside this particular draft =E2= =80=93 which should be doable. Perhaps staying silent on the option alterna= tive and just recommend leveraging layer-provided infrastructure such as ip= sec may be best for now?

 

I'll await your suggested updated language for 3.5.1.

 

Thanks,

 

Sent from my Wi= ndows 10 phone

 

 

Hi Magnus,

 

Thanks for your review and feedback. Please see inline for m= y responses.

 

Regards,

Ilango

 

 

Fr= om: Magnus Nystr=C3=B6m [mailto:magnusn@gmail.com]
Sent: Tue= sday, October 23, 2018 9:01 PM
To: secdir@ietf.org; draft-ietf-nv= o3-geneve@ietf.org
Subject: Secdir review (early review) of draft= -ietf-nvo3-geneve

 

=

I have reviewed this document as part of the security d= irectorate's
ongoing effort to review all IETF documents being processed= by the
IESG. These comments were written primarily for the benefit of t= he
security area directors.  Document editors and WG chairs should = treat
these comments just like any other last call comments.<= /span>

 

&= nbsp;

- Section 3.4: The "MU= ST ignore" for the reserved bits should presumably state "SHALL b= e ignored for this version of the Geneve protocol." - as I imagine tha= t in a future version, these bits may not be ignored?

=

 =

<Ilango> In th= eory, a future version may change the behavior of any of the header fields = including the reserved bits.  The header definition is for this versio= n of the protocol.

 

Please see if the following text would satisfy the inte= nt of your comment.

=E2=80=9CReserved field which = MUST be zero on transmission and MUST be ignored on receipt.=E2=80=9D

<= p class=3DMsoNormal> 

Or let us know if you still want to have this qualified with =E2=80=9C= for this version of the protocol=E2=80=9D

</>

 

<= /div>

- Section 3.5.1: I wonder about the simultaneous r= equirement that one option must not affect the parsing or interpretation of= another option but that the sequencing (order) of options may be significa= nt - they seem to be contradictory since if the sequencing *is* significant= , then some option must be impacted by a previous one's value? From a secur= ity perspective, I also wonder if there could be security consequences of r= e-ordering options (and how to tell if someone did re-order - see below)?

 

= <Ilango> You raise a good point. The intent of this statement is, par= sing and interpretation of options should not be dependent on one another. = We are discussing among the authors to see how we can include appropriate c= larifying statements to address your point. I will update you shortly.=

</&g= t;

=  

- Section 6.2, should= n't such an Option be defined to reduce the risk of under-specified or subp= ar specifications of such integrity mechanisms? Or also from an interop per= spective?

 

<Ilango> Using a Geneve option for the purpose of data int= egrity is more of an optimization. Otherwise data integrity could be provid= ed by using existing mechanisms like IPsec (as stated in second paragraph o= f 6.2). We included the last paragraph to show other possibilities. We coul= d remove this paragraph if it may cause any confusion.

 

We would like to ke= ep the Geneve base specification independent of options specifications, opt= ions could be a defined in a future standards action.  

</>

 = ;

 

Thanks.

