rfc9684.original.xml   rfc9684.xml 
<?xml version='1.0' encoding='utf-8'?> <?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.35 (Ruby 2.5. <!DOCTYPE rfc [
1) --> <!ENTITY nbsp "&#160;">
<!DOCTYPE rfc SYSTEM "rfc2629-xhtml.ent"> <!ENTITY zwsp "&#8203;">
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft <!ENTITY nbhy "&#8209;">
-ietf-rats-yang-tpm-charra-23" category="std" consensus="true" tocInclude="true" <!ENTITY wj "&#8288;">
sortRefs="true" symRefs="true" version="3"> ]>
<!-- xml2rfc v2v3 conversion 2.46.0 -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902"
docName="draft-ietf-rats-yang-tpm-charra-21" number="9684" submissionType="IETF"
category="std" consensus="true" tocInclude="true" sortRefs="true" symRefs="true"
updates="" obsoletes="" xml:lang="en" version="3">
<front> <front>
<title abbrev="YANG-CHARRA for TPMs">A YANG Data Model for Challenge-Respons <title abbrev="YANG Data Model for CHARRA Procedures">A YANG Data Model for
e-based Remote Attestation Procedures using TPMs</title> Challenge-Response-Based Remote Attestation (CHARRA) Procedures Using Trusted Pl
<seriesInfo name="Internet-Draft" value="draft-ietf-rats-yang-tpm-charra-23" atform Modules (TPMs)</title>
/> <seriesInfo name="RFC" value="9684"/>
<author initials="H." surname="Birkholz" fullname="Henk Birkholz"> <author initials="H." surname="Birkholz" fullname="Henk Birkholz">
<organization abbrev="Fraunhofer SIT">Fraunhofer SIT</organization> <organization abbrev="Fraunhofer SIT">Fraunhofer SIT</organization>
<address> <address>
<postal> <postal>
<street>Rheinstrasse 75</street> <street>Rheinstrasse 75</street>
<city>Darmstadt</city> <city>Darmstadt</city>
<code>64295</code> <code>64295</code>
<country>Germany</country> <country>Germany</country>
</postal> </postal>
<email>henk.birkholz@ietf.contact</email> <email>henk.birkholz@ietf.contact</email>
skipping to change at line 56 skipping to change at line 64
<author initials="B." surname="Sulzen" fullname="Bill Sulzen"> <author initials="B." surname="Sulzen" fullname="Bill Sulzen">
<organization abbrev="Cisco">Cisco Systems</organization> <organization abbrev="Cisco">Cisco Systems</organization>
<address> <address>
<email>bsulzen@cisco.com</email> <email>bsulzen@cisco.com</email>
</address> </address>
</author> </author>
<author initials="L." surname="Xia" fullname="Liang Xia (Frank)"> <author initials="L." surname="Xia" fullname="Liang Xia (Frank)">
<organization abbrev="Huawei">Huawei Technologies</organization> <organization abbrev="Huawei">Huawei Technologies</organization>
<address> <address>
<postal> <postal>
<street>101 Software Avenue, Yuhuatai District</street> <extaddr>Yuhuatai District</extaddr>
<street>101 Software Avenue</street>
<city>Nanjing</city> <city>Nanjing</city>
<region>Jiangsu</region> <region>Jiangsu</region>
<code>210012</code> <code>210012</code>
<country>China</country> <country>China</country>
</postal> </postal>
<email>Frank.Xialiang@huawei.com</email> <email>Frank.Xialiang@huawei.com</email>
</address> </address>
</author> </author>
<author initials="T." surname="Laffey" fullname="Tom Laffey"> <author initials="T." surname="Laffey" fullname="Tom Laffey">
<organization abbrev="HPE">Hewlett Packard Enterprise</organization> <organization abbrev="HPE">Hewlett Packard Enterprise</organization>
<address> <address>
<email>tom.laffey@hpe.com</email> <email>tom.laffey@hpe.com</email>
</address> </address>
</author> </author>
<author initials="G." surname="Fedorkow" fullname="Guy C. Fedorkow"> <author initials="G. C." surname="Fedorkow" fullname="Guy C. Fedorkow">
<organization abbrev="Juniper">Juniper Networks</organization> <organization abbrev="Juniper">Juniper Networks</organization>
<address> <address>
<postal> <postal>
<street>10 Technology Park Drive</street> <street>10 Technology Park Drive</street>
<city>Westford</city> <city>Westford</city>
<region>Massachusetts</region> <region>Massachusetts</region>
<code>01886</code> <code>01886</code>
<country>United States of America</country>
</postal> </postal>
<email>gfedorkow@juniper.net</email> <email>gfedorkow@juniper.net</email>
</address> </address>
</author> </author>
<date year="2024" month="July" day="29"/> <date year="2024" month="November"/>
<area>Security</area> <area>sec</area>
<workgroup>RATS Working Group</workgroup> <workgroup>rats</workgroup>
<keyword>Internet-Draft</keyword>
<abstract>
<?line 236?>
<t>This document defines YANG Remote Procedure Calls (RPCs) and a few configurat <keyword>TPM</keyword>
ion nodes required to retrieve attestation evidence about integrity measurements <abstract>
from a device, following the operational context defined in TPM-based Network D <t>This document defines the YANG Remote Procedure Calls (RPCs) and config
evice Remote Integrity Verification. Complementary measurement logs are also pro uration nodes that are required to retrieve attestation evidence about integrity
vided by the YANG RPCs, originating from one or more roots of trust for measurem measurements from a device, following the operational context defined in RFC 96
ent (RTMs). The module defined requires at least one TPM 1.2 or TPM 2.0 as well 83 "TPM-based Network Device Remote Integrity Verification". Complementary measu
as a corresponding TPM Software Stack (TSS), or equivalent hardware implementati rement logs originating from one or more Roots of Trust for Measurement (RTMs) a
ons that include the protected capabilities as provided by TPMs as well as a cor re also provided by the YANG RPCs. The defined module requires the inclusion of
responding software stack, included in the device components of the composite de the following in the device components of the composite device on which the YAN
vice the YANG server is running on.</t> G server is running: at least one Trusted Platform Module (TPM) of either versio
n 1.2 or 2.0 as well as a corresponding TPM Software Stack (TSS), or an equivale
nt hardware implementation that includes the protected capabilities as provided
by TPMs as well as a corresponding software stack.</t>
</abstract> </abstract>
</front> </front>
<middle> <middle>
<?line 240?> <section anchor="introduction">
<section anchor="introduction">
<name>Introduction</name> <name>Introduction</name>
<t>This document is based on the general terminology defined in the <xref <t>This document is based on the general terminology defined in Remote ATt
target="RFC9334"/> and uses the operational context defined in <xref target="I-D estation procedureS (RATS) architecture <xref target="RFC9334"/> and uses the op
.ietf-rats-tpm-based-network-device-attest"/> as well as the interaction model a erational context defined in <xref target="RFC9683"/> as well as the interaction
nd information elements defined in <xref target="I-D.ietf-rats-reference-interac model and information elements defined in <xref target="I-D.ietf-rats-reference
tion-models"/>. The currently supported hardware security modules (HSMs) are the -interaction-models"/>. The currently supported hardware security modules (HSMs)
Trusted Platform Modules (TPMs) <xref target="TPM1.2"/> and <xref target="TPM2. are the Trusted Platform Modules (TPMs) <xref target="TPM1.2"/> <xref target="T
0"/> as specified by the Trusted Computing Group (TCG). One TPM, or multiple TPM PM2.0"/> as specified by the Trusted Computing Group (TCG). One TPM, or multiple
s in the case of a Composite Device, are required in order to use the YANG modul TPMs in the case of a composite device, is required in order to use the YANG mo
e defined in this document. Each TPM is used as a root of trust for storage (RTS dule defined in this document. Each TPM is used as a Root of Trust for Storage (
) in order to store system security measurement Evidence. And each TPM is used RTS) in order to store system security measurement Evidence. And each TPM is us
as a root of trust for reporting (RTR) in order to retrieve attestation Evidence ed as a Root of Trust for Reporting (RTR) in order to retrieve attestation Evide
. This is done by using a YANG RPC to request a quote which exposes a rolling h nce. This is done by using a YANG RPC to request a quote that exposes a rolling
ash of the security measurements held internally within the TPM.</t> hash of the security measurements held internally within the TPM.</t>
<t>Specific terms imported from <xref target="RFC9334"/> and used in this <t>Specific terms imported from <xref target="RFC9334"/> and used in this
document include: Attester, Composite Device, Evidence.</t> document include Attester, composite device, and Evidence.</t>
<t>Specific terms imported from <xref target="TPM2.0-Key"/> and used in th <t>Specific terms imported from <xref target="TPM2.0-Key"/> and used in th
is document include: Endorsement Key (EK), Initial Attestation Key (IAK), Attest is document include Endorsement Key (EK), Initial Attestation Key (IAK), Attesta
ation Identity Key (AIK), Local Attestation Key (LAK).</t> tion Identity Key (AIK), and Local Attestation Key (LAK).</t>
<section anchor="requirements-notation"> <section anchor="requirements-notation">
<name>Requirements notation</name> <name>Requirements Notation</name>
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL <t>
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
"MAY", and "OPTIONAL" in this document are to be interpreted as "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>
described in BCP&nbsp;14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, ",
and only when, they "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
appear in all capitals, as shown here. "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
<?line -6?> "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to
be
interpreted as described in BCP&nbsp;14 <xref target="RFC2119"/> <xref
target="RFC8174"/> when, and only when, they appear in all capitals, as
shown here.
</t> </t>
</section> </section>
</section> </section>
<section anchor="the-yang-module-for-basic-remote-attestation-procedures"> <section anchor="the-yang-module-for-basic-remote-attestation-procedures">
<name>The YANG Module for Basic Remote Attestation Procedures</name> <name>The YANG Module for Basic Remote Attestation Procedures</name>
<t>One or more TPMs MUST be embedded in a Composite Device that provides a ttestation Evidence via the YANG module defined in this document. The ietf-tpm-r emote-attestation YANG module enables a composite device to take on the role of an Attester, in accordance with the Remote Attestation Procedures (RATS) archite cture <xref target="RFC9334"/>, and the corresponding challenge-response interac tion model defined in the <xref target="I-D.ietf-rats-reference-interaction-mode ls"/> document. A fresh nonce with an appropriate amount of entropy <xref target ="NIST-915121"/> MUST be supplied by the YANG client in order to enable a proof- of-freshness with respect to the attestation Evidence provided by the Attester r unning the YANG datastore. Further, this nonce is used to prevent replay attacks . The method for communicating the relationship of each individual TPM to specif ic measured component within the Composite Device is out of the scope of this do cument.</t> <t>One or more TPMs <bcp14>MUST</bcp14> be embedded in a composite device that provides attestation Evidence via the YANG module defined in this document. The ietf-tpm-remote-attestation YANG module enables a composite device to take on the role of an Attester, in accordance with the RATS architecture <xref targe t="RFC9334"/> and the corresponding challenge-response interaction model defined in <xref target="I-D.ietf-rats-reference-interaction-models"/>. A fresh nonce w ith an appropriate amount of entropy <xref target="NIST-915121"/> <bcp14>MUST</b cp14> be supplied by the YANG client in order to enable a proof-of-freshness wit h respect to the attestation Evidence provided by the Attester running the YANG datastore. Further, this nonce is used to prevent replay attacks. The method for communicating the relationship of each individual TPM to the specific measured component within the composite device is out of the scope of this document.</t>
<section anchor="yang-modules"> <section anchor="yang-modules">
<name>YANG Modules</name> <name>YANG Modules</name>
<t>In this section the several YANG modules are defined.</t> <t>In this section, the two YANG modules are defined.</t>
<section anchor="ietf-tpm-remote-attestation"> <section anchor="ietf-tpm-remote-attestation">
<name>'ietf-tpm-remote-attestation'</name> <name>ietf-tpm-remote-attestation</name>
<t>This YANG module imports modules from <xref target="RFC6991"/> with <t>This YANG module imports modules from <xref target="RFC6991"/> with
prefix 'yang', <xref target="RFC8348"/> with prefix 'hw', <xref target="I-D.iet prefix 'yang', <xref target="RFC8348"/> with prefix 'hw', <xref target="RFC9642
f-netconf-keystore"/> with prefix 'ks', and 'ietf-tcg-algs.yang' <xref target="r "/> with prefix 'ks', and ietf-tcg-algs.yang <xref target="ref-ietf-tcg-algs"/>
ef-ietf-tcg-algs"/> with prefix 'taa'. Additionally, references are made to <xr with prefix 'taa'. Additionally, references are made to <xref target="RFC6933"/
ef target="RFC8032"/>, <xref target="RFC8017"/>, <xref target="RFC6933"/>, <xref >, <xref target="TPM1.2-Commands"/>, <xref target="TPM2.0-Arch"/>, <xref target=
target="TPM1.2-Commands"/>, <xref target="TPM2.0-Arch"/>, <xref target="TPM2.0- "TPM2.0-Structures"/>, <xref target="TPM2.0-Key"/>, <xref target="TPM1.2-Structu
Structures"/>, <xref target="TPM2.0-Key"/>, <xref target="TPM1.2-Structures"/>, res"/>, <xref target="BIOS-Log"/>, and <xref target="CEL"/>, as well as <xref ta
<xref target="bios-log"/>, <xref target="BIOS-Log-Event-Type"/>, as well as <xre rget="netequip-boot-log"/>.</t>
f target="ima"/> and <xref target="netequip-boot-log"/>.</t>
<section anchor="features"> <section anchor="features">
<name>Features</name> <name>Features</name>
<t>This module supports the following features:</t> <t>This module supports the following features:</t>
<ul spacing="normal"> <dl spacing="normal">
<li>'mtpm': Indicates that multiple TPMs on the device can support <dt>'mtpm':</dt><dd>Indicates that multiple TPMs on the device can
remote attestation. For example, this feature could be used in cases where mult support remote attestation. For example, this feature could be used in cases wh
iple line cards are present, each with its own TPM.</li> ere multiple line cards are present, each with its own TPM.</dd>
<li>'bios': Indicates that the device supports the retrieval of BI <dt>'bios':</dt><dd>Indicates that the device supports the retriev
OS/UEFI event logs. <xref target="bios-log"/></li> al of BIOS and Unified Extensible Firmware Interface (UEFI) event logs <xref tar
<li>'ima': Indicates that the device supports the retrieval of eve get="BIOS-Log"/>.</dd>
nt logs from the Linux Integrity Measurement Architecture (IMA, see <xref target <dt>'ima':</dt><dd>Indicates that the device supports the retrieva
="ima"/>).</li> l of event logs from the Linux Integrity Measurement Architecture (IMA, see <xre
<li>'netequip_boot': Indicates that the device supports the retrie f target="ima"/>).</dd>
val of netequip boot event logs. See <xref target="ima"/> and <xref target="nete <dt>'netequip_boot':</dt><dd>Indicates that the device supports th
quip-boot-log"/>.</li> e retrieval of netequip boot event logs. See Appendixes <xref target="ima" forma
</ul> t="counter"/> and <xref target="netequip-boot-log" format="counter"/>.</dd>
</dl>
</section> </section>
<section anchor="identities"> <section anchor="identities">
<name>Identities</name> <name>Identities</name>
<t>This module supports the following types of attestation event log s: 'bios', 'ima', and 'netequip_boot'.</t> <t>This module supports the following types of attestation event log s: 'bios', 'ima', and 'netequip_boot'.</t>
</section> </section>
<section anchor="remote-procedure-calls-rpcs"> <section anchor="remote-procedure-calls-rpcs">
<name>Remote Procedure Calls (RPCs)</name> <name>Remote Procedure Calls (RPCs)</name>
<t>In the following, RPCs for both TPM 1.2 and TPM 2.0 attestation p rocedures are defined.</t> <t>In the following sections, RPCs for attestation procedures for bo th TPM 1.2 and TPM 2.0 are defined.</t>
<section anchor="tpm12-challenge-response-attestation"> <section anchor="tpm12-challenge-response-attestation">
<name>'tpm12-challenge-response-attestation'</name> <name>tpm12-challenge-response-attestation</name>
<t>This RPC allows a Verifier to request signed TPM PCRs (<em>TPM <t>This RPC allows a Verifier to request via the <em>TPM Quote</em
Quote</em> operation) from a TPM 1.2 compliant cryptoprocessor. Where the featur > operation, signed TPM Platform Configuration Registers (PCRs) from a cryptopro
e 'mtpm' is active, and one or more 'certificate-name' is not provided, all TPM cessor compliant with TPM 1.2. Where the feature 'mtpm' is active, and one or mo
1.2 compliant cryptoprocessors will respond. A YANG tree diagram of this RPC is re 'certificate-name' is not provided, all cryptoprocessors compliant with TPM 1
as follows:</t> .2 will respond. The YANG tree diagram of this RPC is as follows:</t>
<sourcecode type="TREE"> <sourcecode type="yangtree">
+---x tpm12-challenge-response-attestation {taa:tpm12}? +---x tpm12-challenge-response-attestation {taa:tpm12}?
+---w input +---w input
| +---w tpm12-attestation-challenge | +---w tpm12-attestation-challenge
| +---w pcr-index* pcr | +---w pcr-index* pcr
| +---w nonce-value binary | +---w nonce-value binary
| +---w certificate-name* certificate-name-ref | +---w certificate-name* certificate-name-ref
| {tpm:mtpm}? | {tpm:mtpm}?
+--ro output +--ro output
+--ro tpm12-attestation-response* [] +--ro tpm12-attestation-response* []
+--ro certificate-name certificate-name-ref +--ro certificate-name certificate-name-ref
+--ro up-time? uint32 +--ro up-time? uint32
+--ro TPM_QUOTE2? binary +--ro TPM_QUOTE2? binary
</sourcecode> </sourcecode>
</section> </section>
<section anchor="tpm20-challenge-response-attestation"> <section anchor="tpm20-challenge-response-attestation">
<name>'tpm20-challenge-response-attestation'</name> <name>tpm20-challenge-response-attestation</name>
<t>This RPC allows a Verifier to request signed TPM PCRs (<em>TPM <t>This RPC allows a Verifier to request signed TPM PCRs (<em>TPM
Quote</em> operation) from a TPM 2.0 compliant cryptoprocessor. Where the featur Quote</em> operation) from a cryptoprocessor compliant with TPM 2.0. Where the f
e 'mtpm' is active, and one or more 'certificate-name' is not provided, all TPM eature 'mtpm' is active, and one or more 'certificate-name' is not provided, all
2.0 compliant cryptoprocessors will respond. A YANG tree diagram of this RPC is cryptoprocessors compliant with TPM 2.0 will respond. The YANG tree diagram of
as follows:</t> this RPC is as follows:</t>
<sourcecode type="TREE"> <sourcecode type="yangtree">
+---x tpm20-challenge-response-attestation {taa:tpm20}? +---x tpm20-challenge-response-attestation {taa:tpm20}?
+---w input +---w input
| +---w tpm20-attestation-challenge | +---w tpm20-attestation-challenge
| +---w nonce-value binary | +---w nonce-value binary
| +---w tpm20-pcr-selection* [] | +---w tpm20-pcr-selection* []
| | +---w tpm20-hash-algo? identityref | | +---w tpm20-hash-algo? identityref
| | +---w pcr-index* pcr | | +---w pcr-index* pcr
| +---w certificate-name* certificate-name-ref | +---w certificate-name* certificate-name-ref
| {tpm:mtpm}? | {tpm:mtpm}?
+--ro output +--ro output
skipping to change at line 182 skipping to change at line 192
+--ro TPMS_QUOTE_INFO binary +--ro TPMS_QUOTE_INFO binary
+--ro quote-signature? binary +--ro quote-signature? binary
+--ro up-time? uint32 +--ro up-time? uint32
+--ro unsigned-pcr-values* [] +--ro unsigned-pcr-values* []
+--ro tpm20-hash-algo? identityref +--ro tpm20-hash-algo? identityref
+--ro pcr-values* [pcr-index] +--ro pcr-values* [pcr-index]
+--ro pcr-index pcr +--ro pcr-index pcr
+--ro pcr-value? binary +--ro pcr-value? binary
</sourcecode> </sourcecode>
<t>An example of an RPC challenge requesting PCRs 0-7 from a SHA-2 56 bank could look like the following:</t> <t>An example of an RPC challenge requesting PCRs 0-7 from a SHA-2 56 bank could look like the following:</t>
<artwork><![CDATA[ <sourcecode type="xml"><![CDATA[
<rpc message-id="101" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> <rpc message-id="101"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<tpm20-attestation-challenge <tpm20-attestation-challenge
xmlns="urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation"> xmlns="urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation">
<certificate-name> <certificate-name>
(identifier of a TPM signature key with which the Attester is (identifier of a TPM signature key with which the Attester is
supposed to sign the attestation data) supposed to sign the attestation data)
</certificate-name> </certificate-name>
<nonce> <nonce>
0xe041307208d9f78f5b1bbecd19e2d152ad49de2fc5a7d8dbf769f6b8ffdeab9 0xe041307208d9f78f5b1bbecd19e2d152ad49de2fc5a7d8dbf769f6b8ffdeab9
</nonce> </nonce>
<tpm20-pcr-selection> <tpm20-pcr-selection>
<tpm20-hash-algo <tpm20-hash-algo
xmlns="urn:ietf:params:xml:ns:yang:ietf-tcg-algs"> xmlns="urn:ietf:params:xml:ns:yang:ietf-tcg-algs">
TPM_ALG_SHA256 TPM_ALG_SHA256
</tpm20-hash-algo> </tpm20-hash-algo>
<pcr-index>0</pcr-index> <pcr-index>0</pcr-index>
<pcr-index>1</pcr-index> <pcr-index>1</pcr-index>
<pcr-index>2</pcr-index> <pcr-index>2</pcr-index>
<pcr-index>3</pcr-index> <pcr-index>3</pcr-index>
<pcr-index>4</pcr-index> <pcr-index>4</pcr-index>
<pcr-index>5</pcr-index> <pcr-index>5</pcr-index>
<pcr-index>6</pcr-index> <pcr-index>6</pcr-index>
<pcr-index>7</pcr-index> <pcr-index>7</pcr-index>
</tpm20-pcr-selection> </tpm20-pcr-selection>
</tpm20-attestation-challenge> </tpm20-attestation-challenge>
</rpc> </rpc>
]]></artwork> ]]></sourcecode>
<t>A successful response could be formatted as follows:</t> <t>A successful response could be formatted as follows:</t>
<artwork><![CDATA[ <sourcecode type="xml"><![CDATA[
<rpc-reply message-id="101" <rpc-reply message-id="101"
xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"> xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
<tpm20-attestation-response <tpm20-attestation-response
xmlns="urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation"> xmlns="urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation">
<certificate-name <certificate-name
xmlns="urn:ietf:params:xml:ns:yang:ietf-keystore"> xmlns="urn:ietf:params:xml:ns:yang:ietf-keystore">
(instance of Certificate name in the Keystore) (instance of certificate name in the keystore)
</certificate-name> </certificate-name>
<attestation-data> <attestation-data>
(raw attestation data, i.e., the TPM quote; this includes, (raw attestation data, i.e., the TPM quote; this includes,
among other information, a composite digest of requested PCRs, among other information, a composite digest of requested PCRs,
the nonce, and TPM 2.0 clock information.) the nonce, and TPM 2.0 clock information.)
</attestation-data> </attestation-data>
<quote-signature> <quote-signature>
(signature over attestation-data using the TPM key (signature over attestation-data using the TPM key
identified by sig-key-id) identified by sig-key-id)
</quote-signature> </quote-signature>
</tpm20-attestation-response> </tpm20-attestation-response>
</rpc-reply> </rpc-reply>
]]></artwork> ]]></sourcecode>
</section> </section>
</section> </section>
<section anchor="log-retrieval"> <section anchor="log-retrieval">
<name>'log-retrieval'</name> <name>log-retrieval</name>
<t>This RPC allows a Verifier to acquire the Evidence which was exte <t>This RPC allows a Verifier to acquire the Evidence that was exten
nded into specific TPM PCRs. A YANG tree diagram of this RPC is as follows:</t> ded into specific TPM PCRs. The YANG tree diagram of this RPC is as follows:</t>
<sourcecode type="TREE"> <sourcecode type="yangtree">
+---x log-retrieval +---x log-retrieval
+---w input +---w input
| +---w log-type identityref | +---w log-type identityref
| +---w log-selector* [] | +---w log-selector* []
| +---w name* string | +---w name* string
| +---w (index-type)? | +---w (index-type)?
| | +--:(last-entry) | | +--:(last-entry)
| | | +---w last-entry-value? binary | | | +---w last-entry-value? binary
| | +--:(index) | | +--:(index)
| | | +---w last-index-number? uint64 | | | +---w last-index-number? uint64
| | +--:(timestamp) | | +--:(timestamp)
| | +---w timestamp? yang:date-and-time | | +---w timestamp? yang:date-and-time
| +---w log-entry-quantity? uint16 | +---w log-entry-quantity? uint16
+--ro output +--ro output
+--ro system-event-logs +--ro system-event-logs
+--ro node-data* [] +--ro node-data* []
+--ro name? string +--ro name? string
+--ro up-time? uint32 +--ro up-time? uint32
+--ro log-result +--ro log-result
+--ro (attested_event_log_type) +--ro (attested_event_log_type)
+--:(bios) {bios}? +--:(bios) {bios}?
| +--ro bios-event-logs | +--ro bios-event-logs
| +--ro bios-event-entry* [event-number] | +--ro bios-event-entry* [event-number]
| +--ro event-number uint32 | +--ro event-number uint32
| +--ro event-type? uint32 | +--ro event-type? uint32
| +--ro pcr-index? pcr | +--ro pcr-index? pcr
| +--ro digest-list* [] | +--ro digest-list* []
| | +--ro hash-algo? identityref | | +--ro hash-algo? identityref
| | +--ro digest* binary | | +--ro digest* binary
| +--ro event-size? uint32 | +--ro event-size? uint32
| +--ro event-data* binary | +--ro event-data* binary
+--:(ima) {ima}? +--:(ima) {ima}?
| +--ro ima-event-logs | +--ro ima-event-logs
| +--ro ima-event-entry* [event-number] | +--ro ima-event-entry* [event-number]
| +--ro event-number uint64 | +--ro event-number uint64
| +--ro ima-template? string | +--ro ima-template? string
| +--ro filename-hint? string | +--ro filename-hint? string
| +--ro filedata-hash? binary | +--ro filedata-hash? binary
| +--ro filedata-hash-algorithm? string | +--ro filedata-hash-algorithm? string
| +--ro template-hash-algorithm? string | +--ro template-hash-algorithm? string
| +--ro template-hash? binary | +--ro template-hash? binary
| +--ro pcr-index? pcr | +--ro pcr-index? pcr
| +--ro signature? binary | +--ro signature? binary
+--:(netequip_boot) {netequip_boot}? +--:(netequip_boot) {netequip_boot}?
+--ro boot-event-logs +--ro boot-event-logs
+--ro boot-event-entry* [event-number] +--ro boot-event-entry* [event-number]
+--ro event-number uint64 +--ro event-number uint64
+--ro ima-template? string +--ro ima-template? string
+--ro filename-hint? string +--ro filename-hint? string
+--ro filedata-hash? binary +--ro filedata-hash? binary
+--ro filedata-hash-algorithm? string +--ro filedata-hash-algorithm? string
+--ro template-hash-algorithm? string +--ro template-hash-algorithm? string
+--ro template-hash? binary +--ro template-hash? binary
+--ro pcr-index? pcr +--ro pcr-index? pcr
+--ro signature? binary +--ro signature? binary
</sourcecode> </sourcecode>
</section> </section>
<section anchor="data-nodes"> <section anchor="data-nodes">
<name>Data Nodes</name> <name>Data Nodes</name>
<t>This section provides a high level description of the data nodes containing the configuration and operational objects with the YANG model. For mo re details, please see the YANG model itself in <xref target="ref-ietf-tpm-remot e-attestation"/>.</t> <t>This section provides a high-level description of the data nodes that contain the configuration and operational objects within the YANG data mode l. For more details, please see the YANG module itself in <xref target="ref-ietf -tpm-remote-attestation"/>.</t>
<dl> <dl>
<dt>Container 'rats-support-structures':</dt> <dt>Container 'rats-support-structures':</dt>
<dd> <dd>
<t>This houses the set of information relating to remote attesta tion for a device. This includes specific device TPM(s), the compute nodes (such as line cards) on which the TPM(s) reside, and the algorithms supported across the platform.</t> <t>This houses the set of information relating to remote attesta tion for a device. This includes specific device TPM(s), the compute nodes (suc h as line cards) on which the TPM(s) reside, and the algorithms supported across the platform.</t>
</dd> </dd>
<dt>Container 'tpms':</dt> <dt>Container 'tpms':</dt>
<dd> <dd>
<t>Provides configuration and operational details for each suppo rted TPM, including the tpm-firmware-version, PCRs which may be quoted, certific ates which are associated with that TPM, and the current operational status. Of note are the certificates which are associated with that TPM. As a certificate i s associated with a particular TPM attestation key, knowledge of the certificate allows a specific TPM to be identified.</t> <t>This provides configuration and operational details for each supported TPM, including the tpm-firmware-version, PCRs that may be quoted, cert ificates that are associated with that TPM, and the current operational status. Of note are the certificates that are associated with that TPM. As a certificate is associated with a particular TPM Attestation Key, knowledge of the certifica te allows a specific TPM to be identified.</t>
</dd> </dd>
</dl> </dl>
<sourcecode type="TREE"> <sourcecode type="yangtree">
+--rw tpms +--rw tpms
+--rw tpm* [name] +--rw tpm* [name]
+--rw name string +--rw name string
+--ro hardware-based boolean +--ro hardware-based boolean
+--ro physical-index? int32 {hw:entity-mib}? +--ro physical-index? int32 {hw:entity-mib}?
