Return-Path: X-Original-To: tls@mail2.ietf.org Delivered-To: tls@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 788AEB87B9CE; Mon, 16 Feb 2026 14:05:37 -0800 (PST) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -4.397 X-Spam-Level: X-Spam-Status: No, score=-4.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=tu-dresden.de Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NI3GSZSno8_H; Mon, 16 Feb 2026 14:05:36 -0800 (PST) Received: from mailout3.zih.tu-dresden.de (mailout3.zih.tu-dresden.de [141.30.67.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 2A0A0B87B9B7; Mon, 16 Feb 2026 14:05:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tu-dresden.de; s=dkim2022; h=Content-Type:In-Reply-To:CC:References:To:From :Subject:MIME-Version:Date:Message-ID:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=CvKiXgEq5AfnlAYiRPcYDjGkqXxkWIlt4NVXd7N4cXQ=; b=zzOfAjtKPde93HA4qucjklIR1O Hip+yuAnJVIANCrH3qzvgWLPLsaXFjyAo+420gSLQH8vZIYo3m+QOSezsx7CFBnSewhEGE4daMMkM 9PheTUO2XdRYXWUEazYoV0XG0V2CPDj2t0loXRq76QD3jFFQCkgnyDr9NjmgeDH3qXfIhro9D+TaJ eQtcX+NW++SMqsQot0kN0SytER5Q5IOMEr9qbpQDH5zwqBR/Za31JYNHS9xiiB64yU5LYnuX99fJZ gbedKeX6YJ29/o8Tzw3FVmDgDPq3sfNnfwCpYEf4kbS5z0yptibojkI5NmMcGXfxfenMSF5qQvJmQ pPA8Wq3Q==; Received: from msx-t422.msx.ad.zih.tu-dresden.de ([172.26.35.139] helo=msx.tu-dresden.de) by mailout3.zih.tu-dresden.de with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1vs6il-006aYn-Aw; Mon, 16 Feb 2026 23:05:35 +0100 Received: from [10.12.5.228] (141.76.13.149) by msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Mon, 16 Feb 2026 23:05:23 +0100 Message-ID: Date: Mon, 16 Feb 2026 23:05:22 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Muhammad Usama Sardar To: UFMRG IRTF , References: <8ca160c8-1f42-441a-90b3-d28ac4ae8931@tu-dresden.de> Content-Language: en-US In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-512; boundary="------------ms090608060408030208050405" X-ClientProxiedBy: msx-t420.msx.ad.zih.tu-dresden.de (172.26.35.137) To msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139) X-TUD-Virus-Scanned: mailout3.zih.tu-dresden.de Message-ID-Hash: VBIOWKQWH7EPDRQ6ST6EC6DZCFNKARL4 X-Message-ID-Hash: VBIOWKQWH7EPDRQ6ST6EC6DZCFNKARL4 X-MailFrom: muhammad_usama.sardar@tu-dresden.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "TLS@ietf.org" X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Clarification_on_security_considerations_of_RFC926?= =?utf-8?q?1?