[Ace] Re: Deb Cooley's No Objection on draft-ietf-ace-revoked-token-notification-08: (with COMMENT)

[Deb Cooley <[e-mail]>]

TYVM for this clarification and addition.  It has answered my question
completely.

Deb

On Wed, Sep 11, 2024 at 5:29 PM Marco Tiloca <[e-mail]> wrote:

> Hello Deb,
>
> Thanks a lot for your review! Please find in line below our detailed
> replies to your comments.
>
> A Github PR where we have addressed your comments is available at [PR].
>
> Unless any concern is raised, we plan to soon merge this PR (and the other
> ones related to other received reviews), and to submit the result as
> version -09 of the document.
>
> Thanks,
> /Marco
>
> [PR] https://github.com/ace-wg/ace-revoked-token-notification/pull/17
>
>
> On 2024-07-06 15:32, Deb Cooley via Datatracker wrote:
>
> Deb Cooley has entered the following ballot position for
> draft-ietf-ace-revoked-token-notification-08: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fabout%2Fgroups%2Fiesg%2Fstatements%2Fhandling-ballot-positions%2F&data=05%7C02%7Cmarco.tiloca%40ri.se%7C970c5fc6a6de4b05ba7308dc9dc00998%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C638558695329472322%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=AV32d%2FHdDlzyyMg2xyB67jrY3Seopa2jHLtsso28F%2F4%3D&reserved=0
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-ace-revoked-token-notification%2F&data=05%7C02%7Cmarco.tiloca%40ri.se%7C970c5fc6a6de4b05ba7308dc9dc00998%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C638558695329482887%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=28GU%2F3gyDtFwfsJ6jbpFXXsEJeLdFUW1KszKlicjH%2BY%3D&reserved=0
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thank you to Kyle Rose for doing the secdir review of this draft.  Also thanks
> to the authors for the discussions and improvements.
>
> I have one last (easy?) question:
>
> Section 13:  I expected to see some discussion on whether it is possible for an
> attacker to remove a revoked access token from the TRL allowing a registered
> device with a revoked access token to continue to participate.  Conversely, is
> it possible for an attacker to add an access token to the TRL, which would deny
> service to the registered device.  If these situations are not possible, what
> feature protects the TRL both at the AS and in transit?
>
>
> ==>MT
>
> Just to clarify and be sure: the AS indeed stores active **access tokens**
> that it has issued (e.g., in order to serve requests of token introspection
> from Resource Servers). However, the TRL specifically includes **token
> hashes** corresponding to issued access tokens, i.e., those that have been
> revoked and are not expired yet.
>
>
> If we consider an external adversary that is not in control of the AS,
> then the attacks suggested in the comment are not possible.
>
> First of all, a registered device or an administrator always relies on
> secure communications when interacting with the AS, as per Section 5 "The
> TRL Endpoint" and Section 9 "Registration at the Authorization Server".
> This is also aligned with Section 5 of RFC 9200 and with the security
> considerations of RFC 9200 that are simply inherited by this document as
> stated in its Section 13.0.
>
> Furthermore, as per the interface at the AS defined in Section 5,
> registered devices and administrators can access the TRL endpoint at the AS
> exclusively in read-only mode. That is, the TRL endpoint at the AS supports
> only the GET method (see the fourth paragraph of Section 5).
>
> It follows that accesses to the TRL are performed exclusively by sending
> protected and authenticated GET requests to the TRL endpoint, which by
> definition are safe in the REST sense and do not alter the content of the
> TRL.
>
> In fact, the content of the TRL can be updated only internally by the AS,
> in the two circumstances described in Section 4.1 "Update of the TRL".
>
>
> An adversary that has compromised and taken control of the AS is indeed
> able to update the content of the TRL, just like the AS would normally do.
> In particular, by appropriately updating the TRL content to become not
> aligned with the current set of access tokens that have been revoked but
> are not expired yet, such an adversary can practically perform the attacks
> suggested in the comment above.
>
> However, an adversary in control of the AS would be able to perform
> actions with considerably more severe and harmful consequences, such as
> revoking access tokens for no good reasons, issuing access token
> inconsistently with the installed access control policies, or providing
> wrong information to Resource Servers that ask the AS to perform token
> introspection.