+--ro path? string +--ro path? string
+--ro compute-node compute-node-ref {tpm:mtpm}? +--ro compute-node compute-node-ref {tpm:mtpm}?
+--ro manufacturer? string +--ro manufacturer? string
+--rw firmware-version identityref +--rw firmware-version identityref
+--rw tpm12-hash-algo? identityref {taa:tpm12}? +--rw tpm12-hash-algo? identityref {taa:tpm12}?
skipping to change at line 330 skipping to change at line 341
+--rw tpm20-pcr-bank* [tpm20-hash-algo] {taa:tpm20}? +--rw tpm20-pcr-bank* [tpm20-hash-algo] {taa:tpm20}?
| +--rw tpm20-hash-algo identityref | +--rw tpm20-hash-algo identityref
| +--rw pcr-index* tpm:pcr | +--rw pcr-index* tpm:pcr
+--ro status enumeration +--ro status enumeration
+--rw certificates +--rw certificates
+--rw certificate* [name] +--rw certificate* [name]
+--rw name string +--rw name string
+--rw keystore-ref? leafref {ks:asymmetric-keys}? +--rw keystore-ref? leafref {ks:asymmetric-keys}?
+--rw type? enumeration +--rw type? enumeration
</sourcecode> </sourcecode>
<t>container 'attester-supported-algos' - Identifies which TCG hash <dl>
algorithms are available for use on the Attesting platform. An operator will use <dt>Container 'attester-supported-algos':</dt>
this information to limit algorithms available for use by RPCs to just a desire <dd>
d set from the universe of all allowed hash algorithms by the TCG.</t> <t>This identifies which TCG hash algorithms are available for use
<sourcecode type="TREE"> on the Attesting platform. An operator will use this information to limit algor
+--rw attester-supported-algos ithms available for use by RPCs to just a desired set from the universe of all h
+--rw tpm12-asymmetric-signing* identityref {taa:tpm12}? ash algorithms allowed by the TCG.</t>
+--rw tpm12-hash* identityref {taa:tpm12}? </dd>
+--rw tpm20-asymmetric-signing* identityref {taa:tpm20}? </dl>
+--rw tpm20-hash* identityref {taa:tpm20}? <sourcecode type="yangtree">
+--rw attester-supported-algos
+--rw tpm12-asymmetric-signing* identityref {taa:tpm12}?
+--rw tpm12-hash* identityref {taa:tpm12}?
+--rw tpm20-asymmetric-signing* identityref {taa:tpm20}?
+--rw tpm20-hash* identityref {taa:tpm20}?
</sourcecode> </sourcecode>
<t>container 'compute-nodes' - When there is more than one TPM suppo <dl>
rted, this container maintains the set of information related to the compute nod <dt>Container 'compute-nodes':</dt>
e associated with a specific TPM. This allows each specific TPM to identify to w <dd>
hich 'compute-node' it belongs.</t> <t>When there is more than one TPM supported, this container main
<sourcecode type="TREE"> tains the set of information related to the compute node associated with a speci
+--rw compute-nodes {tpm:mtpm}? fic TPM. This allows each specific TPM to identify to which 'compute-node' it be
+--ro compute-node* [node-id] longs.</t>
+--ro node-id string </dd>
+--ro node-physical-index? int32 {hw:entity-mib}? </dl>
+--ro node-name? string <sourcecode type="yangtree">
+--ro node-location? string +--rw compute-nodes {tpm:mtpm}?
+--ro compute-node* [node-id]
+--ro node-id string
+--ro node-physical-index? int32 {hw:entity-mib}?
+--ro node-name? string
+--ro node-location? string
</sourcecode> </sourcecode>
</section> </section>
<section anchor="yang-module"> <section anchor="yang-module">
<name>YANG Module</name> <name>YANG Module</name>
<figure anchor="ref-ietf-tpm-remote-attestation"> <figure anchor="ref-ietf-tpm-remote-attestation">
<sourcecode type="YANG"> <!-- [rfced] Section 2.1.1.6. Please help us clarify the following description.
&lt;CODE BEGINS&gt; file "ietf-tpm-remote-attestation.yang@24-07-29.yang" Are smart NICs not covered because they are not a TPM?
Current:
description
"This RPC accepts the input for TSS TPM 2.0 commands of the
managed device. /hardware/component/physical-index from the
hardware management YANG module is used to refer to dedicated
TPMs in composite devices, e.g., smart NICs, is not covered.";
-->
<sourcecode type="yang" name="ietf-tpm-remote-attestation@2024-10-
22.yang" markers="true"><![CDATA[
module ietf-tpm-remote-attestation { module ietf-tpm-remote-attestation {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation"; namespace "urn:ietf:params:xml:ns:yang"
+ ":ietf-tpm-remote-attestation";
prefix tpm; prefix tpm;
import ietf-yang-types { import ietf-yang-types {
prefix yang; prefix yang;
} }
import ietf-hardware { import ietf-hardware {
prefix hw; prefix hw;
} }
import ietf-keystore { import ietf-keystore {
prefix ks; prefix ks;
} }
import ietf-tcg-algs { import ietf-tcg-algs {
prefix taa; prefix taa;
} }
organization organization
"IETF RATS (Remote ATtestation procedureS) Working Group"; "IETF RATS (Remote ATtestation procedureS) Working Group";
contact contact
"WG Web : &lt;https://datatracker.ietf.org/wg/rats/&gt; "WG Web : <https://datatracker.ietf.org/wg/rats/>
WG List : &lt;mailto:rats@ietf.org&gt; WG List : <mailto:rats@ietf.org>
Author : Eric Voit &lt;evoit@cisco.com&gt; Author : Eric Voit <evoit@cisco.com>
Author : Henk Birkholz &lt;henk.birkholz@sit.fraunhofer.de&gt; Author : Henk Birkholz <henk.birkholz@ietf.contact>
Author : Michael Eckel &lt;michael.eckel@sit.fraunhofer.de&gt; Author : Michael Eckel <michael.eckel@sit.fraunhofer.de>
Author : Shwetha Bhandari &lt;shwetha.bhandari@thoughtspot.com&gt; Author : Shwetha Bhandari <shwetha.bhandari@thoughtspot.com>
Author : Bill Sulzen &lt;bsulzen@cisco.com&gt; Author : Bill Sulzen <bsulzen@cisco.com>
Author : Liang Xia (Frank) &lt;frank.xialiang@huawei.com&gt; Author : Liang Xia (Frank) <frank.xialiang@huawei.com>
Author : Tom Laffey &lt;tom.laffey@hpe.com&gt; Author : Tom Laffey <tom.laffey@hpe.com>
Author : Guy Fedorkow &lt;gfedorkow@juniper.net&gt;"; Author : Guy C. Fedorkow <gfedorkow@juniper.net>";
description description
"A YANG module to enable a TPM 1.2 and TPM 2.0 based "A YANG module to enable remote attestation procedures based
remote attestation procedure using a challenge-response on TPM 1.2 and TPM 2.0 using a challenge-response
interaction model and the TPM 1.2 and TPM 2.0 Quote interaction model and the Quote primitive operations defined
primitive operations. by TPM 1.2 and TPM 2.0.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.
Copyright (c) 2024 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Copyright (c) 2022 IETF Trust and the persons identified
as authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject to without modification, is permitted pursuant to, and subject to
the license terms contained in, the Revised BSD License set the license terms contained in, the Revised BSD License set
forth in Section 4.c of the IETF Trust's Legal Provisions forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents Relating to IETF Documents
(https://trustee.ietf.org/license-info). (https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX This version of this YANG module is part of RFC 9684; see the
(https://www.rfc-editor.org/info/rfcXXXX); see the RFC RFC itself for full legal notices.";
itself for full legal notices.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
'MAY', and 'OPTIONAL' in this document are to be interpreted as
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
they appear in all capitals, as shown here.";
revision 2022-05-17 { revision 2024-10-22 {
description description
"Initial version"; "Initial version";
reference reference
"RFC XXXX: A YANG Data Model for Challenge-Response-based Remote "RFC 9684: A YANG Data Model for Challenge-Response-Based
Attestation Procedures using TPMs"; Remote Attestation (CHARRA) Procedures Using Trusted Platform
Modules (TPMs)";
} }
/*****************/ /*****************/
/* Features */ /* Features */
/*****************/ /*****************/
feature mtpm { feature mtpm {
description description
"The device supports the remote attestation of multiple "The device supports the remote attestation of multiple
TPM based cryptoprocessors."; TPM-based cryptoprocessors.";
} }
feature bios { feature bios {
description description
"The device supports the bios logs."; "The device supports the BIOS logs.";
reference reference
"bios-log: "BIOS-Log:
TCG PC Client Platform Firmware Profile Specification,
https://trustedcomputinggroup.org/wp-content/uploads/ https://trustedcomputinggroup.org/wp-content/uploads/
PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf TCG-PC-Client-Platform-Firmware-Profile-Version-1.06-
Section 9.4.5.2"; Revision-52_pub-2.pdf, Section 10.4.5.2";
} }
feature ima { feature ima {
description description
"The device supports Integrity Measurement Architecture logs. "The device supports Integrity Measurement Architecture logs.
Many variants of IMA logs exist in the deployment. Each encodes Many variants of IMA logs exist in the deployment. Each
the log entry contents as the specific measurements which get encodes the log entry contents as the specific measurements
hashed into a PCRs as Evidence. See the reference below for that get hashed into a PCRs as Evidence. See the reference
one example of such an encoding."; below for one example of such an encoding.";
reference reference
"ima-log: "CEL:
Canonical Event Log Format,
https://www.trustedcomputinggroup.org/wp-content/uploads/ https://www.trustedcomputinggroup.org/wp-content/uploads/
TCG_IWG_CEL_v1_r0p41_pub.pdf Section 5.1.6"; TCG_IWG_CEL_v1_r0p41_pub.pdf, Section 5.1.6";
} }
feature netequip_boot { feature netequip_boot {
description description
"The device supports the netequip_boot logs."; "The device supports the netequip_boot logs.";
reference reference
"netequip-boot-log: "RFC 9684: A YANG Data Model for Challenge-Response-Based
RFC XXXX Appendix B"; Remote Attestation (CHARRA) Procedures Using Trusted Platform
Modules (TPMs), Appendix B";
} }
/*****************/ /*****************/
/* Typedefs */ /* Typedefs */
/*****************/ /*****************/
typedef pcr { typedef pcr {
type uint8 { type uint8 {
range "0..31"; range "0..31";
} }
description description
"Valid index number for a PCR. A {{TPM2.0}} compliant PCR index "Valid index number for a PCR. A PCR index compliant with
extends from 0-31. At this time a typical TPM would have no TPM 2.0 extends from 0-31. At this time, a typical TPM would
more than 32 PCRS."; have no more than 32 PCRs.";
} }
typedef compute-node-ref { typedef compute-node-ref {
type leafref { type leafref {
path "/tpm:rats-support-structures/tpm:compute-nodes" path "/tpm:rats-support-structures/tpm:compute-nodes"
+ "/tpm:compute-node/tpm:node-id"; + "/tpm:compute-node/tpm:node-id";
} }
description description
"This type is used to reference a hardware node. Note that an "This type is used to reference a hardware node. Note that an
implementer might include an alternative leafref pointing to a implementer might include an alternative leafref pointing to a
different YANG module node specifying hardware structures."; different YANG module node specifying hardware structures.";
} }
typedef certificate-name-ref { typedef certificate-name-ref {
type leafref { type leafref {
path "/tpm:rats-support-structures/tpm:tpms/tpm:tpm" path "/tpm:rats-support-structures/tpm:tpms/tpm:tpm"
+ "/tpm:certificates/tpm:certificate/tpm:name"; + "/tpm:certificates/tpm:certificate/tpm:name";
} }
description description
"A type which allows identification of a TPM based certificate."; "A type that allows identification of a TPM-based
certificate.";
} }
/******************/ /******************/
/* Identities */ /* Identities */
/******************/ /******************/
identity attested_event_log_type { identity attested_event_log_type {
description description
"Base identity allowing categorization of the reasons why an "Base identity allowing categorization of the reasons why an
attested measurement has been taken on an Attester."; attested measurement has been taken on an Attester.";
skipping to change at line 526 skipping to change at line 561
description description
"An event type associated with Network Equipment Boot."; "An event type associated with Network Equipment Boot.";
} }
/*****************/ /*****************/
/* Groupings */ /* Groupings */
/*****************/ /*****************/
grouping tpm20-hash-algo { grouping tpm20-hash-algo {
description description
"The cryptographic algorithm used to hash the TPM2 PCRs. This "The cryptographic algorithm used to hash the PCRs compliant
must be from the list of platform supported options."; with TPM 2.0. This must be from the list of platform-
supported options.";
leaf tpm20-hash-algo { leaf tpm20-hash-algo {
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
must '. = /tpm:rats-support-structures' must '. = /tpm:rats-support-structures'
+ '/tpm:attester-supported-algos/tpm:tpm20-hash' { + '/tpm:attester-supported-algos/tpm:tpm20-hash' {
error-message "This platform does not support tpm20-hash-algo"; error-message "This platform does not support "
+ "tpm20-hash-algo";
} }
description description
"The hash scheme that is used to hash a TPM2.0 PCR. This "The hash scheme that is used to hash a PCR compliant with
must be one of those supported by a platform. TPM 2.0. This must be one of those supported by a platform.
Where this object does not appear, the default value of Where this object does not appear, the default value of
'taa:TPM_ALG_SHA256' will apply."; 'taa:TPM_ALG_SHA256' will apply.";
} }
} }
grouping tpm12-hash-algo { grouping tpm12-hash-algo {
description description
"The cryptographic algorithm used to hash the TPM1.2 PCRs."; "The cryptographic algorithm used to hash the PCRs compliant
with TPM 1.2.";
leaf tpm12-hash-algo { leaf tpm12-hash-algo {
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
must '. = /tpm:rats-support-structures' must '. = /tpm:rats-support-structures'
+ '/tpm:attester-supported-algos/tpm:tpm12-hash' { + '/tpm:attester-supported-algos/tpm:tpm12-hash' {
error-message "This platform does not support tpm12-hash-algo"; error-message "This platform does not support "
+ "tpm12-hash-algo";
} }
description description
"The hash scheme that is used to hash a TPM1.2 PCR. This "The hash scheme that is used to hash a PCR compliant with
MUST be one of those supported by a platform. TPM 1.2. This MUST be one of those supported by a platform.
Where this object does not appear, the default value of Where this object does not appear, the default value of
'taa:TPM_ALG_SHA1' will apply."; 'taa:TPM_ALG_SHA1' will apply.";
} }
} }
grouping nonce { grouping nonce {
description description
"A random number intended to guarantee freshness and for use "A random number intended to guarantee freshness and for use
as part of a replay-detection mechanism."; as part of a replay-detection mechanism.";
leaf nonce-value { leaf nonce-value {
type binary; type binary;
mandatory true; mandatory true;
description description
"A cryptographically generated random number which should "A cryptographically generated random number that should
not be predictable prior to its issuance from a random not be predictable prior to its issuance from a random
number generation function. The random number MUST be number generation function. The random number MUST be
derived from an entropy source external to the Attester. derived from an entropy source external to the Attester.
Note that a nonce sent into a TPM will typically be 160 or 256 Note that a nonce sent into a TPM will typically be 160 or
binary digits long. (This is 20 or 32 bytes.) So if fewer 256 binary digits long. (This is 20 or 32 bytes.) So if
binary digits are sent, this nonce object will be padded fewer binary digits are sent, this nonce object will be
with leading zeros within Quotes returned from the TPM. padded with leading zeros within Quotes returned from the
Additionally if more bytes are sent, the nonce will be trimmed TPM. Additionally, if more bytes are sent, the nonce will
to the most significant binary digits."; be trimmed to the most significant binary digits.";
} }
} }
grouping tpm12-pcr-selection { grouping tpm12-pcr-selection {
description description
"A Verifier can request one or more PCR values using its "A Verifier can request one or more PCR values using its
individually created Attestation Key Certificate (AC). individually created Attestation Key Certificate (AC).
The corresponding selection filter is represented in this The corresponding selection filter is represented in this
grouping."; grouping.";
leaf-list pcr-index { leaf-list pcr-index {
type pcr; type pcr;
description description
"The numbers/indexes of the PCRs. In addition, any selection "The numbers/indexes of the PCRs. In addition, any selection
of PCRs MUST verify that the set of PCRs requested are a of PCRs MUST verify that the set of PCRs requested are a
subset the set of PCRs exposed by in the leaf-list subset of the set of PCRs exposed in the leaf-list
/tpm:rats-support-structures /tpm:rats-support-structures
/tpm:tpms/tpm:tpm[name=current()]/tpm:tpm12-pcrs"; /tpm:tpms/tpm:tpm[name=current()]/tpm:tpm12-pcrs";
} }
} }
grouping tpm20-pcr-selection { grouping tpm20-pcr-selection {
description description
"A Verifier can acquire one or more PCR values, which are hashed "A Verifier can acquire one or more PCR values, which are
together in a TPM2B_DIGEST coming from the TPM2. The selection hashed together in a TPM2B_DIGEST coming from the TPM2.
list of desired PCRs and the Hash Algorithm is represented in The selection list of desired PCRs and the hash algorithm
this grouping."; is represented in this grouping.";
list tpm20-pcr-selection { list tpm20-pcr-selection {
unique "tpm20-hash-algo"; unique "tpm20-hash-algo";
description description
"Specifies the list of PCRs and Hash Algorithms that can be "Specifies the list of PCRs and hash algorithms that can be
returned within a TPM2B_DIGEST."; returned within a TPM2B_DIGEST.";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://www.trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf Section 10.9.7"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 10.9.7";
uses tpm20-hash-algo; uses tpm20-hash-algo;
leaf-list pcr-index { leaf-list pcr-index {
type pcr; type pcr;
description description
"The numbers of the PCRs that which are being tracked "The numbers of the PCRs that are being tracked
with a hash based on the tpm20-hash-algo. In addition, with a hash based on the tpm20-hash-algo. In addition,
any selection of PCRs MUST verify that the set of PCRs any selection of PCRs MUST verify that the set of PCRs
requested are a subset the set of PCR indexes selected requested are a subset of the set of selected PCR indexes
are available for that specific TPM."; available for that specific TPM.";
} }
} }
} }
grouping certificate-name-ref { grouping certificate-name-ref {
description description
"Identifies a certificate in a keystore."; "Identifies a certificate in a keystore.";
leaf certificate-name { leaf certificate-name {
type certificate-name-ref; type certificate-name-ref;
mandatory true; mandatory true;
skipping to change at line 647 skipping to change at line 688
"Identifies a certificate in a keystore."; "Identifies a certificate in a keystore.";
} }
} }
grouping tpm-name { grouping tpm-name {
description description
"A unique TPM on a device."; "A unique TPM on a device.";
leaf name { leaf name {
type string; type string;
description description
"Unique system generated name for a TPM on a device."; "Unique system-generated name for a TPM on a device.";
} }
} }
grouping node-uptime { grouping node-uptime {
description description
"Uptime in seconds of the node."; "Uptime in seconds of the node.";
leaf up-time { leaf up-time {
type uint32; type uint32;
description description
"Uptime in seconds of this node reporting its data"; "Uptime in seconds of this node reporting its data.";
} }
} }
grouping tpm12-attestation { grouping tpm12-attestation {
description description
"Contains an instance of TPM1.2 style signed cryptoprocessor "Contains an instance of cryptoprocessor measurements signed
measurements. It is supplemented by unsigned Attester according to TPM 1.2. It is supplemented by unsigned
information."; Attester information.";
uses node-uptime; uses node-uptime;
leaf pcr-data { leaf pcr-data {
type binary; type binary;
description description
"The value created and signed for the quote (type TPM_PCR_INFO_SHORT), "The value created and signed for the quote
i.e., the 'pcrData' part of a TPM1.2 Quote2 operation result."; (type TPM_PCR_INFO_SHORT), i.e., the 'pcrData' part of
a TPM1.2 Quote2 operation result.";
reference reference
"TPM1.2-Commands: "TPM1.2-Commands:
TPM1.2 commands rev116 July 2007, Section 16.5 TPM Main Part 3 Commands, Rev116,
https://trustedcomputinggroup.org/wp-content/uploads https://trustedcomputinggroup.org/wp-content/uploads
/TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf"; /TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf,
Section 16.5";
} }
leaf version-info { leaf version-info {
type binary; type binary;
description description
"The version info (type TPM_CAP_VERSION_INFO), "The version info (type TPM_CAP_VERSION_INFO),
i.e., the 'versionInfo' part of a TPM1.2 Quote2 operation result."; i.e., the 'versionInfo' part of a TPM1.2 Quote2
operation result.";
reference reference
"TPM1.2-Commands: "TPM1.2-Commands:
TPM1.2 commands rev116 July 2007, Section 16.5 TPM Main Part 3 Commands, Rev116,
https://trustedcomputinggroup.org/wp-content/uploads https://trustedcomputinggroup.org/wp-content/uploads
/TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf"; /TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf,
Section 16.5";
} }
leaf sig { leaf sig {
type binary; type binary;
description description
"The signed data blob, i.e., the signature "The signature generated across the signed data,
i.e., the 'sig' part of a TPM1.2 Quote2 operation result."; i.e., the 'sig' part of a TPM1.2 Quote2 operation
result.";
reference reference
"TPM1.2-Commands: "TPM1.2-Commands:
TPM1.2 commands rev116 July 2007, Section 16.5 TPM Main Part 3 Commands, Rev116,
https://trustedcomputinggroup.org/wp-content/uploads https://trustedcomputinggroup.org/wp-content/uploads
/TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf"; /TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf,
Section 16.5";
} }
} }
grouping tpm20-attestation { grouping tpm20-attestation {
description description
"Contains an instance of TPM2 style signed cryptoprocessor "Contains an instance of cryptoprocessor measurements signed
measurements. It is supplemented by unsigned Attester according to TPM 2.0. It is supplemented by unsigned
information."; Attester information.";
leaf quote-data { leaf quote-data {
type binary; type binary;
mandatory true; mandatory true;
description description
"A hash of the latest PCR values (and the hash algorithm used) "A hash of the latest PCR values (and the hash algorithm
which have been returned from an Attester for the selected PCRs used) that have been returned from an Attester for the
and Hash Algorithms."; selected PCRs and hash algorithms.";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://www.trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf Section 10.12.1"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 10.12.1";
} }
leaf quote-signature { leaf quote-signature {
type binary; type binary;
description description
"Quote signature returned by TPM Quote. The signature was "Quote signature returned by TPM Quote. The signature was
generated using the key associated with the generated using the key associated with the
certificate 'name'."; certificate 'name'.";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://www.trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf Section 11.2.1"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 11.2.1";
} }
uses node-uptime; uses node-uptime;
list unsigned-pcr-values { list unsigned-pcr-values {
description description
"PCR values in each PCR bank. This might appear redundant with "PCR values in each PCR bank. This might appear redundant
the TPM2B_DIGEST, but that digest is calculated across multiple with the TPM2B_DIGEST, but that digest is calculated across
PCRs. Having to verify across multiple PCRs does not multiple PCRs. Having to verify across multiple PCRs does
necessarily make it easy for a Verifier to appraise just the not necessarily make it easy for a Verifier to appraise just
minimum set of PCR information which has changed since the last the minimum set of PCR information that has changed since
received TPM2B_DIGEST. Put another way, why should a Verifier the last received TPM2B_DIGEST. Put another way, why should
reconstruct the proper value of all PCR Quotes when only a a Verifier reconstruct the proper value of all PCR Quotes
single PCR has changed? when only a single PCR has changed?
To help this happen, if the Attester does know specific PCR To help this happen, if the Attester does know specific PCR
values, the Attester can provide these individual values via values, the Attester can provide these individual values via
'unsigned-pcr-values'. By comparing this information to 'unsigned-pcr-values'. By comparing this information to
what has previously been validated, it is possible for a what has previously been validated, it is possible for a
Verifier to confirm the Attester's signature while eliminating Verifier to confirm the Attester's signature while
eliminating significant processing. Note that there should
significant processing. Note that there should never be a never be a result where an unsigned PCR value differs from
result where an unsigned PCR value differs from what may be what may be reconstructed from within the PCR quote and
reconstructed from the within the PCR quote and the event logs. the event logs.