= List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --------------ms090608060408030208050405 Content-Type: multipart/alternative; boundary="------------d1pPtLztLq0I0v4wjXEYv3H7" --------------d1pPtLztLq0I0v4wjXEYv3H7 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64 SGkgVUZNUkcgYW5kIENGUkcsDQoNCkkgZGlkbid0IGdldCBhbnkgYW5zd2VyL29waW5pb24g YXQgVExTIFdHLiBTbyBJIHdhbnRlZCB0byBjaGVjayBpZiANCnNvbWVvbmUgaGVyZSBoYXMg YW55IGFuc3dlci9vcGluaW9uLg0KDQpCZXN0IHJlZ2FyZHMsDQoNCi1Vc2FtYQ0KDQoNCk9u IDEyLjAyLjI2IDEzOjU5LCBNdWhhbW1hZCBVc2FtYSBTYXJkYXIgd3JvdGU6DQo+DQo+IEp1 c3QgYSByZW1pbmRlciB0aGF0IGl0J3MgL25vdC8gbmVjZXNzYXJ5IHRvIGFuc3dlciAvYWxs LyB0aGUgDQo+IHF1ZXN0aW9ucyA6KSBXaGF0ZXZlciBhbnN3ZXJzL29waW5pb25zIGFueW9u ZSBoYXMgYXJlIHdlbGNvbWUuDQo+DQo+IEdpdmVuIGxhY2sgb2YgY2xhcml0eSwgd2UgYXJl IGJhc2ljYWxseSBtYWtpbmcgYXNzdW1wdGlvbnMsIHdoaWNoIG1heSANCj4gbm90IG1hdGNo IHRoZSBpbnRlbnRpb25zIG9mIHRoZSBXRy4NCj4NCj4gVGhhbmtzLg0KPg0KPiAtVXNhbWEN Cj4NCj4NCj4gT24gMDMuMDIuMjYgMjE6MDgsIE11aGFtbWFkIFVzYW1hIFNhcmRhciB3cm90 ZToNCj4+DQo+PiBbIFNvcnJ5IGZvciB0aGUgbGVuZ3RoIF0NCj4+DQo+PiBIaSBOaWNrLCBh bGwsDQo+Pg0KPj4gVGhhbmsgeW91IGZvciB0aGUgd29yayBvbiBSRkM5MjYxLiBXZSBmb3Vu ZCBpdCBhIHVzZWZ1bCBmb3VuZGF0aW9uIA0KPj4gZm9yIG91ciB3b3JrLg0KPj4NCj4+ICMg KkNvbnRleHQqDQo+Pg0KPj4gRm91ciBkZXZlbG9wZXJzIChQZWcgSm9uZXMgZnJvbSBGbGFz aGJvdHMsIE1hcmt1cyBSdWR5IGZyb20gRWRnZWxlc3MgDQo+PiBTeXN0ZW1zLCBBeW91YiBC ZW5haXNzYSBmcm9tIFphbWEsIGFuZCBQYXZlbCBOaWtvbm9yb3YgZnJvbSBHQTRHSCBhbmQg DQo+PiBFbGl4aXIgRXVyb3BlKSBhcmUgZGV2ZWxvcGluZyBpbXBsZW1lbnRhdGlvbnMgb2Yg UkZDIDkyNjEuIEkgYW0gZG9pbmcgDQo+PiB0aGUgZm9ybWFsIGFuYWx5c2lzIGluIFByb1Zl cmlmLiBXZSByZXF1ZXN0IHRoZSBmb2xsb3dpbmcgY2xhcmlmaWNhdGlvbnMuDQo+Pg0KPj4g IyAqU2NvcGUqDQo+Pg0KPj4gSSBiYXNpY2FsbHkgY2FyZSBhYm91dCBUTFMgMS4zIG9ubHku IFdoaWxlIG1hbnkgdGhpbmdzIGFwcGx5IHRvIERUTFMgDQo+PiAxLjPCoGFzIHdlbGwgYXMg VExTIDEuMiwgdGhlIHNjb3BlIG9mIG15IHF1ZXN0aW9ucyBpcyBvbmx5IGxpbWl0ZWQgdG8g DQo+PiBUTFMgMS4zIC9vbmx5Ly4NCj4+DQo+PiBPZiB0aGUgdGhyZWUgb3B0aW9ucyBpbiBT ZWN0aW9uIDMsIEkgY2FyZSBhYm91dCBTZXJ2ZXIgDQo+PiBBdXRoZW50aWNhdGlvbi4gVGhh dCBpcywgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTcG9udGFuZW91cyBTZXJ2ZXIgDQo+ PiBBdXRoZW50aWNhdGlvbiBhcmUgb3V0IG9mIHNjb3BlIG9mIHRoaXMgZW1haWwuDQo+Pg0K Pj4gV2hpbGUgQXV0aGVudGljYXRvcnMgY2FuIGJlIGNvbnZleWVkICJvdXQgb2YgYmFuZCIg YXMgbWVudGlvbmVkIGluIA0KPj4gUkZDICh3aGljaCBJIGRvbid0IHJlYWxseSBzZWUgd2h5 KSwgbGV0J3Mgc2F5IEkgcHV0IGl0IG91dCBvZiBzY29wZS4gDQo+PiBXaGVuIHRoZXJlIGlz IGFscmVhZHkgYW4gZXN0YWJsaXNoZWQgY29ubmVjdGlvbiwgdGhlbiBJIHRoaW5rIGl0IGlz IA0KPj4gcHJlZmVyYWJsZSB0byB1c2UgdGhhdC4gU28gbGV0J3Mgc2F5IEF1dGhlbnRpY2F0 