>
>
> In the document, we have extended Section 13.1 "Content Retrieval from the
> TRL" by adding the following new text at its end.
>
> NEW:
> > Note that the TRL endpoint supports only the GET method (see Section 5).
> Therefore, as detailed in Section 6 and Section 7, accesses to the TRL
> endpoint are performed only by means of protected and authenticated GET
> requests, which by definition are safe in the REST sense and do not alter
> the content of the TRL. That is, registered devices and administrators can
> perform exclusively read-only operations when accessing the TRL endpoint.
> >
> > In fact, the content of the TRL can be updated only internally by the
> AS, in the two circumstances described in Section 4.1. Therefore, an
> adversary that is not in control of the AS cannot manipulate the content of
> the TRL, e.g., by removing a token hash and thereby fraudulently allowing a
> Client to access protected resources in spite of a revoked access token, or
> by adding a token hash and thereby fraudulently stopping a Client from
> accessing protected resources in spite of an access token being still valid.
>
> <==
>
>
> Received: from GVZP280MB0975.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:f7::17)
>  by GVYP280MB0464.SWEP280.PROD.OUTLOOK.COM with HTTPS; Sun, 7 Jul 2024
>  07:00:37 +0000
> Received: from DU2PR04CA0026.eurprd04.prod.outlook.com (2603:10a6:10:3b::31)
>  by GVZP280MB0975.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:f7::17) with
>  Microsoft SMTP Server (version=TLS1_2,
>  cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7741.35; Sun, 7 Jul
>  2024 07:00:35 +0000
> Received: from DU6PEPF0000B622.eurprd02.prod.outlook.com
>  (2603:10a6:10:3b:cafe::b8) by DU2PR04CA0026.outlook.office365.com
>  (2603:10a6:10:3b::31) with Microsoft SMTP Server (version=TLS1_2,
>  cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7741.35 via Frontend
>  Transport; Sun, 7 Jul 2024 07:00:35 +0000
> Authentication-Results: spf=pass (sender IP is 50.223.129.194)
>  smtp.mailfrom=ietf.org; dkim=none (message not signed)
>  header.d=none;dmarc=pass action=none header.from=ietf.org;compauth=pass
>  reason=100
> Received-SPF: Pass (protection.outlook.com: domain of ietf.org designates
>  50.223.129.194 as permitted sender) receiver=protection.outlook.com;
>  client-ip=50.223.129.194; helo=mail.ietf.org; pr=C
> Received: from mail.ietf.org (50.223.129.194) by
>  DU6PEPF0000B622.mail.protection.outlook.com (10.167.8.139) with Microsoft
>  SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.7762.17
