text:
Please read this carefully because it sets out the terms of a legally binding agreement between you and Shuem International.
These are the Terms (together with any other policies or documents referred to in these Terms, collectively called "Terms") on which you may use the Website, Shuem mobile and other online services ("Website") and the products or services available on them ("Media"). These Terms apply to your use of Website and all Media irrespective of the delivery platform or device you use to access it.
The Shuem Website and Media can only be used by you after you have read the Terms and accepted them by clicking on the tick box provided for this purpose. If you use Website in the course of your business or work, clicking on the tick box to indicate your acceptance of the Terms will mean that you are also accepting these Terms on behalf of that business. We only make these Terms available in the English language.
If you do not agree with the Terms (or are not authorized to do so on behalf of your business or work) you should not use Website or any Media and should cancel any subscription in accordance with your cancellation rights (see section 5 below). If you have any questions about our website or your subscription please contact email@example.com. We strongly recommend that you read these Terms in their entirety and you print and save a copy.
Except where we state otherwise in section 5, references in these Terms to "Shuem International" (or "we", "us" or "our") refer to the company operating Website. See section 8 below for details.
1. Introduction
These Terms were updated in September 2019 and replace all previous Terms for Shuem International. Shuem International may update these Terms for legal or regulatory reasons, or to reflect changes in our services or business practices. We will provide a notice of such changes on this website. If you are a Website or Media subscriber, any changes will become effective from the date of your next payment following the changes, unless we notify you otherwise. If you do not agree to the changes, you should cancel your subscription and not use this website. If you are not a Website subscriber, any changes will become effective as soon as we notify you of them through our website.
We may in exceptional circumstances cease to publish the Website, the Media or cease to provide subscription services. If we do so, then we will have no further obligation or liability to you, unless you are a subscriber, in which case we will offer you a refund of the value of the unexpired period of your subscription. See section 5 for details.
2. Access and use
We invest in and provide high quality content depends on our users complying with this section 2. We recommend you read our Copyright Policy which summarizes how you are allowed to use Media. Amongst other things, the Copyright Policy invites organizations that may be using Media without the appropriate permissions to contact us to purchase a license to legitimize that use.
In summary, unless you are a registered user of Website you may not be permitted to view any articles; if you are a registered user, you can view a limited number of articles a month; if you have a standard subscription you can view all of our articles but not Shuemvideo or imeditate content; and if you have a premium subscription, you can view all of our articles and Shuemvideo content. If you have all access you have unlimited access to all of our articles and content, including access to imeditate. [we may vary the amount of content that each category of user can access depending on the device used to access Media.] From time to time we may invite specific groups of users to access certain sections of Website which may be the same as or different to the access given under other types of subscriptions. [in order to access iShuem content on a mobile device you may be required to purchase the iShuem.mobile.app]. Please note that the minimum duration of any subscription available on Website is.
Permitted use: All Media belongs to Shuem International or its licensors, who own all right, title, interest and intellectual property rights (including copyright, trademark and database rights) in and to the Media. No intellectual property rights in any Media are transferred or granted to subscribers, users or other third parties. "Shuem" and other marks (see Website/trademarks) are registered trademarks which, along with all other Media, you may not use without written permission from Shuem International. You may, however, do the following:
- View Media for your personal use on any device that is compatible with Website or any Shuem application (this might be your pc, laptop, smartphone, tablet or other mobile device) and store Media on that device for your personal use.
- Print single copies of articles on paper for your personal use.
- Share links to articles by using the article tools we make available at the foot of each article.
- Use spidering technology to search and link to Website, provided that you do not infringe the restrictions on use below.
On condition that you do not create a substitute (as defined below), you may also do the following:
- Publish online, the original Shuem headline and a link to the Shuem article (on Website) and the first 140 characters of an article.
- Forward the original Shuem headline and a link to the Shuem article (on Website) and the first 140 characters of an article to other individuals.
We define a substitute as a product or service that in our reasonable opinion reduces the need for users or other third parties to pay for Media directly, or which creates revenue from the Media to the detriment of Shuem International's own ability to generate revenues from that content.
As specified in the "restrictions on use" section below you may not republish or redistribute full text articles (unless you share articles published at www.Shuem.com/ using our 'email article' tool to send articles to the email addresses of individuals but not group email accounts with an active standard or premium subscription).you may however republish or redistribute "summaries" of Shuem articles if you comply with the conditions set out below. "summaries" can be either an "extract" or an "abstract". By "extract" we mean 30 words copied verbatim from an Shuem article which is inserted into a longer original work. By "abstract" we mean a 30 word non-verbatim summary of the news or facts reported in an Shuem article which does not form part of a longer work.