b3IgUmVxdWVzdCBhbmQgDQo+PiBBdXRoZW50aWNhdG9yIGFyZSBzZW50IG92ZXIgdGhlIGNv bm5lY3Rpb24gZXN0YWJsaXNoZWQgYnkgdGhlIA0KPj4gaGFuZHNoYWtlIChhbmQgaGVuY2Ug Im91dCBvZiBiYW5kIiBiZWluZyBvdXQgb2Ygc2NvcGUpLg0KPj4NCj4+IEZvciBmdXJ0aGVy IHNpbXBsaWNpdHksIGxldCdzIHNheSBTZXJ2ZXIgZG9lcyBub3Qgc2VuZCANCj4+IENlcnRp ZmljYXRlUmVxdWVzdCBkdXJpbmcgdGhlIGhhbmRzaGFrZSwgc28gdGhlIGNsaWVudCBhdXRo ZW50aWNhdGlvbiANCj4+IGlzIG5vdCBkb25lIGR1cmluZyB0aGUgaGFuZHNoYWtlLg0KPj4N Cj4+ICMgKktub3duIGltcGxlbWVudGF0aW9uKg0KPj4NCj4+IFRoZSBvbmx5IHB1YmxpYyBp bXBsZW1lbnRhdGlvbiBjdXJyZW50bHkga25vd24gdG8gdXMgaXMgQ2xvdWRmbGFyZSdzIA0K Pj4gb3BhcXVlLWVhIFswXSwgd2hpY2ggYXMgYWNrbm93bGVkZ2VkIFsxXSBieSBDbG91ZGZs YXJlLCBpcyBhIHBhcnRpYWwgDQo+PiBpbXBsZW1lbnRhdGlvbiBvZiBSRkM5MjYxLiBJdCBp bXBsZW1lbnRzIFRMUyBtZXNzYWdlcyBoZXJlIFsyXSBhbmQgaXMgDQo+PiBiYXNlZCBvbiBt aW50IFszXSAtIGEgbWluaW1hbCBUTFMgMS4zIHN0YWNrIGZvciBsZWFybmluZyBwdXJwb3Nl cy4gSXMgDQo+PiB0aGVyZSBhbnkgb3RoZXIgb3Blbi1zb3VyY2UgaW1wbGVtZW50YXRpb24/ DQo+Pg0KPj4gRm9yIGZ1dHVyZSwgY291bGQgd2UgcGxlYXNlIHJlZmVyZW5jZSB0aGUgaW1w bGVtZW50YXRpb25zIHdpdGhpbiB0aGUgDQo+PiBSRkNzIChlaXRoZXIgaW4gdGV4dCBvciBp biAiYWRkaXRpb25hbCByZXNvdXJjZXMiIGluIGRhdGF0cmFja2VyKSB0byANCj4+IGF2b2lk IHRoZSB0cm91YmxlIHRvIGZpbmQgaXQ/DQo+Pg0KPj4gVGhlIGRldmVsb3BlcnMgYXJlIHVs dGltYXRlbHkgYWltaW5nIGF0IGNvZGUgdGhhdCB0aGV5IHdpbGwgdXNlIGluIA0KPj4gcHJv ZHVjdGlvbi4NCj4+DQo+Pg0KPj4gIyAqU2VjdXJpdHkgY29uc2lkZXJhdGlvbnMqDQo+Pg0K Pj4gSSBhZ3JlZSB3aXRoIHRoZSBsYXN0IHBhcmFncmFwaCBvZiBzZWN1cml0eSBjb25zaWRl cmF0aW9ucywgYnV0IA0KPj4gY291bGRuJ3QgcGFyc2UgdGhlIDJuZCBwYXJhZ3JhcGggKHNl ZSBiZWxvdykuDQo+Pg0KPj4gIyMgKkZvcm1hbCBhbmFseXNpcyBpbiBQcm9WZXJpZioNCj4+ DQo+PiBJIGFtIHRyeWluZyB0byB1bmRlcnN0YW5kIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0 aW9ucyBvZiBSRkM5MjYxLiBJdCANCj4+IGFja25vd2xlZGdlcyBLYXJ0aGlrIGZvciBzdWdn ZXN0aW9ucyBvbiBzZWN1cml0eSBjb25zaWRlcmF0aW9ucy4gRG9lcyANCj4+IHNvbWVvbmUg aGFwcGVuIHRvIHJlY2FsbCB3aGV0aGVyIGhlIGFjdHVhbGx5IGRpZCBzb21lIGZvcm1hbCBh bmFseXNpcyANCj4+IGluIFByb1ZlcmlmIG9yIHdhcyBpdCBiYXNlZCBvbiBoaXMgaW50dWl0 aW9uPyBJZiB0aGUgZm9ybWVyLCBjb3VsZCANCj4+IHNvbWVvbmUgcG9pbnQgbWUgdG8gdGhl IGFuYWx5c2lzPyBJIGRpZCBjaGVjayByZWZ0bHMgcmVwbyBbNF0gd2hpY2ggDQo+PiBkb2Vz IG5vdCBjb250YWluIGl0LiBJIGFsc28gY2hlY2tlZCBoaXMgcGVyc29uYWwgcmVwb3MgWzVd IGJ1dCBjb3VsZCANCj4+IG5vdCBmaW5kIHNvbWV0aGluZyByZWxldmFudC4NCj4+DQo+PiBJ IGtub3cgc29tZSBmb3JtYWwgYW5hbHlzaXMgd2FzIGRvbmUgaW4gVGFtYXJpbiBidXQgSSB3 b3VsZCBsaWtlIHRvIA0KPj4gY29tcGFyZSBteSBQcm9WZXJpZiBtb2RlbCB3aXRoIGhpcyBt b2RlbCwgaWYgaGUgaGFkIG9uZS4NCj4+DQo+PiBGb3IgZnV0dXJlLCBjb3VsZCB3ZSBwbGVh