-- Magnus

 <= /p>

= --_33233C1B-BE0D-4EF2-9ADA-8BCD22F66AEB_-- From nobody Wed Oct 31 12:30:36 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FC3A130DDA for ; Wed, 31 Oct 2018 12:30:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G1YqVYxas59R for ; Wed, 31 Oct 2018 12:30:21 -0700 (PDT) Received: from mail-ot1-x334.google.com (mail-ot1-x334.google.com [IPv6:2607:f8b0:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FAB112F1A5 for ; Wed, 31 Oct 2018 12:30:17 -0700 (PDT) Received: by mail-ot1-x334.google.com with SMTP id j3so9850796otl.9 for ; Wed, 31 Oct 2018 12:30:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bsZmzGuhs3125hBdoJ2TSWcEBfZiSI5Jb2aWFkYRzgU=; b=0VaOtkqFnpSWD9MaE2ocpmdZy7iED9v/lpYRIbRxpahq6FfpNzRhoNCuW4iPWJDIs9 Jv09l+N1CS01C7NWWS4X26wwh/7dYfIZrmX6LqTASk5te0YjNG6luQXAg2UZTjkchgIi CGz2OmkQNoA8zdEgfYYmJSSvfFmpwUXjU+jc0Z4odsoFXuy87F/tkejFqJofZqbixDuq VaSmxAVaIncfAp0yxgEv1PU4AkWYTPv4opir5My0UjCVzlm5OT4rsS0WRCxs5tXnZQcQ 4xNTWjkX6n5GgKNGULKHV2SGDw9fPlPgFRHHfCwWS/b3WE9g3XH78TmChEi9t9GqWco2 6X+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bsZmzGuhs3125hBdoJ2TSWcEBfZiSI5Jb2aWFkYRzgU=; b=DBeT1hOWGlDK0f3fn/Zia11whACGez/KmNL+hOeBYpoYwMTfYw746wuFZBHivW5FgJ yi/2R9qXyEVpjYCAtSYvJkKq+rx+SXDMtW717G8yChOqFJC7YcE76Bu50eOrLWSiUIsA UcOsb867sYxfN9NFMw1TVgfXqGXM5AvfPsb6GmGDKztC8oBaFjuZHi5pkSHT3AuO3AyK SxelMKCD0fnbKtIWAQQtTx33geRlouyyZ5TWxTiCaISl/ZH9DymDD8pQh9g3FF2+RGwP KeXTlr/913Ueuam2pkUyirl/Ut82hwFSa9z2oeyW/SgoEkk0JGdpUmowVBv6rdp/GwQJ HXbw== X-Gm-Message-State: AGRZ1gLdmMaoadvxW71bAvBATQTsyY8kIt+Z7iW+CfpqfSfybPIngXBy sbipX16rv8U9hNPlVPuz/Ki8SfPnzX/z3KfzzGT80g== X-Google-Smtp-Source: AJdET5d4YyZc+0VwA6lHm1TOF9f+VUOufH5vNuKWAG9IuBCBOsjJw8bB/kReH0gNle9CGi/YzThPPszirodA7J35Ans= X-Received: by 2002:a9d:3e50:: with SMTP id h16mr2525784otg.116.1541014216377; Wed, 31 Oct 2018 12:30:16 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Wed, 31 Oct 2018 15:29:58 -0400 Message-ID: To: radiaperlman@gmail.com Cc: secdir , The IESG , draft-ietf-perc-double.all@ietf.org Content-Type: multipart/alternative; boundary="000000000000f61b6405798b5424" Archived-At: Subject: Re: [secdir] Secdir review of draft-ietf-perc-double-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 19:30:24 -0000 --000000000000f61b6405798b5424 Content-Type: text/plain; charset="UTF-8" Hi Radia, Thanks for the review. Responses to the substantive comments inline. Will take a look at the editorial ones in a bit. On Wed, Oct 31, 2018 at 2:25 PM Radia Perlman wrote: > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments just > like any other last call comments. > > This document specifies a syntax for doubly encrypting Secure Real Time > Protocol (SRTP) packets so that the inner (media) content is encrypted with > a key known only to the endpoints while some header content is encrypted > with a separate key known by both the endpoints and network relay points > called Media Distributors (with the outer encryption key (usually) changing > on each hop). > > Below are details for consideration by the authors and other potential > security reviewers. > > Substantive comments: > > Page 2 First paragraph: > AES-GCM is the only specified cryptographic mode, but may not be the > appropriate mode to use in distributing this content because there may be > cases where we want to guarantee the integrity of the data end-to-end while > allowing intermediaries to see the content. To support this case, it might > make sense to allow the encryption and integrity protection keys to be > separate so that an intermediary might be given the encryption key but not > the integrity protection key. > I think you mean we would give the intermediary the integrity key, not the encryption key :) Since we want to enable the intermediary to modify things, but not read the content. Even that wouldn't work, however, because we do want the payload content to be integrity-protected end-to-end. So you need to double up at least on the integrity check. > As noted in section 8, the inner payload ends up being encrypted twice > (which is a substantial waste of resources). It might make more sense to > include the inner encrypted payload as additional authenticated data in the > outer invocation of AES-GCM to avoid that overhead. > You're correct that the second encryption is duplicative, but in the testing I've done, it is not a substantial waste of resources. As noted above, you need two integrity checks anyway, so if we're not going to rely on multiple primitives, that means multiple invocations of AES-GCM. And in practice, an "integrity only" invocation of GCM, with everything in the AAD, is not noticeably faster or slower than a normal invocation that also encrypts. Another benefit of the current scheme is that having the outer transform be identical to the base AES-GCM transform makes implementation easier for intermediaries. They don't have to change their SRTP stacks, they just have to adapt packet processing a little bit to add the OHB logic. So yes, in principle, it's a little duplicative, but in practice, the duplication doesn't matter and the symmetry you get from it is advantageous. > Page 5 section 3.1 Key Derivation: > This section specifies how the end-to-end and hop-by-hop keys must be > derived from a single "master key". But this could only be true at the > source node and would imply the intermediaries are not allowed to see the > master key and the destination would not need to see the master key > (because by the time the destination receives the message the key used for > the outer encryption would be different. > > I would expect that the inner and outer keys would be negotiated > independently and there would be no master key from which they are all > derived. > The key derivation here is inherent to SRTP; it would be a much more significant change to SRTP processing logic to specify keys directly, rather than adapting the KDF. The KDF adaptation is needed so that you can give the intermediary the HBH half of the master key (using something like draft-ietf-perc-dtls-tunnel ), and it'll end up KDF'ing that to the right keys / IVs for the HBH transform. > Page 5 Section 4: > If the set of RTP header fields is fixed and there is a fixed ordering to > them, this is OK. But it wasn't obvious to me how to reflect in the OHB the > difference between a new header field being added. And if fields are > deleted (and therefore added to the OHB), it's not obvious in what order > they should be reinserted by the ultimate recipient. > The set of RTP header fields that get E2E protection is fixed, with a fixed bit layout. There is a variable extension portion at the end, but that receives no E2E protection, so it's not included in the OHB. > Page 6 Section 5: > The second paragraph says the extensions are truncated when computing the > inner checksum while the third paragraph says there is information in the > OHB to reconstruct the original extensions to allow verification of the > inner checksum. Either of these two techniques could be used, but the > source and destinations must use the same one. Or is this specifying that > some combination be used? > Where are you seeing a claim that the OHB can help with extensions? It's not impossible that it's there; earlier versions had this feature, but it was removed to simplify things. If the text you have in mind is "OHB that expresses any changes made between the inner and outer transforms", then I think it's just approximation for brevity. The exact changes that the OHB can express are defined elsewhere. > Page 9 paragraph 1 says: > "A Media Distributor that decrypts, modifies, and re-encrypts packets > in this way MUST use an independent key for each recipient, SHOULD > use an independent salt for each recipient, ..." > This represents substantial additional work for the Media Distributor. If > it is important to use an independent key for each recipient, some > justification should be noted. The likely one is that it prevents one > recipient from undetectably modifying the copy of data sent to another > recipient. This protection is not needed in all scenarios, and so perhaps > should be optional. > The hard line here is that whenever the plaintext changes (e.g., the PT header gets sent to a different value), then a different (key, IV) pair needs to get used. Otherwise you have nonce reuse. The requirement as written, however, is probably a bit too strong. It presumes that each recipient is getting a different packet, which is very common in conferencing scenarios, but not universal. I'll think about how to clarify. Thanks, --Richard > > > Editorial Comments / Typos: > > Page 2 Second paragraph: > There may be a word missing. What is "the double"? Also, throughout the > document the protocol is referred to as "double", which if intended should > probably be listed in section 2. > > Page 2 Last line: > If multiple Media Distributors are allowed, hop by hop also refers to the > path between two Media Distributors. > > Page 8 Section 5.2 bullet 2: > -> > > Page 11 section 7.1 paragraph 1 > I suspect there is a word or two missing. "it MUST be encrypted the packet > in repair mode" sounds like something Yoda would say. > > Page 13 section 9 last paragraph says: > "If the MD doesn't modify any header fields, > then an MD that supports AES-GCM could be unused unmodified." > This should say something like ...could use the same key and relay packets > unmodified. > > --000000000000f61b6405798b5424 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Radia,