These are the conditions you must comply with in order to produce summaries:
- You clearly source Shuem as the author of any article from which you have derived a summary by way of an attribution with a hypertext link from the word Shuem to the original story published on Website;
- In the case of abstracts, you make clear that the abstract has been produced by you by stating "this abstract from Shuem International was produced by Shuem International", with a hypertext link from the word "Shuem International" to the original story published on Website;
- You ensure that your summaries do not in whole or in part form a substitute for Shuem International's own products and services (see above for how we define substitute). The more summaries you create the greater the risk is that each one is a substitute. No individual or organization may create, republish or redistribute more than ten summaries in aggregate each day, each one sourced from a different Shuem article that is published on the same day that you create the summary;
- You do not use or create summaries that promote or endorse any product or service; and
If Shuem International notifies you that you are creating a substitute(s) or republishing Media, you shall immediately cease doing so and all of your rights in respect of Media shall be regarded as having been withdrawn, unless/until Shuem International reaches an agreement with you regarding your rights in respect of Media.
Please note that the rights to use Media detailed above do not extend to content, data or other material published by Shuem International that we license from third parties, which you may not republish or redistribute. Nor shall you modify, copy, transmit, display, perform, reproduce, license, create derivative works from, transfer, or sell any such licensed content, data or other material, in whole or in part.
Please note that in addition to our rights at law to restrict certain types of use referred to in this section 2, the restrictions below are also contractual in nature and bind all users and subscribers of Website.
Restrictions on use:
You may not use Website or the Media for any unlawful purpose or other than as set out in the "permitted use" section above. Without limitation and by way of example only, this means that you cannot:
- If you are a registered user or subscriber, share your user name and password (which includes pins) with anyone else. A password is for one person's use. Sharing a password means a copy of the Media may subsequently be made by someone who is not authorized to do so. Password sharing is a breach of the Terms and may result in an infringement of copyright. We monitor usage of Website to detect password sharing;Copy, display, publish, republish or redistribute, communicate or disseminate to third parties full text articles, photographs, graphics, tables or images in any way other than as permitted by the "permitted use" section;
- Copy, display, publish, republish or redistribute, communicate or disseminate to third parties full text articles, photographs, graphics, tables or images in any way other than as permitted by the "permitted use" section;
- Copy, display, publish, republish, redistribute, communicate or disseminate headlines in any way other than as permitted by the "permitted use" section;
- Archive or store any of the Media for access by anyone other than yourself;
- Create derivative works from the Media, unless you are creating summaries as described in the "permitted use" section above;
- Create more than one copy of any articles on Website or any other Media;
- Photocopy or scan copies of articles or other Media;
- Remove the copyright or trademark notice from any copies of Media;
- Create a database in electronic or structured manual form by systematically and/or regularly downloading, caching, printing and storing all or any of the Media (by spidering or otherwise);
- License, transfer or sell any of the Shuem content, in whole or in part;
- Frame, harvest or scrape the Media or otherwise access the Media for similar purposes; and
- Use or attempt to use the Media outside the parameters we set depending on what subscription you have.
Linking: if you would like to link to Website, please read and comply with the following guidelines and all applicable laws. A site or service that links to Website:
- May display an Shuem logo (view our brand guidelines here) but must not otherwise use any Shuem trademarks without permission from Shuem;
- May not remove, distort or otherwise alter the size or appearance of the logo;
- May link to the homepage of Website, and, provided that the requirements of section 2 are complied with, may also link to other pages of Website;
- Must not in any way imply that Shuem is endorsing it or its products or services or any other party or that party's products or services;
- Must not misrepresent its relationship with Shuem or present false information about Shuem International, Website or the Media;
- Must not be a site or service that infringes any intellectual property or other right of any person or that otherwise does not comply with all relevant laws and regulations;
- Must not be a site or service that contains content that could be construed as distasteful or offensive or otherwise incompatible with the ethos of Shuem International, Website or Media.
3. Privacy policy and registration
All information received by you from your use of Website must be used by you in accordance with our Privacy Policy, which is incorporated into and forms part of the Terms. Please read this Privacy Policy for details of how we may process your personal data. Please note that Website will only process your personal data in accordance with this Privacy Policy.
In consideration of you being allowed to register as a subscriber of Website, you agree that:
- All information you provide to Shuem International is true, accurate and complete;
- It is your responsibility to update and maintain changes to that information on the applicable Website registration or subscription pages (which may be done via the following link:);
- Shuem International is entitled to rely on any information you provide to us; and
- That you will not impersonate any other person or entity or use a false name that you are not authorized to use.
[if you are under 18 years of age, you confirm that you have obtained the permission of your parent or guardian before you register to use Website.]
Each registration is for a single user only. On registration, you will choose a user name and password ("id"). You are not allowed to share your id or give access to Media through your id to anyone else. Shuem International does not allow multiple users on a network or within an organization to use the same id. Shuem International may cancel or suspend your access to Website if you share your id without further obligation to you. You may not create additional registration or subscription accounts for the benefit of others or with the aim of avoiding our use of ids to control access to and use of Website.