c2UgcmVmZXJlbmNlIHRoZSBmb3JtYWwgYW5hbHlzaXMgd2l0aGluIHRoZSANCj4+IFJGQ3Mg KGVpdGhlciBpbiB0ZXh0IG9yIGluICJhZGRpdGlvbmFsIHJlc291cmNlcyIgaW4gZGF0YXRy YWNrZXIpIHRvIA0KPj4gYXZvaWQgdGhlIHRyb3VibGUgdG8gZmluZCBpdD8NCj4+DQo+PiAj IyAqMm5kIHBhcmFncmFwaCAqDQo+Pg0KPj4gQSB3aG9sZSBsb3Qgb2YgbXkgdHJvdWJsZSBp cyB1bmRlcnN0YW5kaW5nIHdoYXQgaXMgYmVpbmcgcmVhc29uZWQgaW4gDQo+PiB0aGlzIHBh cmFncmFwaCBhbmQgaG93IHRoaXMgaXMgbGVhZGluZyB0byB0aGUgZmlyc3QgYnVsbGV0IGFz IGEgDQo+PiBjb25jbHVzaW9uLiBDb3VsZCBzb21lb25lIGV4cGxhaW4/IEZvciBleGFtcGxl Og0KPj4NCj4+ID4gQXV0aGVudGljYXRvcnMgYXJlIGluZGVwZW5kZW50IGFuZCB1bmlkaXJl Y3Rpb25hbC4NCj4+DQo+PiAiSW5kZXBlbmRlbnQiIG9mIHdoYXQ/IEF1dGhlbnRpY2F0b3Ig d291bGQgdXNlIHRoZSANCj4+IC9jZXJ0aWZpY2F0ZV9yZXF1ZXN0X2NvbnRleHQvIGZyb20g QXV0aGVudGljYXRvciBSZXF1ZXN0LCANCj4+IHNvwqBBdXRoZW50aWNhdG9yIGlzIG5vdCBp bmRlcGVuZGVudCBvZiBBdXRoZW50aWNhdG9yIFJlcXVlc3QsIHJpZ2h0PyANCj4+IElmIEF1 dGhlbnRpY2F0b3IgaXMgaW5kZXBlbmRlbnQgb2YgQXV0aGVudGljYXRvciBSZXF1ZXN0LCB0 aGVuIHdoYXQgDQo+PiBwcmV2ZW50cyByZXBsYXkgYXR0YWNrcz8gKFJlY2FsbCBTcG9udGFu ZW91cyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gaXMgDQo+PiBvdXQgb2Ygc2NvcGUgb2YgbXkg ZW1haWwuIE9uZSBjb3VsZCBhcmd1ZSB0aGF0IGlzIHN0aWxsIGluIHNjb3BlIGZvciANCj4+ IFJGQyBidXQgdGhlIHF1b3RlZCBzdGF0ZW1lbnQgaW4gUkZDIGNvbWVzIHdpdGhvdXQgcXVh bGlmaWVyIGFuZCANCj4+IGxvZ2ljYWxseSBzaG91bGQgYXBwbHkgdG8gYWxsIGNhc2VzLikN Cj4+DQo+PiAiVW5pZGlyZWN0aW9uYWwiIGluIHdoYXQgc2Vuc2U/IFRoZSB3aG9sZSBpZGVh IG9mIFJGQzkyNjEgaW4gbXkgbWluZCANCj4+IGlzIHRvIGVuYWJsZSB0aGUgc2VydmVyIHRv IHNlbmQgQXV0aGVudGljYXRvcnMgdG9vLCBzaW5jZSBhZnRlciB0aGUgDQo+PiBoYW5kc2hh a2UsIFJGQzg0NDZiaXMgYWxsb3dzIG9ubHkgdGhlIENsaWVudCB0byBhdXRoZW50aWNhdGUg aXRzZWxmIA0KPj4gYW5kIG5vdCB0aGUgU2VydmVyIFtTZWMuIDQuMi42IGFuZCA0LjYuMiBv ZiA4NDQ2YmlzXS4gVG8gbWUsIFJGQzkyNjEgDQo+PiBpcyBiaWRpcmVjdGlvbmFsLCBhcyBi b3RoIHNlcnZlciBhbmQgY2xpZW50IGNhbiBnZW5lcmF0ZSBBdXRoZW50aWNhdG9ycy4NCj4+ DQo+PiA+IFRoaXMgcHJvcGVydHkgbWFrZXMgaXQgZGlmZmljdWx0IHRvIGZvcm1hbGx5IHBy b3ZlIHRoYXQgYSBzZXJ2ZXIgaXMgDQo+PiBqb2ludGx5IGF1dGhvcml0YXRpdmUgb3ZlciBt dWx0aXBsZSBpZGVudGl0aWVzLCByYXRoZXIgdGhhbiANCj4+IGluZGl2aWR1YWxseSBhdXRo b3JpdGF0aXZlIG92ZXIgZWFjaC4NCj4+DQo+PiBXaGljaCBwcm9wZXJ0eT8gSSBjb3VsZG4n dCBwYXJzZSBpdCBob3cgaXQgd2FzIGRlcml2ZWQgZnJvbSB0aGUgDQo+PiBzdGF0ZW1lbnRz IGFib3ZlIGl0Lg0KPj4NCj4+ICMjICpTdGF0ZSoNCj4+DQo+PiBSRkMgdXNlcyAzeCJzdGF0 ZSIgYnV0IG5ldmVyIGRlZmluZXMgaXQuIFdoYXQgZXhhY3RseSBkb2VzIGl0IGVudGFpbCAN Cj4+IGluIHRoaXMgY29udGV4dD8gVGhlIG1vc3QgaW1wb3J0YW50IGZvciBtZSBpcyB0aGUg b25lIGluIHNlY3VyaXR5IA0KPj4gY29uc2lkZXJhdGlvbnMuDQo+Pg0KPj4gPiBUaGUgYXBw