>  via Frontend Transport; Sun, 7 Jul 2024 07:00:34 +0000
> Received: by ietfa.amsl.com (Postfix, from userid 65534)
> 	id 82C92C151991; Sun,  7 Jul 2024 00:00:32 -0700 (PDT)
> X-Original-To: [e-mail]
> Delivered-To: [e-mail]
> Received: from [10.244.2.27] (unknown [104.131.183.230])
> 	by ietfa.amsl.com (Postfix) with ESMTP id 42B9CC1516E1
> 	for <[e-mail]> <[e-mail]>; Sun,  7 Jul 2024 00:00:32 -0700 (PDT)
> Content-Type: text/plain; charset="utf-8"
> Content-Transfer-Encoding: 8bit
> To: <[e-mail]> <[e-mail]>
> Subject: Expiration impending: <draft-tiloca-ace-authcred-dtls-profile-01.txt>
> X-Test-IDTracker: no
> X-IETF-IDTracker: 12.17.1
> Auto-Submitted: auto-generated
> Precedence: bulk
> Message-ID: <172033563194.274.5459272935872629627@dt-celery-86db7666db-4xkn5>
> Date: Sun, 07 Jul 2024 00:00:31 -0700
> From: IETF Secretariat <[e-mail]> <[e-mail]>
> Resent-From: <[e-mail]> <[e-mail]>
> Resent-To: [e-mail], [e-mail]
> Resent-Message-Id: <[e-mail]> <[e-mail]>
> Resent-Date: Sun,  7 Jul 2024 00:00:32 -0700 (PDT)
> Return-Path: [e-mail]
> X-MS-Exchange-Organization-ExpirationStartTime: 07 Jul 2024 07:00:34.5120
>  (UTC)
> X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
> X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
> X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
> X-MS-Exchange-Organization-Network-Message-Id:
>  5abb92d8-e10c-4736-b7f3-08dc9e527f9a
> X-EOPAttributedMessage: 0
> X-EOPTenantAttributedMessage: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8:0
> X-MS-Exchange-Organization-MessageDirectionality: Incoming
> X-MS-PublicTrafficType: Email
> X-MS-TrafficTypeDiagnostic:
>  DU6PEPF0000B622:EE_|GVZP280MB0975:EE_|GVYP280MB0464:EE_
> X-MS-Exchange-Organization-AuthSource:
>  DU6PEPF0000B622.eurprd02.prod.outlook.com
> X-MS-Exchange-Organization-AuthAs: Anonymous
> X-MS-Office365-Filtering-Correlation-Id: 5abb92d8-e10c-4736-b7f3-08dc9e527f9a
> X-MS-Exchange-AtpMessageProperties: SA|SL
> X-MS-Exchange-Organization-SCL: 1
> X-Microsoft-Antispam: BCL:0;ARA:13230040|12012899012|2092899012;
> X-Forefront-Antispam-Report:
>  CIP:50.223.129.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.ietf.org;PTR:mail.ietf.org;CAT:NONE;SFS:(13230040)(12012899012)(2092899012);DIR:INB;
> X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2024 07:00:34.1995
>  (UTC)
> X-MS-Exchange-CrossTenant-Network-Message-Id: 5abb92d8-e10c-4736-b7f3-08dc9e527f9a
> X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8
> X-MS-Exchange-CrossTenant-AuthSource:
>  DU6PEPF0000B622.eurprd02.prod.outlook.com