If there is a difference, a signed result which has been If there is a difference, a signed result that has been
verified from retrieved logs is considered definitive."; verified from retrieved logs is considered definitive.";
uses tpm20-hash-algo; uses tpm20-hash-algo;
list pcr-values { list pcr-values {
key "pcr-index"; key "pcr-index";
description description
"List of one PCR bank."; "List of one PCR bank.";
leaf pcr-index { leaf pcr-index {
type pcr; type pcr;
description description
"PCR index number."; "PCR index number.";
} }
leaf pcr-value { leaf pcr-value {
type binary; type binary;
description description
"PCR value."; "PCR value.";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://www.trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf Section 10.9.7"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 10.9.7";
} }
} }
} }
} }
grouping log-identifier { grouping log-identifier {
description description
"Identifier for type of log to be retrieved."; "Identifier for type of log to be retrieved.";
leaf log-type { leaf log-type {
type identityref { type identityref {
base attested_event_log_type; base attested_event_log_type;
} }
mandatory true; mandatory true;
description description
"The corresponding measurement log type identity."; "The corresponding identity of the measurement log type.";
} }
} }
grouping boot-event-log { grouping boot-event-log {
description description
"Defines a specific instance of an event log entry "Defines a specific instance of an event log entry
and corresponding to the information used to and corresponding to the information used to
extend the PCR"; extend the PCR.";
leaf event-number { leaf event-number {
type uint32; type uint32;
description description
"Unique event number of this event which monotonically "Unique event number of this event, which monotonically
increases within a given event log. The maximum event increases within a given event log. The maximum event
number should not be reached, nor is wrapping back to number should not be reached, nor is wrapping back to
an earlier number supported."; an earlier number supported.";
} }
leaf event-type { leaf event-type {
type uint32; type uint32;
description description
"BIOS Log Event Type: "BIOS log event type.";
reference
"BIOS-Log:
TCG PC Client Platform Firmware Profile Specification,
https://trustedcomputinggroup.org/wp-content/uploads/ https://trustedcomputinggroup.org/wp-content/uploads/
TCG_PCClient_PFP_r1p05_v23_pub.pdf Section 10.4.1"; TCG-PC-Client-Platform-Firmware-Profile-Version-1.06-
Revision-52_pub-2.pdf, Section 10.4.1";
} }
leaf pcr-index { leaf pcr-index {
type pcr; type pcr;
description description
"Defines the PCR index that this event extended"; "Defines the PCR index that this event extended.";
} }
list digest-list { list digest-list {
description description
"Hash of event data"; "Hash of event data.";
leaf hash-algo { leaf hash-algo {
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
description description
"The hash scheme that is used to compress the event data in "The hash scheme that is used to compress the event data in
each of the leaf-list digest items."; each of the leaf-list digest items.";
} }
leaf-list digest { leaf-list digest {
type binary; type binary;
description description
"The hash of the event data using the algorithm of the "The hash of the event data using the algorithm of the
'hash-algo' against 'event data'."; 'hash-algo' against 'event data'.";
} }
} }
leaf event-size { leaf event-size {
type uint32; type uint32;
description description
"Size of the event data"; "Size of the event data.";
} }
leaf-list event-data { leaf-list event-data {
type binary; type binary;
description description
"The event data. This is a binary structure "The event data. This is a binary structure
of size 'event-size'. For more on what of size 'event-size'. For more on what
might be recorded within this object might be recorded within this object
see [bios-log] Section 9 which details see BIOS-Log, Section 10, which details
viable events which might be recorded."; viable events that might be recorded.";
reference
"BIOS-Log:
TCG PC Client Platform Firmware Profile Specification,
https://trustedcomputinggroup.org/wp-content/uploads/
TCG-PC-Client-Platform-Firmware-Profile-Version-1.06-
Revision-52_pub-2.pdf, Section 10";
} }
} }
grouping bios-event-log { grouping bios-event-log {
description description
"Measurement log created by the BIOS/UEFI."; "Measurement log created by the BIOS/UEFI.";
list bios-event-entry { list bios-event-entry {
key "event-number"; key "event-number";
description description
"Ordered list of TCG described event log "Ordered list of the TCG-described event log
that extended the PCRs in the order they that extended the PCRs in the order they
were logged"; were logged.";
uses boot-event-log; uses boot-event-log;
} }
} }
grouping ima-event { grouping ima-event {
description description
"Defines a hash log extend event for IMA measurements"; "Defines a hash log extend event for IMA measurements.";
reference reference
"ima-log: "CEL:
Canonical Event Log Format,
https://www.trustedcomputinggroup.org/wp-content/uploads/ https://www.trustedcomputinggroup.org/wp-content/uploads/
TCG_IWG_CEL_v1_r0p41_pub.pdf Section 4.3"; TCG_IWG_CEL_v1_r0p41_pub.pdf, Section 4.3";
leaf event-number { leaf event-number {
type uint64; type uint64;
description description
"Unique event number of this event which monotonically "Unique event number of this event, which monotonically
increases. The maximum event number should not be increases. The maximum event number should not be
reached, nor is wrapping back to an earlier number reached, nor is wrapping back to an earlier number
supported."; supported.";
} }
leaf ima-template { leaf ima-template {
type string; type string;
description description
"Name of the template used for event logs "Name of the template used for event logs,
for e.g. ima, ima-ng, ima-sig"; e.g., ima, ima-ng, ima-sig.";
} }
leaf filename-hint { leaf filename-hint {
type string; type string;
description description
"File name (including the path) that was measured."; "File name (including the path) that was measured.";
} }
leaf filedata-hash { leaf filedata-hash {
type binary; type binary;
description description
"Hash of filedata as updated based upon the "Hash of filedata as updated based upon the
filedata-hash-algorithm"; filedata-hash-algorithm.";
} }
leaf filedata-hash-algorithm { leaf filedata-hash-algorithm {
type string; type string;
description description
"Algorithm used for filedata-hash"; "Algorithm used for filedata-hash.";
} }
leaf template-hash-algorithm { leaf template-hash-algorithm {
type string; type string;
description description
"Algorithm used for template-hash"; "Algorithm used for template-hash.";
} }
leaf template-hash { leaf template-hash {
type binary; type binary;
description description
"hash(filedata-hash, filename-hint)"; "hash(filedata-hash, filename-hint)";
} }
leaf pcr-index { leaf pcr-index {
type pcr; type pcr;
description description
"Defines the PCR index that this event extended"; "Defines the PCR index that this event extended.";
} }
leaf signature { leaf signature {
type binary; type binary;
description description
"Digital file signature which provides a "Digital file signature that provides a
fingerprint for the file being measured."; fingerprint for the file being measured.";
} }
} }
grouping ima-event-log { grouping ima-event-log {
description description
"Measurement log created by IMA."; "Measurement log created by IMA.";
list ima-event-entry { list ima-event-entry {
key "event-number"; key "event-number";
description description
"Ordered list of ima event logs by event-number"; "Ordered list of IMA event logs by event-number.";
uses ima-event; uses ima-event;
} }
} }
grouping network-equipment-boot-event-log { grouping network-equipment-boot-event-log {
description description
"Measurement log created by Network Equipment Boot. The Network "Measurement log created by Network Equipment Boot. The
Equipment Boot format is identical to the IMA format. In Network Equipment Boot format is identical to the IMA
contrast to the IMA log, the Network Equipment Boot log format. In contrast to the IMA log, the Network Equipment
includes every measurable event from an Attester, including Boot log includes every measurable event from an Attester,
the boot stages of BIOS, Bootloader, etc. In essence, the scope including the boot stages of BIOS, Bootloader, etc. In
of events represented in this format combines the scope of BIOS essence, the scope of events represented in this format
events and IMA events."; combines the scope of BIOS events and IMA events.";
list boot-event-entry { list boot-event-entry {
key "event-number"; key "event-number";
description description
"Ordered list of Network Equipment Boot event logs "Ordered list of Network Equipment Boot event logs
by event-number, using the IMA event format."; by event-number, using the IMA event format.";
uses ima-event; uses ima-event;
} }
} }
grouping event-logs { grouping event-logs {
description description
"A selector for the log and its type."; "A selector for the log and its type.";
choice attested_event_log_type { choice attested_event_log_type {
mandatory true; mandatory true;
description description
"Event log type determines the event logs content."; "Event log type determines the event log's content.";
case bios { case bios {
if-feature "bios"; if-feature "bios";
description description
"BIOS/UEFI event logs"; "BIOS/UEFI event logs.";
container bios-event-logs { container bios-event-logs {
description description
"BIOS/UEFI event logs"; "BIOS/UEFI event logs.";
uses bios-event-log; uses bios-event-log;
} }
} }
case ima { case ima {
if-feature "ima"; if-feature "ima";
description description
"IMA event logs."; "IMA event logs.";
container ima-event-logs { container ima-event-logs {
description description
"IMA event logs."; "IMA event logs.";
uses ima-event-log; uses ima-event-log;
} }
} }
case netequip_boot { case netequip_boot {
if-feature "netequip_boot"; if-feature "netequip_boot";
description description
"Network Equipment Boot event logs"; "Network Equipment Boot event logs.";
container boot-event-logs { container boot-event-logs {
description description
"Network equipment boot event logs."; "Network Equipment Boot event logs.";
uses network-equipment-boot-event-log; uses network-equipment-boot-event-log;
} }
} }
} }
} }
/**********************/ /**********************/
/* RPC operations */ /* RPC operations */
/**********************/ /**********************/
rpc tpm12-challenge-response-attestation { rpc tpm12-challenge-response-attestation {
if-feature "taa:tpm12"; if-feature "taa:tpm12";
description description
"This RPC accepts the input for TSS TPM 1.2 commands made to the "This RPC accepts the input for TSS TPM 1.2 commands made to
attesting device."; the attesting device.";
input { input {
container tpm12-attestation-challenge { container tpm12-attestation-challenge {
description description
"This container includes every information element defined "This container includes every information element defined
in the reference challenge-response interaction model for in the reference challenge-response interaction model for
remote attestation. Corresponding values are based on remote attestation. Corresponding values are based on
TPM 1.2 structure definitions"; TPM 1.2 structure definitions";
uses tpm12-pcr-selection; uses tpm12-pcr-selection;
uses nonce; uses nonce;
leaf-list certificate-name { leaf-list certificate-name {
if-feature "tpm:mtpm"; if-feature "tpm:mtpm";
type certificate-name-ref; type certificate-name-ref;
must "/tpm:rats-support-structures/tpm:tpms" must "/tpm:rats-support-structures/tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm12']" + "/tpm:tpm[tpm:firmware-version='taa:tpm12']"
+ "/tpm:certificates/" + "/tpm:certificates/"
+ "/tpm:certificate[name=current()]" { + "/tpm:certificate[name=current()]" {
skipping to change at line 1026 skipping to change at line 1090
description description
"When populated, the RPC will only get a Quote for the "When populated, the RPC will only get a Quote for the
TPMs associated with these certificate(s)."; TPMs associated with these certificate(s).";
} }
} }
} }
output { output {
list tpm12-attestation-response { list tpm12-attestation-response {
unique "certificate-name"; unique "certificate-name";
description description
"The binary output of TPM 1.2 TPM_Quote/TPM_Quote2, including "The binary output of TPM 1.2 TPM_Quote/TPM_Quote2,
the PCR selection and other associated attestation evidence including the PCR selection and other associated
metadata"; attestation evidence metadata.";
uses certificate-name-ref { uses certificate-name-ref {
description description
"Certificate associated with this tpm12-attestation."; "Certificate associated with this tpm12-attestation.";
} }
uses tpm12-attestation; uses tpm12-attestation;
} }
} }
} }
rpc tpm20-challenge-response-attestation { rpc tpm20-challenge-response-attestation {
if-feature "taa:tpm20"; if-feature "taa:tpm20";
description description
"This RPC accepts the input for TSS TPM 2.0 commands of the "This RPC accepts the input for TSS TPM 2.0 commands of the
managed device. ComponentIndex from the hardware manager YANG managed device. Composite devices may contain several TPMs;
module is used to refer to dedicated TPM in composite devices, /hardware/component/physical-index from the hardware management
e.g. smart NICs, is not covered."; YANG module is used to refer to dedicated TPMs in composite
devices; however, devices without TPMs are not covered.";
input { input {
container tpm20-attestation-challenge { container tpm20-attestation-challenge {
description description
"This container includes every information element defined "This container includes every information element defined
in the reference challenge-response interaction model for in the reference challenge-response interaction model for
remote attestation. Corresponding values are based on remote attestation. Corresponding values are based on
TPM 2.0 structure definitions"; TPM 2.0 structure definitions.";
uses nonce; uses nonce;
uses tpm20-pcr-selection; uses tpm20-pcr-selection;
leaf-list certificate-name { leaf-list certificate-name {
if-feature "tpm:mtpm"; if-feature "tpm:mtpm";
type certificate-name-ref; type certificate-name-ref;
must "/tpm:rats-support-structures/tpm:tpms" must "/tpm:rats-support-structures/tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm20']" + "/tpm:tpm[tpm:firmware-version='taa:tpm20']"
+ "/tpm:certificates/" + "/tpm:certificates/"
+ "/tpm:certificate[name=current()]" { + "/tpm:certificate[name=current()]" {
error-message "Not an available TPM2.0 AIK certificate."; error-message "Not an available TPM2.0 AIK certificate.";
skipping to change at line 1074 skipping to change at line 1139
"When populated, the RPC will only get a Quote for the "When populated, the RPC will only get a Quote for the
TPMs associated with the certificates."; TPMs associated with the certificates.";
} }
} }
} }
output { output {
list tpm20-attestation-response { list tpm20-attestation-response {
unique "certificate-name"; unique "certificate-name";
description description
"The binary output of TPM2_Quote from one TPM of the "The binary output of TPM2_Quote from one TPM of the
node which identified by node-id. An TPMS_ATTEST structure node which is identified by node-id: an attestation
including a length, encapsulated in a signature"; structure (TPMS_ATTEST), including a length, and a
signature (TPMT_SIGNATURE) over that structure.";
reference
"TPM2.0-Structures:
Trusted Platform Module Library Part 2: Structures,
Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 10.12.12";
uses certificate-name-ref { uses certificate-name-ref {
description description
"Certificate associated with this tpm20-attestation."; "Certificate associated with this tpm20-attestation.";
} }
uses tpm20-attestation; uses tpm20-attestation;
} }
} }
} }
rpc log-retrieval { rpc log-retrieval {
description description
"Logs Entries are either identified via indices or via providing "Log entries are identified either via indices or by providing
the last line received. The number of lines returned can be the last line received. The number of lines returned can be
limited. The type of log is a choice that can be augmented."; limited. The type of log is a choice that can be augmented.";
input { input {
uses log-identifier; uses log-identifier;
list log-selector { list log-selector {
description description
"Only log entries which meet all the selection criteria "Only log entries that meet all of the provided selection
provided are to be returned by the RPC output."; criteria are to be returned by the RPC output.";
leaf-list name { leaf-list name {
type string; type string;
description description
"Name of one or more unique TPMs on a device. If this "Name of one or more unique TPMs on a device. If this
object exists, a selection should pull only the objects object exists, a selection should pull only the objects
related to these TPM(s). If it does not exist, all related to these TPM(s). If it does not exist, all
qualifying TPMs that are 'hardware-based' equals true qualifying TPMs that are 'hardware-based' equals true
on the device are selected. When this selection on the device are selected. When this selection
criteria is provided, it will be considered as a logical criteria is provided, it will be considered as a logical
AND with any other selection criteria provided."; AND with any other selection criteria provided.";
} }
choice index-type { choice index-type {
description description
"Last log entry received, log index number, or timestamp."; "Last log entry received, log index number, or
timestamp.";
case last-entry { case last-entry {
description description
"The last entry of the log already retrieved."; "The last entry of the log already retrieved.";
leaf last-entry-value { leaf last-entry-value {
type binary; type binary;
description description
"Content of a log event which matches 1:1 with a "Content of a log event that matches 1:1 with a
unique event record contained within the log. Log unique event record contained within the log. Log
entries after this will be passed to the entries after this will be passed to the
requester. Note: if log entry values are not unique, requester. Note: if log entry values are not
this MUST return an error."; unique, this MUST return an error.";
} }
} }
case index { case index {
description description
"Numeric index of the last log entry retrieved, or "Numeric index of the last log entry retrieved, or
zero."; zero.";
leaf last-index-number { leaf last-index-number {
type uint64; type uint64;
description description
"The last numeric index number of a log entry. "The last numeric index number of a log entry.
skipping to change at line 1159 skipping to change at line 1232
type uint16; type uint16;
description description
"The number of log entries to be returned. If omitted, it "The number of log entries to be returned. If omitted, it
means all of them."; means all of them.";
} }
} }
} }
output { output {
container system-event-logs { container system-event-logs {
description description
"The requested data of the measurement event logs"; "The requested data of the measurement event logs.";
list node-data { list node-data {
unique "name"; unique "name";
description description
"Event logs of a node in a distributed system "Event logs of a node in a distributed system
identified by the node name"; identified by the node name.";
uses tpm-name; uses tpm-name;
uses node-uptime; uses node-uptime;
container log-result { container log-result {
description description
"The requested entries of the corresponding log."; "The requested entries of the corresponding log.";
uses event-logs; uses event-logs;
} }
} }
} }
} }
} }
/**************************************/ /****************************************/
/* Config &amp; Oper accessible nodes */ /* Config and Oper accessible nodes */
/**************************************/ /****************************************/
container rats-support-structures { container rats-support-structures {
description description
"The datastore definition enabling verifiers or relying "The datastore definition enabling Verifiers or Relying
parties to discover the information necessary to use the Parties to discover the information necessary to use the
remote attestation RPCs appropriately."; remote attestation RPCs appropriately.";
container compute-nodes { container compute-nodes {
if-feature "tpm:mtpm"; if-feature "tpm:mtpm";
description description
"Holds the set of device subsystems/components in this "Holds the set of device subsystems/components in this
composite device that support TPM operations."; composite device that support TPM operations.";
list compute-node { list compute-node {
key "node-id"; key "node-id";
unique "node-name"; unique "node-name";
config false; config false;
min-elements 2; min-elements 2;
description description
"A component within this composite device which "A component within this composite device that
supports TPM operations."; supports TPM operations.";
leaf node-id { leaf node-id {
type string; type string;
description description
"ID of the compute node, such as Board Serial Number."; "ID of the compute node, such as Board Serial Number.";
} }
leaf node-physical-index { leaf node-physical-index {
if-feature "hw:entity-mib"; if-feature "hw:entity-mib";
type int32 { type int32 {
range "1..2147483647"; range "1..2147483647";
skipping to change at line 1242 skipping to change at line 1315
unique "path"; unique "path";
description description
"A list of TPMs in this composite device that RATS "A list of TPMs in this composite device that RATS
can be conducted with."; can be conducted with.";
uses tpm-name; uses tpm-name;
leaf hardware-based { leaf hardware-based {
type boolean; type boolean;
config false; config false;
mandatory true; mandatory true;
description description
"System generated indication of whether this is a "System-generated indication of whether this is a
hardware based TPM."; hardware-based TPM.";
} }
leaf physical-index { leaf physical-index {
if-feature "hw:entity-mib"; if-feature "hw:entity-mib";
type int32 { type int32 {
range "1..2147483647"; range "1..2147483647";
} }
config false; config false;
description description
"The entPhysicalIndex for the TPM."; "The entPhysicalIndex for the TPM.";
reference reference
"RFC 6933: Entity MIB (Version 4) - entPhysicalIndex"; "RFC 6933: Entity MIB (Version 4) - entPhysicalIndex";
} }
leaf path { leaf path {
type string; type string;
config false; config false;
description description
"Device path to a unique TPM on a device. This can change "Device path to a unique TPM on a device. This can
across reboots."; change across reboots.";
} }
leaf compute-node { leaf compute-node {
if-feature "tpm:mtpm"; if-feature "tpm:mtpm";
type compute-node-ref; type compute-node-ref;
config false; config false;
mandatory true; mandatory true;
description description
"Indicates the compute node measured by this TPM."; "Indicates the compute node measured by this TPM.";
} }
leaf manufacturer { leaf manufacturer {
skipping to change at line 1292 skipping to change at line 1365
description description
"Identifies the cryptoprocessor API set supported. This "Identifies the cryptoprocessor API set supported. This
is automatically configured by the device and should not is automatically configured by the device and should not
be changed."; be changed.";
} }
uses tpm12-hash-algo { uses tpm12-hash-algo {
when "derived-from-or-self(firmware-version, 'taa:tpm12')"; when "derived-from-or-self(firmware-version, 'taa:tpm12')";
if-feature "taa:tpm12"; if-feature "taa:tpm12";
refine "tpm12-hash-algo" { refine "tpm12-hash-algo" {
description description
"The hash algorithm overwrites the default used for PCRs "The hash algorithm overwrites the default used for
on this TPM1.2 compliant cryptoprocessor."; PCRs on this TPM1.2-compliant cryptoprocessor.";
} }
} }
leaf-list tpm12-pcrs { leaf-list tpm12-pcrs {
when when "derived-from-or-self(../firmware-version, "
"derived-from-or-self(../firmware-version, 'taa:tpm12')"; + "'taa:tpm12')";
if-feature "taa:tpm12"; if-feature "taa:tpm12";
type pcr; type pcr;
description description
"The PCRs which may be extracted from this TPM1.2 "The PCRs that may be extracted from this TPM1.2-
compliant cryptoprocessor."; compliant cryptoprocessor.";
} }
list tpm20-pcr-bank { list tpm20-pcr-bank {
when when "derived-from-or-self(../firmware-version, "
"derived-from-or-self(../firmware-version, 'taa:tpm20')"; + "'taa:tpm20')";
if-feature "taa:tpm20"; if-feature "taa:tpm20";
key "tpm20-hash-algo"; key "tpm20-hash-algo";
description description
"Specifies the list of PCRs that may be extracted for "Specifies the list of PCRs that may be extracted for
a specific Hash Algorithm on this TPM2 compliant a specific hash algorithm on this TPM2-compliant
cryptoprocessor. A bank is a set of PCRs which are cryptoprocessor. A bank is a set of PCRs that are
extended using a particular hash algorithm."; extended using a particular hash algorithm.";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://www.trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf Section 10.9.7"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf,
Section 10.9.7";
leaf tpm20-hash-algo { leaf tpm20-hash-algo {
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
must '/tpm:rats-support-structures' must '/tpm:rats-support-structures'
+ '/tpm:attester-supported-algos' + '/tpm:attester-supported-algos'
+ '/tpm:tpm20-hash' { + '/tpm:tpm20-hash' {
error-message "This platform does not support tpm20-hash-algo"; error-message "This platform does not support "
+ "tpm20-hash-algo";
} }
description description
"The hash scheme actively being used to hash a "The hash scheme actively being used to hash
one or more TPM2.0 PCRs."; one or more TPM2.0 PCRs.";
} }
leaf-list pcr-index { leaf-list pcr-index {
type tpm:pcr; type tpm:pcr;
description description
"Defines what TPM2 PCRs are available to be extracted."; "Defines which TPM2.0 PCRs are available to be
extracted.";
} }
} }
leaf status { leaf status {
type enumeration { type enumeration {
enum operational { enum operational {
value 0; value 0;
description description
"The TPM currently is running normally and "The TPM currently is running normally and
is ready to accept and process TPM quotes."; is ready to accept and process TPM quotes.";
reference reference
"TPM2.0-Arch: "TPM2.0-Arch: Trusted Platform Module Library
https://trustedcomputinggroup.org/wp-content/uploads/ Part 1: Architecture,
TCG_TPM2_r1p59_Part1_Architecture_pub.pdf https://trustedcomputinggroup.org/wp-content/
uploads/TPM-2.0-1.83-Part-1-Architecture.pdf,
Section 12"; Section 12";
} }
enum non-operational { enum non-operational {
value 1; value 1;
description description
"TPM is in a state such as startup or shutdown which "TPM is in a state such as startup or shutdown, which
precludes the processing of TPM quotes."; precludes the processing of TPM quotes.";
} }
} }
config false; config false;
mandatory true; mandatory true;
description description
"TPM chip self-test status."; "TPM chip self-test status.";
} }
container certificates { container certificates {
description description
"The TPM's certificates, including EK certificates "The TPM's certificates, including EK Certificates
and Attestation Key certificates."; and Attestation Key Certificates.";
list certificate { list certificate {
key "name"; key "name";
description description
"Three types of certificates can be accessed via "Three types of certificates can be accessed via
this statement, including Initial Attestation this statement, including Initial Attestation
Key Certificate, Local Attestation Key Certificate or Key Certificate, Local Attestation Key Certificate, or
Endorsement Key Certificate."; Endorsement Key Certificate.";
leaf name { leaf name {
type string; type string;
description description
"An arbitrary name uniquely identifying a certificate "An arbitrary name uniquely identifying a certificate
associated within key within a TPM."; associated with a key within a TPM.";
} }
leaf keystore-ref { leaf keystore-ref {
if-feature "ks:central-keystore-supported"; if-feature "ks:central-keystore-supported";
if-feature "ks:asymmetric-keys"; if-feature "ks:asymmetric-keys";
type leafref { type leafref {
path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key" path "/ks:keystore/ks:asymmetric-keys"
+ "/ks:name"; + "/ks:asymmetric-key/ks:name";
} }
description description
"A reference to a specific certificate of an "A reference to a specific certificate of an
asymmetric key in the Keystore."; asymmetric key in the keystore.";
} }
leaf type { leaf type {
type enumeration { type enumeration {
enum endorsement-certificate { enum endorsement-certificate {
value 0; value 0;
description description
"Endorsement Key (EK) Certificate type."; "Endorsement Key (EK) Certificate type.";
reference reference
"TPM2.0-Key: "TPM2.0-Key:
TPM 2.0 Keys for Device Identity and Attestation
https://trustedcomputinggroup.org/wp-content/ https://trustedcomputinggroup.org/wp-content/
uploads/TPM-2p0-Keys-for-Device-Identity- uploads/TPM-2p0-Keys-for-Device-Identity-
and-Attestation_v1_r12_pub10082021.pdf and-Attestation_v1_r12_pub10082021.pdf,
Section 3.11"; Section 3.11";
} }
enum initial-attestation-certificate { enum initial-attestation-certificate {
value 1; value 1;
description description
"Initial Attestation key (IAK) Certificate type."; "Initial Attestation Key (IAK) Certificate
type.";
reference reference
"TPM2.0-Key: "TPM2.0-Key:
TPM 2.0 Keys for Device Identity and Attestation
https://trustedcomputinggroup.org/wp-content/ https://trustedcomputinggroup.org/wp-content/
uploads/TPM-2p0-Keys-for-Device-Identity- uploads/TPM-2p0-Keys-for-Device-Identity-
and-Attestation_v1_r12_pub10082021.pdf and-Attestation_v1_r12_pub10082021.pdf,
Section 3.2"; Section 3.2";
} }
enum local-attestation-certificate { enum local-attestation-certificate {
value 2; value 2;
description description
"Local Attestation Key (LAK) Certificate type."; "Local Attestation Key (LAK) Certificate type.";
reference reference
"TPM2.0-Key: "TPM2.0-Key:
TPM 2.0 Keys for Device Identity and Attestation
https://trustedcomputinggroup.org/wp-content/ https://trustedcomputinggroup.org/wp-content/
uploads/TPM-2p0-Keys-for-Device-Identity- uploads/TPM-2p0-Keys-for-Device-Identity-
and-Attestation_v1_r12_pub10082021.pdf and-Attestation_v1_r12_pub10082021.pdf,
Section 3.2"; Section 3.2";
} }
} }
description description
"Function supported by this certificate from within the "Function supported by this certificate from within
TPM."; the TPM.";
} }
} }
} }
} }
} }
container attester-supported-algos { container attester-supported-algos {
description description
"Identifies which TPM algorithms are available for use on an "Identifies which TPM algorithms are available for use on an
attesting platform."; attesting platform.";
leaf-list tpm12-asymmetric-signing { leaf-list tpm12-asymmetric-signing {
when "../../tpm:tpms" when "../../tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm12']"; + "/tpm:tpm[tpm:firmware-version='taa:tpm12']";
if-feature "taa:tpm12"; if-feature "taa:tpm12";
type identityref { type identityref {
base taa:asymmetric; base taa:asymmetric;
} }
description description
"Platform Supported TPM12 asymmetric algorithms."; "Platform-supported TPM1.2 asymmetric algorithms.";
} }
leaf-list tpm12-hash { leaf-list tpm12-hash {
when "../../tpm:tpms" when "../../tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm12']"; + "/tpm:tpm[tpm:firmware-version='taa:tpm12']";
if-feature "taa:tpm12"; if-feature "taa:tpm12";
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
description description
"Platform supported TPM12 hash algorithms."; "Platform-supported TPM1.2 hash algorithms.";
} }
leaf-list tpm20-asymmetric-signing { leaf-list tpm20-asymmetric-signing {
when "../../tpm:tpms" when "../../tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm20']"; + "/tpm:tpm[tpm:firmware-version='taa:tpm20']";
if-feature "taa:tpm20"; if-feature "taa:tpm20";
type identityref { type identityref {
base taa:asymmetric; base taa:asymmetric;
} }
description description
"Platform Supported TPM20 asymmetric algorithms."; "Platform-supported TPM2.0 asymmetric algorithms.";
} }
leaf-list tpm20-hash { leaf-list tpm20-hash {
when "../../tpm:tpms" when "../../tpm:tpms"
+ "/tpm:tpm[tpm:firmware-version='taa:tpm20']"; + "/tpm:tpm[tpm:firmware-version='taa:tpm20']";
if-feature "taa:tpm20"; if-feature "taa:tpm20";
type identityref { type identityref {
base taa:hash; base taa:hash;
} }
description description
"Platform supported TPM20 hash algorithms."; "Platform-supported TPM2.0 hash algorithms.";
} }
} }
} }
} }
&lt;CODE ENDS&gt; ]]></sourcecode>
</sourcecode>
</figure> </figure>
</section> </section>
</section> </section>
<section anchor="ietf-tcg-algs"> <section anchor="ietf-tcg-algs">
<name>'ietf-tcg-algs'</name> <name>ietf-tcg-algs</name>
<t>This document has encoded the TCG Algorithm definitions of <xref ta <t>This document has encoded the TCG Algorithm definitions of Table 3
rget="TCG-Algos"/>, revision 1.32. By including this full table as a separate YA of <xref target="TCG-Algos"/>, revision 1.32. By including this full table as a
NG file within this document, it is possible for other YANG models to leverage t separate YANG file within this document, it is possible for other YANG modules t
he contents of this model. Specific references to <xref target="RFC2104"/>, <xre o leverage the contents of this module. Specific references to <xref target="TP
f target="RFC8017"/>, <xref target="ISO-IEC-9797-1"/>, <xref target="ISO-IEC-979 M1.2-Structures"/>, <xref target="TPM2.0"/>, <xref target="RFC2104"/>, <xref tar
7-2"/>, <xref target="ISO-IEC-10116"/>, <xref target="ISO-IEC-10118-3"/>, <xref get="RFC8017"/>, <xref target="RFC8032"/>, <xref target="ISO-IEC-9797-1"/>, <xre
target="ISO-IEC-14888-3"/>, <xref target="ISO-IEC-15946-1"/>, <xref target="ISO- f target="ISO-IEC-9797-2"/>, <xref target="ISO-IEC-10116"/>, <xref target="ISO-I
IEC-18033-3"/>, <xref target="IEEE-Std-1363-2000"/>, <xref target="IEEE-Std-1363 EC-10118-3"/>, <xref target="ISO-IEC-14888-3"/>, <xref target="ISO-IEC-15946-1"/
a-2004"/>, <xref target="NIST-PUB-FIPS-202"/>, <xref target="NIST-SP800-38C"/>, >, <xref target="ISO-IEC-18033-3"/>, <xref target="IEEE-Std-1363-2000"/>, <xref
<xref target="NIST-SP800-38D"/>, <xref target="NIST-SP800-38F"/>, <xref target=" target="IEEE-Std-1363a-2004"/>, <xref target="NIST-FIPS-202"/>, <xref target="NI
NIST-SP800-56A"/>, <xref target="NIST-SP800-108"/>, <xref target="bios-log"/>, a ST-SP800-38C"/>, <xref target="NIST-SP800-38D"/>, <xref target="NIST-SP800-38F"/
s well as <xref target="ima"/> and <xref target="netequip-boot-log"/> exist with >, <xref target="NIST-SP800-56A"/>, and <xref target="NIST-SP800-108"/> exist wi
in the YANG Model.</t> thin the YANG module.</t>
<section anchor="features-1"> <section anchor="features-1">
<name>Features</name> <name>Features</name>
<t>There are two types of features supported: 'TPM12' and 'TPM20'. S upport for either of these features indicates that a cryptoprocessor supporting the corresponding type of TCG TPM API is present on an Attester. Most commonly, only one type of cryptoprocessor will be available on an Attester.</t> <t>There are two types of features supported: 'tpm12' and 'tpm20'. S upport for either of these features indicates that a cryptoprocessor supporting the corresponding type of TCG TPM API is present on an Attester. Most commonly, only one type of cryptoprocessor will be available on an Attester.</t>
</section> </section>
<section anchor="identities-1"> <section anchor="identities-1">
<name>Identities</name> <name>Identities</name>
<t>There are three types of identities in this model:</t> <t>There are three types of identities in this model:</t>
<ol spacing="normal" type="1"> <ol spacing="normal" type="1">
<li>Cryptographic functions supported by a TPM algorithm; these in clude: 'asymmetric', 'symmetric', 'hash', 'signing', 'anonymous_signing', 'encry ption_mode', 'method', and 'object_type'. The definitions of each of these are i n Table 2 of <xref target="TCG-Algos"/>.</li> <li>Cryptographic functions supported by a TPM algorithm; these in clude 'asymmetric', 'symmetric', 'hash', 'signing', 'anonymous_signing', 'encryp tion_mode', 'method', and 'object_type'. The definitions of each of these are in Table 2 of <xref target="TCG-Algos"/>.</li>
<li>API specifications for TPM types: 'tpm12' and 'tpm20'</li> <li>API specifications for TPM types: 'tpm12' and 'tpm20'</li>
<li>Specific algorithm types: Each algorithm type defines what cry ptographic functions may be supported, and on which type of API specification. I t is not required that an implementation of a specific TPM will support all algo rithm types. The contents of each specific algorithm mirrors what is in Table 3 of <xref target="TCG-Algos"/>.</li> <li>Specific algorithm types: Each algorithm type defines which cr yptographic functions may be supported, and on which type of API specification. It is not required that an implementation of a specific TPM will support all alg orithm types. The contents of each specific algorithm mirrors the contents of Ta ble 3 of <xref target="TCG-Algos"/>.</li>
</ol> </ol>
</section> </section>
<section anchor="ref-ietf-tcg-algs"> <section anchor="ref-ietf-tcg-algs">
<name>YANG Module</name> <name>YANG Module</name>
<sourcecode type="YANG"> <sourcecode type="yang" markers="true" name="ietf-tcg-algs@2024-10-2
&lt;CODE BEGINS&gt; file "ietf-tcg-algs@2022-03-23.yang" 2.yang"><![CDATA[
module ietf-tcg-algs { module ietf-tcg-algs {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-tcg-algs"; namespace "urn:ietf:params:xml:ns:yang:ietf-tcg-algs";
prefix taa; prefix taa;
organization organization
"IETF RATS (Remote ATtestation procedureS) Working Group"; "IETF RATS (Remote ATtestation procedureS) Working Group";
contact contact
"WG Web: &lt;https://datatracker.ietf.org/wg/rats/&gt; "WG Web: <https://datatracker.ietf.org/wg/rats/>
WG List: &lt;mailto:rats@ietf.org&gt; WG List: <mailto:rats@ietf.org>
Author: Eric Voit &lt;mailto:evoit@cisco.com&gt;"; Author: Eric Voit <mailto:evoit@cisco.com>";
description description
"This module defines identities for asymmetric algorithms. "This module defines identities for asymmetric algorithms.