bGljYXRpb24gaW4gcG9zc2Vzc2lvbiBvZiBhIHZhbGlkYXRlZCBhdXRoZW50aWNhdG9yIGNh biByZWx5IA0KPj4gb24gYW55IHNlbWFudGljcyBhc3NvY2lhdGVkIHdpdGggZGF0YSBpbiB0 aGUgY2VydGlmaWNhdGVfcmVxdWVzdF9jb250ZXh0Lg0KPj4NCj4+IEkgY291bGRuJ3QgcGFy c2XCoGFib3ZlIHF1b3RlZCBzdGF0ZW1lbnQuIFdoYXQgZG9lcyBpdCBtZWFuPyBBcyBwZXIg DQo+PiBzY29wZSBtZW50aW9uZWQgYWJvdmUsIENsaWVudCB2YWxpZGF0ZXMgQXV0aGVudGlj YXRvci4NCj4+DQo+PiAjIyAqVExTIExheWVyKg0KPj4NCj4+IFJGQyB1c2VzIFRMUyBsYXll ciwgYW5kIEkgZG9uJ3QgZmluZCBhbnkgZGVmaW5pdGlvbiBvZiB0aGlzIGluIHRoaXMgDQo+ PiBkb2N1bWVudCBvciBpbiBSRkM4NDQ2YmlzLiBJbiBwYXJ0aWN1bGFyLCBkb2VzIGl0IG1l YW4gdGhlIGVuZCBvZiANCj4+IGhhbmRzaGFrZSBwcm90b2NvbD8gT3IgZG9lcyBpdCBpbmNs dWRlIHRoZSBBdXRoZW50aWNhdG9yIFJlcXVlc3QgYW5kwqAgDQo+PiBBdXRoZW50aWNhdG9y IHRvbz8gSSBhbSBhIGJpdCBjb25mdXNlZCBiZWNhdXNlIFNlY3Rpb24gNyBzYXlzIHRoZSAN Cj4+IG1lc3NhZ2VzIFNIT1VMRCBiZSBpbXBsZW1lbnRlZCBpbnNpZGUgdGhlIFRMUyBsaWJy YXJ5Lg0KPj4NCj4+DQo+PiAjICooSG9wZWZ1bGx5KSBzb21lIG5pdHMqDQo+Pg0KPj4gIyMg KkVBIHZzLiAiRXhwb3J0ZWQgQXV0aGVudGljYXRvciIgdnMuICJBdXRoZW50aWNhdG9yIioN Cj4+DQo+PiBFQSBpcyB1c2VkIGJ1dCBuZXZlciBkZWZpbmVkLiBJcyBpdCBhbnkgZGlmZmVy ZW50IGZyb20gIkV4cG9ydGVkIA0KPj4gQXV0aGVudGljYXRvciIgdXNlZCBpbiB0aGUgc2Ft ZSBzZW50ZW5jZT8NCj4+DQo+PiBIb3cgZXhhY3RseSBhcmUgYm90aCBvZiB0aGVtIGRpZmZl cmVudCBmcm9tICJBdXRoZW50aWNhdG9yIiBkZWZpbmVkIA0KPj4gaW4gU2VjdGlvbiA1Pw0K Pj4NCj4+ICMjICpMb3dlci1jYXNlIHZzLiBVcHBlci1jYXNlKg0KPj4NCj4+IEluIFNlY3Rp b24gMyAoYW5kIGluIGdlbmVyYWwpLCBpcyB0aGVyZSBhIHN1YnRsZSBkaWZmZXJlbmNlIGJl dHdlZW4gDQo+PiAiQXV0aGVudGljYXRvciIgYW5kICJhdXRoZW50aWNhdG9yIj8gU2ltaWxh cmx5LCAiQXV0aGVudGljYXRvciANCj4+IFJlcXVlc3QiIGFuZCAiYXV0aGVudGljYXRvciBy ZXF1ZXN0Ii4NCj4+DQo+PiAjIyAqImV4cG9ydGVyIHZhbHVlIiB2cy4gImV4cG9ydGVkIHZh bHVlIioNCj4+DQo+PiBJcyB0aGVyZSBhIHN1YnRsZSBkaWZmZXJlbmNlIGJldHdlZW4gImV4 cG9ydGVyIHZhbHVlIiBhbmQgImV4cG9ydGVkIA0KPj4gdmFsdWUiPw0KPj4NCj4+DQo+PiBU aGFua3MuDQo+Pg0KPj4gLVVzYW1hDQo+Pg0KPj4NCj4+IFswXSBodHRwczovL2dpdGh1Yi5j b20vY2xvdWRmbGFyZS9vcGFxdWUtZWENCj4+DQo+PiBbMV0gDQo+PiBodHRwczovL2dpdGh1 Yi5jb20vY2xvdWRmbGFyZS9vcGFxdWUtZWE/dGFiPXJlYWRtZS1vdi1maWxlI2xpYnJhcnkt cGFja2FnZXMNCj4+DQo+PiBbMl0gDQo+PiBodHRwczovL2dpdGh1Yi5jb20vY2xvdWRmbGFy ZS9vcGFxdWUtZWEvYmxvYi9tYXN0ZXIvc3JjL2V4cGF1dGgvdGxzX21lc3NhZ2VzLmdvDQo+ Pg0KPj4gWzNdIGh0dHBzOi8vZ2l0aHViLmNvbS90YXRpYW5hYi9taW50DQo+Pg0KPj4gWzRd IGh0dHBzOi8vZ2l0aHViLmNvbS9JbnJpYS1Qcm9zZWNjby9yZWZ0bHMNCj4+DQo+PiBbNV0g aHR0cHM6Ly9naXRodWIuY29tL2thcnRoaWtiaGFyZ2F2YW4NCj4+DQo= --------------d1pPtLztLq0I0v4wjXEYv3H7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Hi UFMRG and CFRG,