T= hanks for the review.=C2=A0 Responses to the substantive comments inline.= =C2=A0 Will take a look at the editorial ones in a bit.

<= /div>

On Wed, Oct 31, 2= 018 at 2:25 PM Radia Perlman <= radiaperlman@gmail.com> wrote:

I have reviewed this document as part of the securit= y directorate's ongoing effort to review all IETF documents being proce= ssed by the IESG.=C2=A0 These comments were written primarily for the benef= it of the security area directors.=C2=A0 Document editors and WG chairs sho= uld treat these comments just like any other last call comments.
=
This document specifies a syntax for doubly encrypting Secur= e Real Time Protocol (SRTP) packets so that the inner (media) content is en= crypted with a key known only to the endpoints while some header content is= encrypted with a separate key known by both the endpoints and network rela= y points called Media Distributors (with the outer encryption key (usually)= changing on each hop).

Below are details for cons= ideration by the authors and other potential security reviewers.
=
Substantive comments:

Page 2 First = paragraph:
AES-GCM is the only specified cryptographic mode, but = may not be the appropriate mode to use in distributing this content because= there may be cases where we want to guarantee the integrity of the data en= d-to-end while allowing intermediaries to see the content. To support this = case, it might make sense to allow the encryption and integrity protection = keys to be separate so that an intermediary might be given the encryption k= ey but not the integrity protection key.

I think you mean we would give the intermediary= the integrity key, not the encryption key :)=C2=A0 Since we want to enable= the intermediary to modify things, but not read the content.=C2=A0 Even th= at wouldn't work, however, because we do want the payload content to be= integrity-protected end-to-end.=C2=A0 So you need to double up at least on= the integrity check.

=C2=A0
As noted in section 8, the inner payload ends up being = encrypted twice (which is a substantial waste of resources). It might make = more sense to include the inner encrypted payload as additional authenticat= ed data in the outer invocation of AES-GCM to avoid that overhead.

You're correct th= at the second encryption is duplicative, but in the testing I've done, = it is not a substantial waste of resources.=C2=A0 As noted above, you need = two integrity checks anyway, so if we're not going to rely on multiple = primitives, that means multiple invocations of AES-GCM.=C2=A0 And in practi= ce, an "integrity only" invocation of GCM, with everything in the= AAD, is not noticeably faster or slower than a normal invocation that also= encrypts.

Another benefit of the current scheme i= s that having the outer transform be identical to the base AES-GCM transfor= m makes implementation easier for intermediaries.=C2=A0 They don't have= to change their SRTP stacks, they just have to adapt packet processing a l= ittle bit to add the OHB logic.

So yes, in pri= nciple, it's a little duplicative, but in practice, the duplication doe= sn't matter and the symmetry you get from it is advantageous.

=C2=A0
Page 5 sect= ion 3.1 Key Derivation:
This section specifies how the end-to-end= and hop-by-hop keys must be derived from a single "master key". = But this could only be true at the source node and would imply the intermed= iaries are not allowed to see the master key and the destination would not = need to see the master key (because by the time the destination receives th= e message the key used for the outer encryption would be different.