You are responsible for all use of Website made by you or under your id and for preventing unauthorized use of your id. If you believe there has been any breach of security such as the disclosure, theft or unauthorized use of your id or any payment information, you must notify Shuem International immediately by emailing us at email@example.com We recommend that you do not select an obvious user password (such as your name) and that you change it regularly.
If you provide Shuem International with an email address that will result in any messages Shuem International may send you being sent to you via a network or device operated or owned by a third party (e.g. Your employer or college) then you confirm that you are entitled to receive those messages. [you also agree that Shuem International may stop sending messages to you without notifying you.]
If you are a registered user of or subscriber to Website then you may choose to use Website's "remember me" log in feature that enables you to be logged in automatically to Website whenever you visit Website without having to manually log in each time. We recommend that you do not enable this feature on any computer that is or may be used by anyone other than you in order to prevent unauthorized access by third parties to both your subscription details and features of Website personal to you.
4. Third party sites and services
Website may contain links to other internet websites or online and mobile services provided by independent third parties, including websites of our advertisers and sponsors (what we call 'third party sites"), either directly or through frames. Third party sites may be co-branded with Shuem International and so include Shuem International's trademarks.
It is your decision whether you purchase or use any third party products or services made available on or via third party sites and you should read section 5 below carefully. Our privacy policy does not apply to third party sites.
Website contains advertising and sponsorship. Advertisers and Sponsors are responsible for ensuring that material submitted for inclusion on Website complies with International and national law. Shuem International is not responsible for any error or inaccuracy in advertising or sponsorship material.
Copyright in any software that is made available for download from Website belongs to Shuem International or its suppliers. Your use of the software is governed by the terms of any license agreement that may accompany or be included with the software. Do not install or use any of this software unless you agree to such license agreement.
5. Our responsibilities to you:
A summary of what this section means: this section is important and you should read it carefully. It makes clear to what extent, if any, Shuem International accepts responsibility (liability) to you for your use of Website or the Media or in respect of any third party products or services that we refer to or link to on Website.
Shuem does not control third party sites and is not responsible for their content. Any links on Website to third party sites does not imply any endorsement of the material, products or services on such websites or any association between Shuem and the operators of any such third party sites or any other third parties. In no circumstances do we accept any liability for your use of third party sites or in respect of any third party products. By third party sites we mean websites, online or mobile services provided by third parties, including websites of advertisers and sponsors that may appear on Website. By third party products we mean materials, products or services available from or through third party sites.
Limitations of Media: The Media is only for your general information and entertainment purposes and is not intended to address your particular requirements. In particular, the Media, distributed by Website, does not constitute any form of advice, recommendation, representation, endorsement or arrangement by Shuem International. Shuem International shall in no way be liable for any agreements, transactions or other arrangements made between you and any third party named on (or linked to from) Website, which are at your own responsibility and entered into at your own risk.
What we promise: Shuem International will endeavour to develop and operate Website with reasonable skill and care and will use reasonable efforts to promptly remedy any faults of which it is aware. This is the only promise we make in relation to our provision of Website, and the Media.
What we do not promise: Website and the Media are provided on an "as is" and "as available" basis. This means that Shuem International does not make any promises in respect of Website or the services and functions and products available on or through Website or of the quality, completeness or accuracy of the information published on or linked to from Website. You assume complete responsibility for all risk or loss resulting from your downloading and/or use of or referring to or relying on information, products, services or materials provided or obtained through your use of Website. To the fullest extent allowed by applicable law, Shuem International disclaims all warranties, representations, undertakings conditions and duties (except any duties of good faith) of any kind, including without limitation, any warranties of satisfactory quality, merchantability or of fitness for a particular purpose. Shuem International also does not make any promises as to the timeliness, security, performance or availability of Website and does not provide any undertaking warranty or representation that Website will be free from defects or infection by viruses or anything else that has contaminating or destructive properties. Save as expressly provided in these Terms, Shuem International accepts no liability for any infection by computer virus, bug, tampering, unauthorised access, intervention, alteration or use, fraud, theft, technical failure, error, omission, interruption, deletion, defect, delay, or any event or occurrence beyond its control, which corrupts or affects the administration, security, fairness and the integrity or proper conduct of any aspect of Website
The above disclaimers apply equally to your use of Website and all Media. Without limiting the above, Shuem International is not liable for matters beyond its reasonable control. Without limitation, Shuem does not control third party communications networks (including your internet service provider), the internet, acts of god or the acts of third parties.
Our financial responsibility to you:
You agree that if we are in breach of these Terms, we will only be responsible to you for any damages or loss that you incur in the manner set out in this section 5 and arising directly out of your use of Website or the Media in accordance with these Terms(to the extent that Shuem International's liability is not otherwise excluded by this section 5).