I didn't get any answer/opinion at TLS WG. So I wanted to check if someone here has any answer/opinion.

Best regards,

-Usama


On 12.02.26 13:59, Muhammad Usama Sardar wrote:

Just a reminder that it's not necessary to answer all<= /i> the questions :) Whatever answers/opinions anyone has are welcome.

Given lack of clarity, we are basically making assumptions, which may not match the intentions of the WG.

Thanks.

-Usama


On 03.02.26 21:08, Muhammad Usama Sardar wrote:

[ Sorry for the length ]

Hi Nick, all,

Thank you for the work on RFC9261. We found it a useful foundation for our work.

# Context

Four developers (Peg Jones from Flashbots, Markus Rudy from Edgeless Systems, Ayoub Benaissa from Zama, and Pavel Nikonorov from GA4GH and Elixir Europe) are developing implementations of RFC 9261. I am doing the formal analysis in ProVerif. We request the following clarifications.

# Scope

I basically care about TLS 1.3 only. While many things apply to DTLS 1.3=C2=A0as well as TLS 1.2, the scope of my questions = is only limited to TLS 1.3 only.

Of the three options in Section 3, I care about Server Authentication. That is, Client Authentication and Spontaneous Server Authentication are out of scope of this email.

While Authenticators can be conveyed "out of band" as mentioned in RFC (which I don't really see why), let's say I put it out of scope. When there is already an established connection, then I think it is preferable to use that. So let's say Authenticator Request and Authenticator are sent over the connection established by the handshake (and hence "out of band" being out of scope).

For further simplicity, let's say Server does not send CertificateRequest during the handshake, so the client authentication is not done during the handshake.

# Known implementation

The only public implementation currently known to us is Cloudflare's opaque-ea [0], which as acknowledged [1] by Cloudflare, is a partial implementation of RFC9261. It implements TLS messages here [2] and is based on mint [3] - a minimal TLS 1.3 stack for learning purposes. Is there any other open-source implementation?

For future, could we please reference the implementations within the RFCs (either in text or in "additional resources" in datatracker) to avoid the trouble to find it?

The developers are ultimately aiming at code that they will use in production.


# Security considerations

I agree with the last paragraph of security considerations, but couldn't parse the 2nd paragraph (see below).

## Formal analysis in ProVerif

I am trying to understand the security considerations of RFC9261. It acknowledges Karthik for suggestions on security considerations. Does someone happen to recall whether he actually did some formal analysis in ProVerif or was it based on his intuition? If the former, could someone point me to the analysis? I did check reftls repo [4] which does not contain it. I also checked his personal repos [5] but could not find something relevant.

I know some formal analysis was done in Tamarin but I would like to compare my ProVerif model with his model, if he had one.

For future, could we please reference the formal analysis within the RFCs (either in text or in "additional resources" in datatracker) to avoid the trouble to find it?

## 2nd paragraph

A whole lot of my trouble is understanding what is being reasoned in this paragraph and how this is leading to the first bullet as a conclusion. Could someone explain? For example:

> Authenticators are independent and unidirectional.

"Independent" of what? Authenticator would use the certific= ate_request_context from Authenticator Request, so=C2=A0Authenticator is not independent of Authenticator Request, right? If Authenticator is independent of Authenticator Request, then what prevents replay attacks? (Recall Spontaneous Server Authentication is out of scope of my email. One could argue that is still in scope for RFC but the quoted statement in RFC comes without qualifier and logically should apply to all cases.)

"Unidirectional" in what sense? The whole idea of RFC9261 in my mind is to enable the server to send Authenticators too, since after the handshake, RFC8446bis allows only the Client to authenticate itself and not the Server [Sec. 4.2.6 and 4.6.2 of 8446bis]. To me, RFC9261 is bidirectional, as both server and client can generate Authenticators.

> This property makes it difficult to formally prove that a server is jointly authoritative over multiple identities, rather than individually authoritative over each.

Which property? I couldn't parse it how it was derived from the statements above it.

## State

RFC uses 3x"state" but never defines it. What exactly does it entail in this context? The most important for me is the one in security considerations.

> The application in possession of a validated authenticator can rely on any semantics associated with data in the certificate_request_context.

I couldn't parse=C2=A0above quoted statement. What does it mea= n? As per scope mentioned above, Client validates Authenticator.

## TLS Layer

RFC uses TLS layer, and I don't find any definition of this in this document or in RFC8446bis. In particular, does it mean the end of handshake protocol? Or does it include the Authenticator Request and=C2=A0 Authenticator too? I am a bit confused because Section 7 says the messages SHOULD be implemented inside the TLS library.


# (Hopefully) some nits

## EA vs. "Exported Authenticator" vs. "Authenticator"

EA is used but never defined. Is it any different from "Exported Authenticator" used in the same sentence?=C2=A0

How exactly are both of them different from "Authenticator" defined in Section 5?

## Lower-case vs. Upper-case

In Section 3 (and in general), is there a subtle difference between "Authenticator" and "authenticator"? Similarly, "Authenticator Request" and "authenticator request".

## "exporter value" vs. "exported value"

Is there a subtle difference between "exporter value" and "exported value"?


Thanks.