I would expect that the inner and outer keys would be neg= otiated independently and there would be no master key from which they are = all derived.

= The key derivation here is inherent to SRTP; it would be a much more signif= icant change to SRTP processing logic to specify keys directly, rather than= adapting the KDF.

The KDF adaptation is needed so= that you can give the intermediary the HBH half of the master key (using s= omething like draft-ietf-perc-dtls-tunnel), and it'll end up KDF'i= ng that to the right keys / IVs for the HBH transform.

=C2=A0
Page 5 Section 4:<= /div>
If the set of RTP header fields is fixed and there is a fixed ord= ering to them, this is OK. But it wasn't obvious to me how to reflect i= n the OHB the difference between a new header field being added. And if fie= lds are deleted (and therefore added to the OHB), it's not obvious in w= hat order they should be reinserted by the ultimate recipient.
<= /div>

The set of RTP header fie= lds that get E2E protection is fixed, with a fixed bit layout.=C2=A0 There = is a variable extension portion at the end, but that receives no E2E protec= tion, so it's not included in the OHB.

=C2= =A0
Page 6 Section 5:
Th= e second paragraph says the extensions are truncated when computing the inn= er checksum while the third paragraph says there is information in the OHB = to reconstruct the original extensions to allow verification of the inner c= hecksum. Either of these two techniques could be used, but the source and d= estinations must use the same one. Or is this specifying that some combinat= ion be used?

= Where are you seeing a claim that the OHB can help with extensions?=C2=A0 I= t's not impossible that it's there; earlier versions had this featu= re, but it was removed to simplify things.

If the = text you have in mind is "OHB that expresses any changes made between = the inner and outer transforms", then I think it's just approximat= ion for brevity.=C2=A0 The exact changes that the OHB can express are defin= ed elsewhere.

=C2=A0
Page 9 paragraph 1 says:
"A Media Distributor th= at decrypts, modifies, and re-encrypts packets
=C2=A0 =C2=A0in th= is way MUST use an independent key for each recipient, SHOULD
=C2= =A0 =C2=A0use an independent salt for each recipient, ..."
T= his represents substantial additional work for the Media Distributor. If it= is important to use an independent key for each recipient, some justificat= ion should be noted. The likely one is that it prevents one recipient from = undetectably modifying the copy of data sent to another recipient. This pro= tection is not needed in all scenarios, and so perhaps should be optional.<= /div>

The hard line= here is that whenever the plaintext changes (e.g., the PT header gets sent= to a different value), then a different (key, IV) pair needs to get used.= =C2=A0 Otherwise you have nonce reuse.=C2=A0

= The requirement as written, however, is probably a bit too strong.=C2=A0 It= presumes that each recipient is getting a different packet, which is very = common in conferencing scenarios, but not universal.=C2=A0 I'll think a= bout how to clarify.

Thanks,
--Richa= rd
=C2=A0

=

Editorial Comments / Typos:

Pa= ge 2 Second paragraph:
There may be a word missing. What is "= ;the double"? Also, throughout the document the=C2=A0 protocol is refe= rred to as "double", which if intended should probably be listed = in section 2.=C2=A0

Page 2 Last line:
If= multiple Media Distributors are allowed, hop by hop also refers to the pat= h between two Media Distributors.

Page 8 Section 5= .2 bullet 2:
<fields are allowed> -> <fields that are= allowed>

Page 11 section 7.1 paragraph 1
=
I suspect there is a word or two missing. "it MUST be encrypted t= he packet in repair mode" sounds like something Yoda would say.
<= div>
Page 13 section 9 last paragraph says:
"I= f the MD doesn't modify any header fields,
=C2=A0 =C2=A0then = an MD that supports AES-GCM could be unused unmodified."
Thi= s should say something like ...could use the same key and relay packets unm= odified.