> X-MS-Exchange-CrossTenant-AuthAs: Anonymous
> X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVZP280MB0975
> X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.0584539
> X-MS-Exchange-Processed-By-BccFoldering: 15.20.7741.016
> X-Microsoft-Antispam-Mailbox-Delivery:
> 	dwl:1;ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(831239)(255002)(410001)(930097)(140003)(1420198);
> X-Microsoft-Antispam-Message-Info:
> 	=?utf-8?B?NnNUdHBLRDFrWlY3U3FBZFQ4QkhXaHFieDdxdUN4NnpjaS9HNXFPbGNoNzFV?=
>  =?utf-8?B?SHFCTTl0WnZMODNmV3pLK2NWVEFMYmxtSEIxNWhQdWpXWDJMTDVwNm11M21p?=
>  =?utf-8?B?dzRwVklva29nR1VSbkI0ZDJVdGpHVjU2OTVpYWxHWUoyUG02UE9pVlltNys3?=
>  =?utf-8?B?TUE5bkZIWllrTUNPZW05aE4zeXhZOE1Qdm9KM0J4ZDVzdUFFVGlxWHhKTFNE?=
>  =?utf-8?B?THMzNTd1djg3MEdPbCtiNXlZeFJJajJsRU5PazRTb25iM1VGWS9mYnZzVEFu?=
>  =?utf-8?B?bmQyQ3FjcStSQ1RJdGdnTmZ6TUJPYThOSjZpUkdsN1o1TWdaSlB4QnVnVGQ3?=
>  =?utf-8?B?U09QSkdDaXFCVld0S0pwMEhlNlJJem1LWFRlLy9wcTVtZmpNcnBWVTRYby9p?=
>  =?utf-8?B?eW5EOHM2NHpCNGlTa0h1ZGhLR2VVY1ZFa3cyTHN6cnhvd0VBYmc1UW9BZEpQ?=
>  =?utf-8?B?ME9id240UGJlUS9qU1p4N0JNMHhNWmpwOTZMMmU5bVFjUVI5ZXJ2YWhPQkhZ?=
>  =?utf-8?B?Y1dFQ2d5WUdIb2RIMmtab29Qb0RJRlVNaXBnWkIva0l4a3ZKSHNDMXkxRjhq?=
>  =?utf-8?B?NVFWR214ZUdEaEpTQnRoWUhIbFFCOHhsQjMzdFJXWVU3bXc5UVAreTc4Vlpn?=
>  =?utf-8?B?LzA1UUFFdEY4eHI4QTdLbFhpN2hnMyt0RVZYZk5iMDhkM3hMMndPZUdzTUds?=
>  =?utf-8?B?ajBoOXNSUW1QaWY1bWZlcm8rT3lId29iMWxHWGQ3RkpsYW5abUFrc2tCdm1a?=
>  =?utf-8?B?Zkg2WXJTaU8zWHlPZUZKTFhqMEtMdVUxeXhHK0pud3ZGU0IwNUlHNlNaV2xz?=
>  =?utf-8?B?SkR2MnVPWjNCQVVxa2lIS3ZsMms2VmhNcklFOVNwUzBCQ21COTFJaHNQdG5N?=
>  =?utf-8?B?OWl1MWxtdW9HcUJlUGZ0TkxoUzI3b2tDa21ndUZaTHpQQ0lZUW9nd3o3YVkx?=
>  =?utf-8?B?VzBCdWVyV3ljOEExRVMyTy96a0tSS082SXFOdXRIQm8xQ3oxdCtIQXJKTE15?=
>  =?utf-8?B?S2xCNllLT25FbmhlMDUrbC9NMElYMXM3S2ZaS1Rnck9TVUp6TzlrVXJEUlQ3?=
>  =?utf-8?B?ZnNXY3VDWnZxZzVCQWRMQ01tdE5Nakg4RnNaMUFyU2dvSE9MMjZCK3BLOFBj?=
>  =?utf-8?B?YTd6b3MzM3UyVTF2a0s2WTdrRnJMMkFuU3BsTUhScWhiUkppdjNaQXFENjBE?=
>  =?utf-8?B?by9EVEdKYjBJeFlPd0p0cTRTZHgwbFlaOEtGeVFaUlI2SDdOa1FXeTRJYzU3?=
>  =?utf-8?B?S2dqU3lSbzVvM3lqdFdLMmFwdzNyNlVkbDJHRXA2ZmJkZFFwQVZEVllTWTcy?=
>  =?utf-8?B?cTRhSkFMeThhZSswb0FCNHVoWWRucW1WN3E3VnV6MDlaSDBtYWl1WkJuRnJH?=
>  =?utf-8?B?T1NUamhGb1dya1c3dTdrR3NxZGFNSUlkczN2SXd5OFEwVHdOcS9JSjRzeG5i?=
>  =?utf-8?B?eHNjWGUzdWU4MXBiaDlpTGloZnFoRVdHZVphZ3dKQWVnanJEbGtLWjh5NWJ5?=
>  =?utf-8?B?MUNLUW1UV0VXS1oxNko2czNVQVRvZmRVMG1lR2FPUSs5Mnk4eloycHZ6SEh2?=
>  =?utf-8?B?c3N5WTNwL2Y1OFdBa1JidSs2ZTMvb3l0SDFZMnlKUkNLZVozdkNaQ2RRREtL?=
>  =?utf-8?B?WldCUkl6SXlWamY5T0pVVFI0SXc1S3RsYmJtT1pMb0V2dDl1T0NldXFERTVz?=