Copyright (c) 2022 IETF Trust and the persons identified as The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
authors of the code. All rights reserved. NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
Redistribution and use in source and binary forms, with 'MAY', and 'OPTIONAL' in this document are to be interpreted as
or without modification, is permitted pursuant to, and described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
subject to the license terms contained in, the Revised they appear in all capitals, as shown here.
BSD License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX Copyright (c) 2024 IETF Trust and the persons identified as
(https://www.rfc-editor.org/info/rfcXXXX); see the RFC itself authors of the code. All rights reserved.
for full legal notices.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', Redistribution and use in source and binary forms, with or
'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', without modification, is permitted pursuant to, and subject to
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document the license terms contained in, the Revised BSD License set
are to be interpreted as described in BCP 14 (RFC 2119) forth in Section 4.c of the IETF Trust's Legal Provisions
(RFC 8174) when, and only when, they appear in all Relating to IETF Documents
capitals, as shown here."; (https://trustee.ietf.org/license-info).
revision 2022-03-23 { This version of this YANG module is part of RFC 9684; see the
RFC itself for full legal notices.";
revision 2024-10-22 {
description description
"Initial version"; "Initial version";
reference reference
"RFC XXXX: A YANG Data Model for Challenge-Response-based Remote "RFC 9684: A YANG Data Model for Challenge-Response-Based
Attestation Procedures using TPMs"; Remote Attestation (CHARRA) Procedures Using Trusted Platform
Modules (TPMs)";
} }
/*****************/ /*****************/
/* Features */ /* Features */
/*****************/ /*****************/
feature tpm12 { feature tpm12 {
description description
"This feature indicates algorithm support for the TPM 1.2 API "This feature indicates algorithm support for the TPM 1.2 API
as per Section 4.8 of TPM1.2-Structures: per Section 4.8 of TPM1.2-Structures.";
TPM Main Part 2 TPM Structures reference
https://trustedcomputinggroup.org/wp-content/uploads/TPM- "TPM1.2-Structures: TPM Main Part 2 TPM Structures,
Main-Part-2-TPM-Structures_v1.2_rev116_01032011.pdf"; https://trustedcomputinggroup.org/wp-content/uploads/
TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.pdf
TPM_ALGORITHM_ID values, Section 4.8";
} }
feature tpm20 { feature tpm20 {
description description
"This feature indicates algorithm support for the TPM 2.0 API "This feature indicates algorithm support for the TPM 2.0 API
as per Section 11.4 of Trusted Platform Module Library per Section 11.4 of Trusted Platform Module Library Part 1:
Part 1: Architecture. See TPM2.0-Arch: Architecture.";
https://trustedcomputinggroup.org/wp-content/uploads/ reference
TCG_TPM2_r1p59_Part1_Architecture_pub.pdf"; "TPM2.0-Arch: Trusted Platform Module Library Part 1:
Architecture, https://trustedcomputinggroup.org/wp-content/
uploads/TPM-2.0-1.83-Part-1-Architecture.pdf, Section 11.4";
} }
/*****************/ /*****************/
/* Identities */ /* Identities */
/*****************/ /*****************/
identity asymmetric { identity asymmetric {
description description
"A TCG recognized asymmetric algorithm with a public and "A TCG-recognized asymmetric algorithm with a public and
private key."; private key.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2, "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2,
https://trustedcomputinggroup.org/resource/ https://trustedcomputinggroup.org/resource/
tcg-algorithm-registry/TCG-_Algorithm_Registry_r1p32_pub"; tcg-algorithm-registry/TCG-_Algorithm_Registry_r1p32_pub";
} }
identity symmetric { identity symmetric {
description description
"A TCG recognized symmetric algorithm with only a private key."; "A TCG-recognized symmetric algorithm with only a private
key.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity hash { identity hash {
description description
"A TCG recognized hash algorithm that compresses input data to "A TCG-recognized hash algorithm that compresses input data to
a digest value or indicates a method that uses a hash."; a digest value or indicates a method that uses a hash.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity signing { identity signing {
description description
"A TCG recognized signing algorithm"; "A TCG-recognized signing algorithm";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity anonymous_signing { identity anonymous_signing {
description description
"A TCG recognized anonymous signing algorithm."; "A TCG-recognized anonymous signing algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity encryption_mode { identity encryption_mode {
description description
"A TCG recognized encryption mode."; "A TCG-recognized encryption mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity method { identity method {
description description
"A TCG recognized method such as a mask generation function."; "A TCG-recognized method such as a mask generation function.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity object_type { identity object_type {
description description
"A TCG recognized object type."; "A TCG-recognized object type.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 2"; "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 2";
} }
identity cryptoprocessor { identity cryptoprocessor {
description description
"Base identity identifying a crytoprocessor."; "Base identity identifying a crytoprocessor.";
} }
identity tpm12 { identity tpm12 {
if-feature "tpm12"; if-feature "tpm12";
base cryptoprocessor; base cryptoprocessor;
description description
"Supportable by a TPM1.2."; "Supportable by a TPM 1.2.";
reference reference
"TPM1.2-Structures: "TPM1.2-Structures:
TPM Main Part 2 TPM Structures,
https://trustedcomputinggroup.org/wp-content/uploads/ https://trustedcomputinggroup.org/wp-content/uploads/
TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.pdf TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.pdf
TPM_ALGORITHM_ID values, Section 4.8"; TPM_ALGORITHM_ID values, Section 4.8";
} }
identity tpm20 { identity tpm20 {
if-feature "tpm20"; if-feature "tpm20";
base cryptoprocessor; base cryptoprocessor;
description description
"Supportable by a TPM2."; "Supportable by a TPM 2.0";
reference reference
"TPM2.0-Structures: "TPM2.0-Structures:
https://trustedcomputinggroup.org/wp-content/uploads/ Trusted Platform Module Library Part 2: Structures,
TPM-Rev-2.0-Part-2-Structures-01.38.pdf"; Revision 01.83, https://trustedcomputinggroup.org/
wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf";
} }
identity TPM_ALG_RSA { identity TPM_ALG_RSA {
if-feature "tpm12 or tpm20"; if-feature "tpm12 or tpm20";
base tpm12; base tpm12;
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base object_type; base object_type;
description description
"RSA algorithm"; "RSA algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8017. ALG_ID: 0x0001"; RFC 8017. ALG_ID: 0x0001";
} }
identity TPM_ALG_TDES { identity TPM_ALG_TDES {
if-feature "tpm12"; if-feature "tpm12";
base tpm12; base tpm12;
base symmetric; base symmetric;
description description
"Block cipher with various key sizes (Triple Data Encryption "Block cipher with various key sizes (Triple Data Encryption
Algorithm, commonly called Triple Data Encryption Standard) Algorithm, commonly called Triple Data Encryption Standard)
Note: was banned in TPM1.2 v94"; Note: Was banned in TPM 1.2, v94";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 18033-3. ALG_ID: 0x0003"; ISO/IEC 18033-3. ALG_ID: 0x0003";
} }
identity TPM_ALG_SHA1 { identity TPM_ALG_SHA1 {
if-feature "tpm12 or tpm20"; if-feature "tpm12 or tpm20";
base hash; base hash;
base tpm12; base tpm12;
base tpm20; base tpm20;
description description
"SHA1 algorithm - Deprecated due to insufficient cryptographic "SHA1 algorithm - Deprecated due to insufficient cryptographic
protection. However, it is still useful for hash algorithms protection. However, it is still useful for hash algorithms
where protection is not required."; where protection is not required.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry Rev1.34, Table 3, and
ISO/IEC 10118-3. ALG_ID: 0x0004"; ISO/IEC 10118-3. ALG_ID: 0x0004";
} }
identity TPM_ALG_HMAC { identity TPM_ALG_HMAC {
if-feature "tpm12 or tpm20"; if-feature "tpm12 or tpm20";
base tpm12; base tpm12;
base tpm20; base tpm20;
base hash; base hash;
base signing; base signing;
description description
"Hash Message Authentication Code (HMAC) algorithm"; "Hash Message Authentication Code (HMAC) algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3, "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 9797-2 and RFC2104. ALG_ID: 0x0005"; ISO/IEC 9797-2, and
RFC 2104. ALG_ID: 0x0005";
} }
identity TPM_ALG_AES { identity TPM_ALG_AES {
if-feature "tpm12"; if-feature "tpm12";
base tpm12; base tpm12;
base symmetric; base symmetric;
description description
"The AES algorithm with various key sizes"; "The AES algorithm with various key sizes.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3, "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 18033-3. ALG_ID: 0x0006"; ISO/IEC 18033-3. ALG_ID: 0x0006";
} }
identity TPM_ALG_MGF1 { identity TPM_ALG_MGF1 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
base method; base method;
description description
"hash-based mask-generation function"; "Hash-based mask-generation function.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3, "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
IEEE Std 1363-2000 and IEEE Std 1363a-2004. IEEE Std 1363-2000, and
IEEE Std 1363a-2004.
ALG_ID: 0x0007"; ALG_ID: 0x0007";
} }
identity TPM_ALG_KEYEDHASH { identity TPM_ALG_KEYEDHASH {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
base object_type; base object_type;
description description
"An encryption or signing algorithm using a keyed hash. These "An encryption or signing algorithm using a keyed hash. These
may use XOR for encryption or an HMAC for signing and may may use XOR for encryption or an HMAC for signing and may
also refer to a data object that is neither signing nor also refer to a data object that is neither signing nor
encrypting."; encrypting.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3, "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x0008"; ALG_ID: 0x0008";
} }
identity TPM_ALG_XOR { identity TPM_ALG_XOR {
if-feature "tpm12 or tpm20"; if-feature "tpm12 or tpm20";
base tpm12; base tpm12;
base tpm20; base tpm20;
base hash; base hash;
base symmetric; base symmetric;
description description
"The XOR encryption algorithm."; "The XOR encryption algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3. "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x000A"; ALG_ID: 0x000A";
} }
identity TPM_ALG_SHA256 { identity TPM_ALG_SHA256 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SHA 256 algorithm"; "The SHA-256 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10118-3. ALG_ID: 0x000B"; ISO/IEC 10118-3. ALG_ID: 0x000B";
} }
identity TPM_ALG_SHA384 { identity TPM_ALG_SHA384 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SHA 384 algorithm"; "The SHA-384 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10118-3. ALG_ID: 0x000C"; ISO/IEC 10118-3. ALG_ID: 0x000C";
} }
identity TPM_ALG_SHA512 { identity TPM_ALG_SHA512 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SHA 512 algorithm"; "The SHA-512 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10118-3. ALG_ID: 0x000D"; ISO/IEC 10118-3. ALG_ID: 0x000D";
} }
identity TPM_ALG_NULL { identity TPM_ALG_NULL {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
description description
"NULL algorithm"; "Null algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3. "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x0010"; ALG_ID: 0x0010";
} }
identity TPM_ALG_SM3_256 { identity TPM_ALG_SM3_256 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SM3 hash algorithm."; "The ShangMi 3 (SM3) hash algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10118-3:2018. ALG_ID: 0x0012"; ISO/IEC 10118-3:2018. ALG_ID: 0x0012";
} }
identity TPM_ALG_SM4 { identity TPM_ALG_SM4 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
description description
"SM4 symmetric block cipher"; "ShangMi 4 (SM4) symmetric block cipher.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3. "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x0013"; ALG_ID: 0x0013";
} }
identity TPM_ALG_RSASSA { identity TPM_ALG_RSASSA {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
description description
"RFC 8017 Signature algorithm defined in section 8.2 "Signature algorithm defined in Section 8.2
(RSASSAPKCS1-v1_5)"; (RSASSA-PKCS1-v1_5) of RFC 8017.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8017. ALG_ID: 0x0014"; RFC 8017. ALG_ID: 0x0014";
} }
identity TPM_ALG_RSAES { identity TPM_ALG_RSAES {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base encryption_mode; base encryption_mode;
description description
"RFC 8017 Signature algorithm defined in section 7.2 "Signature algorithm defined in Section 7.2
(RSAES-PKCS1-v1_5)"; (RSAES-PKCS1-v1_5) of RFC 8017.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8017. ALG_ID: 0x0015"; RFC 8017. ALG_ID: 0x0015";
} }
identity TPM_ALG_RSAPSS { identity TPM_ALG_RSAPSS {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
description description
"Padding algorithm defined in section 8.1 (RSASSA PSS)"; "Padding algorithm defined in Section 8.1 (RSASSA-PSS)
of RFC 8017.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8017. ALG_ID: 0x0016"; RFC 8017. ALG_ID: 0x0016";
} }
identity TPM_ALG_OAEP { identity TPM_ALG_OAEP {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base encryption_mode; base encryption_mode;
description description
"Padding algorithm defined in section 7.1 (RSASSA OAEP)"; "Padding algorithm defined in Section 7.1 (RSAES-OAEP)
of RFC 8017.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8017. ALG_ID: 0x0017"; RFC 8017. ALG_ID: 0x0017";
} }
identity TPM_ALG_ECDSA { identity TPM_ALG_ECDSA {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
description description
"Signature algorithm using elliptic curve cryptography (ECC)"; "Signature algorithm using elliptic curve cryptography (ECC).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 14888-3. ALG_ID: 0x0018"; ISO/IEC 14888-3. ALG_ID: 0x0018";
} }
identity TPM_ALG_ECDH { identity TPM_ALG_ECDH {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base method; base method;
description description
"Secret sharing using ECC"; "Secret sharing using ECC.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-56A. ALG_ID: 0x0019"; NIST SP800-56A. ALG_ID: 0x0019";
} }
identity TPM_ALG_ECDAA { identity TPM_ALG_ECDAA {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
base anonymous_signing; base anonymous_signing;
description description
"Elliptic-curve based anonymous signing scheme"; "Elliptic-curve-based, anonymous signing scheme.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
TCG TPM 2.0 library specification. ALG_ID: 0x001A"; TCG TPM 2.0 Library. ALG_ID: 0x001A";
} }
identity TPM_ALG_SM2 { identity TPM_ALG_SM2 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
base method; base method;
description description
"SM2 - depending on context, either an elliptic-curve based, "SM2 - depending on context, either an elliptic-curve based,
signature algorithm, an encryption scheme, or a key exchange signature algorithm, an encryption scheme, or a key exchange
protocol"; protocol.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3. "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x001B"; ALG_ID: 0x001B";
} }
identity TPM_ALG_ECSCHNORR { identity TPM_ALG_ECSCHNORR {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
description description
"Elliptic-curve based Schnorr signature"; "Elliptic-curve-based Schnorr signature.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3. "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3.
ALG_ID: 0x001C"; ALG_ID: 0x001C";
} }
identity TPM_ALG_ECMQV { identity TPM_ALG_ECMQV {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base method; base method;
description description
"Two-phase elliptic-curve key"; "Two-phase elliptic-curve key.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-56A. ALG_ID: 0x001D"; NIST SP800-56A. ALG_ID: 0x001D";
} }
identity TPM_ALG_KDF1_SP800_56A { identity TPM_ALG_KDF1_SP800_56A {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
base method; base method;
description description
"Concatenation key derivation function"; "Concatenation key derivation function.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-56A (approved alternative1) section 5.8.1. NIST SP800-56A (approved alternative1) Section 5.8.1.
ALG_ID: 0x0020"; ALG_ID: 0x0020";
} }
identity TPM_ALG_KDF2 { identity TPM_ALG_KDF2 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
base method; base method;
description description
"Key derivation function"; "Key derivation function.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
IEEE 1363a-2004 KDF2 section 13.2. ALG_ID: 0x0021"; IEEE 1363a-2004, KDF2, Section 13.2. ALG_ID: 0x0021";
} }
identity TPM_ALG_KDF1_SP800_108 { identity TPM_ALG_KDF1_SP800_108 {
base TPM_ALG_KDF2; base TPM_ALG_KDF2;
description description
"A key derivation method"; "A key derivation method.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3 and
NIST SP800-108 - Section 5.1 KDF. ALG_ID: 0x0022"; NIST SP800-108, Section 4.1, KDF. ALG_ID: 0x0022";
} }
identity TPM_ALG_ECC { identity TPM_ALG_ECC {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base object_type; base object_type;
description description
"Prime field ECC"; "Prime field ECC.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 15946-1. ALG_ID: 0x0023"; ISO/IEC 15946-1. ALG_ID: 0x0023";
} }
identity TPM_ALG_SYMCIPHER { identity TPM_ALG_SYMCIPHER {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base object_type; base object_type;
description description
"Object type for a symmetric block cipher"; "Object type for a symmetric block cipher.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
TCG TPM 2.0 library specification. ALG_ID: 0x0025"; TCG TPM 2.0 Library. ALG_ID: 0x0025";
} }
identity TPM_ALG_CAMELLIA { identity TPM_ALG_CAMELLIA {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
description description
"The Camellia algorithm"; "The Camellia algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 18033-3. ALG_ID: 0x0026"; ISO/IEC 18033-3. ALG_ID: 0x0026";
} }
identity TPM_ALG_SHA3_256 { identity TPM_ALG_SHA3_256 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"ISO/IEC 10118-3 - the SHA 256 algorithm"; "ISO/IEC 10118-3 - the SHA-256 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST PUB FIPS 202. ALG_ID: 0x0027"; NIST FIPS 202. ALG_ID: 0x0027";
} }
identity TPM_ALG_SHA3_384 { identity TPM_ALG_SHA3_384 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SHA 384 algorithm"; "The SHA-384 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST PUB FIPS 202. ALG_ID: 0x0028"; NIST FIPS 202. ALG_ID: 0x0028";
} }
identity TPM_ALG_SHA3_512 { identity TPM_ALG_SHA3_512 {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base hash; base hash;
description description
"The SHA 512 algorithm"; "The SHA-512 algorithm.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST PUB FIPS 202. ALG_ID: 0x0029"; NIST FIPS 202. ALG_ID: 0x0029";
} }
identity TPM_ALG_CMAC { identity TPM_ALG_CMAC {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
description description
"block Cipher-based Message Authentication Code (CMAC)"; "Block Cipher-based Message Authentication Code (CMAC).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 9797-1:2011 Algorithm 5. ALG_ID: 0x003F"; ISO/IEC 9797-1:2011, Algorithm 5. ALG_ID: 0x003F";
} }
identity TPM_ALG_CTR { identity TPM_ALG_CTR {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base encryption_mode; base encryption_mode;
description description
"Counter mode"; "Counter mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10116. ALG_ID: 0x0040"; ISO/IEC 10116. ALG_ID: 0x0040";
} }
identity TPM_ALG_OFB { identity TPM_ALG_OFB {
base tpm20; base tpm20;
base symmetric; base symmetric;
base encryption_mode; base encryption_mode;
description description
"Output Feedback mode"; "Output Feedback mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10116. ALG_ID: 0x0041"; ISO/IEC 10116. ALG_ID: 0x0041";
} }
identity TPM_ALG_CBC { identity TPM_ALG_CBC {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base encryption_mode; base encryption_mode;
description description
"Cipher Block Chaining mode"; "Cipher Block Chaining mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10116. ALG_ID: 0x0042"; ISO/IEC 10116. ALG_ID: 0x0042";
} }
identity TPM_ALG_CFB { identity TPM_ALG_CFB {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base encryption_mode; base encryption_mode;
description description
"Cipher Feedback mode"; "Cipher Feedback mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10116. ALG_ID: 0x0043"; ISO/IEC 10116. ALG_ID: 0x0043";
} }
identity TPM_ALG_ECB { identity TPM_ALG_ECB {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base encryption_mode; base encryption_mode;
description description
"Electronic Codebook mode"; "Electronic Codebook mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
ISO/IEC 10116. ALG_ID: 0x0044"; ISO/IEC 10116. ALG_ID: 0x0044";
} }
identity TPM_ALG_CCM { identity TPM_ALG_CCM {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
description description
"Counter with Cipher Block Chaining-Message Authentication "Counter with Cipher Block Chaining--Message Authentication
Code (CCM)"; Code (CCM).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-38C. ALG_ID: 0x0050"; NIST SP800-38C. ALG_ID: 0x0050";
} }
identity TPM_ALG_GCM { identity TPM_ALG_GCM {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
description description
"Galois/Counter Mode (GCM)"; "Galois/Counter Mode (GCM).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-38D. ALG_ID: 0x0051"; NIST SP800-38D. ALG_ID: 0x0051";
} }
identity TPM_ALG_KW { identity TPM_ALG_KW {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
description description
"AES Key Wrap (KW)"; "AES Key Wrap (KW).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-38F. ALG_ID: 0x0052"; NIST SP800-38F. ALG_ID: 0x0052";
} }
identity TPM_ALG_KWP { identity TPM_ALG_KWP {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
description description
"AES Key Wrap with Padding (KWP)"; "AES Key Wrap with Padding (KWP).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-38F. ALG_ID: 0x0053"; NIST SP800-38F. ALG_ID: 0x0053";
} }
identity TPM_ALG_EAX { identity TPM_ALG_EAX {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base symmetric; base symmetric;
base signing; base signing;
base encryption_mode; base encryption_mode;
description description
"Authenticated-Encryption Mode"; "Authenticated-Encryption Mode.";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
NIST SP800-38F. ALG_ID: 0x0054"; NIST SP800-38F. ALG_ID: 0x0054";
} }
identity TPM_ALG_EDDSA { identity TPM_ALG_EDDSA {
if-feature "tpm20"; if-feature "tpm20";
base tpm20; base tpm20;
base asymmetric; base asymmetric;
base signing; base signing;
description description
"Edwards-curve Digital Signature Algorithm (PureEdDSA)"; "Edwards-curve Digital Signature Algorithm (PureEdDSA).";
reference reference
"TCG-Algos:TCG Algorithm Registry Rev1.32 Table 3 and "TCG-Algos: TCG Algorithm Registry, Rev1.34, Table 3, and
RFC 8032. ALG_ID: 0x0060"; RFC 8032. ALG_ID: 0x0060";
} }
} }
&lt;CODE ENDS&gt; ]]></sourcecode>
</sourcecode> <t>Note that not all cryptographic functions are required for use by
<t>Note that not all cryptographic functions are required for use by ietf-tpm-remote-attestation.yang. However, the full definition of Table 3 of <x
<tt>ietf-tpm-remote-attestation.yang</tt>. However, the full definition of Tabl ref target="TCG-Algos"/> will allow use by additional YANG specifications.</t>
e 3 of <xref target="TCG-Algos"/> will allow use by additional YANG specificatio
ns.</t>
</section> </section>
</section> </section>
</section> </section>
</section> </section>
<section anchor="iana-considerations"> <section anchor="iana-considerations">
<name>IANA Considerations</name> <name>IANA Considerations</name>
<t>This document registers the following namespace URIs in the <t>This document registers the following namespace URIs in the
<xref target="xml-registry"/> as per <xref target="RFC3688"/>:</t> <xref target="XML-Registry"/> per <xref target="RFC3688"/>:</t>
<dl> <dl>
<dt>URI:</dt> <dt>URI:</dt>
<dd> <dd>
<t>urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation <t>urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation
</t> </t>
<dl> <dl>
<dt>Registrant Contact:</dt> <dt>Registrant Contact:</dt>
<dd> <dd>
<t>The IESG.</t> <t>The IESG.</t>
</dd> </dd>
skipping to change at line 2255 skipping to change at line 2345
<t>The IESG.</t> <t>The IESG.</t>
</dd> </dd>
<dt>XML:</dt> <dt>XML:</dt>
<dd> <dd>
<t>N/A; the requested URI is an XML namespace.</t> <t>N/A; the requested URI is an XML namespace.</t>
</dd> </dd>
</dl> </dl>
</dd> </dd>
</dl> </dl>
<t>This document registers the following YANG modules in the <t>This document registers the following YANG modules in the
registry <xref target="yang-parameters"/> as per Section 14 of <xref target="RFC 6020"/>:</t> registry <xref target="YANG-Parameters"/> per <xref target="RFC6020" section="14 " sectionFormat="of"/>:</t>
<dl> <dl>
<dt>Name:</dt> <dt>Name:</dt>
<dd> <dd>
<t>ietf-tpm-remote-attestation <t>ietf-tpm-remote-attestation
</t> </t>
<dl> <dl>
<dt>Namespace:</dt> <dt>Namespace:</dt>
<dd> <dd>
<t>urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation</t> <t>urn:ietf:params:xml:ns:yang:ietf-tpm-remote-attestation</t>
</dd> </dd>
skipping to change at line 2299 skipping to change at line 2389
<dt>Reference:</dt> <dt>Reference:</dt>
<dd> <dd>
<t>draft-ietf-rats-yang-tpm-charra (RFC form)</t> <t>draft-ietf-rats-yang-tpm-charra (RFC form)</t>
</dd> </dd>
</dl> </dl>
</dd> </dd>
</dl> </dl>
</section> </section>
<section anchor="security-considerations"> <section anchor="security-considerations">
<name>Security Considerations</name> <name>Security Considerations</name>
<t>The YANG module ietf-tpm-remote-attestation.yang specified in this docu <!-- [rfced] Section 4. The original Security Considerations section was missing
ment defines a schema for data that is designed to be accessed via network manag paragraphs 2, 4, and 5 that are specified in the template found at <https://wik
ement protocols such as NETCONF <xref target="RFC6241"/> or RESTCONF <xref targe i.ietf.org/group/ops/yang-security-guidelines>. We have added paragraph 2. Pleas
t="RFC8040"/>. The lowest NETCONF layer is the secure transport layer, and the m e let us know if paragraphs 4 and 5 should also be added. -->
andatory-to-implement secure transport is Secure Shell (SSH) <xref target="RFC62 <t>The YANG module ietf-tpm-remote-attestation.yang specified in this docu
42"/>. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure ment defines a schema for data that is designed to be accessed via network manag
transport is TLS <xref target="RFC8446"/>.</t> ement protocols such as NETCONF <xref target="RFC6241"/> or RESTCONF <xref targe
<t>There are a number of data nodes defined in this YANG module that are w t="RFC8040"/>. The lowest NETCONF layer is the secure transport layer, and the
ritable/creatable/deletable (i.e., <em>config true</em>, which is the default). mandatory-to-implement secure transport is Secure Shell (SSH) <xref target="RFC6
These data nodes may be considered sensitive or vulnerable in some network envir 242"/>. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secu
onments. Write operations (e.g., <em>edit-config</em>) to these data nodes witho re transport is TLS <xref target="RFC8446"/>.</t>
ut proper protection can have a negative effect on network operations. These are <t> The Network Configuration Access Control Model (NACM) <xref target="RF
the subtrees and data nodes as well as their sensitivity/vulnerability:</t> C8341"/> provides the means to restrict access for particular NETCONF or RESTCON
F users to a preconfigured subset of all available NETCONF or RESTCONF protocol
operations and content.
</t>
<t>Of special consideration are the following nodes:</t>
<ul>
<li>In the 'tpms' container, the 'certificates' will expose certificates
used for attestation, potentially allowing selection of a certificate that migh
t be compromised. The 'type' could also be misconfigured to represent a differen
t type of key, which might alter how a Verifier might evaluate the results.</li>
<li>Within the 'attester-supported-algos' container, each leaf-list will
expose and potentially allow changing of the encryption algorithms supported by
a device.</li>
</ul>
<t>There are a number of data nodes defined in this YANG module that are w
ritable/creatable/deletable (i.e., <em>config true</em>, which is the default).