-Usama


[0] https://github.com/cloudflare/opaque= -ea

[1] https://github.com/cloudflare/opaque= -ea?tab=3Dreadme-ov-file#library-packages

[2] https://github.com/cloudflare/opaque= -ea/blob/master/src/expauth/tls_messages.go

[3] https://github.com/tatianab/mint=

[4] https://github.com/Inria-Prosecco/re= ftls

[5] https://github.com/karthikbhargavan<= /a>

--------------d1pPtLztLq0I0v4wjXEYv3H7-- --------------ms090608060408030208050405 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgMFADCABgkqhkiG9w0BBwEAAKCC DlwwggbmMIIEzqADAgECAhAxAnDUNb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQsw CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAwMDBaFw0zMzA1MDEyMzU5 NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQD ExNHRUFOVCBQZXJzb25hbCBDQSA0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA s0riIl4nW+kEWxQENTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo 7p7yeORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yehHhDjUdyM yT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRMtOhkvGpLuzL8m+LTAQWv QJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZzVKTNORvPrGPRLnJ0EEVCHR82LL6oz91 5WkrgeCY9ImuulBn4uVsd9ZpubCgM/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8B S3bgK6AxdSMROND6hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnb LvWpXv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEdSLKvz8+0 wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4n6zFp2pyYUOiuzP+as/A Znz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4hxnWZOy0vhfDR/g3aJbdsGac+diahjEwz yB+UKJOCyzvecG8bZ/u/U8PsEMZg07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5 v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNV HQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAgYI KwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2Vj dGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNv bS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRq MGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FB ZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTAN BgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rjAcx43D9Hl110Q+BABABg lkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0xdKut8zMazv8/4VMKPCA3EUS0tDUoL01u gDdqwlyXuYizeXyH2ICAQfXMtS+raz7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgj KDYx4hdZ9G2o+oLlHhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlP otv5N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImDQFerHW9b KzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2puNSm4b9uVjBbPO9V6sFS G+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0x XZor4N9tnzD0Fo0JDIURjDPEgo5WTdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZ lHqMFxdw9XRZQgrP+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq 3O4pls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUwggduMIIFVqAD AgECAhA/YCOTOabjcS/HTP8f2MRxMA0GCSqGSIb3DQEBDAUAMEYxCzAJBgNVBAYTAk5MMRkw FwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0 MB4XDTI0MTExOTAwMDAwMFoXDTI2MTExOTIzNTk1OVowgdoxCzAJBgNVBAYTAkRFMRAwDgYD VQQIEwdTYWNoc2VuMSgwJgYDVQQKEx9UZWNobmlzY2hlIFVuaXZlcnNpdGFldCBEcmVzZGVu MREwDwYDVQRhEwhHT1ZERStTTjEyMDAGCSqGSIb3DQEJARYjbXVoYW1tYWRfdXNhbWEuc2Fy ZGFyQHR1LWRyZXNkZW4uZGUxDzANBgNVBAQTBlNhcmRhcjEXMBUGA1UEKhMOTXVoYW1tYWQg VXNhbWExHjAcBgNVBAMTFU11aGFtbWFkIFVzYW1hIFNhcmRhcjCCAiIwDQYJKoZIhvcNAQEB BQADggIPADCCAgoCggIBAKhTeUVDqbjfDFmkVrgQMFC3S4O0vjW9zjlrkD8FrZ2ipCLuiNE2 XHibuTw57N2lrcWMRqjw/Tv7WqpasIHjIlvE5SJ+VuOzu5P0xLqfroT4MSlKIq1LyXkL1u09 A9EuCUxhf4Uc3Ir17VYzjS7meqv4+4yoVhnL9zepze8f0FG3EJmGJlBSJ8sD6dVxGQkDLWMf