>  =?utf-8?B?NHRKQUFxVUxJQWdSUmgxVlg2WjNMeVluQzNSV2d6aWZ3a05OVjZtYW56M1d1?=
>  =?utf-8?B?UCtvZkpGbG9HOU5rclVzUWdpQ2ROSk41L3U0aitUL2pYNTNreFB2VDh1YUdE?=
>  =?utf-8?B?d2ZQY2dscDNZSXFMczBYSkswYWpnak5RaG5HSlhQOTNCZGR3dGU5YWlpbjRK?=
>  =?utf-8?B?ZDZKTDNhWldSdHN2YTMvOU95RUFtRG5Dd09XdHFId3dUUEJ6dURHdEsyMit6?=
>  =?utf-8?B?THV0N1dsYzVVcDVxZTh5Y0VvTVRIcHJhQk9MdzdFOVdpcnAxbGpxRFBZQ3dY?=
>  =?utf-8?B?KzFaUDJIaGozSXpqQkZCNUczRk9MMllrZCtNcGs0RjNyRFl6VlphV0dITUNi?=
>  =?utf-8?B?MVl5eG5LdUZXdkVMWWt6NzgyTHBtM2Ixcnp4RWJXd21mTXBNRTRBYzZHRU1y?=
>  =?utf-8?B?RHM4ZEpWNnowRzRKSWM0d2FIWjlqQ1oxK2R3VzZTUm11cER0QWR5Slh0Y09D?=
>  =?utf-8?B?WnpWWlQrRC85RzJkUjVZYjBkUkFNOEJ0cCtucStmQWNGV0VrRGV1RVFHdXZE?=
>  =?utf-8?B?bWtpNks2MVhtcmdnSkdNRWtzdEFueHNBWmdhcW5scWlrWGx5eVdQQ3YwQW44?=
>  =?utf-8?B?YW5jWVlCeDJkV2U3aEJjekVFd0tTZWt5QVdPVlplQkVWanNHRkRZcG5lNmFN?=
>  =?utf-8?B?UlZNTldWQ0hIWkxVUWpSOElGb1V6TFcxekNzVUFvQzYyaDE2MDFvbkI5N0ZW?=
>  =?utf-8?B?VTV0T3VtUkFPWnRYL3pWK25kdmlZWkN5M01tOWxZMlBvL0dQVlkrRXYyZmk5?=
>  =?utf-8?B?TmVWN01LcHVDbCttSWVGckN3Tm5jSXUxR3FEQ3F4ZFM4V2xVLzFrYXlPOU9Z?=
>  =?utf-8?B?d3ZvSmJUcDI4Y1dpbFNleVlaZjY5NmRhOTZ0eUpEc2FtNTZ3cFMyY3ZkOGZw?=
>  =?utf-8?B?TVpTUWFIZEFjL1BLUnY1YVVINzRoNWNVV29keWIxK1Vsc0JvNTkwTjZGRFE1?=
>  =?utf-8?B?bnBaUTRITTM5WDJSL3ZCL0VnK01nVUVBSGpJZ0xIaktnL3FKY21Ga1pwQ1Fj?=
>  =?utf-8?B?dTVPZFM1OUhaMGVJVFBORFJpL0p0S0tCZDRFUG4wODRJV21VR0tGTytBRDBn?=
>  =?utf-8?B?PT0=?=
> MIME-Version: 1.0
>
> The following Internet-Draft will expire soon:
>
> Name:     draft-tiloca-ace-authcred-dtls-profile
> Title:    Additional Formats of Authentication Credentials for the Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)
> State:    I-D Exists
> Expires:  2024-07-13 (in 5 days, 23 hours)
>
>
> Received: from GV3P280MB0827.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:f2::5) by
>  GVYP280MB0464.SWEP280.PROD.OUTLOOK.COM with HTTPS; Sun, 7 Jul 2024 07:00:37
>  +0000
> Received: from AS9P251CA0015.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:50f::29)
>  by GV3P280MB0827.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:f2::5) with
>  Microsoft SMTP Server (version=TLS1_2,
>  cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7741.35; Sun, 7 Jul
>  2024 07:00:35 +0000
> Received: from AMS1EPF00000041.eurprd04.prod.outlook.com
>  (2603:10a6:20b:50f:cafe::a7) by AS9P251CA0015.outlook.office365.com
>  (2603:10a6:20b:50f::29) with Microsoft SMTP Server (version=TLS1_2,
>  cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7741.34 via Frontend
>  Transport; Sun, 7 Jul 2024 07:00:35 +0000
> Authentication-Results: spf=pass (sender IP is 50.223.129.194)