--000000000000f61b6405798b5424-- From nobody Wed Oct 31 13:39:07 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 510B6130D7A; Wed, 31 Oct 2018 13:38:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sTIAsP1Ul_zq; Wed, 31 Oct 2018 13:38:55 -0700 (PDT) Received: from out01.mta.xmission.com (out01.mta.xmission.com [166.70.13.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91C08130DC2; Wed, 31 Oct 2018 13:38:55 -0700 (PDT) Received: from in01.mta.xmission.com ([166.70.13.51]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1gHxGQ-0003Zc-F3; Wed, 31 Oct 2018 14:38:54 -0600 Received: from [72.250.219.84] (helo=rumpleteazer.rhmr.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1gHxGP-000112-MO; Wed, 31 Oct 2018 14:38:54 -0600 Received: from rumpleteazer.rhmr.com (localhost [127.0.0.1]) by rumpleteazer.rhmr.com (8.14.4/8.14.4/Debian-4.1ubuntu1) with ESMTP id w9VKcZG7013490; Wed, 31 Oct 2018 14:38:35 -0600 Received: (from hilarie@localhost) by rumpleteazer.rhmr.com (8.14.4/8.14.4/Submit) id w9VKcZmV013489; Wed, 31 Oct 2018 14:38:35 -0600 Date: Wed, 31 Oct 2018 14:38:35 -0600 Message-Id: <201810312038.w9VKcZmV013489@rumpleteazer.rhmr.com> From: "Hilarie Orman" Reply-To: "Hilarie Orman" To: iesg@ietf.org, secdir@ietf.org, draft-ietf-perc-srtp-ekt-diet.all@ietf.org X-XM-SPF: eid=1gHxGP-000112-MO; ; ; mid=<201810312038.w9VKcZmV013489@rumpleteazer.rhmr.com>; ; ; hst=in01.mta.xmission.com; ; ; ip=72.250.219.84; ; ; frm=hilarie@purplestreak.com; ; ; spf=none X-XM-AID: U2FsdGVkX183ama5UV+jxaMaxUNSBPfJ X-SA-Exim-Connect-IP: 72.250.219.84 X-SA-Exim-Mail-From: hilarie@purplestreak.com X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ****;iesg@ietf.org, secdir@ietf.org, draft-ietf-perc-srtp-ekt-diet.all@ietf.org X-Spam-Relay-Country: X-Spam-Timing: total 321 ms - load_scoreonly_sql: 0.04 (0.0%), signal_user_changed: 10 (3.0%), b_tie_ro: 4.5 (1.4%), parse: 0.66 (0.2%), extract_message_metadata: 3.6 (1.1%), get_uri_detail_list: 1.40 (0.4%), tests_pri_-1000: 2.6 (0.8%), tests_pri_-950: 1.20 (0.4%), tests_pri_-900: 1.02 (0.3%), tests_pri_-90: 27 (8.4%), check_bayes: 26 (8.0%), b_tokenize: 6 (1.8%), b_tok_get_all: 6 (1.9%), b_comp_prob: 2.4 (0.7%), b_tok_touch_all: 9 (2.9%), b_finish: 0.64 (0.2%), tests_pri_0: 262 (81.7%), check_dkim_signature: 0.47 (0.1%), check_dkim_adsp: 26 (8.2%), tests_pri_10: 3.1 (1.0%), tests_pri_500: 8 (2.5%), rewrite_mail: 0.00 (0.0%) X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Archived-At: Subject: [secdir] Security review of draft-ietf-perc-srtp-ekt-diet-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2018 20:38:58 -0000 Security review of Encrypted Key Transport for DTLS and Secure RTP draft-ietf-perc-srtp-ekt-diet-08 Do not be alarmed. I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The draft defines a way by which each sender in a multi-participant session can communicate its encrypting key (called a "master key") to the other participants. In this scheme, all participants learn a key encrypting key (EKTKey) that is used to protect sender's encrypting keys during transit. "This specification also defines a way to send the encrypted SRTP master key (with the EKTKey) along with the SRTP packet ... Endpoints that receive this and know the EKTKey can use the EKTKey to decrypt the SRTP master key which can then be used to decrypt the SRTP packet." I think that the paragraph above would be clearer if "(with the EKTkey)" were changed to "(encrypted with the EKTkey)". I do not understand the security model. If all participants know the EKTkey, then why do senders need to separately select their own individual keys? Cannot all participants use something derived from the EKTkey? Is this a legacy thing? Section 4.4 states that "EKT uses an authenticated cipher to encrypt and authenticate the EKTPlaintext." Also section 6 (security considerations) states: The EKT Cipher includes its own authentication/integrity check. For an attacker to successfully forge a FullEKTField, it would need to defeat the authentication mechanisms of the EKT Cipher authentication mechanism. Section 4.4.1 state "The default EKT Cipher is the Advanced Encryption Standard (AES) Key Wrap with Padding [RFC5649] algorithm." RFC5649 does not purport to define an authenticated cipher. I am not sure what properties of RFC5649 are the ones that are considered important, so I cannot recommend appropriate wording, though I suspect that "integrity" is the right word, not "authentication". I have one concern about the requirement that all senders change their keys when the EKTKey changes. Suppose a malicious participant manages to create a replay attack that sends a EKTkey message with a key that was previously used, perhaps even the same one that is currently used. This would force all participants to change their keys, perhaps at a very high rate, and this might lead to denial of service. Participants might be advised to ignore EKTkey messages that repeat the current EKTkey. Hilarie From nobody Wed Oct 31 17:00:27 2018 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C18A124BE5 for ; Wed, 31 Oct 2018 17:00:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen To: X-Test-IDTracker: no X-IETF-IDTracker: 6.87.2 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu Message-ID: <154103042510.5483.16974536085913228990.idtracker@ietfa.amsl.com> Date: Wed, 31 Oct 2018 17:00:25 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Nov 2018 00:00:25 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2018-11-21 Reviewer LC end Draft Kathleen Moriarty 2018-10-19 draft-ietf-ntp-mac-05 Melinda Shore 2018-11-06 draft-ietf-dmarc-arc-protocol-18 Samuel Weiler 2018-11-13 draft-ietf-dnsop-dns-capture-format-08 Last calls: Reviewer LC end Draft John Bradley 2018-09-25 draft-ietf-dnsop-attrleaf-fix-05 John Bradley 2018-06-18 draft-ietf-bfd-multipoint-active-tail-09 Daniel Gillmor 2018-06-25 draft-ietf-dnsop-session-signal-18 Daniel Gillmor 2018-03-19 draft-gutmann-scep-10 Phillip Hallam-Baker 2018-10-11 draft-ietf-softwire-yang-11 Steve