To the fullest extent permissible by law, Shuem International excludes all liability to you in contract, negligence or other tort, under any law or otherwise howsoever arising for loss or damages arising out of or in connection with your use of any information, products, services and/or the materials available on or through this website, including but not limited to, loss of data, income, profit or opportunity, loss of or damage to property and claims of third parties, or any indirect or consequential loss or damages, even if Shuem International has been advised of the possibility of such loss or damage, or such loss or damages were reasonably foreseeable.
If you incur any loss as a result of using Website or any Media outside the scope of these Terms, Shuem International accepts no responsibility (liability) to you for this.
If you have paid for a subscription then Shuem International accepts responsibility (liability) to you for any direct damages you actually incur arising out of your use of Website or the Media in accordance with these Terms, subject to a limit equal to the price paid by you to Shuem International for your subscription during the year in which you incur the damage or the price paid by you for the subscription that gave you access at the time you incurred the damage. You may at your option receive a renewal to your subscription free-of-charge at the point of renewal or the same type of free-of-charge, in place of monetary damages.
If you have not paid for a subscription then Shuem International accepts no responsibility (liability) to you for any loss or damage you may incur as a result of your use of Website or the Media in accordance with these Terms.
The limitations of liability in this section 5 apply for the benefit of Shuem International, its affiliates and all of their respective officers, directors, employees, agents, successors and assigns.
To the full extent permitted by law you acknowledge and agree that in respect of our third party content and data suppliers, we have no liability whatsoever to you in respect of any of their data supplied to you as part of the Media.
You also agree to waive, to the fullest extent permitted by law, any right you may have to bring legal claim against any third party who supplies content to us, which arises from your use of their content or data on any Shuem service.
Notwithstanding anything else in this section 5, Shuem International's liability will not be limited in the case of death or personal injury directly caused by Shuem International's negligence, fraud, fraudulent misrepresentation or willful default in those countries where it is unlawful for Shuem International to seek to exclude such liability.
Indemnity: You agree to indemnify us and keep us indemnified in respect of any losses, liabilities, costs, penalties, fines, damages, expenses, actions, claims or proceedings arising out of or in connection with any claim brought made or threatened by a third party against us relating to or in connection with your use of any content or material available on Website (including without limitation the Media) in breach of these Terms.
Payment details: When you subscribe for a service you must provide us with complete and accurate payment information. By submitting payment details you promise that you are entitled to purchase a subscription using those payment details. If we do not receive payment authorization or any authorization is subsequently cancelled, we may immediately terminate or suspend your access to your subscription and in circumstances that we reasonably deem to be suspicious, we may contact the issuing bank/payment provider and/or law enforcement authorities/other appropriate third parties, to the extent relevant and proportionate in the context. If you are entitled to a refund under these Terms (please see "cancellations by you and refunds" section below) we will credit that refund to the card or other payment method you used to submit payment, unless it has expired in which case we will contact you. If you buy a subscription pass using a corporate credit card then we will treat your subscription as being for the benefit of both you and the relevant company.
Pricing: The subscription price [including any applicable taxes] will be made clear to you on our sign-up pages or otherwise during the sign-up process and may vary from time to time or by country. You agree to pay the fees at the rates notified to you at the time you take out your subscription or purchase your temporary access pass. Other subscription services may only require a one-off payment. You can also take out any other fixed term or payment frequency that we may offer from time to time via our website or by direct notification to you. Shuem International will charge you in british pounds sterling, united states dollars, euros, singapore dollars, australian dollars, hong kong dollars, swiss francs or japanese yen depending on the service that you wish to purchase and your country of residence. The currency in which you will be charged will be made clear to you prior to the completion of your sign-up. You will also have to pay any applicable currency conversion charges. Eligibility for any discounts is ascertained at the time you subscribe and cannot be changed during the term of your subscription. We will always notify you in advance of any increase in the price of your subscription and offer you an opportunity to cancel it if you do not wish to pay the new price.
Pricing errors: If we incorrectly state a price to you whether online or otherwise, we are not obliged to provide you with a subscription at that price, even if we have mistakenly accepted your offer to buy a subscription at that price, and reserve the right to subsequently notify you of any pricing error. If we do this, you may cancel the subscription without any obligation to us and we will refund you any money you have paid us in full or you may pay the correct price. If you refuse to exercise either of these choices then we may cancel your subscription and will refund you any money you have paid us in full. We will always act in good faith in determining whether a genuine pricing error has occurred.
Other costs: In addition to any subscription or fees you pay, you are responsible for paying any internet connection or other telecommunications charges that you may incur by accessing Website or using the services available on it. For example, if you use any of our mobile services then your network operator may charge you for data or messaging services.