>  smtp.mailfrom=ietf.org; dkim=none (message not signed)
>  header.d=none;dmarc=pass action=none header.from=ietf.org;compauth=pass
>  reason=100
> Received-SPF: Pass (protection.outlook.com: domain of ietf.org designates
>  50.223.129.194 as permitted sender) receiver=protection.outlook.com;
>  client-ip=50.223.129.194; helo=mail.ietf.org; pr=C
> Received: from mail.ietf.org (50.223.129.194) by
>  AMS1EPF00000041.mail.protection.outlook.com (10.167.16.38) with Microsoft
>  SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.7762.17
>  via Frontend Transport; Sun, 7 Jul 2024 07:00:34 +0000
> Received: by ietfa.amsl.com (Postfix, from userid 65534)
> 	id 4C4B8C16940C; Sun,  7 Jul 2024 00:00:33 -0700 (PDT)
> X-Original-To: [e-mail]
> Delivered-To: [e-mail]
> Received: from [10.244.2.27] (unknown [104.131.183.230])
> 	by ietfa.amsl.com (Postfix) with ESMTP id DB046C1522B9;
> 	Sun,  7 Jul 2024 00:00:32 -0700 (PDT)
> Content-Type: text/plain; charset="utf-8"
> Content-Transfer-Encoding: 8bit
> To: <[e-mail]> <[e-mail]>
> Cc: [e-mail], [e-mail]
> Subject: Expiration impending: <draft-ietf-ace-oscore-gm-admin-coral-01.txt>
> X-Test-IDTracker: no
> X-IETF-IDTracker: 12.17.1
> Auto-Submitted: auto-generated
> Precedence: bulk
> Message-ID: <172033563255.274.9265451665620885998@dt-celery-86db7666db-4xkn5>
> Date: Sun, 07 Jul 2024 00:00:32 -0700
> From: IETF Secretariat <[e-mail]> <[e-mail]>
> Resent-From: <[e-mail]> <[e-mail]>
> Resent-To: [e-mail], [e-mail]
> Resent-Message-Id: <[e-mail]> <[e-mail]>
> Resent-Date: Sun,  7 Jul 2024 00:00:33 -0700 (PDT)
> Return-Path: [e-mail]
> X-MS-Exchange-Organization-ExpirationStartTime: 07 Jul 2024 07:00:35.2287
>  (UTC)
> X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
> X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
> X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
> X-MS-Exchange-Organization-Network-Message-Id:
>  26f577d6-a8a7-41bc-125e-08dc9e528008
> X-EOPAttributedMessage: 0
> X-EOPTenantAttributedMessage: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8:0
> X-MS-Exchange-Organization-MessageDirectionality: Incoming
> X-MS-PublicTrafficType: Email
> X-MS-TrafficTypeDiagnostic:
>  AMS1EPF00000041:EE_|GV3P280MB0827:EE_|GVYP280MB0464:EE_
> X-MS-Exchange-Organization-AuthSource:
>  AMS1EPF00000041.eurprd04.prod.outlook.com
> X-MS-Exchange-Organization-AuthAs: Anonymous
> X-MS-Office365-Filtering-Correlation-Id: 26f577d6-a8a7-41bc-125e-08dc9e528008
> X-MS-Exchange-AtpMessageProperties: SA|SL
> X-MS-Exchange-Organization-SCL: 1