Hanna 2018-10-10 draft-ietf-ospf-lls-interface-id-08 Steve Hanna 2018-10-03 draft-ietf-detnet-problem-statement-07 Matthew Miller 2018-10-12 draft-ietf-httpbis-rand-access-live-03 Russ Mundy 2017-09-14 draft-spinosa-urn-lex-13 Magnus Nystrom 2018-11-13 draft-op3ft-leaptofrogans-uri-scheme-03 Vincent Roca 2018-10-29 draft-ietf-pce-gmpls-pcep-extensions-12 Joseph Salowey 2018-11-20 draft-wilde-sunset-header-07 Stefan Santesson 2018-11-20 draft-wilde-service-link-rel-06 Yaron Sheffer 2018-11-16 draft-ietf-ospf-ospfv3-segment-routing-extensions-16 Takeshi Takahashi 2018-11-02 draft-ietf-stir-passport-shaken-04 Samuel Weiler 2018-05-21 draft-ietf-bfd-multipoint-18 Brian Weis 2018-11-09 draft-ietf-dots-requirements-16 Paul Wouters 2018-09-06 draft-ietf-dnsop-kskroll-sentinel-17 Taylor Yu 2018-10-09 draft-murchison-tzdist-tzif-15 Dacheng Zhang 2018-10-05 draft-ietf-iasa2-trust-update-02 Early review requests: Reviewer Due Draft Daniel Franke 2018-01-31 draft-ietf-intarea-provisioning-domains-00 Robert Sparks 2018-11-25 draft-ietf-babel-hmac-00 Sean Turner 2018-11-25 draft-ietf-babel-dtls-01 Carl Wallace 2018-11-09 draft-ietf-idr-bgpls-segment-routing-epe-17 Next in the reviewer rotation: Christopher Wood Paul Wouters Liang Xia Taylor Yu Dacheng Zhang Derek Atkins John Bradley Shaun Cooley Roman Danyliw Alan DeKok From nobody Wed Oct 31 18:45:07 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42017130DF3; Wed, 31 Oct 2018 18:44:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nii8WodPbqjM; Wed, 31 Oct 2018 18:44:55 -0700 (PDT) Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85BF2130DDE; Wed, 31 Oct 2018 18:44:55 -0700 (PDT) Received: by mail-lf1-x135.google.com with SMTP id n3-v6so13114048lfe.7; Wed, 31 Oct 2018 18:44:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SrYCpfA7hulVPIHKm44A36t4DC1yz3FQ0n46FVum4vY=; b=LoUObtb+sqNJrjgs7g4rLadHT1VOKjal1USnZdja6G5BzaKqWOuWgDuoNC4DV7ftIB x+Ky/JaY+2Vr4sTAcAYdEMeh8ff0C3u5TgmGeS7oK2EJNeuaaPRGUkqGdVUN+sRVUJoS 5u7FXbce0WFjYnAovyrH9mzob8z06ZLBotyeiSG31VztmUYmepmUZJpcLIVBO4Z19xkn qFe7Mknp+pBC3oid6vSBdX+S/wT65xwqgkiy550i/k8dlSDKANuq9NKTmSt2PiLsun/Y zU5/sswdTmaGxDP6qF04jhdsbzzdB8PuIOPbJ2MATGE1R9iWbiGezItg9Y3TIiZw9dn2 C58Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SrYCpfA7hulVPIHKm44A36t4DC1yz3FQ0n46FVum4vY=; b=LvT0hZ7EVTQy/RM6Jm5OkEtrXwGRsabegpITHOfDBE6uDCeWQ5OYhRoJ7QK+4ZMBb6 DwXUlyczPbNlGOQ7kNii7ZTaPmhgfd7wHyhebpeAso0+5W85JY3TUAWDi9dImqvL977m U4XLISL/9o+vw8NmH2izuGU1qPM/lcA8QgBeJch+ave/1VvdH3N+o5L4DWrXsKnv3gDB 5OQgR4wK7IcA9SjYuZdC+/kDcP9hBsuhOadcr2Z1tejQBt8odpKxtwR9rtjym21g+ev2 dXCTSKYdYP7rLHIvfNjjZN/VL+0QYmvejVU3dtA+cUEsgiTl1lXONRSE8LLuX0zTzQoi X/QA== X-Gm-Message-State: AGRZ1gJTgaKVisKFpgUf5uNVWuaIScXfgBpfDZYnDP7S/IOr/xq+Cdgh UiNq20+5v0q38fRJze4JjfIge2dOhiHEmwMEre8= X-Google-Smtp-Source: AJdET5cslpF414McgwFpNn5m0IiggGs0Wdkj0eEmj0RoPicIZnVspYkJ2DU1Rxdzh4Xu/vrYKePWrHTGQ15Fthfk8fY= X-Received: by 2002:a19:d8ea:: with SMTP id r103mr3449767lfi.146.1541036693665; Wed, 31 Oct 2018 18:44:53 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Radia Perlman Date: Wed, 31 Oct 2018 18:44:41 -0700 Message-ID: To: Richard Barnes Cc: secdir@ietf.org, The IESG , draft-ietf-perc-double.all@ietf.org Content-Type: multipart/alternative; boundary="000000000000b63d6e05799090f3" Archived-At: Subject: Re: [secdir] Secdir review of draft-ietf-perc-double-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Nov 2018 01:44:58 -0000 --000000000000b63d6e05799090f3 Content-Type: text/plain; charset="UTF-8" On Wed, Oct 31, 2018 at 12:30 PM Richard Barnes wrote: > Hi Radia, > > Thanks for the review. Responses to the substantive comments inline. > Will take a look at the editorial ones in a bit. > > > On Wed, Oct 31, 2018 at 2:25 PM Radia Perlman > wrote: > >> >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the IESG. >> These comments were written primarily for the benefit of the security area >> directors. Document editors and WG chairs should treat these comments just >> like any other last call comments. >> >> This document specifies a syntax for doubly encrypting Secure Real Time >> Protocol (SRTP) packets so that the inner (media) content is encrypted with >> a key known only to the endpoints while some header content is encrypted >> with a separate key known by both the endpoints and network relay points >> called Media Distributors (with the outer encryption key (usually) changing >> on each hop). >> >> Below are details for consideration by the authors and other potential >> security reviewers. >> >> Substantive comments: >> >> Page 2 First paragraph: >> AES-GCM is the only specified cryptographic mode, but may not be the >> appropriate mode to use in distributing this content because there may be >> cases where we want to guarantee the integrity of the data end-to-end while >> allowing intermediaries to see the content. To support this case, it might >> make sense to allow the encryption and integrity protection keys to be >> separate so that an intermediary might be given the encryption key but not >> the integrity protection key. >> > > I think you mean we would give the intermediary the integrity key, not the > encryption key :) Since we want to enable the intermediary to modify > things, but not read the content. > No, I really mean an intermediary might need the encryption key, so it can read the contents, but not the integrity key, because it shouldn't modify the contents. An example is an intermediary scanning for viruses. It needs to see the contents, but is not going to modify the contents. That way the integrity check really means that the source is vouching for the authenticity of the content ("end-to-end integrity") I can't think of any cases of an intermediary needing to modify encrypted contents, and therefore needing the integrity key but not the encryption key. I'll look at the rest of the comments later.. Radia --000000000000b63d6e05799090f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed= , Oct 31, 2018 at 12:30 PM Richard Barnes <rlb@ipv.sx> wrote:
Hi = Radia,