These data nodes may be considered sensitive or vulnerable in some network envi
ronments. Write operations (e.g., <em>edit-config</em>) to these data nodes wit
hout proper protection can have a negative effect on network operations. These
are the subtrees and data nodes as well as their sensitivity/vulnerability:</t>
<dl> <dl>
<dt>Container '/rats-support-structures/attester-supported-algos':</dt> <dt>Container '/rats-support-structures/attester-supported-algos':</dt>
<dd> <dd>
<t>'tpm12-asymmetric-signing', 'tpm12-hash', 'tpm20-asymmetric-signing ', and 'tpm20-hash'. All could be populated with algorithms that are not support ed by the underlying physical TPM installed by the equipment vendor. A vendor sh ould restrict the ability to configure unsupported algorithms.</t> <t>'tpm12-asymmetric-signing', 'tpm12-hash', 'tpm20-asymmetric-signing ', and 'tpm20-hash'. All could be populated with algorithms that are not support ed by the underlying physical TPM installed by the equipment vendor. A vendor s hould restrict the ability to configure unsupported algorithms.</t>
</dd> </dd>
<dt>Container: '/rats-support-structures/tpms':</dt> <dt>Container: '/rats-support-structures/tpms':</dt>
<dd> <dd>
<t>'name': Although shown as 'rw', it is system generated. Therefore, it should not be possible for an operator to add or remove a TPM from the config uration.</t> <t>'name': Although shown as 'rw', it is system generated. Therefore, it should not be possible for an operator to add or remove a TPM from the config uration.</t>
</dd> </dd>
<dt/> <dt/>
<dd> <dd>
<t>'tpm20-pcr-bank': It is possible to configure PCRs for extraction w hich are not being extended by system software. This could unnecessarily use TPM resources.</t> <t>'tpm20-pcr-bank': It is possible to configure PCRs that are not bei ng extended by system software for extraction. This could unnecessarily use TPM resources.</t>
</dd> </dd>
<dt/> <dt/>
<dd> <dd>
<t>'certificates': It is possible to provision a certificate which doe s not correspond to an Attestation Identity Key (AIK) within the TPM 1.2, or an Attestation Key (AK) within the TPM 2.0 respectively. In such a case, calls to a n RPC requesting this specific certificate could result in either no response or a response for an unexpected TPM.</t> <t>'certificates': It is possible to provision a certificate that does not correspond to an AIK within the TPM 1.2, or to an Attestation Key (AK) with in the TPM 2.0, respectively. In such a case, calls to an RPC requesting this sp ecific certificate could result in either no response or a response from an unex pected TPM.</t>
</dd> </dd>
<dt>RPC 'tpm12-challenge-response-attestation':</dt> <dt>RPC 'tpm12-challenge-response-attestation':</dt>
<dd> <dd>
<t>The receiver of the RPC response must verify that the certificate i s for an active AIK, i.e., the certificate has been confirmed by a third party a s being able to support Attestation on the targeted TPM 1.2.</t> <t>The receiver of the RPC response must verify that the certificate i s for an active AIK, i.e., the certificate has been confirmed by a third party a s being able to support Attestation on the targeted TPM 1.2.</t>
</dd> </dd>
<dt>RPC 'tpm20-challenge-response-attestation':</dt> <dt>RPC 'tpm20-challenge-response-attestation':</dt>
<dd> <dd>
<t>The receiver of the RPC response must verify that the certificate i s for an active AK, i.e., the private key confirmation of the quote signature wi thin the RPC response has been confirmed by a third party to belong to an entity legitimately able to perform Attestation on the targeted TPM 2.0.</t> <t>The receiver of the RPC response must verify that the certificate i s for an active AK, i.e., the private key confirmation of the quote signature wi thin the RPC response has been confirmed by a third party to belong to an entity legitimately able to perform Attestation on the targeted TPM 2.0.</t>
</dd> </dd>
<dt>RPC 'log-retrieval':</dt> <dt>RPC 'log-retrieval':</dt>
<dd> <dd>
<t>Requesting a large volume of logs from the Attester could require s ignificant system resources and create a denial of service.</t> <t>Requesting a large volume of logs from the Attester could require s ignificant system resources and create a denial of service.</t>
</dd> </dd>
</dl> </dl>
<t>Information collected through the RPCs above could reveal that specific <t>Information collected through the RPCs above could reveal specific vers
versions of software and configurations of endpoints that could identify vulner ions of software and configurations of endpoints that could identify vulnerabili
abilities on those systems. Therefore, RPCs should be protected by NACM <xref ta ties on those systems. Therefore, RPCs should be protected by NACM <xref target
rget="RFC8341"/> with a default setting of deny-all to limit the extraction of a ="RFC8341"/> with a default setting of deny-all to limit the extraction of attes
ttestation data by only authorized Verifiers.</t> tation data by only authorized Verifiers.</t>
<t>For the YANG module ietf-tcg-algs.yang, please use care when selecting <t>For the YANG module ietf-tcg-algs.yang, please use care when selecting
specific algorithms. The introductory section of <xref target="TCG-Algos"/> high specific algorithms. The introductory section of <xref target="TCG-Algos"/> hig
lights that some algorithms should be considered legacy, and recommends implemen hlights that some algorithms should be considered legacy, and recommends impleme
ters and adopters diligently evaluate available information such as governmental nters and adopters diligently evaluate available information such as governmenta
, industrial, and academic research before selecting an algorithm for use.</t> l, industrial, and academic research before selecting an algorithm for use.</t>
<t>Some of the readable data nodes in this YANG module may be considered s
ensitive or vulnerable in some network environments. It is thus important to con
trol read access (e.g., via get, get-config, or notification) to these data node
s. These are the subtrees and data nodes and their sensitivity/vulnerability:</t
>
<t>Event logs (bios-log, ima-log, netequip-boot-log) typically contain has
h values (digests) of running boot and OS software. Passive attackers can use th
ese hash values to identify software versions and thus launch targeted attacks o
n known vulnerabilities. Hence, bios-log, ima-log, and netequip-boot-log are con
siderd sensitive.</t>
<t>Some of the RPC operations in this YANG module may be considered sensit
ive or vulnerable in some network environments. It is thus important to control
access to these operations. These are the operations and their sensitivity/vulne
rability:</t>
<t>The 'log-retrieval' RPC operation is considered sensitive since it enab
les retrieval of logs (bios-log, ima-log, netequip-boot-log) that typically cont
ain hash values (digests) of running boot and OS software. This allows specific
s of loaded software including BIOS and operating system software to be understo
od externally.</t>
<t>The other two RPC operations, 'tpm20-challenge-response-attestation' an
d 'tpm12-challenge-response-attestation', will expose values indicating the inte
rnal operational state of the device. These values could also be correlated to s
pecifics of running software as well.</t>
</section> </section>
</middle> </middle>
<back> <back>
<displayreference target="I-D.ietf-rats-reference-interaction-models" to="RATS-I
nteraction-Models"/>
<references> <references>
<name>References</name> <name>References</name>
<references> <references>
<name>Normative References</name> <name>Normative References</name>
<reference anchor="RFC2104">
<front>
<title>HMAC: Keyed-Hashing for Message Authentication</title>
<seriesInfo name="DOI" value="10.17487/RFC2104"/>
<seriesInfo name="RFC" value="2104"/>
<author fullname="H. Krawczyk" initials="H." surname="Krawczyk"/>
<author fullname="M. Bellare" initials="M." surname="Bellare"/>
<author fullname="R. Canetti" initials="R." surname="Canetti"/>
<date month="February" year="1997"/>
<abstract>
<t>This document describes HMAC, a mechanism for message authentic
ation using cryptographic hash functions. HMAC can be used with any iterative cr
yptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared
key. The cryptographic strength of HMAC depends on the properties of the underl
ying hash function. This memo provides information for the Internet community. T
his memo does not specify an Internet standard of any kind</t>
</abstract>
</front>
</reference>
<reference anchor="RFC6020">
<front>
<title>YANG - A Data Modeling Language for the Network Configuration
Protocol (NETCONF)</title>
<seriesInfo name="DOI" value="10.17487/RFC6020"/>
<seriesInfo name="RFC" value="6020"/>
<author fullname="M. Bjorklund" initials="M." role="editor" surname=
"Bjorklund"/>
<date month="October" year="2010"/>
<abstract>
<t>YANG is a data modeling language used to model configuration an
d state data manipulated by the Network Configuration Protocol (NETCONF), NETCON
F remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK]</t>
</abstract>
</front>
</reference>
<reference anchor="RFC3688">
<front>
<title>The IETF XML Registry</title>
<seriesInfo name="DOI" value="10.17487/RFC3688"/>
<seriesInfo name="RFC" value="3688"/>
<seriesInfo name="BCP" value="81"/>
<author fullname="M. Mealling" initials="M." surname="Mealling"/>
<date month="January" year="2004"/>
<abstract>
<t>This document describes an IANA maintained registry for IETF st
andards which use Extensible Markup Language (XML) related items such as Namespa
ces, Document Type Declarations (DTDs), Schemas, and Resource Description Framew
ork (RDF) Schemas.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC6991">
<front>
<title>Common YANG Data Types</title>
<seriesInfo name="DOI" value="10.17487/RFC6991"/>
<seriesInfo name="RFC" value="6991"/>
<author fullname="J. Schoenwaelder" initials="J." role="editor" surn
ame="Schoenwaelder"/>
<date month="July" year="2013"/>
<abstract>
<t>This document introduces a collection of common data types to b
e used with the YANG data modeling language. This document obsoletes RFC 6021.</
t>
</abstract>
</front>
</reference>
<reference anchor="RFC8348">
<front>
<title>A YANG Data Model for Hardware Management</title>
<seriesInfo name="DOI" value="10.17487/RFC8348"/>
<seriesInfo name="RFC" value="8348"/>
<author fullname="A. Bierman" initials="A." surname="Bierman"/>
<author fullname="M. Bjorklund" initials="M." surname="Bjorklund"/>
<author fullname="J. Dong" initials="J." surname="Dong"/>
<author fullname="D. Romascanu" initials="D." surname="Romascanu"/>
<date month="March" year="2018"/>
<abstract>
<t>This document defines a YANG data model for the management of h
ardware on a single server.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC6241">
<front>
<title>Network Configuration Protocol (NETCONF)</title>
<seriesInfo name="DOI" value="10.17487/RFC6241"/>
<seriesInfo name="RFC" value="6241"/>
<author fullname="R. Enns" initials="R." role="editor" surname="Enns
"/>
<author fullname="M. Bjorklund" initials="M." role="editor" surname=
"Bjorklund"/>
<author fullname="J. Schoenwaelder" initials="J." role="editor" surn
ame="Schoenwaelder"/>
<author fullname="A. Bierman" initials="A." role="editor" surname="B
ierman"/>
<date month="June" year="2011"/>
<abstract>
<t>The Network Configuration Protocol (NETCONF) defined in this do
cument provides mechanisms to install, manipulate, and delete the configuration
of network devices. It uses an Extensible Markup Language (XML)-based data encod
ing for the configuration data as well as the protocol messages. The NETCONF pro
tocol operations are realized as remote procedure calls (RPCs). This document ob
soletes RFC 4741. [STANDARDS-TRACK]</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8040">
<front>
<title>RESTCONF Protocol</title>
<seriesInfo name="DOI" value="10.17487/RFC8040"/>
<seriesInfo name="RFC" value="8040"/>
<author fullname="A. Bierman" initials="A." surname="Bierman"/>
<author fullname="M. Bjorklund" initials="M." surname="Bjorklund"/>
<author fullname="K. Watsen" initials="K." surname="Watsen"/>
<date month="January" year="2017"/>
<abstract>
<t>This document describes an HTTP-based protocol that provides a
programmatic interface for accessing data defined in YANG, using the datastore c
oncepts defined in the Network Configuration Protocol (NETCONF).</t>
</abstract>
</front>
</reference>
<reference anchor="RFC6242">
<front>
<title>Using the NETCONF Protocol over Secure Shell (SSH)</title>
<seriesInfo name="DOI" value="10.17487/RFC6242"/>
<seriesInfo name="RFC" value="6242"/>
<author fullname="M. Wasserman" initials="M." surname="Wasserman"/>
<date month="June" year="2011"/>
<abstract>
<t>This document describes a method for invoking and running the N
etwork Configuration Protocol (NETCONF) within a Secure Shell (SSH) session as a
n SSH subsystem. This document obsoletes RFC 4742. [STANDARDS-TRACK]</t>
</abstract>
</front>
</reference>
<reference anchor="RFC6933">
<front>
<title>Entity MIB (Version 4)</title>
<seriesInfo name="DOI" value="10.17487/RFC6933"/>
<seriesInfo name="RFC" value="6933"/>
<author fullname="A. Bierman" initials="A." surname="Bierman"/>
<author fullname="D. Romascanu" initials="D." surname="Romascanu"/>
<author fullname="J. Quittek" initials="J." surname="Quittek"/>
<author fullname="M. Chandramouli" initials="M." surname="Chandramou
li"/>
<date month="May" year="2013"/>
<abstract>
<t>This memo defines a portion of the Management Information Base
(MIB) for use with network management protocols in the Internet community. In pa
rticular, it describes managed objects used for managing multiple logical and ph
ysical entities managed by a single Simple Network Management Protocol (SNMP) ag
ent. This document specifies version 4 of the Entity MIB. This memo obsoletes ve
rsion 3 of the Entity MIB module published as RFC 4133.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8446">
<front>
<title>The Transport Layer Security (TLS) Protocol Version 1.3</titl
e>
<seriesInfo name="DOI" value="10.17487/RFC8446"/>
<seriesInfo name="RFC" value="8446"/>
<author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
<date month="August" year="2018"/>
<abstract>
<t>This document specifies version 1.3 of the Transport Layer Secu
rity (TLS) protocol. TLS allows client/server applications to communicate over t
he Internet in a way that is designed to prevent eavesdropping, tampering, and m
essage forgery.</t>
<t>This document updates RFCs 5705 and 6066, and obsoletes RFCs 50
77, 5246, and 6961. This document also specifies new requirements for TLS 1.2 im
plementations.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8341">
<front>
<title>Network Configuration Access Control Model</title>
<seriesInfo name="DOI" value="10.17487/RFC8341"/>
<seriesInfo name="RFC" value="8341"/>
<seriesInfo name="STD" value="91"/>
<author fullname="A. Bierman" initials="A." surname="Bierman"/>
<author fullname="M. Bjorklund" initials="M." surname="Bjorklund"/>
<date month="March" year="2018"/>
<abstract>
<t>The standardization of network configuration interfaces for use
with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requ
ires a structured and secure operating environment that promotes human usability
and multi-vendor interoperability. There is a need for standard mechanisms to r
estrict NETCONF or RESTCONF protocol access for particular users to a preconfigu
red subset of all available NETCONF or RESTCONF protocol operations and content.
This document defines such an access control model.</t>
<t>This document obsoletes RFC 6536.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8032">
<front>
<title>Edwards-Curve Digital Signature Algorithm (EdDSA)</title>
<seriesInfo name="DOI" value="10.17487/RFC8032"/>
<seriesInfo name="RFC" value="8032"/>
<author fullname="S. Josefsson" initials="S." surname="Josefsson"/>
<author fullname="I. Liusvaara" initials="I." surname="Liusvaara"/>
<date month="January" year="2017"/>
<abstract>
<t>This document describes elliptic curve signature scheme Edwards
-curve Digital Signature Algorithm (EdDSA). The algorithm is instantiated with r
ecommended parameters for the edwards25519 and edwards448 curves. An example imp
lementation and test vectors are provided.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8017">
<front>
<title>PKCS #1: RSA Cryptography Specifications Version 2.2</title>
<seriesInfo name="DOI" value="10.17487/RFC8017"/>
<seriesInfo name="RFC" value="8017"/>
<author fullname="K. Moriarty" initials="K." role="editor" surname="
Moriarty"/>
<author fullname="B. Kaliski" initials="B." surname="Kaliski"/>
<author fullname="J. Jonsson" initials="J." surname="Jonsson"/>
<author fullname="A. Rusch" initials="A." surname="Rusch"/>
<date month="November" year="2016"/>
<abstract>
<t>This document provides recommendations for the implementation o
f public-key cryptography based on the RSA algorithm, covering cryptographic pri
mitives, encryption schemes, signature schemes with appendix, and ASN.1 syntax f
or representing keys and for identifying the schemes.</t>
<t>This document represents a republication of PKCS #1 v2.2 from R
SA Laboratories' Public-Key Cryptography Standards (PKCS) series. By publishing
this RFC, change control is transferred to the IETF.</t>
<t>This document also obsoletes RFC 3447.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC9334">
<front>
<title>Remote ATtestation procedureS (RATS) Architecture</title>
<seriesInfo name="DOI" value="10.17487/RFC9334"/>
<seriesInfo name="RFC" value="9334"/>
<author fullname="H. Birkholz" initials="H." surname="Birkholz"/>
<author fullname="D. Thaler" initials="D." surname="Thaler"/>
<author fullname="M. Richardson" initials="M." surname="Richardson"/
>
<author fullname="N. Smith" initials="N." surname="Smith"/>
<author fullname="W. Pan" initials="W." surname="Pan"/>
<date month="January" year="2023"/>
<abstract>
<t>In network protocol exchanges, it is often useful for one end o
f a communication to know whether the other end is in an intended operating stat
e. This document provides an architectural overview of the entities involved tha
t make such tests possible through the process of generating, conveying, and eva
luating evidentiary Claims. It provides a model that is neutral toward processor
architectures, the content of Claims, and protocols.</t>
</abstract>
</front>
</reference>
<reference anchor="I-D.ietf-netconf-keystore">
<front>
<title>A YANG Data Model for a Keystore and Keystore Operations</tit
le>
<seriesInfo name="Internet-Draft" value="draft-ietf-netconf-keystore
-35"/>
<author fullname="Kent Watsen" initials="K." surname="Watsen">
<organization>Watsen Networks</organization>
</author>
<date day="16" month="March" year="2024"/>
<abstract>
<t> This document presents a YANG module called "ietf-keystore"
that
enables centralized configuration of both symmetric and asymmetric
keys. The secret value for both key types may be encrypted or
hidden. Asymmetric keys may be associated with certificates.
Notifications are sent when certificates are about to expire.
</t> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2104.xml"
</abstract> />
</front> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6020.xml"
</reference> />
<reference anchor="I-D.ietf-rats-tpm-based-network-device-attest"> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.3688.xml"
<front> />
<title>TPM-based Network Device Remote Integrity Verification</title <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6991.xml"
> />
<seriesInfo name="Internet-Draft" value="draft-ietf-rats-tpm-based-n <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8348.xml"
etwork-device-attest-14"/> />
<author fullname="Guy Fedorkow" initials="G." surname="Fedorkow"> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6241.xml"
<organization>Juniper Networks, Inc.</organization> />
</author> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8040.xml"
<author fullname="Eric Voit" initials="E." surname="Voit"> />
<organization>Cisco Systems</organization> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6242.xml"
</author> />
<author fullname="Jessica Fitzgerald-McKay" initials="J." surname="F <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6933.xml"
itzgerald-McKay"> />
<organization>National Security Agency</organization> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8446.xml"
</author> />
<date day="22" month="March" year="2022"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8341.xml"
<abstract> />
<t> This document describes a workflow for remote attestation of <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8032.xml"
the />
integrity of firmware and software installed on network devices that <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8017.xml"
contain Trusted Platform Modules [TPM1.2], [TPM2.0], as defined by />
the Trusted Computing Group (TCG)), or equivalent hardware
implementations that include the protected capabilities, as provided <!-- [I-D.ietf-netconf-keystore] now RFC 9642 -->
by TPMs. <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9642.xml"
/>