Renewals: By paying annually, unless you notify us before the expiry of your annual subscription period that you no longer wish to receive it, your annual subscription will renew automatically for another year. We will charge the then current subscription fee using the same card or other payment method that you previously used. We will notify you in advance of any changes to the price in your subscription that will apply upon renewal.
Cancellations by you and refunds : You may cancel your subscription at any time up to the point at which 30 days has expired from the date of your initial payment for your then current subscription. Otherwise you may not cancel your subscription or any part of it until the end of your then current subscription period. This means that you are not entitled to a refund once we have started providing any part of your subscription to you, except in the limited circumstances which are referred to in these Terms. Where you notify us of your intention to cancel after the expiry of 30 days from the date of payment for your subscription, such notice will only take effect at the end of your then current subscription period and any payments due for your then current subscription period will be charged to you using the same card or other payment method that you initially used.. You may notify us of your wish to cancel your subscription by email to firstname.lastname@example.com.
If within 30 days of the date of first payment for your then current subscription you have used any gift or voucher coupon or downloaded any digital content or redeemed or otherwise used any gift material received by you as part of your subscription sign up you will have elected to forego your right of cancellation and there will be no refunds or exchanges allowed in respect of your subscription.
Cancellations by us: Shuem International reserves the right to suspend or terminate your subscription if you materially breach these Terms, with or without notice and without further obligation to you. You will not be entitled to any refund in these circumstances. If however we terminate or suspend your subscription for any other reason and/or permanently cease publishing Website and/or the Media or cease to provide subscription services then, unless there are exceptional circumstances, we will provide you with a pro rata refund to your credit card, which means that we will refund you with any amounts that you have paid us in advance that relate to any remaining and unexpired period of your subscription.
6. Choice of law and jurisdiction
If you are a user whose principal address or principal use of Website occurs in any jurisdiction other than the united states then these Terms will be subject to irish law and you agree that the Courts of Seychelles will (subject to the final paragraph in this section 6) have non-exclusive jurisdiction to settle any dispute which may arise out of, under, or in connection with these Terms.
If you are a user whose principal address or principal use of Website occurs in the United States then these Terms will be subject to the laws of the State of New Yor and you agree that the courts of the state of New York will (subject to the final paragraph in this section 6) have non-exclusive jurisdiction to settle any dispute which may arise out of, under, or in connection with these Terms.
For the exclusive benefit of Shuem International and to the extent possible in the applicable jurisdiction, Shuem International will retain the right to bring or enforce proceedings as to the substance of the matter in the courts of the country of your residence or, where these Terms are entered into in the course of your trade or profession, the country of the place of business in which you agreed to these Terms or (if different) the country of your principal place of business.
7. General
You may not license or transfer any of your rights under these Terms. We may transfer any of our rights or obligations under these Terms to any company within Shuem International group of companies but if we do so we will ensure that any company to whom we transfer our rights or obligations will continue to honor your rights under them.
If any provision of these Terms is found to be invalid or unenforceable by any court or body having competent jurisdiction or by virtue of any legislation, it will be invalid or unenforceable to that extent only and will not affect the validity and enforceability of the remaining provisions of these Terms, which will remain in full force and effect.
Failure or delay by either party to exercise any right or remedy under these Terms does not constitute a waiver of that right or remedy or any subsequent rights or remedies. Nor will any single or partial exercise or waiver of any right or remedy provided under these Terms or by law prejudice its further exercise or the exercise of any other right or remedy.
Headings in these Terms are for convenience only and will have no legal meaning or effect.
Website is best viewed with one of our supported browsers. Any payment information you send to us over the internet is encrypted using 128 bit secure socket layer technology. Ssl is currently the preferred method to securely transfer credit card data over the internet.
8. Corporate information
Shuem Inc.