Thanks for the review.=C2=A0 Responses to t= he substantive comments inline.=C2=A0 Will take a look at the editorial one= s in a bit.


On Wed, Oct 31, 2018 at 2:25 PM Radia Perlman <radiaperlman@gmail.com= > wrote:

I h= ave reviewed this document as part of the security directorate's ongoin= g effort to review all IETF documents being processed by the IESG.=C2=A0 Th= ese comments were written primarily for the benefit of the security area di= rectors.=C2=A0 Document editors and WG chairs should treat these comments j= ust like any other last call comments.

This docume= nt specifies a syntax for doubly encrypting Secure Real Time Protocol (SRTP= ) packets so that the inner (media) content is encrypted with a key known o= nly to the endpoints while some header content is encrypted with a separate= key known by both the endpoints and network relay points called Media Dist= ributors (with the outer encryption key (usually) changing on each hop).

Below are details for consideration by the authors a= nd other potential security reviewers.

Substantive= comments:

Page 2 First paragraph:
AES-G= CM is the only specified cryptographic mode, but may not be the appropriate= mode to use in distributing this content because there may be cases where = we want to guarantee the integrity of the data end-to-end while allowing in= termediaries to see the content. To support this case, it might make sense = to allow the encryption and integrity protection keys to be separate so tha= t an intermediary might be given the encryption key but not the integrity p= rotection key.

I think you mean we would give the intermediary the integrity key, not th= e encryption key :)=C2=A0 Since we want to enable the intermediary to modif= y things, but not read the content.=C2=A0
=C2=A0

No, I really mean an interme= diary might need the encryption key, so it can read the contents, but not t= he integrity key, because it shouldn't modify the contents.=C2=A0 An ex= ample is an intermediary scanning for viruses.=C2=A0 It needs to see the co= ntents, but is not going to modify the contents. That way the integrity che= ck really means that the source is vouching for the authenticity of the con= tent ("end-to-end integrity")

I can'= t think of any cases of an intermediary needing to modify encrypted content= s, and therefore needing the integrity key but not the encryption key.=C2= =A0

I'll look at the rest of the comments late= r..