<!-- [I-D.ietf-rats-architecture] now RFC 9334 -->
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9334.xml"
/>
<!-- [I-D.ietf-rats-tpm-based-network-device-attest] in REF; companion document
RFC 9683 -->
<reference anchor='RFC9683' target='https://www.rfc-editor.org/info/rfc9683'>
<front>
<title>Remote Integrity Verification of Network Devices Containing Trusted P
latform Modules</title>
<author initials='G. C.' surname='Fedorkow' fullname='Guy C. Fedorkow'>
<organization />
</author>
<author initials='E' surname='Voit' fullname='Eric Voit'>
<organization />
</author>
<author initials='J' surname='Fitzgerald-McKay' fullname='Jessica Fitzgerald
-McKay'>
<organization />
</author>
<date year='2024' month='November' />
</front>
<seriesInfo name="RFC" value="9683"/>
<seriesInfo name="DOI" value="10.17487/RFC9683"/>
</reference>
</t>
</abstract>
</front>
</reference>
<reference anchor="TPM1.2" target="https://trustedcomputinggroup.org/res ource/tpm-main-specification/"> <reference anchor="TPM1.2" target="https://trustedcomputinggroup.org/res ource/tpm-main-specification/">
<front> <front>
<title>TPM 1.2 Main Specification</title> <title>TPM 1.2 Main Specification</title>
<author initials="" surname="TCG" fullname="Trusted Computing Group" <author>
> <organization>Trusted Computing Group</organization>
<organization/>
</author> </author>
<date year="2003" month="October" day="02"/> <date year="2011" month="March" day="01"/>
</front> </front>
<refcontent>TPM Main Specification Level 2 Version 1.2, Revision 116</ refcontent>
</reference> </reference>
<reference anchor="TPM1.2-Structures" target="https://trustedcomputinggr oup.org/wp-content/uploads/TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.p df"> <reference anchor="TPM1.2-Structures" target="https://trustedcomputinggr oup.org/wp-content/uploads/TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.p df">
<front> <front>
<title>TPM Main Part 2 TPM Structures</title> <title>TPM Main Part 2 TPM Structures</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author> </author>
<date>n.d.</date> <date year="2011" month="March" day="01"/>
</front> </front>
<refcontent>TPM Main Specification Level 2 Version 1.2, Revision 116</ refcontent>
</reference> </reference>
<reference anchor="TPM1.2-Commands" target="https://trustedcomputinggrou p.org/wp-content/uploads/TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf"> <reference anchor="TPM1.2-Commands" target="https://trustedcomputinggrou p.org/wp-content/uploads/TPM-Main-Part-3-Commands_v1.2_rev116_01032011.pdf">
<front> <front>
<title>TPM Main Part 3 Commands</title> <title>TPM Main Part 3 Commands</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author> </author>
<date>n.d.</date> <date year="2011" month="March" day="01"/>
</front> </front>
<refcontent>TPM Main Specification Level 2 Version 1.2, Revision 116</ refcontent>
</reference> </reference>
<reference anchor="TPM2.0" target="https://trustedcomputinggroup.org/res ource/tpm-library-specification/"> <reference anchor="TPM2.0" target="https://trustedcomputinggroup.org/res ource/tpm-library-specification/">
<front> <front>
<title>TPM 2.0 Library Specification</title> <title>TPM 2.0 Library</title>
<author initials="" surname="TCG" fullname="Trusted Computing Group" <author>
> <organization>Trusted Computing Group</organization>
<organization/>
</author> </author>
<date year="2013" month="March" day="15"/> <date year="2024" month="March"/>
</front> </front>
<refcontent>Trusted Platform Module Library Specification, Family "2.0 ", Level 00, Revision 01.83</refcontent>
</reference> </reference>
<reference anchor="TPM2.0-Arch" target="https://trustedcomputinggroup.or
g/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf"> <reference anchor="TPM2.0-Arch" target="https://trustedcomputinggroup.or
g/wp-content/uploads/TPM-2.0-1.83-Part-1-Architecture.pdf">
<front> <front>
<title>Trusted Platform Module Library - Part 1: Architecture</title > <title>Trusted Platform Module Library Part 1: Architecture</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author> </author>
<date>n.d.</date> <date year="2024" month="January" day="25"/>
</front> </front>
<refcontent>Family "2.0", Level 00, Revision 01.83</refcontent>
</reference> </reference>
<reference anchor="TPM2.0-Structures" target="https://trustedcomputinggr
oup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf"> <reference anchor="TPM2.0-Structures" target="https://trustedcomputinggr
<front> oup.org/wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf">
<title>Trusted Platform Module Library - Part 2: Structures</title> <front>
<author> <title>Trusted Platform Module Library Part 2: Structures</title>
<organization/> <author>
</author> <organization>Trusted Computing Group</organization>
<date>n.d.</date> </author>
<date year="2024" month="January" day="25"/>
</front> </front>
<refcontent>Family "2.0", Level 00, Revision 01.83</refcontent>
</reference> </reference>
<reference anchor="TPM2.0-Key" target="https://trustedcomputinggroup.org /wp-content/uploads/TPM-2p0-Keys-for-Device-Identity-and-Attestation_v1_r12_pub1 0082021.pdf"> <reference anchor="TPM2.0-Key" target="https://trustedcomputinggroup.org /wp-content/uploads/TPM-2p0-Keys-for-Device-Identity-and-Attestation_v1_r12_pub1 0082021.pdf">
<front> <front>
<title>TPM 2.0 Keys for Device Identity and Attestation, Rev12</titl <title>TPM 2.0 Keys for Device Identity and Attestation</title>
e> <author>
<author initials="" surname="TCG" fullname="Trusted Computing Group" <organization>Trusted Computing Group</organization>
>
<organization/>
</author> </author>
<date year="2021" month="October" day="08"/> <date year="2021" month="October" day="08"/>
</front> </front>
<refcontent>Version 1.00, Revision 12</refcontent>
</reference> </reference>
<reference anchor="TCG-Algos" target="https://trustedcomputinggroup.org/
wp-content/uploads/TCG-_Algorithm_Registry_r1p32_pub.pdf"> <reference anchor="TCG-Algos" target="https://trustedcomputinggroup.org/
wp-content/uploads/TCG-Algorithm-Registry-Revision-1.34_pub-1.pdf">
<front> <front>
<title>TCG Algorithm Registry</title> <title>TCG Algorithm Registry</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author>
<date>n.d.</date>
</front>
</reference>
<reference anchor="BIOS-Log-Event-Type" target="https://trustedcomputing
group.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf">
<front>
<title>TCG PC Client Platform Firmware Profile Specification</title>
<author>
<organization/>
</author> </author>
<date>n.d.</date> <date year="2023" month="August" day="24"/>
</front> </front>
<refcontent>Family "2.0" Level 00 Revision 01.34</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-9797-1" target="https://www.iso.org/standard/ 50375.html"> <reference anchor="ISO-IEC-9797-1" target="https://www.iso.org/standard/ 50375.html">
<front> <front>
<title>Message Authentication Codes (MACs) - ISO/IEC 9797-1:2011</ti tle> <title>Information technology - Security techniques - Message Authen tication Codes (MACs) - Part 1: Mechanisms using a block cipher</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="November" year="2011"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="9797-1:2011"/>
<refcontent>Edition 2</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-9797-2" target="https://www.iso.org/standard/
51618.html"> <reference anchor="ISO-IEC-9797-2" target="https://www.iso.org/standard/
75296.html">
<front> <front>
<title>Message Authentication Codes (MACs) - ISO/IEC 9797-2:2011</ti <title>Information security - Message authentication codes (MACs) -
tle> Part 2:
Mechanisms using a dedicated hash-function</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="June" year="2021"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="9797-2:2021"/>
<refcontent>Edition 3</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-10116" target="https://www.iso.org/standard/6 4575.html"> <reference anchor="ISO-IEC-10116" target="https://www.iso.org/standard/6 4575.html">
<front> <front>
<title>ISO/IEC 10116:2017 - Information technology</title> <title>Information technology - Security techniques - Modes of opera tion for an n-bit block cipher</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="July" year="2017"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="10116:2017"/>
<refcontent>Edition 4</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-10118-3" target="https://www.iso.org/standard /67116.html"> <reference anchor="ISO-IEC-10118-3" target="https://www.iso.org/standard /67116.html">
<front> <front>
<title>Dedicated hash-functions - ISO/IEC 10118-3:2018</title> <title>IT Security techniques - Hash-functions - Part 3: Dedicated h ash-functions</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="October" year="2018"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="10118-3:2018"/>
<refcontent>Edition 4</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-14888-3" target="https://www.iso.org/standard /76382.html"> <reference anchor="ISO-IEC-14888-3" target="https://www.iso.org/standard /76382.html">
<front> <front>
<title>ISO/IEC 14888-3:2018 - Digital signatures with appendix</titl e> <title>Security techniques - Digital signatures with appendix - Part 3: Discrete logarithm based mechanisms</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="November" year="2018"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="14888-3:2018"/>
<refcontent>Edition 4</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-15946-1" target="https://www.iso.org/standard /65480.html"> <reference anchor="ISO-IEC-15946-1" target="https://www.iso.org/standard /65480.html">
<front> <front>
<title>ISO/IEC 15946-1:2016 - Information technology</title> <title>Information technology - Security techniques - Cryptographic techniques based on elliptic curves - Part 1: General</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="July" year="2016"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="15946-1:2016"/>
<refcontent>Edition 3</refcontent>
</reference> </reference>
<reference anchor="ISO-IEC-18033-3" target="https://www.iso.org/standard /54531.html"> <reference anchor="ISO-IEC-18033-3" target="https://www.iso.org/standard /54531.html">
<front> <front>
<title>ISO/IEC 18033-3:2010 - Encryption algorithms</title> <title>Information technology - Security techniques - Encryption alg orithms - Part 3: Block ciphers</title>
<author> <author>
<organization/> <organization>ISO/IEC</organization>
</author> </author>
<date>n.d.</date> <date month="December" year="2010"/>
</front> </front>
<seriesInfo name="ISO/IEC" value="18033-3:2010"/>
<refcontent>Edition 2</refcontent>
</reference> </reference>
<reference anchor="IEEE-Std-1363-2000" target="https://standards.ieee.or
g/standard/1363-2000.html"> <reference anchor="IEEE-Std-1363-2000" target="https://ieeexplore.ieee.o
rg/document/891000">
<front> <front>
<title>IEEE 1363-2000 - IEEE Standard Specifications for Public-Key Cryptography</title> <title>IEEE Standard Specifications for Public-Key Cryptography</tit le>
<author> <author>
<organization/> <organization>IEEE</organization>
</author> </author>
<date>n.d.</date> <date month="August" year="2000"/>
</front> </front>
<seriesInfo name="IEEE Std" value="1363-2000"/>
<seriesInfo name="DOI" value="10.1109/IEEESTD.2000.92292"/>
</reference> </reference>
<reference anchor="IEEE-Std-1363a-2004" target="https://ieeexplore.ieee. org/document/1335427"> <reference anchor="IEEE-Std-1363a-2004" target="https://ieeexplore.ieee. org/document/1335427">
<front> <front>
<title>1363a-2004 - IEEE Standard Specifications for Public-Key Cryp tography - Amendment 1: Additional Techniques</title> <title>IEEE Standard Specifications for Public-Key Cryptography - Am endment 1: Additional Techniques</title>
<author> <author>
<organization/> <organization>IEEE</organization>
</author> </author>
<date>n.d.</date> <date month="September" year="2004"/>
</front> </front>
<seriesInfo name="IEEE Std" value="1363a-2004"/>
<seriesInfo name="DOI" value="10.1109/IEEESTD.2004.94612"/>
</reference> </reference>
<reference anchor="NIST-PUB-FIPS-202" target="https://csrc.nist.gov/publ
ications/detail/fips/202/final"> <reference anchor="NIST-FIPS-202" target="https://csrc.nist.gov/publicat
ions/detail/fips/202/final">
<front> <front>
<title>SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</title> <title>SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</title>
<author> <author>
<organization/> <organization>NIST</organization>
</author> </author>
<date>n.d.</date> <date month="August" year="2015"/>
</front> </front>
<seriesInfo name="NIST FIPS" value="202"/>
<seriesInfo name="DOI" value="10.6028/NIST.FIPS.202"/>
</reference> </reference>
<reference anchor="NIST-SP800-38C" target="https://csrc.nist.gov/publica tions/detail/sp/800-38c/final"> <reference anchor="NIST-SP800-38C" target="https://csrc.nist.gov/publica tions/detail/sp/800-38c/final">
<front> <front>
<title>Recommendation for Block Cipher Modes of Operation: the CCM M ode for Authentication and Confidentiality</title> <title>Recommendation for Block Cipher Modes of Operation: the CCM M ode for Authentication and Confidentiality</title>
<author> <author fullname="Morris Dworkin">
<organization/> <organization>NIST</organization>
</author> </author>
<date>n.d.</date> <date month="July" year="2007"/>
</front> </front>
<seriesInfo name="NIST SP" value="800-38C"/>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-38C"/>
</reference> </reference>
<reference anchor="NIST-SP800-38D" target="https://csrc.nist.gov/publica tions/detail/sp/800-38d/final"> <reference anchor="NIST-SP800-38D" target="https://csrc.nist.gov/publica tions/detail/sp/800-38d/final">
<front> <front>
<title>Recommendation for Block Cipher Modes of Operation: Galois/Co unter Mode (GCM) and GMAC</title> <title>Recommendation for Block Cipher Modes of Operation: Galois/Co unter Mode (GCM) and GMAC</title>
<author> <author fullname="Morris Dworkin">
<organization/> <organization>NIST</organization>
</author> </author>
<date>n.d.</date> <date month="November" year="2007"/>
</front> </front>
<seriesInfo name="NIST SP" value="800-38D"/>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-38D"/>
</reference> </reference>
<reference anchor="NIST-SP800-38F" target="https://csrc.nist.gov/publica tions/detail/sp/800-38f/final"> <reference anchor="NIST-SP800-38F" target="https://csrc.nist.gov/publica tions/detail/sp/800-38f/final">
<front> <front>
<title>Recommendation for Block Cipher Modes of Operation: Methods f or Key Wrapping</title> <title>Recommendation for Block Cipher Modes of Operation: Methods f or Key Wrapping</title>
<author> <author fullname="Morris Dworkin">
<organization/> <organization>NIST</organization>
</author> </author>
<date>n.d.</date> <date month="December" year="2012"/>
</front> </front>
<seriesInfo name="NIST SP" value="800-38F"/>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-38F"/>
</reference> </reference>
<reference anchor="NIST-SP800-56A" target="https://csrc.nist.gov/publica tions/detail/sp/800-56a/rev-3/final"> <reference anchor="NIST-SP800-56A" target="https://csrc.nist.gov/publica tions/detail/sp/800-56a/rev-3/final">
<front> <front>
<title>Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</title> <title>Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</title>
<author> <author fullname="Elaine Barker"/>
<organization/> <author fullname="Lily Chen"/>
</author> <author fullname="Allen Roginsky"/>
<date>n.d.</date> <author fullname="Apostol Vassilev"/>
<author fullname="Richard Davis"/>
<date month="April" year="2018"/>
</front> </front>
<seriesInfo name="NIST SP" value="800-56A Rev. 3"/>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-56Ar3"/>
</reference> </reference>
<reference anchor="NIST-SP800-108" target="https://nvlpubs.nist.gov/nist
pubs/Legacy/SP/nistspecialpublication800-108.pdf"> <reference anchor="NIST-SP800-108" target="https://csrc.nist.gov/pubs/sp
/800/108/r1/upd1/final">
<front> <front>
<title>Recommendation for Key Derivation Using Pseudorandom Function s</title> <title>Recommendation for Key Derivation Using Pseudorandom Function s</title>
<author> <author fullname="Lily Chen"/>
<organization/> <date month="February" year="2024"/>
</author>
<date>n.d.</date>
</front> </front>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-108r1-upd1"/>
<seriesInfo name="NIST SP" value="800-108r1-upd1"/>
</reference> </reference>
<reference anchor="bios-log" target="https://trustedcomputinggroup.org/w
p-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf <reference anchor="BIOS-Log" target="https://trustedcomputinggroup.org/w
"> p-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf
">
<front> <front>
<title>TCG PC Client Platform Firmware Profile Specification, Sectio n 9.4.5.2</title> <title>TCG PC Client Platform Firmware Profile Specification</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author> </author>
<date>n.d.</date> <date day="1" month="May" year="2017"/>
</front> </front>
<refcontent>Family "2.0" Level 00 Revision 1.03 Version 51</refcontent >
</reference> </reference>
<reference anchor="cel" target="https://trustedcomputinggroup.org/wp-con
tent/uploads/TCG_IWG_CEL_v1_r0p41_pub.pdf"> <reference anchor="CEL" target="https://trustedcomputinggroup.org/wp-con
tent/uploads/TCG_IWG_CEL_v1_r0p41_pub.pdf">
<front> <front>
<title>Canonical Event Log Format, Section 4.3</title> <title>Canonical Event Log Format</title>
<author> <author>
<organization/> <organization>Trusted Computing Group</organization>
</author> </author>
<date>n.d.</date> <date day="25" month="February" year="2022"/>
</front> </front>
<refcontent>Version 1.0 Revision 0.41</refcontent>
</reference> </reference>
<reference anchor="UEFI-Secure-Boot" target="https://uefi.org/sites/defa
ult/files/resources/UEFI_Spec_2_9_2021_03_18.pdf"> <reference anchor="UEFI-Secure-Boot" target="https://uefi.org/sites/defa
ult/files/resources/UEFI_Spec_2_10_Aug29.pdf">
<front> <front>
<title>Unified Extensible Firmware Interface (UEFI) Specification Ve rsion 2.9 (March 2021), Section 32.1 (Secure Boot)</title> <title>Unified Extensible Firmware Interface (UEFI) Specification</t itle>
<author> <author>
<organization/> <organization>Unified Extensible Firmware Interface (UEFI) Forum, Inc.</organization>
</author> </author>
<date>n.d.</date> <date day="29" month="August" year="2022"/>
</front>
</reference>
<reference anchor="RFC2119">
<front>
<title>Key words for use in RFCs to Indicate Requirement Levels</tit
le>
<seriesInfo name="DOI" value="10.17487/RFC2119"/>
<seriesInfo name="RFC" value="2119"/>
<seriesInfo name="BCP" value="14"/>
<author fullname="S. Bradner" initials="S." surname="Bradner"/>
<date month="March" year="1997"/>
<abstract>
<t>In many standards track documents several words are used to sig
nify the requirements in the specification. These words are often capitalized. T
his document defines these words as they should be interpreted in IETF documents
. This document specifies an Internet Best Current Practices for the Internet Co
mmunity, and requests discussion and suggestions for improvements.</t>
</abstract>
</front>
</reference>
<reference anchor="RFC8174">
<front>
<title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</ti
tle>
<seriesInfo name="DOI" value="10.17487/RFC8174"/>
<seriesInfo name="RFC" value="8174"/>
<seriesInfo name="BCP" value="14"/>
<author fullname="B. Leiba" initials="B." surname="Leiba"/>
<date month="May" year="2017"/>
<abstract>
<t>RFC 2119 specifies common key words that may be used in protoco
l specifications. This document aims to reduce the ambiguity by clarifying that
only UPPERCASE usage of the key words have the defined special meanings.</t>
</abstract>
</front> </front>
<refcontent>Section 32.1: Secure Boot</refcontent>
<refcontent>Version 2.10</refcontent>
</reference> </reference>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"
/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"
/>
</references> </references>
<references> <references>
<name>Informative References</name> <name>Informative References</name>
<reference anchor="I-D.ietf-rats-reference-interaction-models">
<front>
<title>Reference Interaction Models for Remote Attestation Procedure
s</title>
<seriesInfo name="Internet-Draft" value="draft-ietf-rats-reference-i
nteraction-models-11"/>
<author fullname="Henk Birkholz" initials="H." surname="Birkholz">
<organization>Fraunhofer SIT</organization>
</author>
<author fullname="Michael Eckel" initials="M." surname="Eckel">
<organization>Fraunhofer SIT</organization>
</author>
<author fullname="Wei Pan" initials="W." surname="Pan">
<organization>Huawei Technologies</organization>
</author>
<author fullname="Eric Voit" initials="E." surname="Voit">
<organization>Cisco Systems</organization>
</author>
<date day="22" month="July" year="2024"/>
<abstract>
<t> This document describes interaction models for remote attest
ation
procedures (RATS). Three conveying mechanisms -- Challenge/Response,
Uni-Directional, and Streaming Remote Attestation -- are illustrated
and defined. Analogously, a general overview about the information
elements typically used by corresponding conveyance protocols are