> X-Microsoft-Antispam: BCL:0;ARA:13230040|12012899012|2092899012;
> X-Forefront-Antispam-Report:
>  CIP:50.223.129.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.ietf.org;PTR:mail.ietf.org;CAT:NONE;SFS:(13230040)(12012899012)(2092899012);DIR:INB;
> X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2024 07:00:34.9006
>  (UTC)
> X-MS-Exchange-CrossTenant-Network-Message-Id: 26f577d6-a8a7-41bc-125e-08dc9e528008
> X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8
> X-MS-Exchange-CrossTenant-AuthSource:
>  AMS1EPF00000041.eurprd04.prod.outlook.com
> X-MS-Exchange-CrossTenant-AuthAs: Anonymous
> X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
> X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV3P280MB0827
> X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.7249057
> X-MS-Exchange-Processed-By-BccFoldering: 15.20.7741.016
> X-Microsoft-Antispam-Mailbox-Delivery:
> 	dwl:1;ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(831239)(255002)(410001)(930097)(140003)(1420198);
> X-Microsoft-Antispam-Message-Info:
> 	=?utf-8?B?cXE1V3V2a252cTlwYWR2SlpTaGdJL1VRMk9CaGNxekJuUC9hL3FxdEhqZk5q?=
>  =?utf-8?B?L0FDa0hPOGJtQjZkZitxMVBocVY3R05mTTJkbXIyekFEQXAvOHU2Z043aWVo?=
>  =?utf-8?B?VjkxbnIrUGdVTEFjeFlKemlDNUJoL0pGOHI4V3BvWnpkb1ZhVlJQOGJnV2ZR?=
>  =?utf-8?B?Z0ttRHUzS0ozRGlockMxaFdFQk5ZdTZjSkpYL2R3bDhXdEh0VGRNSVpWb045?=
>  =?utf-8?B?akx5RC9LOHpWQ2kzTEQyeXgvQnBaZWF5QS9iNHZjQmNCMmR1bS9jWmZ4SURJ?=
>  =?utf-8?B?SlVrbEMyNFZWclBkN28xQkNaaklZdkRRdG91TXFNRTB6MDRUaVVHUnVSeUM3?=
>  =?utf-8?B?MnBDbFArWTlLSzhIR29RWXRNSnROVm4wYnZpRkNuRW9RMWFFYjZSdFl4VWt2?=
>  =?utf-8?B?ejdJKzZDQldEcXI5UlRnUW1Rb3RBWU15YXlyTmRYemRzcDRobm4rdTUwYTVy?=
>  =?utf-8?B?dm54MTVKNHJsbzNBVkNsMEEyTmREOHFjelNKRk1XaTc5Mi9RdEs3blBCTXZU?=
>  =?utf-8?B?dFo1M2c5U3V4bUVWb2h3bG84Q0Nkalh5eEoyYjk1SXl2RjY4TFBLbS9OZkdK?=
>  =?utf-8?B?UFZPcGNRV0RxZ29KNXRDaWVNNkJuL0JRZDl5cVN0WjRQeUJVVmVhY05xUkdT?=
>  =?utf-8?B?ejZpbmpWWHJaaFZXb0ZZM1hXTTdzRHlPdmZ1TGpKcjJPT0FMNUU4R2k2c2Zt?=
>  =?utf-8?B?NzRlZGpXRThyTmJ1VldPVkpJdWt1OGpBbGtjZElxQTcxWU00ZmdWS09YbTNJ?=
>  =?utf-8?B?U1NIS1pkSnBvS1o5Q0FSRkRIeDI5dGVBNU1ZenQyZ2hnWHp4OVB1cG5aRzlI?=
>  =?utf-8?B?VnArSHFPbVVjbDJoUXlidG1zMVRKNTYxOGF5TzUwWEIzTUNTejdlanNiVjhS?=
>  =?utf-8?B?Z2pGYkpDck90Q2twNzY4dlJ4SFBuUjFMWjliN08rR3l1NEJqczAzUnJKeVl4?=
>  =?utf-8?B?WEdldTF5VjBXWkswdjI3cjYvSVE0T1hxSzE2NlZjTExUT0djR3M4MWVIblpD?=
>  =?utf-8?B?QVo1ZWl0bUp0R1BpakRGYkdQUmxGMHY0RXp5S0Z3VjhJOWxFTkpQSXRuNnFY?=
>  =?utf-8?B?L2duWmZaR0hPRUNtN2s3VDZKWDM3bVJ1ZjNVbGFpMEl5NmxVR084RC9LMmtX?=
>  =?utf-8?B?Qk5BdUZkUmMrUzhXenF4eUhkck1uWThMWHh6L2ROUVZCUE0zY2M2WmZOdWIz?=