No. 209953
103 Sham Pen Tong Plaza, Victoria, Mahe, Seychelles
9. Changes to terms and conditions
These Terms were published in September 2019 and replace with immediate effect any previous Terms


text:
Title | Erin Adams and Dalyn Marthaler wearing masks, treat golden eagle |
Creator | Marthaler, Buz |
Date | 2020-04-09 |
Spatial Coverage | Ogden, Weber County, Utah, United States |
Subject | Masks; Wildlife rescue; Golden eagle; COVID-19 (Disease)--Prevention |
Description | "Hard to social distance when you are a health care specialist, human or otherwise. Wildlife Specialists at Wildlife Rehabilitation Center of Northern Utah (WRCNU) continue to support over 200 wildlife patients while accepting new patients each day. Erin Adams, Wildlife Specialist (Lt) and DaLyn Marthaler, Exec. Dir / Wildlife Specialist (Rt) are shown here providing necessary daily "PT" for "Phoenix" the WRCNU's Golden Eagle Ambassador. Photo taken 4/9/2020 by Buz Marthaler, Chair / Finance / Wildlife Specialist; Ogden UT." |
Collection Number and Name | Utah COVID-19 Photograph Project |
Type | Image |
Genre | born digital |
Format | image/jpeg |
Language | eng |
Rights | |
Rights Holder | Buz Marthaler |
Access Rights | Permission to publish has been granted to the Marriott Library by the rights holder of this work. Unless otherwise specified, the rights holder retains copyright of this work. |
Note | The views and opinions expressed are solely those of the author, and do not reflect any views, opinions, or official policy of the University of Utah or the J. Willard Marriott Library. |
ARK | ark:/87278/s6tf5707 |
Setname | uum_uc19 |
Reference URL | https://collections.lib.utah.edu/ark:/87278/s6tf5707 |

subset: commoncrawl


text:
Tag Archives: garden designer Rebecca Sweet
consider the leaves
We have Pam at Digging to thank for hosting this monthly celebration of foliage. This month I'm focusing on some of the leaves that impressed me during recent garden travels as well as examples from the back pages of AGO. … Continue reading
Posted in agaves, woody lilies, artists, design, garden travel, garden visit, MB Maher, pots and containers, succulents
Tagged Acacia pendula, Aloe striatula, Bernard Trainor, bromeliads, CA, conservatories, Garden Bloggers Fling 2013, garden designer Dustin Gimbel, garden designer Rebecca Sweet, Golden Gate Park Conservatory of Flowers, Hakonechloa macra, Huntington Botanical Gardens, Landcraft Environments, landscape architect Jarrod Baumann, Long Island, Longhouse Reserve, Lysimachia nummularia, Muehlenbeckia axillaris, New York, Planting Fields Arboretum, San Francisco, Zingiber malaysianum
12 Comments


text:
By Joe Swift
The series of five basic kata called Pinan (later renamed Heian in Japan) are probably the most widely practiced kata in karate today. It is commonly understood that they were developed by Anko (or Yasutsune) Itosu (1832-1915) in around 1907 for inclusion in the karate curriculum of the Okinawan school system. However, the actual history of the Pinan series has been the subject of intense curiosity as of late. There are basically two schools of thought, one that Anko Itosu (1) developed them from the older classical forms that were cultivated in and around the Shuri (capital of Okinawa) area, and the other that Itosu was re-working a longer Chinese form called Channan.
Unfortunately, most of the written references to the Channan/Pinan phenomenon in the English language are basically re-hashes of the same uncorroborated oral testimony. This article will examine the primary literature written by direct students of Itosu, as well as more recent research in the Japanese language, in an effort to solve the "mystery" of Channan.
Anko Itosu
In order to understand the Pinan phenomenon, perhaps it is best to start off with a capsule biography of their architect, Anko Itosu (1832-1915). Many sources state that Itosu was born in the Yamakawa section of Shuri (Bishop, 1999; Okinawa Prefecture, 1994; Okinawa Prefecture, 1995), however, noted Japanese martial arts historian Tsukuo Iwai states that he was actually born in Gibo, Shuri, and later relocated to Yamakawa (Iwai, 1992). He is commonly believed to have studied under Sokon ("Bushi") Matsumura (1809-1901), but also appears to have had other influences, such as Nagahama of Naha (Iwai, 1992; Motobu, 1932), Kosaku Matsumora of Tomari and a master named Gusukuma (Nihon Karate Kenkyukai, 1956). There does not seem to be much detail about Itosu's early life, except for the fact that he was a student of the Ryukyuan civil fighting traditions. At around age 23, he passed the civil service examinations and was employed by the Royal government (Iwai, 1992). It seems as if Itosu gained his position as a clerical scribe for the King through an introduction by his friend and fellow karate master Anko Asato (Funakoshi, 1988). Itosu stayed with the Royal government until the Meiji Restoration, when the Ryukyu Kingdome became Okinawa Prefecture. Itosu stayed on and worked for the Okinawan Prefectural government until 1885 (Iwai, 1992).
There is some controversy as to when Itosu became a student of Matsumura. Some say that he first met Matsumura when Itosu was in his late 20s (Iwai, 1992), whereas others maintain that Itosu was older than 35 when he began studying from Matsumura (Fujiwara, 1990). Matsumura appears to have been friendly with Itosu's father (Iwai, 1992).
Be that as it may, Itosu is said to have mastered the Naifuanchi kata (Nihon Karate Kenkyukai, 1950; Okinawa Pref., 1995). In fact, one direct student of Itosu, namely Funakoshi Gichin, recalled 10 years of studying nothing but the three Naifuanchi kata under the eminent master (Funakoshi, 1976) (2).