highlighted.
</t> <!-- [I-D.ietf-rats-reference-interaction-models] Active I-D -->
</abstract>
</front> <xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.ietf-rat
</reference> s-reference-interaction-models.xml"/>
<reference anchor="IMA-Kernel-Source" target="https://github.com/torvald
s/linux/blob/df0cc57e057f18e44dac8e6c18aba47ab53202f9/security/integrity/ima/"> <reference anchor="IMA-Template-Management" target="https://www.kernel.o
rg/doc/html/v6.11/security/IMA-templates.html">
<front> <front>
<title>Linux Integrity Measurement Architecture (IMA): Kernel Source code</title> <title>IMA Template Management Mechanism</title>
<author> <author>
<organization/> <organization>The kernel development community</organization>
</author> </author>
<date>n.d.</date> <date day="15" month="September" year="2024"/>
</front> </front>
<refcontent>Linux Kernel 6.11</refcontent>
</reference> </reference>
<reference anchor="NIST-915121" target="https://tsapps.nist.gov/publicat ion/get_pdf.cfm?pub_id=915121"> <reference anchor="NIST-915121" target="https://tsapps.nist.gov/publicat ion/get_pdf.cfm?pub_id=915121">
<front> <front>
<title>True Randomness Can't be Left to Chance: Why entropy is impor tant for information security</title> <title>True Randomness Can't be Left to Chance: Why entropy is impor tant for information security</title>
<author> <author>
<organization/> <organization>NIST</organization>
</author> </author>
<date>n.d.</date>
</front> </front>
</reference> </reference>
<reference anchor="yang-parameters" target="https://www.iana.org/assignm
ents/yang-parameters/yang-parameters.xhtml"> <reference anchor="YANG-Parameters" target="https://www.iana.org/assignm
ents/yang-parameters/">
<front> <front>
<title>YANG Parameters</title> <title>YANG Parameters</title>
<author> <author>
<organization/> <organization>IANA</organization>
</author> </author>
<date>n.d.</date>
</front> </front>
</reference> </reference>
<reference anchor="xml-registry" target="https://www.iana.org/assignment
s/xml-registry/xml-registry.xhtml"> <reference anchor="XML-Registry" target="https://www.iana.org/assignment
s/xml-registry/">
<front> <front>
<title>IETF XML Registry</title> <title>IETF XML Registry</title>
<author> <author>
<organization/> <organization>IANA</organization>
</author> </author>
<date>n.d.</date>
</front> </front>
</reference> </reference>
</references> </references>
</references> </references>
<?line 2469?> <section anchor="ima">
<section anchor="ima">
<name>Integrity Measurement Architecture (IMA)</name> <name>Integrity Measurement Architecture (IMA)</name>
<t>IMA extends the principles of Measured Boot <xref target="TPM2.0-Arch"/ > and Secure Boot <xref target="UEFI-Secure-Boot"/> to the Linux operating syste m, applying it to operating system applications and files. <t>IMA extends the principles of Measured Boot <xref target="TPM2.0-Arch"/ > and Secure Boot <xref target="UEFI-Secure-Boot"/> to the Linux operating syste m, applying it to operating system applications and files.
IMA has been part of the Linux integrity subsystem of the Linux kernel since 200 9 (kernel version 2.6.30). The IMA mechanism represented by the YANG module in t his specification is rooted in the kernel version 5.16 <xref target="IMA-Kernel- Source"/>. IMA has been part of the Linux integrity subsystem of the Linux kernel since 200 9 (kernel version 2.6.30). The IMA mechanism represented by the YANG module in t his specification is rooted in the kernel version 5.16 <xref target="IMA-Templat e-Management"/>.
IMA enables the protection of system integrity by collecting (commonly referred to as measuring) and storing measurements (called Claims in the context of IETF RATS) of files before execution so that these measurements can be used later, at system runtime, in remote attestation procedures. IMA enables the protection of system integrity by collecting (commonly referred to as measuring) and storing measurements (called Claims in the context of IETF RATS) of files before execution so that these measurements can be used later, at system runtime, in remote attestation procedures.
IMA acts in support of the appraisal of Evidence (which includes measurement Cla IMA acts in support of the Appraisal of Evidence (which includes measurement Cla
ims) by leveraging Reference Values stored in extended file attributes.</t> ims) by leveraging Reference Values stored in extended file attributes.</t>
<t>In support of the appraisal of Evidence, IMA maintains an ordered list <t>In support of the Appraisal of Evidence, IMA maintains an ordered list
(with no duplicates) of measurements in kernel-space, the Stored Measurement Log (with no duplicates) of measurements in kernel space, the Stored Measurement Log
(SML), for all files that have been measured before execution since the operati (SML), for all files that have been measured before execution since the operati
ng system was started. ng system was started.
Although IMA can be used without a TPM, it is typically used in conjunction with Although IMA can be used without a TPM, it is typically used in conjunction with
a TPM to anchor the integrity of the SML in a hardware-protected secure storage a TPM to anchor the integrity of the SML in a hardware-protected secure storage
location, i.e., Platform Configuration Registers (PCRs) provided by TPMs. location, i.e., PCRs provided by TPMs.
IMA provides the SML in both binary and ASCII representations in the Linux secur ity file system <em>securityfs</em> (<tt>/sys/kernel/security/ima/</tt>).</t> IMA provides the SML in both binary and ASCII representations in the Linux secur ity file system <em>securityfs</em> (<tt>/sys/kernel/security/ima/</tt>).</t>
<t>IMA templates define the format of the SML, i.e., which fields are incl uded in a log record. <t>IMA templates define the format of the SML, i.e., which fields are incl uded in a log record.
Examples are file path, file hash, user ID, group ID, file signature, and extend ed file attributes. Examples are file path, file hash, user ID, group ID, file signature, and extend ed file attributes.
IMA comes with a set of predefined template formats and also allows a custom for mat, i.e., a format consisting of template fields supported by IMA. IMA comes with a set of predefined template formats and also allows a custom for mat, i.e., a format consisting of template fields supported by IMA.
Template usage is typically determined by boot arguments passed to the kernel. Template usage is typically determined by boot arguments passed to the kernel.
Alternatively, the format can also be hard-coded into custom kernels. Alternatively, the format can also be hard-coded into custom kernels.
IMA templates and fields are extensible in the kernel source code. IMA templates and fields are extensible in the kernel source code. As a result,
As a result, more template fields can be added in the future.</t> more template fields can be added in the future.</t>
<t>IMA policies define which files are measured using the IMA policy langu age. <t>IMA policies define which files are measured using the IMA policy langu age.
Built-in policies can be passed as boot arguments to the kernel. Built-in policies can be passed as boot arguments to the kernel.
Custom IMA policies can be defined once during runtime or be hard-coded into a c ustom kernel. Custom IMA policies can be defined once during runtime or be hard-coded into a c ustom kernel.
If no policy is defined, no measurements are taken and IMA is effectively disabl ed.</t> If no policy is defined, no measurements are taken and IMA is effectively disabl ed.</t>
<t>A comprehensive description of the content fields in native Linux IMA T LV format can be found in Table 16 of the Canonical Event Log (CEL) specificatio n <xref target="cel"/>. The CEL specification also illustrates the use of templa tes to enable extended or customized IMA TLV formats in Section 5.1.6.</t> <t>A comprehensive description of the content fields of the Linux IMA TLV format can be found in Table 16 of the Canonical Event Log (CEL) specification < xref target="CEL"/>. The CEL specification also illustrates the use of templates to enable extended or customized IMA TLV formats in Section 5.1.6.</t>
</section> </section>
<section anchor="netequip-boot-log"> <section anchor="netequip-boot-log">
<name>IMA for Network Equipment Boot Logs</name> <name>IMA for Network Equipment Boot Logs</name>
<t>Network equipment can generally implement similar IMA-protected functio ns to generate measurements (Claims) about the boot process of a device and enab le corresponding remote attestation. <t>Network equipment can generally implement similar IMA-protected functio ns to generate measurements (Claims) about the boot process of a device and enab le corresponding remote attestation.
Network Equipment Boot Logs combine the measurement and logging of boot componen ts and operating system components (executables and files) into a single log fil e in a format identical to the IMA format. Network Equipment Boot Logs combine the measurement and logging of boot componen ts and operating system components (executables and files) into a single log fil e in a format identical to the IMA format.
Note that the format used for logging measurement of boot components in this sch eme differs from the boot logging strategy described elsewhere in this document. </t> Note that the format used for logging measurement of boot components in this sch eme differs from the boot logging strategy described elsewhere in this document. </t>
<t>During the boot process of the network device, i.e., from BIOS to the e nd of the operating system and user-space, all files executed can be measured an d logged in the order of their execution. <t>During the boot process of the network device, i.e., from BIOS to the e nd of the operating system and user-space, all files executed can be measured an d logged in the order of their execution.
When the Verifier initiates a remote attestation process (e.g., challenge-respon se remote attestation as defined in this document), the network equipment takes on the role of an Attester and can convey to the Verifier Claims that comprise t he measurement log as well as the corresponding PCR values (Evidence) of a TPM.< /t> When the Verifier initiates a remote attestation process (e.g., challenge-respon se remote attestation as defined in this document), the network equipment takes on the role of an Attester and can convey to the Verifier Claims that comprise t he measurement log as well as the corresponding PCR values (Evidence) of a TPM.< /t>
<t>The Verifier can appraise the integrity (compliance with the Reference Values) of each executed file by comparing its measured value with the Reference Value. <t>The Verifier can appraise the integrity (compliance with the Reference Values) of each executed file by comparing its measured value with the Reference Value.
Based on the execution order, the Verifier can compute a PCR Reference Value (by Based on the execution order, the Verifier can compute a PCR Reference Value (by
replaying the log) and compare it to the Measurement Log Claims obtained in con replaying the log) and compare it to the measurement log Claims obtained in con
junction with the PCR Evidence to assess their trustworthiness with respect to a junction with the PCR Evidence to assess their trustworthiness with respect to a
n intended operational state.</t> n intended operational state.</t>
<t>Network equipment usually executes multiple components in parallel. Thi <t>Network equipment usually executes multiple components in parallel. Th
s holds not only during the operating system loading phase, but also even during is holds not only during the operating system loading phase, but also even durin
the BIOS boot phase. g the BIOS boot phase.
With this measurement log mechanism, network equipment can take on the role of a With this measurement log mechanism, network equipment can assume the role of an
n Attester, proving to the Verifier the trustworthiness of its boot process. Attester, proving to the Verifier the trustworthiness of its boot process.
Using the measurement log, Verifiers can precisely identify mismatching log entr ies to infer potentially tampered components.</t> Using the measurement log, Verifiers can precisely identify mismatching log entr ies to infer potentially tampered components.</t>
<t>This mechanism also supports scenarios that modify files on the Atteste r that are subsequently executed during the boot phase (e.g., updating/patching) by simply updating the appropriate Reference Values in Reference Integrity Mani fests that inform Verifiers about how an Attester is composed.</t> <t>This mechanism also supports scenarios that modify files on the Atteste r that are subsequently executed during the boot phase (e.g., updating/patching) by simply updating the appropriate Reference Values in Reference Integrity Mani fests that inform Verifiers about how an Attester is composed.</t>
</section> </section>
</back> </back>
<!-- ##markdown-source:
H4sIAGRzp2YAA+2923LbSLYg+s6I+YccV8RIqkNQJHWxrHJXFU3RtnZJtlqU
q7rPRIc2RCZFtEmADYCS2R53zG/M23zLfMr5krMueQVAUpIlV++ezXCERTCR
l5Ur1y3XJQiCWh7lE3koOuLPnXdvxFGYh+I0GcqJGCWp6I7DyUTG1zI4l9ks
iTMZXIWZHIpzOU1yKTp5LrM8zKMkFmdpMpDDeSozMc+i+FpcnJ1mtfDqKpU3
h9R70H3bOT/vUM/04zAZxOEURh+m4SgPIpmPgjTMs2ARxtdBPpsGg3GYpmHQ
3qndXh+K885FX/yWpB+x+zdpMp/VYPR4eBlOkhi6ydO5rEWzlP7K8naz+aLZ
roWpDA9FXw7maZQvah9vD8VxnMs0lnlwhAPXBmF+KLJ8WJtFhzUh8mRwKBYy
gz+zJM1TOcrM98XUfq2F83ycpIe1QEQxPHvbEK+i9OM4mfwdmvLK3sr4o/s0
SWEdr9NwHo+TkUxF//gCnmoolX6Q0zCaHIox9NK4Ur38jHBqDJI4Dwc5zglm
KGEB52MJ08jTMMukeL4HvwxgIw/Fxv5u+8XeBn6H9R/CHqdTANswpxbzOE/h
4RuZTsN4oZdy2hC9wUc5Mes4jWArACv004etY8q9NCT28nMW5Y2RadkYyida
TB/2ZQxoEqaRWU9/fCvzcej+QEu6GCfz63HenyW5sx7/qVpMxl00rlQXP+fc
Cg5KDtsz1cP3GuLXJMrN0L00GugnNGY3ygaJ6C+yXE4zZ1R6bseTN/DOzwN8
6Hb/qiH688nfZWwGeBVNJvbZfYa4yuit8iAnDfGnKDQjnERwQPGJ2IStjj9u
6XHezsNbGYkLORjHySS5jqQ7Gv9qh6N3G9DNBPv7eUw/07AWEVrNlugno/wW
jrHo3Mh4Luviz3Nom4eROIqgXUTHgPHhXRj/FagDfE/lNZClQ/Fv2Hc2txjU
bjWbrfaGizDdcRSHeq0XDXESjkZyYZZ7kUztI16nvJ3IPBdn4eBjmA5FDwnK
LI0y6S73rGfXmifTxoT6+Hk8ky5s3zTEazkEqpbcmhHfzBei6z2nYf9tHkcz
OFTvZH4LP7iwVT/ZAa9H6uWf/8o/NYDgeYC127SAhaQfxVEa3UgDyt+AtAOp
HlrINVsHB/sbDmxP4XiGg/E8A1gAPYwTOHc59IFU9Px1FyC9q/7cb7ab6s+d
/YMD/fTFi9ahILrPJH8xI4SBnw52dg/UT8ADhrj96p32bku9ftDc1Z3C07bp
dGdHN9jd3T80/dnXdtrmz9Zz9Se8tXsoiP2E6WAc5XKQAzerwa/HwVGDZgIQ
BLo7Cj5KOElJKtUE9Ve3KXWELIwYJr6JOxYM5U00kEFIjBPI3PGvOABww1aD
5gTcJ0yvcX/GeT7LDre3iZXJISDMbJ4Dal8j32sAOmwDq03m6UBu4zCw6XGQ
zeQgGkUD4sjb3B3z92cwhIAxYMuiWPTdds+oneZlgj6B+l+oI9F9Yx6oI8Gz
El09LcWPscUwzKEFcN+doNUMgAObFQZ9WA2BNbvvYm9nAbI8Gefb89kkCYfZ
NvQZ4HICQN48aAf43Q5weQMDXsLZaLX2L5st2PNmq9WYDUclsBBIsA/RxnkK
28czZ+qwUmAqw8ef+I7p+iFT3hH6bT3ZdqP5VZg0ia7SMF2sQyYYBvgANf1G
+NTaCRCl9uw6gw6c1MfYkO6bS+zxMm3N9l5cImBblx2HClzO5lfljVBzPpuE
SCinKDjPJ9JAJeAdAgrnduVs0+Mfh3N5E2DH6kTY/oNmq7Fz8NAltA8rDgWO
84tcPNLM2zPqLQtgGsERU8njIbQCXhQAegeOrgHnBHaqjZsCvPyg3WxXnxJE
UeyTNA7uU+g+BfTp6i910GluWu0nQ952i4jhAQGv+yboTK6TR9l16OsSOwPl
Zjy9PAfODBx+gZi8065G2+4bYV4Q+gXa1VfH7/vBSXId9EDQyoMLYMePdLrO
ut1JBA8vz16f4dyae5c37Z2l8zvrCm5vMfN1lE5JCARFcxQBjhaIDjLf/vvg
uNcNXjx/8TxoVc/89va2EWUJzZWURxAutveaO8/3GuN8OvFmcipBvLkGsRPQ
AbGGh4JtHoKSu3na6WZbcEJg1G0YVahRkWaXZ7OEuVfPprXfOniU2bTLswF5
urV/j8ns7+5VgUYPw93BKM9x7HjEEiBMKzeyZWn4g2DnPhN4DiOUJ3AkhwgB
OHXjMBsHo3k8wHEzBwR6LJjdgT+J3YOD+03i+f7OQXsFFFSHOBJM4Ci6jvJw
IrLoOg6JZopbOGwinM1kPIw++ZPZe7G7fy9s3d/bPWiumIzqECazf8dNAYl4
517w2Nvd22mtmILqEKbQhCn04kG6mNEMQk14mI0c93o94FLDoLWzvxOAyLhE
dNEDZyBcS+nPxbxaMR/oXpjfERj4oK/e9CkIc4mz+dUkGiAnEl2cc3KdhrPx
ojzZELvcrZ4tzvETEL9U2ukOk8F8ilSxtbOzt9t+7s3TdvgVc4RXOzDCEEch
oWM4jPAlQERS9KK/zRXzfnfcvwjOPrwKXh+f9WHYJcRpkKWDRgzcoXGd3GzP
aFSexvZQgvY92R5Fs2wb3oc/YBhvSf23nWDHLONQnMl0OmdWG7wiG+JbOLfE
hXufgF0Mw6uJDN7Pc2Ao4rU+zXa6/bODZjPYOeg+dK7ZbJt7GFTM9lwCK0Pg
8TlBKL+aJIOPohvNxqBwnxKRTUbiPSjS1AY0+rEU3e4p/UZvFAgzLq0L2mJE
Ekc4AaGjvJyjr17O8JGW8yacJFG23UWbiGoiNt90T7doIW+Av5Rn//qrZz96
pNmfSpDYhnw+8GD8BkdiBoJJcc57+52vnPPefgj60k2wc7eZn4VRGvwWZRKn
FfSAakHP2ZgOaX8wllNYygeylx9F2SCVOQjfyXXIwlmJBDkraTUPqlcS30xg
+pldDP6BT7ZP5HU4WGz3z+gR6XfhxFmq6rYkkVUsC2F8JNPohh/xCs4yOR8m
KeBLMi2c4asoyQJgPI8gTp51A5YNNWm81DLipRINL+EL6nOXoFRcKqPn5c1e
hZLwEFGzjncJtOoXjd3GXqNNCxzIySOJyse/vbns9k5IyWnOdluVQnI3jJMY
JjQRJKojzojXxOft9HYbOzS1D73XxwHdf8jgVZLk1fOcy1HEjBU0VUT6UTif
5Nu4/swYCLJt7OwS4XHZvnxxiXrNZXPnslVGmg8xQEwq6p5FQN0tXOn+ZRSC
OraJ/W35ABa/yjTD/9uNFyDYojWOFKgtu7SddqMlNnlNAte0BSuNtKTDBkjf
FJfKkUxlDFplhIOH1E8wxauuTJn9yj8Q1z/tAKtNYzkJ+gSDavCBxDeGfYJt
3s6T9CacwG5Oonj+aftqklxtD0fNwWDvuWzuPR+1DuTu7jAcHMj9QesgvAp3
n4dXezuwxNGL7UzdU23jbK75r2nom19OsF8CIjUA4hdmAAiiKa6pQWzC5LcO
BU9f8PTRlmtpyYvWXqu9RPjMM6ChWSVR3IaGl7DjjcFo+hM8v4yGf+CuiuYF
Kc6JHsSgvQjA2v/vf/6vXFwBkZOjXOQJXjHCphyK30CAgfmnyWwhokxE01mS
gvCQE7WJHBlWA4jWQFbjWZiCGg57t0SfJgk2jEPC7jBDqRxBlW0X3i5+b3wq
CpR0R3pmGuAMPk0nQap06HsO777qfSkPfNy7eC3+dHpi1PVaLQgCEV7hFdkg
r9UuxgA0LWMKOLwRAJznq+5qzf0s7MJkAhrj+RlqjMjcQzGStwIt29H1nDmq
iInJpvJv8yiFUww7BbwpjeSNFKFz6ytvULyBgxxeJSC4GaQVU4uTwJVTYAih
YON3HbZ0MklukWOgDJVoLg7EjOjhJ72AIfSHliZ16axuPbQlR63LHgMgG4aG
NMgYM6Hx0ZDlTEcAG8oEkqFwkiVilia4hqG4WtB0GGYAm7oATeUaeDxZdGgJ
SQzTTcUUJHuRAtUhKYQIPKGpO8jm+cVpttUQF9DllI1qelEKqDAHmAu8klO/
2kDPl+NkuwpBb5STCf4fAmjSlC7hh+py3V6LgZQN0tHmRb+/hZMW2D9QIJyG
vjvBA6WgwYpEPg5xuwaTOch5uG6AA5INmN8gnIVXEcirEc4x8yCE9/ar5pXp
OWU4p7oegXYSR2EUEMgNYdGxguBYPUHWo5uYvchkegNSH+B3Oo9jHAS2l/F/
Gg2HE1mrfYdYkAKUiXgXTwP8zQiU8ByuZQwYNwFtOJ1G6v7LQThs8vlzULoJ
+vKFDss8k9ld8Ba6OD/+FV+y0MLXHC4jiMtQry6FkxN1bPzelvCoL18YyYAq
An/LJwuRzWdIPMk0onZfE02FinD63/ZP8fSnDOgldmBohxu+BcPzLYiCAX0F
DOXVqYsCe4SW2EOhs+4bOBLvGdsJVacgY0SAmYxYCvoD2C3Ei5B6YKw4UrQD
Z2yoErRP0iEgB5An2BeLM4UTR/06KNEQvRCECjxEEbqrQBPCZTzT/pHGez00
usFx7m9549GNn8hIunTg65CAnqKNDSE6ADR5xyFTibuHUINBz/1BK2mwMw4h
Pi0UYAy7wZ44oSFq3AcaAnJ4+rc5EtDbcQQTk58A0JJnNJngW2hX06ezan2Z
GMvJkPEZzgAgHhq51BbCOuGMarGOjppm6rByIqarz1h50zQtOVRme5nWK/DD
AGPt6PYK426j9kCMSTPeWlR/Nnu/ALk9jiNU7j1XKPr1uIM/u4/N1QP93jnG
30+SQdXLJ/AyrOC774DLEa4zwOOEGyGFk+IjtASGCFrvs9MP/Ytndf5fvHtP
f5/3/vjh+Lx3hH/333ZOTswfNdWi//b9h5Mj+5d9s/v+9LT37ohfhqfCe1R7
dtr5M/yCQHv2/uzi+P27zsmzMuiIuiQo7UXsHyFzQvsaiBaDNLpicL/qnv2f
/93ahR35r+Qz0HoB+8FfDlrPd+HL7VjGPFoSI5rRV8CyRQ0tqiHKh8DLJ8i4
0O4KnBup0ji5jQFFU0CFlz8BRksR7P/0Yw25xYWmE+q6i0wMYQaostKxrVZ7
7wgARLEI4LBAOYXVKD5XJlvMbRUfzSoPr7iJwnvQL1wBKTd4Y5vSpAO3W7cX
GaNtjXl1kckmIK5+lJozwtFnwhs7ZwxXNAAuP0RBnQ3Z2Ha1C+Am+uohf3G0
keoDzxvLIoArSQyM72GqfA8rWOcStl3FJR3gdYAESCBuoELrFcGKAZdA+0ij
EFYVTtEMhqDQOsnnz46+BL3pjUdmO4kK4uOADQou5eZNgD2AQZJRAP9oDqQW
0QxwlQAT2pJxNYEvyap6k4xkZGYwDPOQOFRDvJ6n8DitMwrxmjULylH+lWRB
ALYzCRc4LghumRJcyapGxwMtQPOYpGs1TionLEuOoxlBCvlbBJsHU5yj0RlY
HfJJTYUV6xha4c9lGKUjA1NEjUIzoAGIW/zFPQdEIp2TDEf0WJ2VTJkKmH3d
kMTnnArWABT+UD/fiY0VJ2pDSZXuwWKOkpkeNVsrODQhBcMdBkiPok9iA3/Z
qJuGWkgrNhvfOo20i1Gx0cdsgw+QmvvgOggn11mDxoC3oVng/VLsIA/DDRRQ
zGXBZFEXxljCUJqGQyIVnz8r7yk8tepL67n5go5X/KXgMmMeapcN74H1LPAe
E192Ois20xZF/lZxc02kxcrenz9H09DIrzGwImCss+AK5C/uhpHgO/Fa8p2d
2nC110qoZhneKrAj1fgQFBKxMQXc2UD3Yr6bVFqWL+MmviIEhEd1LRjp3JPf
QJseiGYhKm/qAKsR0XkRpC+gQFpsQak5Q+aIO6aHJL43wJsz2knY9QzgU+fD
SogQoQ52GyuJDRaBgC0vwpmzBwolkcLhgsOJu0AWQsE0BTXthrdXNAJsxAMH
sN3yYcMG97KG1YEWSI0LW7xgjQuXiAsPnJjuQ2Af3ur7drz1uKdExOiO2Efk
hRi2Z5LRgx+qzawzyBWh8JerR15pJVJU1Rm6TiYS4gxXST421gscwZgvnEnN
rGhQortIeeHgtNpBmedXkWDUY0KcB4o0bPTR2hFrNmhikzyPs+45LOJ7/POP
qO18b9X2LW2W0nNHvoSeyLmg6+qE5pxlSdoQv9GpIgio48dnHbkUyhk3Usun
Vj7cGEhQ48ggJQN0FKLWIMIbNl4nqXXt8CggQDslGzV0rAb68YphFF6n4dRw
RoRNRBYa3iokTP/4xz/ExXmvV/t/giD4JO4CavEZ+MIhtfzyU00IfPMWiAyo
8/Dtf+gH3JXznu2WmwndcjZIQSobyk/fC/OBZ4VWJJwEcKTm0rS6iuIwXRQa
FkGLvRafocnfvKY/n2HKh7h1ellpgmIGr0voJ+V1aSB9L/77X4z3FzcujiuW
z8V9bT4L8mgqf3JnNwfBdaddaIgXWX/88P6i17ZtFVBgZ90T1G7+jicIT/zv
eIJWDv/4J2gtqM0JajcJ1QpHyDtD0NmyM7T2eLgnxGvM/eK5y+SEZWGNvNys
MANyo0L3HMSySJkqFNoWXqg4zHyW157RFUdj1TmtOKj2pBagV3lSVxzVdafV
nsI+H8PL43ev35dh7zYmw1pg3L9+Wtm4ihCIEi3QjWM+mrSxhAmZv9ACZFbt
auEFr0ezxX7XXmP63dn8FV3+JHya1Ym1VKvMDXjqDN5rMkQ+BUh+msFzTWrQ
r6i9ty+uwvijkoEnSfIRBN2P0hdR+NzWXqYz1D3JdzKIhn941mq2nuG1XZz9
4dk8jQ9RPTqkW7/sEB4fxtmhivM4xGuDw1aj+exHWN/LNSdViDW9ok52uELF
pFFgnCI6/qh63+T9I1pN1nGkewbJ2ByIEj0bdD37QJSpPkiQVJo/vlqyNaDh
YIvnsV09kZdEhvSkmp9kc7e103zebh4MX4yeH4z2rlpXV3IwbL2Q7WFrrx0O
d18MZXs02AufDw+GV6Pn+y9G+1cHo9FQhlcv1FhOpy8rSJce7mUBrR28uzPw
lSb87EfzMrLYzsmbS0AuwC091HZhLDMHg/w/Nl9u2y/ln1urf26v/nln9c+7
q3/eW/3z/uqfn5d+1uAobYv+ofJg/Fh7uQ0H8Ed17AH/BsiSR3PNjTNHk+Ur
MLYR+9yXTnGAJqpF6SzX1m/+Xc+zntKTHmeDdXftXtt+nllCEKP364CIZ9d2
T+EI2hb6i3przWF2l49n34yRhrclwlAXUUM26vqGh/ncDyw3qXuSrK46CKcJ
XtWi6dG93az7ZujoGsVNWIYi+XgHCRRfd4IDEWWoe5rlgNwBnV4bepXVy3lZ
YMhmkZZ6JnjHXHxb3Z/p5X6UmnkbSkymWOgFNwkwUk+jYryqY6LxTZ0SRvAf
rVgvNkCND4yhYa34Hg7osogmbIzGzA5u4UhJcrQla5FrmNVS/lfIxbhqlo29
CWtUL8i++DHCJL6Adgx9KiqEFK8t054kdcUeT0i2ombxg7HCFBtcemmTCB3N
Y+snvwEPfrg5CbM8wNuAxVapgZ2gaWTlnoLY5/dK467rkCcXz6dXMsUeUTTc
363uEEVJQK/prNypWa1p48qcRG8wWomirbBJFaBwB3h9f5uHtE+mD5xVa9/Z
8qLEbh/zrXlAlio0gGVOC9MIPZDoFJYEXKdN6ArO/v4WmvpidlG69poyDmfz
SV5qYNps8jmWw0taxSW8c0noU/WKUJuD1rgtQebQLz8tafg/9AhkNF0GIre5
qHiD9ggAx98YdcpAdLswvbivrADVincRDgzn+7xr5A21RRVaRfWLzESCSZTl
lahSeMkA+E660aoOeGBFbIrK3aoZM5iy6O8PABO/y+di7bhMY6YhIB1aoNfi
HDS6H8rZFx4R45yPT+pWd4NzAbIymwARK2jTSyhDZTfo8UxWgDGM7fdz325w
l0h/8Lu5D6p43QQmfOqne85Gw+Uxu3n4oopH3fnc+dSXrCt3nAodCe8OBA6H
933pMTFj08XN2nOy5I37HJRCLw89KIVuHnpQCt089KBUdPOQg7Kqm3tgeKGb
hx6UVd08fFEPOiiFPtYfFKtvUP6vd+j6rVQN7UVhfZfEOLoeiwmgIrrfoB8X