NNt/I8wkaQSFkzvd+KppPOjc4t4JtQWIHKPMKS3lbXv8RLO1jaPO9Fdfg4D/dq5I8fsnfg6y gmCL+nTsHWAXqgX8vcDVG5tz5ONzHgODtItrQWO+m4d8W16JWCbMMCFIqscZ5weRfS5dSFZk sptipqIm5tzUL3y2/VOFCiL/tofo7yA1bHnFXUGm2LkJVNx6pDZFh1G9OYPqmrjjSxL9E/ed xQ1lIe3GmBJGBUFldlP8STm3WapaatgNcuQ6HXX1HexWF14NBIguNajgOR17JxX0JS4t9o5f 3Po+Nqa/Als1Mm9Q6PACcVRhm7yH4vj3UqGcjAps6YM/HDkNoA2qsHmqZ/ya15eIORADN+ZQ O7hJYBH5TJprVdGXL7aTLNJh6xEn5V9TFcsT017ocQ5bJteN6caUay/0zPenwtabuSLR6y7e gmx8gTF4oPDUlgkaNcKAmkyzwM+IzPNIJvyxq/NI1pQRyTGUQJYyExO7AgMBAAGjggHBMIIB vTAfBgNVHSMEGDAWgBRpAKHHIVj44MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQU4R79RPVSVexS +el1ZxCchmYs1akwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYI KwYBBQUHAwQGCCsGAQUFBwMCMFAGA1UdIARJMEcwOgYMKwYBBAGyMQECAQoEMCowKAYIKwYB BQUHAgEWHGh0dHBzOi8vc2VjdGlnby5jb20vU01JTUVDUFMwCQYHZ4EMAQUDAjBCBgNVHR8E OzA5MDegNaAzhjFodHRwOi8vR0VBTlQuY3JsLnNlY3RpZ28uY29tL0dFQU5UUGVyc29uYWxD QTQuY3JsMHgGCCsGAQUFBwEBBGwwajA9BggrBgEFBQcwAoYxaHR0cDovL0dFQU5ULmNydC5z ZWN0aWdvLmNvbS9HRUFOVFBlcnNvbmFsQ0E0LmNydDApBggrBgEFBQcwAYYdaHR0cDovL0dF QU5ULm9jc3Auc2VjdGlnby5jb20wLgYDVR0RBCcwJYEjbXVoYW1tYWRfdXNhbWEuc2FyZGFy QHR1LWRyZXNkZW4uZGUwDQYJKoZIhvcNAQEMBQADggIBAIxymCHDahevSfae44bVKxAKDRLh ZVraNygdRQ2RQOkz8v8b/cl5yuWR/l3yMpIrwiDWT37UQibNuoPxaZeRBjDh8ItcUP51sOAV 7zd3GwfyUJNYKmgd6LjfE8+mkXrVU2JffVjRUgiyy7eBTzvTz5PFUQh2oqWfTh/Oz3pFXV+/ 0K3eP+fNkr0gljmEZi/h0ici5cJ+Q9J/Zx6Vg9ke2qb6PIh+zeb5oL40i7FR875NX/WGKMib ojTopS5xPbo0KmN64FqgasfJW03t0wyTtcYOap6tw2RcfVpjfsXQqEfjdjyrNHH6l/TDxUoL cNlu0zkYHMYmJ6MJ6VwaHWB5hou9N0WWrcQotsfkpf7lGZSlum9jG5/uB+d3FLK00QM99XN7 RhLbLOKKuw2Xri3MEcN/LvIRDIHef4uoONAI+4bOW+1wFmGwqpHYxA/JoUXoRjojuAon8lCF uVf3tFAkQ/V8zuPxCX36gEOsyQuK3IAeS8R8qhV5Cc+dcYDKid61AluluBcUSxfKxmoK19Mm f39FTD+bJpBCiEAdJuZfP6TD0dtBVcgJ4dBLZ4H13WBeVZRDXcxghYJcNWFHPa/qi20jmuUs CvcD4z2+LBFnVrwhOeBefYjm6zy7+9IbuomR11B4+AnLkjzTBZxcX17UMWyqVe4hZN2CsVS0 7doWTJJYMYIEWDCCBFQCAQEwWjBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQgVmVy ZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIQP2Ajkzmm43Evx0z/H9jE cTANBglghkgBZQMEAgMFAKCCAc8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG 9w0BCQUxDxcNMjYwMjE2MjIwNTIyWjBPBgkqhkiG9w0BCQQxQgRAGZNmXadorVsqdnDf9Yur EyAIGp6P0eK06jAJC64iaX5OyXCSUv04LEr6dBhvSO6zi6OSm7wOK7WUJkuaPfC/VjBpBgkr BgEEAYI3EAQxXDBaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5n MRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhA/YCOTOabjcS/HTP8f2MRxMGsGCyqG SIb3DQEJEAILMVygWjBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQgVmVyZW5pZ2lu ZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIQP2Ajkzmm43Evx0z/H9jEcTBsBgkq hkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYI KoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0G CSqGSIb3DQEBAQUABIICAGLIZ6UpXLANRLj17J4Z2eVHbEYNh6Re5q8ruGQxpV8+P5hVtPyu MZS+UmJk7wuP2QfviTyxoNDq6+hDJi8YpaT+3JottR+zLVgzptZlrM0UQm7U2N0BEwDBQjYS 5inLL0LIEqj3CUqgWRNKwDr/orjAttvXmhGZQTFSE9KX8kebss5q0iCo8UaWnApuLMKk7iK5 HqJjTPndDhlpWFa4y39AudiTB6TXCeEB9YTkM2DhBpt4YcHWAb1FiH1RGzfzN7vTdGp75QQ+ XyVtKvj/4Cwz5GlG/eMVVgJ76gMrRxrtbLbRwJubS2Qdf98rggjDNpZ+K6geQbn3YeLWfY/o FM/fPCXF6R0ysmKzXtxH6iB6g2xuRC6czw0WCJ9lasn0KpkxEqvxJi4jBcCj2KDUNAUQyxSS rIc3bpGeLl+KP2AM9IADWbjE4Eve+RFB+lYIQra2kWzsSbIUTy3xtIL2co26xXsCUw8k6+LZ cnPhKjs+zvqO3cctPiuzbgJEwM2m+b3EONFmmVCPQrEBgl7ZHif31ypBiSaHMks8dreacuOl rbupSUjEcDV5SPPKyAFJGRESY4wihghdD2mqp2jrA+WvPxUUQXlOERyGK0muvJA51dF+K5Bk k5+44mlnEeTbwwd1DTeQZiMI6Io7WxIqxL0kmiBYydu9cKO9STNrefEMAAAAAAAA --------------ms090608060408030208050405--