Again, there is some controversy as to where Itosu learned the Naifuanchi kata. Some give credit to Matsumura for teaching this kata to Itosu (Murakami, 1991). However, others say differently, and here is where we first start to see reference to Channan, as the name of a person. It is said that a Chinese sailor who was shipwrecked on Okinawa hid in a cave at Tomari. It was from this man that Itosu supposedly learned the Naifuanchi kata, among other things (Gima, et al, 1986).
In either case, it is known that Itosu was among the first to teach karate (toudi) publicly, karate having previously been taught and practiced in secrecy for hundreds of years. Itosu began his public teaching pf karate as physical education in the school system as early as 1901, where he taught at the Shuri Jinjo Primary School (Iwai, 1992; Okinawa Pref., 1994). He also went on to teach at Shuri Dai-ichi Middle School and the Okinawa Prefectural Men's Normal School in 1905 (Bishop, 1999; Okinawa Pref., 1994, 1995).
In addition to his "spearheading a crusade" (McCarthy, 1996) to modernize toudi practices and get it taught in the school system, Itosu was also known for his physical strength. It is said that he was able to crush a bamboo stalk in his hands (Funakoshi, 1976, 1988), once wrestled a raging bull to the ground and calmed it (Nagamine, 1986) and one could strike his arms with 2-inch thick poles and he would not budge (Iwai, 1992).
Itosu's unique contributions to the art of Karate-do include not only his 1908 letter to the Japanese Ministry of Education and Ministry of War (3), expounding on the 10 precepts of Toudi training, but also the creation of several kata. These include not only the Pinan series, but also Naifuanchi Nidan and Sandan (Kinjo, 1991; Murakami, 1991), and possibly Kusanku Sho and Passai Sho (Iwai, 1992). Another kata that has often been attributed to Itosu is the Shiho Kusanku Kata (Kinjo, 1956a; Mabuni et al, 1938), but more recent evidence points to the actual originator of this paradigm to have been Mabuni Kenwa himself (Sells, 1995).
In addition to creating several kata, the other kata that Itosu taught, such as Chinto, Useishi (Gojushiho), Passai Dai, and Kusanku Dai, etc., were changed from their original guises, in order to make them more palatable to his physical education classes (Kinjo, 1991).
Itosu Anko passed away in March 1915, leaving behind a legacy that very few today even recognize or comprehend.
Early Written References to Channan and Pinan
References to Channan can be found as far back as 1934. In the karate research journal entitled Karate no Kenkyu, published by Nakasone Genwa, Motobu Choki is quoted referring to the Channan and the Pinan kata:
"(Sic.) I was interested in the martial arts since I was a child, and studied under many teachers. I studied with Itosu Sensei for 7-8 years. At first, he lived in Urasoe, then moved to Nakashima Oshima in Naha, then on to Shikina, and finally to the villa of Baron Ie. He spent his final years living near the middle school.
I visited him one day at his home near the school, where we sat talking about the martial arts and current affairs. While I was there, 2-3 students also dropped by and sat talking with us. Itosu Sensei turned to the students and said 'show us a kata.' The kata that they performed was very similar to the Channan kata that I knew, but there were some differences also. Upon asking the student what the kata was, he replied 'It is Pinan no Kata.' The students left shortly after that, upon which I turned to Itosu Sensei and said 'I learned a kata called Channan, but the kata that those students just performed now was different. What is going on?' Itosu Sensei replied 'Yes, the kata is slightly different, but the kata that you just saw is the kata that I have decided upon. The students all told me that the name Pinan is better, so I went along with the opinions of the young people.' These kata, which were developed by Itosu Sensei, underwent change even during his own lifetime." (Murakami, 1991; 120)
There is also reference to Pinan being called Channan in its early years in the 1938 publication Kobo Kenpo Karatedo Nyumon by Mabuni Kenwa and Nakasone Genwa. Mabuni and Nakasone write that those people who learned this kata as Channan still taught it under that name (Mabuni, et al, 1938).
Hiroshi Kinjo , one of Japan's most senior teachers and historians of the Okinawan fighting traditions, and a direct student of three of Itosu's students, namely Chomo Hanashiro, Chojo Oshiro, and Anbun Tokuda, wrote a series of articles on the Pinan kata in Gekkan Karatedo magazine in the mid-1950s. In the first installment he maintains that the Pinan kata were originally called Channan, and there were some technical differences between Channan and the updated versions known as Pinan (Kinjo, 1956a).
Again according to Hiroshi Kinjo, Hisateru Miyagi, a former student of Itosu who graduated from the Okinawa Prefectural Normal School in 1916, stated that when he was studying under the old master, Itosu only really taught the first three Pinan with any real enthusiasm, and that the last two seem to have been rather neglected at that time (Kinjo, 1956b). Although one can speculate about what this means, it is nevertheless a very interesting piece of testimony by someone who was "there."