R3YqRw1Sm9h5nFJURcYvxfcvJ1u/40GbXP0Vhsqsf5F2tJATvgWnGwEOxcrq
YoaO05Iuc/3GeJ8tJyP2mbXeD5UaOt27dnmWcKA2yHdIXbUGmfE32ABN55Bd
K8eJcf/NJOmtruMue8TgcpOKy3y6LNVO8A3lqqmUZquMqZtm0Mk2s626cY2e
o3bPkd7ZHNQ5UMPs1f4WOhVYqx+/i/YV2DHrXmVDbx0P4XCQJhkvaKZ8f32Y
AOQUAM40CqzeSLVFtFryMrCDkdMvL1kjBW7MSIUFBTcc91Nnoy8vaBou0DRE
CvWw7prqdQvy5M+yZBBROLhCoDDn4YxzGbtHe1PFjZmD2vt+hJdK0nhD33MQ
0JvJuc4xxJCi7LcOxSyEBoP5JGQPfxc1PspFXXyMk1ugYdfS+MQ7PRp931Pb
lXelsUY0/LuqlC53Mn2DQt+A8yDR1hyHnzuXIebjkTstMbOrkgrIYBqSJHAW
Y6/dbLzIMDjNpV0k4orP49tDldRjGl0ZTqteC/NxkUhVzEKdhwDPg27mPsPr
m+IFknl5GsbzUUgHO/1p2Ri3ooiTtIKSimCA2mr7Ny1u2+JdevFFIORZ6SLN
baOMrnjjAZtXMEr/RZRuGoUR6Et3e9XLMK0rLvYQjP6cEnVu/H2SIJWok+XN
3z1L/mWW91sBK91WRdysYMPcUNtJcf9xEwAtRwT/j9lhmC2mUzRLDcicWhDx
FKyM2lpeErHIgSWLSvtPA0PdCL7ZBgbw6+OoiQeGmZI3vUOCiaDcAKUkt1Ak
lhjAoJzD+N4GaaQhyqITK9oFTek2mwMeiIk4GR4S4AvTKPeGKg1ztWD3HWj9
1zmFAgBdp4gK5GrGs2oeR4j+fEeHXnRIg1TGDXcAHfbRfdMo2AQVZJdBq1bY
AHa7sFuFogtA4fv1B6p8Fss2wLt3gWbaO8/COXblU3e3WVAXRRRzSRrh1W9j
SeiREn8heQhYUGyixwxwlaeg7QuTw+GfqyUXvhUsShwVjMxlQUqQUeyJGX6B
Qyn2tMC/+UB4a9sAkQ242CSJr7Ml+OOBooK0V3EGpCjIDKKhR1Qc22I0LO5N
mbQ4zctMbSVLK77umyrXjjZJOJCxZN20wrrj91yrfT4U360Tdxm4+FrtZff9
UU+86r05ftf/kXQn8WzFq+RP/HN7N2g+D9ov6NuzmvaCXhGG8LmmYnQ1G201
Wj/UOG9WNsMA8AffrmE3yokZWvyAsbjsj13MJ0mTMG3xOb76pdDehMp5rce3
VW01o/Hbfsyq2urbZr8tnHtuXKPMnmEc/d2yzmcU7UvJjjd1lMVFhStlf8tP
hkwgsXmBoaPf3ojf5JUQh+KljkZG/Qxjhj/KlKLjORPB9TbqPtvqXgxeO4mA
LcBrmEs0Tw7x1591c9WqQ0nSsHOT0Va8LCSpLTX18iHDrLzExqWEwKXXvTTE
MLvV+YRLrxez/oqX65L4lrpwkuuKl6V8uaXmpUy54uWIst5+Kme9Lb1s886K
l+X8saXmmDRWZ4wVLyvzv/5IOOKo7YwnHS+swY1WqfLrJeGfB6/Qcg16muDD
sqMcv1wdCasvW4ujkvMhvzhLUcQB2cRqc8g56LduMlukEeyg2BxsYdqINgfP
U0yqGQBeyzAK2mpO/DaGZBI8nbjkISjrHfQexF4xJJ4CkkHVojfO5ZByEF/N
jTY8p1AlwRkz6AnbWci/IaszF02USI1fMM4FAOBkGAGOOsPoZHKGmM3TDC/b
YGNYn83mZCyB79wHznMSDSQ6U3Cso2b9eNVbV+FaNxHqbK/6R4CU3DaT6oIL
JoaRALGTOmSgAWCht5EJzCAzYUsAkvNMw8DaPaj5kYrPUb9v+rlQpCU8atYB
yiJbegtJoNAMQ18/e3E3GenS+Nv56674E3wKA2HOhXQ0CGBzgFDTUDjENjzD
1ls/GMsRdKCwke1GKCKP5rDdE1pqnIDKLjM7NTfscgODwNC7Xodd4t867BL/
pmhL8wd3oZpxxKX9y75uAi3xayH2ckM5Rmycdv6s/fl1AObGPQIwqZNiFKZo
7QLDAYBiDOYW/4kRmFuVAZgG9RbiblGYz4hHp5JRh45m0NwLWs8VayxSJWSE
KrhWIQMRL2Gjk3QzjQQPLGOgJbC11QyeGZ69/X3xs01PoRcdPoQ9qqfltvBY
u0GjILscAhdLg09KhBdOgw770StC2skrLTpEN+xa9ETw9vj+E6G3KNJl2e74
qZ/g86DMSPrlR8j+BJ9iBqcSMKJpeD9Y3CH+iKCkZ3AaxgtxAxJHqJJgHJ92
OLBJfkLZy+TLgPUvOGyVkxYAaMk+r/oh2p9cU5zqQiioZTrZRDH4ksPIWQm7
lsa9ATVV7RYUsvUVOnDyCvQVtTSbSwrbLZ4u3QdqoY5PL1upY54ubO5S9MDL
qCrsQBL+IAxZlUPL7vxeo9XYL++7dxF4/9Pgv77yWJSiwAwENDkDiqQShopX
dyI9GPU4lKO1pCfndmjuU0skByy8QjxQD2DCIXpiP2s2GjsttYYvy8DxK8iy
iD7oD65uJ/myA1AJg0vdhCE2SAN+5Hf0wtk/TYX2NYOdFr6bM09D3x3oECZK
Wc+Qst2S3+g4vEFDhe7DmkVANYcR+g6l0+suG4stEIzRUHWINmnxDH33Dpdc
D9FvnoXimWPoVO+6v9MDZYFYB1mShWhiTsi2PYWhTfESk6Aq3iFboJsJY5O3
uX/QFESysU78g2HvE8rfQeK0XvwsAVRQAl2oewH5lIbNPVmMTERMZhacNUSn
nDEAqtqBioiLR9gFvOzQf1RtgmOLLj7gTYGprNuRDs9QXQux2UurEQPDiUOX
99pRGqvOsT3INgx0+UnmoxyZdObV7mjLSRgmYXVe1yGlOEs07P7dLIXpfkj6
0u144eCVHtPLegO8BJgDWirDjxKNk242CWf9ZmjLahFcyxbyw9L90BGvtNxU
YqYKFmmBo1aN58g5jzBg0TpqQqCrhq7iLk8wB50orYdj0aZgisSVuGdQjyxJ
gAgrMI8Q71q1K90wreSZA5vQFIQSc4VgKBvdLCgLQFs5JZM+aMg7avEYKqDv
KNDrD7FUX5Q4183JjC0D6kQjTVkyW0V1PNO8IR+0QWiox7d+UI+/1Jz5bDTE
H8Qq4rTh0qINarnsSkSTLzXLDWciMk2TNFDhD4o1mGUPE8mhkTqbQGGlz4oz
L++Q2iPag4xS06oscZm/P6Gq/sDc3d0duz8Uxom0I8mksyVXC7wHN44G5jUd
HYpJP9i2YdbDymVdScOUlFRwCGTieGpiHotDP4xng6/J4P3JouFQ9S9F9HUv
bx8PfdF+RQhcQL+K0f4J0U/N8qvQz13pY6Ofgm4R/XRWnt8b/Vp3Qz5OxrMU
5TpC5VJWMjUacSh+A0BxPQ/hx1xKYfMIoYFGXfEaFm1NZaFK8RMMZa6UoKkc
gKQcZVMPSd0wYw9B2YypdxJTu+Bt9ILqLv6wal87/smhZHGchRF3xV8kC1bZ
GIV7C2DciivKXzKMBjkZp2dplFDUC2YwiTI0kQ6kDhPlPp33uXM1KHljqfzU
nOnIn4NCI/v6EFNd69RxpNVyVihl40XFBXPg6ftTI+7UbBeOYK72PeMcUaRz
kz6DGKMUnAl5PbX2mxgMb2MShfbZQ99zXDfemgKL3NSJ/9r0Aqg+VwuYQmNL
9AE+I8zvKtNlfXCCSMwK42SIUueA5oSADzG7me2B5AzAFnLk+rtMk0wncyI7
PZrJgfTEGmQmJaDpwE04hDMkvY0m7c1HmiRdPI88jaZTdyIK4tNEZS0gQRvg
6i1xHfn3YhpXnUcTbIV5e3SyBDdlAeq0HESt7IZRbsiTzY0FSx6ASI3IX0z9
54bzbXa6WwZkF6UMaXbGo2iSqxSpUqX4sVnjdAd6ze5Zp6AJJ5jbO+7weOWp
xhnxgcm26XVpbk1YcjsG2V9tM1qPF3bGdv/gBbI30ZG7QfAubNod5alADWyA
ILnO2B6y+RW2K7bnhJZE85UtzSzYvruKaxZaubol+Sr9QbkUbm79xeGa6M21
CtuKEbR3xjYd21eNbXXHT5GteXr6QHWlCsJUktury6PjNz0A9yCZmtTGWuhu
MKaVdkrL2dpRiI2E6jqNSnnYmlIlPDRzQfpSwkPseTlkBLohwdaLZ8sk2krk
VOZh5ayrZ29m7c9YZXpCMLtU39AwRdp88DXMBIq2PUHlx6oKvNHnqy2cZNi/
S603a+5sNRsvGs/NjNmL2Yen/m0VXShThmrw+9TBpQoMaYusV5IOBnkkOGRd
aF8jEvm89M2FaQPCunTG7cIjOXemNG4PBaJTTWuEJn48lr+Msp8fjem5UBWE
4zLdWGEuq7o1s/6HBa9kRGHtvOKJfKXEKB4jqBr+AVLg/eZVST3dyVWSTEUr
UJxCy5P2tvfE29L62LNq5dw/cL8q3bOVXakztnUvGbNK6h/KYD4ji/bSpXzg
3yMqeJCgVVwdIrLzuutRga3+kjiicPWSqkcgCXAonTTUKCOi29AaIaro91W5
LBVZgERYuFkMlEqX5QvMdsfZpwp3lsYE5Fxl4eEnDZHSsLKNm1i+zpNjRHEr
hNmkAWpBRAydTXFgixSQIlpW6EFLZSPWoLSgR44bPCemAiqoQWxSn6g8Ai2h
5EKgQb4/v9hyaJlNu7ABU8Lr7Q1Hr1PAI8m7bX1iBMcwr+NT5eK29FGdDtQv
gsvSin+bg/Dabjaf22Isrf3GXpm73YezOaLWvWvjevZ62jTlLUBOJQ/bOOV7
Qh3Y7el2zi5/7Z33j9+/o21askHqbay795+btHST4Cg8aG/UEaJDiZV13JQk
JtKtcl/g1//cj/J+VGkoX0vKfydCTojFqVfWEe17Ga/cSgjoJ5/lrp6/qbUg
PyyCjJZONggWeem2mq7HfAOJc0dm2IMWJwtSaYX68h9NFWm1G60ySSgkzbk3
eaCj7CREMxDmujV81LV+a1rdhg5srWBnM/+gv1859M+hMa4ou0FpKv9j7QfQ
iMJ2LJGIUCesSEBoNqpyV5yTAqImBYjgI4xmU7Ej7JKgnAhTOZzD0VTJ4e2y
tH1Ca991cTXPWZdSSaQw4iWcYHylE9ha9IgT+lLxbXijHByUKlh4gXVFfQ1g
X48lErEwjTATGZZOiHJYVLZQSoCXjWk2S0Os/EgxVh7KTKM4ms6nvhJpw3E0
rcjQdzq+xrisKFY1kTAjkGuiGEiyTHuWCVjlHB1AOPvWbbio0809G9WdWXr9
JDHbvthBOkWOaG46yLETZ6msu+gByr6griEOAMqAc6fuxMNcJFgyZsZKxpiq
IdfR9uulKiSQYyis1ZGhR9uJtnd5L6HlRoWo4w/kgG0KESjsu4mcuW5U4DHm
wRevFuQeFKZ8/EvhdS5BD9nbASsoRMk8I5s9wOUGvaFCisOKCC1ngFiRVv+d
SbjIQkHV6dRb1kbm0qkxBulIjO7jkmQ1F/LW8K3YbET3AvbSgePGFAbEWA8B
zemhiwEo96j88QBOw3jNAVYeQMo/i5bP0dmVaOSa/p06D9gb6z2abTrJ0m1H
xyMb6RYa1yPKA6elCjNhfVYQ+A6eMHDVLHThpCH7WHJ0HMbHoy2TspFTQIEl
3CstZNo4VqB/gnjFM2M2M50tNZKdKLskGnUNVXReM0po0QxXZYhbNooiwq57
njvGl/Jo/t2fGc3nwWsHpF7ckarYIbVexRLx8whsET9fazW1sFpmqMPMYU6W
1vUmOiXtLbi4CTrysr++wVdPtjW58u7qN7DSr8hxI7i7NFy+hiqUVvTntNwK
5ufQWQ6qI1XL0gk7dbWN0Cl4wE7Qeq5IX/yZqrtCl6ArzwL9DnugakLlgt5L
vXNvUxtbD3miqg9tbOOHKtlFAiyb6/pOnAwxwPvRAU9m9iLiGoiVs3Il1U7D
TyRW0HNHZuERNfHnq/QURTHkUXFCN4e3qmI2IM7go8foEMRhOkFk1T1pj4pG
WYq3KeDuDSb0naNKxlzTGN2ZK2Tjh8rF3TeXZ12OHbg8e312mbZmzb3Lm/ZO
2Tkczv1ulYbywItSjcKa/3EXii0bFNDZOf1hkUE4Ce5Wy9pvlaLKHTo2WzX/
suPRShKyxPnIZRkrLn9WOfLg5qVSJZ6xs3WuCvFDyoLWu82tlBb3Ma6jeHUi
yu0KKy3ysHULUMM7c7SaodX1uZU79w0D6w0RXqOdJBcbtpeNqksf7wRhdsB7
n6A+vlSacgmRGUA2k+CDLHG2f6fwZKgdL8w9ugUKRoXg/DbsAjec3E6k94QO
2WK98Mpx6jVypHHUcmRgKcV/17FGf7ERPoq0qrREjnwY0Y0czcUkGyqOuIJ9
edk5l7Ov0wJ31NcBKmdGwV1YHfhiIk+zPyRfuqxo9SX4+5QFXH39jYlIbNSf
4R6ulh1aQmTvbJXsrorZjaXDm24lRzZdG8KlZGefvy8Do8kfeRcBgA4k8Xlm
0/wiClAYPOWaE//Jgo12Gzt3lyX2d7+JLFElMlRKCq52t1pkKEsKzvFcITK4
+QjvfTP7Dm9gFckznRCfoQxkRrm0U6HnDZCZYNw6DY71rPB/0CzLs/PSHN57
eq9Ra6db4k0/8xmGtGwpbwhQXnV1xArweJkN702qtUyge0GX0PlsyESI/Crm
M/ascCBUnUtxzdRsw3tDqeO7UlMQttt1eeQleRofY2Sv6zUj33s78KVNb211
H8O2/inETnVF90BL/BF6XYYTzivjmbAGYyeVpItw8TXGp0eKnuOU6WV2D6o6
HEv4yIO5sYkWUjy4kNn4sVgwRjs5VQxh4Mq+iIWaKSz1JOFAn0DqQJ/grlr1
CkAsiR4ibqF+08vzm6j6HcgZWJ8YWI9oZND8M7qF6veRq6ZhlrutYDZs3K2e
hyuvmOyZaM7UtcmtVFe6WXOST+ouKIQdu83y8Jr9V1Ekq9NYyOrxLZkPyJkV
FBa2QdLtHFak1d1onavSAVfDBSSLK3MgTUFbHE53o/pAywWCgr/6kmEhj/Bj
oeUSYFexzwLK1h2FyExa7/U98dmmVF7l46UrQBhKgQiMMENHJSRRetjBOMEI
7dWhkfeyfvWMqYl6wEiKdGr21DnXSl60AMDqrG7oIeHvKNBx55QlYb29uKrA
qvOWzfhWKB7gKfVLjbZreteCvdf1MtuoWrEN7iwuGH5Zv16LUG4svb9UP2f9
3Va6vN8iqt5hjVVRncXVem3Wr3vtcazedD8t+d1AoYcyPKRUwrYMnXV8Z63B
vCKc2YtCxWIzNreTWB4EbeJRscrb3Sqb1op7Y1JBqoUuC8OnsjuDgZypZA9U
z4aI0EW/75ZxZd8fXTXbkaxDk9fT9xHlnvR22Q1dUV/V2dylJiwvB2SBWbpG
cMkON7oqr4sfSvO3GQfK0K3I4+WkBcFPVWHrrmeZVxdp5BCufL3dDjRsjVHJ
XNnBBBz01Jd2xZCeQgsKKfIv2dgittQNuoQyKgOldzTW+krjhyI275bJ4Jl3
UE0WA4w/wf+LKYr/sGEQeeMvS971MiCsb1OMc3nmAaQUEvoO4yVjx91ducN1
jn8pJ0HQny/O30uJFKU+nSUzdu5QGc3gOFJYGPkhXEsMrGMXICUX+Muj4usV
fjyZt2eb2VbV3ahro+WaRgYSOnxlScFgB2I6jqWIIuvZwcVYq116dPazo0NB
9YFx3dvmr3aFpIsfrQnaoAjK6UVeIg5o/GrinATI7WYq89C7XFDnakWYwpr9
daPeynsUZWUAV99gOwTAaVu2tH9xWMYdSvkuYxnt5lezDFW3mFmGf40Az8Jr
ck/gigFdLJsXw0k8JkXeeFeYlCv8QsoZXnUnJmWelz0G/xhKrnPPORaB0jt1
+WhIU4aPzWXZFJ1n3x13s7quwzzAsnlWL1/Bx5YViPy/jo/hht+JjxW4lOOQ
soS3/avxsXbzn4iP4bb9U/MxL9P+A3nYkvKUT8rD2pdqsUjOdCrz8n0qxSSx
AdEvvqkSaVGCfCrS3bm4wODWigtIYbkiwBhPfz6uY4a6cJYpt1FyrjAWy2/L
4Hzor2ZwftsVDM6rx7ncqnKC+mIvxnZMvmTEQcMW1jdRSF6VAzSTpfSVTbkF
cxo6qHJxGu2cyrZDe1c1IYuJcc/2w26pfIF+x3WMottlZdJxwnVFOL/mcIFq
LkQQ8/2yfnDR3q0pup4Zvcczql2NbIWHqcRji+kb3NhpAT0AS3H9ToU2fw+d
5Kyuo7qmCHxGir6ATN5LJL3ismMlNuo7MzeW3EZOZl4Yo/LFjApVzlR+CEpW
mZFXplm1uj2czTVNo7tjru/kd+KXHch06SIeM3KysNAwdYSw38Hf5uFEJZ6j
iXN+DVjNhl+qZgPNG+EkIwtfYSE60SZlc+TcExx30dAVF6KsKnMBfvQGk5ev
2ljy+tX5KhwvU8wtjaiDZnG/l867IxXuHC+UNF7GIdN/NWFQB8PWsb0bXToJ
M8d1zpzYOp84x2O0johiCsf6rI+sYLb0bYG5Lhtb8QQiF/yedvVBc+4kleFw
UfaD1B/2hyyU2y2MvNRtdfW0VGwTSpIUKUbgcW/Ww3wA2Cpahy21baUO9Gni
19ibxEnK7fhDs/PeSVJRV06TmHCUk9sF3ribdCxZZs5N+U0dtp4qF/BD9LK3
u+xIqXi4eK71cjc0JIXLM4Wi+30UlYqb4co+X4qIUXZdXokT77DoDjl54msm
6qqApgor6iIpVcHDbDTLscWtpVyNLr4PxvoZu3gce5O3HC+0k2+U4fz/SixM
JcOYKvLAAQM1S+UluJLXUUwl9OzhqOih9wiocp89NYSgAEK+IF/yo4JvudD0
/WBteldhCFT2ToONrmE+5UqNYx+X8qJjaOKgkwM1O3f8kpRfveLcRKugtZrk
3Wf6SxSMgsd+uSZ3WTjg4tx3Eg4Kspoj6/jSSgOZdMI1CpDn+StldEaRiBF3
ek+VxCr8pWLhdzEZSCd1B3m9qOPjOqtX3qawgKVLj3uA1LpPQd9ZAcqevRAk
IkBKDKkYpmgExnbRAn3w+TqOzvsgSkNrfYDUkfI9TTGErwhbW+n8fkzbAlfj
himX4ZpDkFgVDgrNy+7lagS/263R0lukLhWqFP9NvMdYNrTDqTgsriO1+lap
8pbJQm6J0WO5hoVgQ5TiykHW7sO1Vsh4pMLBSL0C0XjhKFZUO5KP4BCLzdyw
I6Zn/tKhiVRoi6vDGdpXUS+AKsBhjGIyS1EbtYkK7SoLhbdUbystSNVOaMlk
6BUfM8nTrxj7s+2Btm5mxcRlomSYVDl0VKpJMhjYQjBmJmwKc4tFWhwndwk/
Bzdhpz7iumKXf8+K2DQCNcI5TdMoDpTdMRNt+3wJZeoIs07Pm7m0QmIM7skx
eeaXLddkb+TSZl+jHx4f2fNsK8HVhS49+yoB7Ur0US2ZiHfrIsoqqqctNUh6
tdTKVklVcc2brUpU32o02q3d57sHO/u7z5cwzmWbuIYbwozO1PSV6V05nrjQ
uVOgG6b233+xs3OIEhsVizh+JTZ/VflGdrdEUBpsDVwfzRawaj1VA+sCdV81
+InuZCW6ZZMkXxG46EoR3p3Dmsj0ElEiE4IOsSomLafVKztpiZD4lEJTEXTx
XW8Y7Vj3fBx/KUUgmodV4VwQKhsY5m/imFucvgukJQKCCgfyyvmWNlKV9v3h
Duen2odq5d73i7m0yLho0OF2zGkLcx1Z4ssh5tKL5+6lUSvHtP4rEp/Ckr8N
zaFCDHc48fde6hEjOfVPGXGXZHJToUaI95xgwEcLlcUhleiQVHkNojPeVcsF
d74eK5QQeaIzcsxHQvkXemVZtU806wdRtuYIuHWvn2QDcaO8QZDgrJhQqcJ2
aVLLghKdsMRCZqFlB+8hkLfJCnOT+d0MJDpnx8Q1bFiLKKQix09E5QQTlM85
pzND1W6btTtjdjgTdeP3ciV1Lo21Tg9VAZ6Cs3U8UzmsA7Q7BAndII82i7tQ
F44X0ZaH96tc5viT0r07HRsv9/v9dMtCGiVUdW7RBp4peHEOdhOtUUzZiZ8k
NkdCueSpkkOFbbybgSVwXHwwvW8Jtj7mVMK50dh+VFDfK/vDhY7j0/ZrSi6u
7Ew2T4cBmA/OO0HPgZifzhczWjw6wNrN9QAzvjn8ITltWQbhldBbkUk4tzlQ
XHAWbdJO6oJCpmQHUR00LcC/AHWsp0VQpQtRN+W1yarrd2DiOXVBVjImYKKk
tHDY/rWSdawp+cKfNZxmaQg8fnyjL9fiuGMdDv6sq8ax9IXqAjFqux+lTEzV
Cu9CuFXAPxqwbyRlREKc8wt4lMm1vYa2pWWyZdR5XYpq/NC2IqQKNHLlInTA
HKU2MhWICimc2QhuTvsdbfRodJtnZRlH0o1RWZEW9Iu18xjfDfvhG8/mvS+q
UFBTrlBYegGE5TnfMMVoSUQpBYSR0quc1B2vZFE6J5dGEloUXaJeKa9TVrT4
LiMkPCEmJlgn87A85lem/NAfDNImT6O0Ndt7cYnUpHXplubUEdvlVw1xaa88
GbRZcRIH6zesdb8NQ8/MTLkl5eg9ZIwieGE0n+HBycbzfIh1dktGQ/7MUql8
JlVqN5UgTHsRV+/b0gvAx1NvCBXH0QzdHUYBJdbkg7LEx8HapR1ft7s5OijM
3/CcuDLHT1r0POe+gkyJqF4s1bHM4U5bnh2XLx8VqmxGqyZP008lu0PRVYu3
fu0HRfcb7KhVxAH2YUH8QUO1u2pdYtlZXPHlQlmSukCr3WRl5ZLyrXwvHiZp
xhdvhdaVl/UluyYto1pXXQ07LpcXplcRkGzATuqZrQtI/1jPW6hS9XZW5WNU
8NuDM0mlwJ3aEKtvhWldOs19yXUQP64Y+zE7HODlWjgJzDtGPCiR2MKbYbaY
TtFJYkAvl5pXFtm0H1VuEzrSQ2+XOy0/elaGGbvjQssKdC/CZ90mOt7bZCEy
QrV70iglWNXe6YnSpinnm18KNQeq58VSZNGlyoBxOQvHD3EGaZE/WE4W+LOE
ra8DD4GoeMg2e79seefSjY71P8t5NPWs+DR0WsGm8XMvVl3dhWbgKPm3ZzRY
FoDUGrBtMFBVURdB9evoTeLQJErH0moja281mwftZrtVzeLxo9n8TqPVqgBP
EU/VtkZMO/3Ahjttb0kIwM/a7a2g1YTNm8ed/9zne+5zUZ7Dz5Jtxpuuh2xy
+0GbXM1cN0/+c4ufYovvxYFeq5KBfkVJvq1zdoYdu4yLZ4U+slpSWOUH4wrB
y6wGq289HcM224tQCA9tJaxywSJ0JaFQQTtHG8hsqmnaS9KCydSREShPcXzt
nBk2TTca2/CvMl7oflGvFqjrTKh3S3to516ljyy50D3Txpa+QRO0q7ZdISSs
yN1fTmFoDen/cUB2z0yRZ+W6zQws3zK5DkwYD/Nt8Iyi0lYCzbM8f3M8azcf
hGfKCPgfB2SPgmcArDV4xs6HX2ovu++PeqL37qj/Y+0f//hHrfbdd9+JjUjm
oyAfXCPhzTZqNTK2DpPBnERwTEoOfDjRuRQx/aK1/Tuhn6i1fP4MPwf4c/bl
Sx0rx0R0Ldpq7LQbmJbeTR+HSYUwvIYr4YZ8ETAL0Y+Con85eZbrYKYnVZmT
nmNO6EUKfCU/wwkG2KIJma+eid3bGmHUriH6WgczQge9+/nz+etuu9XcxaXQ
l4Nm6zl/Oe6/D4573eDF8xfPg1bFs7b/rNVstfbLjw6CncLD3YOD8sO9F7v7
xVFaB82dHdOy1+sF/XwYtHb2d4J2s9mseB7iD2ox7477F8HZh1fB6+OzPjxv
O4/7ZwfNZrBz0K14dlTx7HXp2d5+p/Ss1TzgZzq9KX6DTb+VWGIa+P3naBp+
+UJGqs+fdaoZzslCrTl+yg07ob0+pT0kVP5OvOYjmSESUwkADE+7TazNSZ3Z
zJ6gQ7FBtHqDRt6g87TR0OSI8yxyGCG7d8HJNZ1EjmcD1UQu3rCrUXRqqUIm
bxUXiCcK5Re8jqcQLEq9xdKK9d+ChbIn6BTD0eoclIaXDrqb4tg6dsLKQYUe
FcyUGBsVoObb6iLTyPh20eE5rNVaDdH1SsrrotRZsWi5J6T9IHSNCzLrwjZY
ir9RFxveF7okqlP5K+SJ+GcYJ/FimsyzS+chnF2cCorbOD18BJ2Mk+FGnbeX
I/goddYGR2cWKJiTrjljSMB6Lwh87RKFAxACWSM3CkVCVK4fSo4AqyX4wdJY
TuEpMC+p1XYcwmM9BdQbPZyG/1RlBFA3O4MlIFcXuQbyvG5TjkUjS2nODVW6
Cq/V0DGe6uMyVscimqpyVsaxLfSKfzKu6ds4jJcoLKihKj9b+ktwzsrrn0Z4
86cWyZcGDP2dKuh/PhTfAdEOPBb2RSG2Jg/ziawhu/sH55RgJviq9+b4Xf9H
5jHPvPd/BnLYDppAR3caGOfzrKbzT7itxOf/AlwVfzfOP61G6wd8iGbCbBYO
oON5Gh/ia4fI16bZ4afp5DDODil8yOvuGb05Q++TTygawFd8AIpqGEd/J7j/
F+Llz457F6/JhVJsnrNDfOfC6tl0/odAnfpb4rck/YiE5g3qvDwAKV6DXHX1
2xvxm7w6hD9fan0Zvfu5kG3awAmyqny9jbfB2z/yewLew6If8OLLKRCXPKHL
4p91e92sM4ejl2L3PRTjfk2Aa+sX5A18+3mAYQANIGo/8vQcuUdN8UKRGoS/
PgAOMaJiNJWSIsNPYADFbJFSTuzNwZbAvRUEwgu0DJgCLjPYQzw/TsxKmKke
QlqHEx4ylHDqAcupW7xSzGSK4Z2q/bk0kTE6Pc084yKlyTxVjlIqjQCKc1j4
Giat3ibSDQPOc1y3OaCUrmSGmfowVknM5mmGgVIgqNARVy9ncw5pVrkoJ9FA
Yu4DzPBn84+gl6pK24ACmtQvv+ofwb7yG+iSAXPLxzhtmwJ6oIFgQbihwXQi
r8OJOMMI34xo0TlGRquaFdT+SMlv+o1N30ojLcapiVP5yy0NV/UfoYQ+c1qU
03KfyhOjSySi3+if4FMcEP060tEggJ3Kk5SGxKG24Rk23/qBUrETiKCHKMe7
PT0+JfZFwXVCCwaKiekESpPkomu3STrMxAYGoCI3okDUd+/p7/PeHz8cn/eO
8O/+287JyUZdvcxfdbv+2/cfTo7sX/b97vvTU5DmsQv9JvwmvB9gzM6fNft7
f3Zx/P5d52RDFEVqjeomnp8SyQA9yjnq22Zchzdfdc9EaxfoD8Cm3Wq92NLg
xQcHree7W6R4ad4Dggp/xazrukYaXjdNJurFQTjDXLsZSYTZGK+BURJpPFNk
0CgSljQz/a0gGY6NWSEJ0xbHpmgaavQ4FB3GIKxKyyIlbXPXJNg51zmV2FWb
Ka/ux7N0nmkKnClfJfSI5yl84dWUg7W2+TH0pCVY7FU/rmiNP2j9k4SLVeCg
A6NbW5nVMt3MEXaVVzZl5QIpwSwxJOrjkIIDW/LY9aMyL2AnWM9ToKuCoBRf
wrYzzR7kHoEmWdODLRraDvAHO8iK0qHOdjhwBFX6seFIOXeWwxHms0uA5OUL
o+Kz4AL0+AovfM3rBMwW4Kvj+QGCpNROR+yF8nXQtVt4V5+Tu6K31TXWo7c2
nrj8fcXmdEiPwiwFoA38nYhWWSxQqQ6Ae15N8Lnhmyh6RTdoeQCi3VhOMIz4
eejbQc7lNbL8BXJUNHYIrTPU77EVgLEkH9gNUNIhDxKkapBtnMWlGfxSD47b
tEM3DN5+GEA+DI5LwcilE58KcNVLYPPePWZfcMTmnDuqcA8psxivTVHSeWLP
qK67o0pHpu5pF6xRclfkts5FPZ5+8cYifJ/dU+849Q+eeJYlxfx+p1a/XZ75
0wO4YD6418Ttu2QZefrJKjS8zxzVK9r7DlA5zD7q4DWcubYjPP3sHUPMvZag
Ujapi+MnnmTRpLZioq8oS4x+seCQlS78iIOqsTwprhC/1WrrpdLNQTFgaPms
lBWT1qhNcFgpeQXklgt0XylLeOXd7yypue9fdk7evD8/vnh7enl8ZGroOhLp
Ushaua4AWbyzeTTIroFrIeDgEeF6hxCDatAooF6e9ztLUY9yZpUgRT8VHrSb
7gPnOtB56pz7FdDF+TwBx9rxJD5SVput5w2BIDg+OhTNT81ms7UaVBdHvf7d
jmkJREWAVNKRSTL4KAbRjIpeo5h1E6ZYmJmsCVhuLhObFylV9yZltWf4jtVG
NSDq5r4Aq4pP8Lqw8k3Qy9DvOR1umT444xYWdboKYzYZ6Ui0mxe7T7Ulx/33
28e9rlCXW4Wd2Vm9M/23ndY9sZjuX++K1ZVkAMe04mUgjrB0CickHs7JlhLF
2Xw0igZYs9M32zu6R5JLnezpbXKLl5b6jjPL0bYOcuZozjaJwl2v6YSLXtuu
itb8R2SXSzaNLzQLm7a7etPenna6j056ituqRMkV+0ghbacq3Ajt1pJK/xAc
uygKbuJEt56EKNVLkOQbZLKeqSvoAlD3VgO186QkCk2bOEJBHSzRqScFUTWF
2F8Nl9M3r5dRiDKOrUYpFqVXQImi0dhYiFJ2UCFlPw2Aer0e0POhMK4AXIrJ
fcyeAA3zjgfD56th+Evvz72jt53+20cC5N0Egk7sKlh4s17UDk1gKOCf0vs5
c15mzbR4OYo3MX96f84X+16XYSyIGo3c7mPcPmt+CyeZk3w+VGnZlE6irixj
5S+g+4iT1LyvR4yvH5Mc16t3cok8rHcSofDklPeO9ATn4uzGU+j8O0vwvbNW
qmjv7X89si9bOfQvcIAnF3dXs+lXa6Gwc7D7tFDAAX5nKHTXQmFvqZL+SFDA
AX5nKBythsK7Dycn94dB1Zqpp6dYbPVRbzXXbO/pzuXTnvXTnXKygm+yw4ft
ZuvA3+bWEqOXhcZDz/tdiD72bm8Wrhyt9+nRYI0eed7v9JfaQ9atvdrqsV4B
0cYI0TeVZq1oo2rBkAeJUu4OGm2zuE2e8dkv3X4ruGld7m09vcnEh+gaJQ/m
t1QjeRhAC5b6RwTs8wJge/3gmwLWg+saPQ+md9Z/XMCux9SzcDj0Je9K9Gxp
tBQwxW8NtzV64PtO7+x3Qsc7Qe+5Az2c67cG3xoVsNc9+ub0ser0ssYnJxNs
O8B8IDfStbBh7HC3+2TAMyyWffYLMFyjfAEMH6pBV4NwrUGiLwcpJnsbhyln
s6F8Ed3uU4EHff+FiQcoQOfFWuh0nhLDuGHxonoF8HoKyQJGMrbrlO+qOXHQ
U0FUBwqgS9GE/YKKTtwekNdptqcPVWXuDOJqunhHfIXpBfDLTHK4BJaRwUuw
T3ldR2RgKY+KjbHmkKxMNer0ljU18JZRZRiyHQn5iRMVmk7QpJ4MksnTC6Zr
lPBet999++79+TKzzVPR3krk7w/GcZKmbp2xpwbPGu281z3946/flqZe3CbB
bEyY7sMIE4n8HnR1jer+y9Hr1iW9ewnvfitTeDeJ8UYstskeKFvikxnDV4AL
ZHqqFnCD5HuSyxQndSNbW0b22muA7FqNgO019gOA7iMYh+4G01++LRTp+sBe
HQhaqgZZa6fR9vGwveYS3cHDVvNAw4xW7gJzxfo7RTxiiH0DLMIJB8brZA9E
dZhqYflrTCsgdT0qnbrbHcpZGk2lGEVyMnxKuc+IxRy1WoDMujv8P592j8/e
9h7K4r4CPO+tZxmHFT29feprpLv2GttAt3PaOzk5fiiRv+vFTTecIusLv6HN
uurmt71G48f7i6ez7RaMrUAe8m95s0PE6ezDK4HB3BgiU4DNGnWeYPOvcbuz
DhJrlHKCxL/GDc86SKxRwLvL3XIeRILXKxlMYrtEYpXfxEp/HJzhk5t2OL0D
Xp60nD72fFjuvF4Dy4tH5WZ3tzV2kzkG8ZE/+re4Z9r34bK7Rlx+//qVJ/k9
9vLfczG+11IOr0LArd8LDGtk4e6rRz1p90APdjJlj9PuOIzIhPV7QWmNyNy1
yPK7QOl3x6I1gnOv+zvBp4c1ntMkBikZCfNVkvx+MFpzDdntnj4dT3sgbSbX
ycqTGFSzPwMIxQa7p0/GBR2ld+eg68N6bw1xf/NPBOs34SSJsm0N8lMC3Jtv
BbijAuDWmUZ++6eBG17ao53ptzScic1ffvs28CrYUvbWMIZffnvoVe4TA4xO
tr7uBeg93S3uSvCt4xudP/3zgM8SOjkMnPCU0yfkJyuBt4ah9I6+/UV4DysG
DjN1z3AUXWPiDMe5xa5/8wy+94YwxSf2H9gpKJf7ljeUcg7+o1bD0CJ2lsbw
FMwWtSyZFWYjMcmodBbXq4X4d06dNMOQeMzD4eY1ppRN/96wYTRoiqF0LU65
Yky4sCSrFOeyglklt3o4PMP4GsCZkoT4yb4wj5o47rzrYKnmDHBEFbUtJlLk
6H2sjEwzSnAEcg832aI+nB+r9Gqy9vnzp+nERPxjXjzOG0F5CHf2Dw6+fDms
1eCNw9qhWJ9lqhJUWAxa7TNmEupybihMqHxI+WuOe/03DWz0p9MTfvpuu0N5
25za2TAFKuIUYyu7mMY9JqdSYD3xdO64HU4iIbMZehsA+pTwi1Yi8WW7MSah
xy6jFGzTfrPdpG3C8rQIijV78U7Pllf3Fbt6RnnEuBtoxZBVR5+fDtNwlHPe
NCr0ROvCDgfjME1DTuWDiUi2itN3duveE3be9aYYhl85xe8Q/vMUiXP5FEo/
O9Qa2qGPN7tkeUmSTAaykN0GQiJKnD1CBX8AyQZSzIWiCvVMRCzz2yT9iEVm
QK6nDrVvQWaC8t/1Lrrv371WGNTebQGKwSDnvb7z/KC5C5jFWfUAbzFVhX5v
Ei4AGyNdE3hAmW3gQGWUmYZ+rZusZ6bcTZAngcnyV34Nuuvzs/4Y83Vu9vtv
t8wU24WpmLmauby9uDjrP2jYi5O+WvLu7j7l/LM5KkNVT5lqseMmcIV3x6Gu
lBqMMxrCu1iNETnA9iAFpk1/DeVEckD3ZtSQjbr4XlUJwlJA39dVBsXIK+G4
1eAQI3d8lYJxoPAQk3BI+BPvmXEnb+YTjATDcSgj3FQaxJDxTQSqNKVIa4AU
iYWTbZV0sSkb1zgtTFoW8Ny+31Kp3vwp6ARygF5Im5ygUKyzMw5vCHjymi6/
hRyN8OYLftUTcUqzq/VxTlAqdp+nEo8A7KUzopPJFZpFqVkzHMltveRoAt+A
HnZN+veN7SVl5raXlpOD93VGzYp02ZjwLDcZx9W3ysTaOieazRu9wVn9BlTB
FHZwlszmE1Mqx80vb9DIqUJny6HOY9j2CSV/0EWb6WYvioHOUBi2akgpbgn1
b6i6Coyv/tJ1VAESOOecmisA4o6bGqwwmB3fzrDhAPlwBZQxH7aCKPLKjUOA
AKLO9VilYYP93EhvN0w0cqHeNaEHUPIkldTEln9lADr5mQHxGK0Sjp0bDvE0
IBEmbEQAqRqe0iyPqbLecKcaJ0z02E8B7QGFSt5RhB+XuItMAlS9aVzSz1SV
vFropWXJKMcE4A1Vo5nWM49jiYQ8TKMJhxDidHW+poxn6NazqpzfTKdG9Is0
qZmZqoY2SzDBKfayy+miE1xQo3P8y5abEVklbqurcMZSAY5OuTleN+NwUhU7
bIjjWDEjIBYZbCumDsjUVM7PulrYMkm8K0sYDTT6Yp1bGE557MWJSFUmPfa4
M98Uisxj+Qnnosqh12o4ojrRA5ONT7/lMm9G4wuSBgcS1qIzNqtJq3GowiX8
GI0WfIwJ35yZR5meC9d/FABkwG3iCMW2mBz9SsqYUS+d6kzHAJd0SEkoMX2Z
QjZdeVFniXN3J+ENycP0Wqq140Y66wfk/73W7y3fSfelV22yAuPvVIfPcbx0
0M2bx11ARzLUJOEMouS2Sag/AXE8j2BYrH2moQqkhfLmrYMq4LuG6iS5BkgC
fZU34YTBd25xOwTxBd4TN8kEhD9cHrTPLI3SebQNqpOeyho8ghIFGiYphk4Q
wyGBQ1Ix+BiTVELHmD42YiXlOMZV8PRBLpzwUcjHKdFkBUXo6Aqpph75RkI/
tJnmLKrUl5S0VpM0Ht4lrZyKOR7OkgjzMqvsaNipzmAkXN6NefsIpgnZf3Bx
mccBaG6KB1yZZBS8te86aBImUW6HpFqVi08Xw85knqt6jjD2IkDDAGbwj6YR
I6lDyzEDtbPPJIdcLVRGOsrWS8mifkU0jwASANnXKidjWRVQSgkJ/3UBwiga
YpDGD0hQxAoSmcSNiKxy4KUapkMHAEyh1wEVj9SecSXjwji6Hk84azDvF4p/
jmBhYeeIj5hndrBgcQVTYYEgEw8zm5UblVj8LRwmM/oyhM265tKoiNpzwjeT
Bj5yUExrHddYoZwEz3CClRWHc5Q78G/qeBAO5ZQKJGQyTOGVK9pwBy6hE7St
TTWIz0EQCLw3IyMJTPWadLRTgDEQBxJ93HySYvP4tAOKxXdYCwAOw2lHsWhd
9TOKB5jAhvBWdTIUrxLgmgBnmwBT1RFQOov6/UPv9XHAjwJ8BI1UmuSTKJ5/
0kIvbjKhdh1T1bIYF1FG5WID+t3kfMcBMZs4IBvO29A3nYrYDhQZOIA0rbry
GnyEvZATICVYJrDdbL4Qm+qRTnvcbuw3dpqsfQgcbirRaz3KkNqoCgJWzvRw
Pva5dqhzxaQAEq01SVEYb6/R2sd6Eqed4Bf6JegTSUONjHYpRtQytVlzi/9q
fXbNVwtN2MgwbjIUkW0yZc0ZYDel3YUmWwRZLHFI19MWc0AhUlmNupMwmmpr
jY4SwMFNrvQtKv6Au6NRV34CTOAzkBhGSJ63zgCqKilVfkZNAFVnS9bnQCEx
dADGZVuCR5RMJnaFEEC6aIqa/asdR3fkMMqYEfRukO7Cpm8qZTNWNW+dWanV
biEgVXkTBIwxnohfKTEaQYz300i5lOwe5kipyUlsPb7bfOqMY6BOoEpB5rUk
VcQJi3JsEi0H4W445xMhM4K4B0yqNUq4QzYjFif6PEuXIJwkgBb905OtOgsi
wAd452iXSHmlgzXV57+8o3RwsPvSkb3VVYdBd6kZXQdX5+611p9JLdG6T76Y
oSrHCgABFjDtr7qcmuJmVPUBhZXBWDEci/kKwrA0roU8DtMh1RqyfFKZQHDv
8OoXq/Zh71oAM9mBuy4XV1ZTpPybqPlssaah9BpMP80YqJ5m7iyuEpi2ykVP
9YH73eNjS0MUbVMni6lTpi1thE4Krt/rp6Pse7H579sZ1lal3d7Wv2wDUd/+
960G03V4CcuuGXuNMsMiY3IApRfOx4F8lzNVlYNOxpAhCZIZccYUNrX3KZwS
i8BmNEWsBFvnP1HNr+P+peL4qC4oxR79xWvRUiuzveXnhvAFWHemtx3T5cOs
AWra+qTXp9akODSmj6G7BbQhDoDJJlPVQK801EAgASDTIpHtjmHgGR1gOo3a
hW4xJ68BD2GHaKye0rygOdbUAehccy5+AE+mKttbwk9nQ0dHYLkZZ3cGxOsz
sm8iCgdcHArwPNFL4k4UoOxOM4s0e0jwZe3Y5zqqTAIVWqh1MlYTQUasAxND
O1QBFrp29HBo+ddoTpmxGddmyQTzrxlU09ikscRQEg6KzBVPpdeAyIJcOAeQ
Nmqv5tEkD2AE06EaWoEQWb4P2wJQuwweb06qC403CZKuIXE+zWFQU66AdehD
G4A9QhKsZh0ZQ2gdn3qUmIx54UfJtSlwNtCarYC03SBAZsjP4TTVOipd8hi3
6ka6d5K2IAblptTbAfBhvFH0Avu/OPnVRZ8rRKZ5PLTlXUC8UL11MaySbGa9
G8MOur2TrYLI8vnzQE605Rl+L/xMGBpNJijIqhJNLNU7h4n2h0UXe9gB2AxX
UiH8yWduNQyQiUAKI8EWGiGreqfMpz1j1yPR8wT1xs/flWta1Wr6DWsJRPCw
eQ0PrmMcBz0IFFIcy+EX9q4UVqKtcgUhScsLoDPOWZMiJFVZTrmaz5BKmjLV
Y3j4tarK8k2jtmq1gDNXmqi7sgsOACu/VlSNJoL4lcSMmFgvosiynd83mcez
rGkE7i19HvD0TiRxAyLZxBsU2rFCi2ilzqTaNPit4VxJO3SOuDxuq56wu5CK
yRvJmiJK4QzBgUodgwG1130xVl4vnMIaQDAlJ3Es3jsBkh0xRajaPXymDfe8
j5qX0NCvjt/39ZolwndULRmpMjWpls6s3MVAhxmqo2vIpd5NS3ZJKlRDRKkV
yRq131CPxiZaKVeVpzmn+jL5OTO3HmXjV9VLYfn6RwNxq+5Byp44pISZthWl
yUTVX7cGHjKbhCTu3ciFhqVZh9I+bGr5KCsjPuKkf0dSOGEguKmUxmJTi91b
fDjZEHrhjkk8mCV1WZAyUaMCITxEPkLSCRf68bWDLVODy2wunRhSzqYzThEQ
5Znda06Fv6xD4I3ksq+gaEVxQoi6DzCGJWY5RjMYLrzQm9i8Qn0QaPRCIz3A
b0vZr3B6Uqnk+FNRd1D7kVyZYkdlQR3fw4GNwkVKZ4b4xphLyZhvsQASXvgq
OU/ZyZU1EkHOHEPflgFxQUREsaNM2OfZnEi6AjiAFiQaysbr0xC8PAdMn6gL
iHGCPBXvBUhLHlo6UDrBmBmaL53Ibn+FCgxyQVASY/dFoghMRbAlnE0GSZSV
UNaYFeoVBwf3EQ/PirNTZ6WDLbgeEpBhtgBkLDSYZx6Ba9Q+GJmsMLm6te/R
VDDxLhyHiU2/LqYw8zAfjLEHXA48TiNm+1GMSRxnCUouEW1MDnoDqbR2PxrK
a8RaVwigSvhGUg/cMo0SdfqpXtdCUU0FFENFzJ0hGn3QzMz2OX38hkUCT2Hl
ivjNZ0Pa6e2ZWg1p/xlKBwvzo1HfEyBBKAaUTAJR7DxzrHGwtBFMUq2C7YMO
cFlwGCe3HlWkyzEAVIZi4v8P1rRGnYZfAQA=
</rfc> </rfc>
 End of changes. 433 change blocks. 
1657 lines changed or deleted 1057 lines changed or added

This html diff was produced by rfcdiff 1.48.