>  =?utf-8?B?eFZWMnE3aFR2SXc4eFlZaHVWdkJ5YWE2WXVvazBMVWdISldiOE42UU15L3pk?=
>  =?utf-8?B?dU8vWmprOEwyclBRQ3FtMkVsOGNzaG5FNjl3VzNlbEp6L05DKytFRG56azlw?=
>  =?utf-8?B?S2NZUGphbS82OEtVL2dTb25Sa0pzYWU3aVo0SHY4UFhWOXNYMHc0T1BDNWh6?=
>  =?utf-8?B?UjNUb0dvbTFNNWZHckhpMkRsUkFQNHZpdUJkV0pyL01vVGhLTno5b2J3cTAy?=
>  =?utf-8?B?S2U3dFJvZWtDa25kR2JSZzBpL2pqb0FYZ0I3RytzNXZhUGZOMEJiYTMreHFV?=
>  =?utf-8?B?b2xrczVmSnpNYWZ2TDduWndjZkMvdnNYZ3NzeVVyWVZDMXlSUk9iM3N4Zmp4?=
>  =?utf-8?B?V3dnMi9STFhTZDMrb3Rta0JpVHZCbmUyTnN3bGcvK2RYWTE3VGdzdmdBMUdB?=
>  =?utf-8?B?cGFnVWR0YjF5MnBsdTBwSko0RHRJdnpld1NIT1YwcGwvc09KNjB5Qm8yd3VK?=
>  =?utf-8?B?YlhPOVJWbDNnUUp3THRPcjR0eXh0RTlaWWVBQnpCOC9nUlJRbGIyL3VPZGoz?=
>  =?utf-8?B?UGJ5N1ozTlZsaTZpMXhZRDRZd2QvSWh6M25Nd1VuNzNpVEplcVZUMGxsRWRN?=
>  =?utf-8?B?R2J1NzVoUzdNSUdqTkN2T0lzak5YNXRUQVFXQmhUb3RXUFMwVmsrR1JlczVv?=
>  =?utf-8?B?N3RSZk9QZjRVWUhBTVNGT3plY3BqWEFCbklNYWtLa3JLMitQYVdJd2ttTlEy?=
>  =?utf-8?B?WXZ3d0tLZk5hYmdicTRGUmlNM3g2MzNMVXh0aDdRSm9UTXhZVExuTFVpNkZW?=
>  =?utf-8?B?TVJpNEhpdElxb3pxSDVqZXNBU21vb3ZuaDlZV1gxTThQY2RnbS9Sd1R5R1Ev?=
>  =?utf-8?B?MlJNZGNnYTgxamhyemEyZjRERU9IZS9DRVEya1JlaW9YQzAxRk8rQTNSZXlP?=
>  =?utf-8?B?bENWKy8wOG1qTVFGUzNOR0l4R21PR1FNcVhXejgyWk5LdDRweXU5Wlc3ZFZH?=
>  =?utf-8?B?UVAxcEdOQ3puKzJuVGFMVGI3LzVodjJXVzU0cVMxRFNISkV3eE1lVzlBYWJ0?=
>  =?utf-8?B?TmUyamNqamVlSHJvdmdENlFiNWNYOExGWFBqV1Irdmk2VjFpRDBKS3FWOXk3?=
>  =?utf-8?B?S2tKM2N4RG1HaVQyQVpmcnEzYVpLWUlsWFR4cG5mYk1oSFAydXZObEJweEFE?=
>  =?utf-8?B?cXQ1L081dUc4Ukl6SmY3c3hJMTNsL1I1NXZyeTlRNkw5OEpCbWJqSjA5Qmp0?=
>  =?utf-8?B?OHVBS2MxSzdSZnYrUStoU3dSL0xIa21KajJTdGFqL3RFN1BVNXgraE5pc3Ni?=
>  =?utf-8?B?alR1VG1rK1RTRFZ1L2RoK1R1cUg4N3JpUlZmcE5QSGs2aXJCbDdFSjNjdUJM?=
>  =?utf-8?B?OWhYVjFPL05zakxmaEFHWmd4cEVOOWMyVmxlR0dORlJxM05aRmY3aGZURit3?=
>  =?utf-8?B?dy9CaVZFU3Zad212T1RYRC9jSGlxNG9lMld5LzdlMEtOOUN1Vzg5dVlYTVU0?=
>  =?utf-8?B?c3BpL1VhSmpaTXpyN0tXaXhNdFduSFN0SmJFbHlxeHVlMFFySW9yY3JRSFgz?=
>  =?utf-8?B?bHZnYjhEb1VwY2lpSEdpVUp3bGpTSTdHQkF2K2RoNDMwTDFsVFdTNlpEZStB?=
>  =?utf-8?B?PT0=?=
> MIME-Version: 1.0
>
> The following Internet-Draft will expire soon:
>
> Name:     draft-ietf-ace-oscore-gm-admin-coral
> Title:    Using the Constrained RESTful Application Language (CoRAL) with the Admin Interface for the OSCORE Group Manager
> State:    I-D Exists
> Expires:  2024-07-17 (in 1 week, 2 days)
>
>
>
> --
> Marco Tiloca
> Ph.D., Senior Researcher
>
> Phone: [phone]
>
> RISE Research Institutes of Sweden AB
> Box 1263
> 164 29 Kista (Sweden)
>
> Division: Digital Systems
> Department: Computer Science
> Unit: Cybersecurity
> https://www.ri.se
>
>