Radia


= =C2=A0
--000000000000b63d6e05799090f3-- From nobody Wed Oct 31 20:10:19 2018 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 03EFD130E7E; Wed, 31 Oct 2018 20:03:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1541041435; bh=MOBeOMJ5p7d+owPgW6ZIBF/EsAJuSXLcC3zIJJPmFHs=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ZlhDsfwjOFu5rFr0lXgZX+FRvQzBE2Yy6/4bhk2NbrOLhtgui8qcUqkwCV0RygV7I /HhuJPNr1WuAiI0PIwVUovR1V1uNhup3O5Hknk5CFLlN8gfj0QekI3gr9XvgbkahmZ EnhbkKsW9Y3HaNkgeplYFcrAuvlK0kiacfOwyfD4= X-Mailbox-Line: From new-work-bounces@ietf.org Wed Oct 31 20:03:47 2018 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B140B130E96; Wed, 31 Oct 2018 20:03:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1541041411; bh=MOBeOMJ5p7d+owPgW6ZIBF/EsAJuSXLcC3zIJJPmFHs=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=Jf75V6XaXyKQg7SfS0BWHiAgPEQDegy7ncyqBscQGplpJbOfQ5axB9vyHCdn93Oyd F3qxS6CXZFQecbPym/r9ZOZjl9U8GbHGobZdRfoekh6i3vREQnoBU9OlsKBiHxuBM9 PUM1LO3XHpnw7eIP88Jup0RjFzqY89KTW0wy/sZE= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id ED878130DF5 for ; Wed, 31 Oct 2018 20:03:22 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 6.87.2 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <154104140296.5322.13562504299572757087.idtracker@ietfa.amsl.com> Date: Wed, 31 Oct 2018 20:03:22 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Wed, 31 Oct 2018 20:10:18 -0700 Subject: [secdir] [new-work] WG Review: Managed Incident Lightweight Exchange (mile) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Nov 2018 03:04:01 -0000 The Managed Incident Lightweight Exchange (mile) WG in the Security Area of the IETF is undergoing rechartering. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2018-11-10. Managed Incident Lightweight Exchange (mile) ----------------------------------------------------------------------- Current status: Active WG Chairs: Takeshi Takahashi Nancy Cam-Winget Secretaries: David Waltermire Assigned Area Director: Alexey Melnikov Security Area Directors: Eric Rescorla Benjamin Kaduk Mailing list: Address: mile@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/mile Archive: https://mailarchive.ietf.org/arch/browse/mile/ Group page: https://datatracker.ietf.org/group/mile/ Charter: https://datatracker.ietf.org/doc/charter-ietf-mile/ The Managed Incident Lightweight Exchange (MILE) working group develops standards to support computer and network security incident management; an incident is an unplanned event that occurs in an information technology (IT) infrastructure. An incident could be a benign configuration issue, IT incident, a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, or suspected, there may be a need for organizations to collaborate. This collaboration effort may take several forms including joint analysis, information dissemination, and/or a coordinated operational response. Examples of the response may include filing a report, notifying the source of the incident, requesting that a third-party resolve/mitigate the incident, sharing select indicators of compromise, or requesting that the source be located. By sharing indicators of compromise associated with an incident or possible threat, the information becomes a proactive defense for others that may include mitigation options. The MILE WG is focused on two areas: standardizing a data format for representing incident and indicator data, and standardizing mappings into application substrate protocols, such as HTTP and XMPP, for sharing the structured data. With respect to the data format, the working group has adopted the Incident Object Description Exchange Format (IODEF, RFC 7970) as one exchange format and will continue to: - Revise the IODEF document to incorporate enhancements and extensions based on operational experience. Use by the Computer Security Incident Response Teams (CSIRTs) and others has exposed the need to extend IODEF to support industry specific extensions, use case specific content, and representations to associate information related to represented threats (system, threat actors, campaigns, etc.). The value of information sharing has been demonstrated and highlighted at an increasing rate through the success of the Information Sharing and Analysis Centers (ISACs). In addition, the Multinational Alliance for Collaborative Cyber Situational Awareness (CCSA) have been running experiments to determine what data is useful to exchange between industries and nations to effectively mitigate threats. The work of these and other groups have identified and continue to develop data representations relevant to their use cases that may compliment/extend IODEF. - Provide guidance on the implementation and use of IODEF to facilitate interoperability. Though the working group also adopted Real-time Inter-network Defense (RID, RFC 6545) as further enabling information exchange of security policy, its transport mechanism, based on the Simple Object Access Protocol (SOAP), led to the second focus for MILE: adopting more modern transport through the adoption of a RESTful interface through ROLIE (Resource-oriented lightweight information exchange, RFC 8322) and the adoption of a publish-subscribe model through XMPP-Grid (draft-ietf-mile-xmpp-grid). The MILE WG will continue to: - Update and enhance these transport protocols to optimize their performance and representations. More explicitly, documenting how ROLIE can transport JSON representations. - Define and document how these transport protocols can also be used to support other security information exchange formats. For example, documenting how ROLIE can transport STIX (Structured Threat Information Expression) data. As STIX is a expression format defined by the OASIS consortium, the working group will maintain a relationship with OASIS to ensure proper use, compatibility and interoperability when using STIX. Milestones: Dec 2018 - Submit a draft on XMPP Protocol Extensions for Use with IODEF Dec 2018 - Submit a draft on JSON bindings of IODEF to the IESG for publication as a Standards Track RFC Apr 2019 - Submit a draft on RESTful indicator exchange for CSIRT usage as an Informational RFC _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work