Ryusho Sakagami, in his 1978 Karatedo Kata Taikan as well as Tokumasa Miyagi in his 1987 Karate no Rekishi both give extensive kata lists, and both list a kata known as Yoshimura no Channan (Miyagi, 1987; Sakagami, 1978). It is unknown who Yoshimura was, but he may have been a student of Itosu.
American karate historian Ernest Estrada has also stated that Juhatsu Kyoda (1887-1968), a direct student of Kanryo Higashionna, Xianhui Wu (Jpn. Go Kenki), Kentsu Yabu, etc. and the founder of the To'onryu karatedo system, also knew and taught a series of two basic blocking, punching and kicking exercises known as Channan (Estrada, 1998).
Shiraguma no Kata
According to Tsukuo Iwai, one of Japan's most noted Budo researchers and teacher of Choki Motobu's karate in Gunma Prefecture, Motoburyu Karatejutsu, which is being preserved by Choki's son, Chosei Motobu, in Osaka, contains what is known as Shiraguma no Kata, which he maintains used to be called Channan. He also states that this kata is "somewhat similar to the Pinan, yet different." (Iwai, 1997).
The Other Side of the Coin
The flip side to this theory states that Itosu did not create the Pinan kata, but actually remodeled older Chinese-based hsing/kata called Channan. This theory states that Itosu learned a series of Chinese Quan-fa hsing from a shipwrecked Chinese at Tomari, and reworked them into five smaller components, re-naming them Pinan because the Chinese pronunciation "Chiang-Nan" was too difficult (Bishop, 1999).
It has been argued that the source for these Channan kata was a Chinese from an area called Annan, or a man named Annan (Bishop, 1999). On the other hand, others say that the man's name was Channan (Iwai, 1992). Still others go into even more detail, stating that Itosu learned these hsing/kata from a man named Channan, and named them after their source, later adding elements of the Kusanku Dai kata to create the Pinan (Gima, et al, 1986; Kinjo. 1999).
There is also interesting oral testimony passed down in the Tomari-di tradition that is propagated in the Okinawa Gojuryu Tomaridi Karatedo Association of Iken Tokashiki that states that Itosu learned the Channan/Pinan kata from a Chinese at Tomari in one day. The proponents of Tomari-di said that there was no need to learn "over-night kata" and that this is the reason that the Tomari traditions did not include instruction in the Pinan kata (Okinawa Pref., 1995).
This sentiment also echoes the statement by one of Itosu's top students, Yabu Kentsu, made to his students:
"(sic) If you have time to practice the Pinan, practice Kushanku instead (Gima, et al, 1986, p. 86)."
While more research, such as in-depth technical analysis of Motobu's Shiraguma no Kata, needs to be done, the evidence at hand seems to point not to a "long lost kata" but rather to the constant and inevitable evolution of a martial art.
Although there is opposition, most of the primary written materials point to the fact that Itosu was indeed the originator of the Channan/Pinan tradition, based upon his own research, experience, and analyses. However, in either case, Anko Itosu and his efforts left a lasting mark on the fighting traditions of old Okinawa, and will probably always be remembered as one of the visionaries who were able to lift the veil of secrecy that once enshrouded karatedo.
© 2000, by Joe Swift. Posted with permission of the author.
1- Japanese names in this article are listed by given name first and family name second instead of customary Japanese usage which places the family name first.
2- According to noted Japanese martial arts historian Ryozo Fujiwara in his 1990 book entitled "Kakutogi no Rekish" (History of the Martial Arts), Funakoshi first learned Pechurin (Suparinpei) under Taite Kojo, then Kusanku under Anko Asato, and finally Naifuanchi under Itosu.
3- For a comprehensive English translation of this letter, see (McCarthy, 1990)
The Itosu drawing was contributed by Kyoshi Frank Hargrove from his book, The 100 Year History of Shorin-Ryu Karate. Since there are no know photos of Itosu, the drawing was a composite done in Okinawa based on available descriptions.
The Funakoshi photo was reproduced from his 1935 book, Karatedo Kyohan.
The Motobu photo was reproduced from his 1926 book, Okinawa Kempo: Karate Jutsu on Kumite.
Bishop, M. (1999) Okinawan Karate: Teachers, Styles and Secret Techniques, 2nd Edition. Boston: Charles E. Tuttle, Co.
Estrada, E. (1998). Personal Communication: Kyoda and Channan.
Fujiwara, R. (1990). Kakutogi no Rekishi (History of Martial Arts). Tokyo: Baseball Magazine.
Funakoshi G. (1976) Karatedo: My Way of Life. Tokyo: Kodansha International.
Funakoshi G. (1988) Karatedo Nyumon. Tokyo: Kodansha International. Tr. by John Teramoto.
Gima S. and Fujiwara R. (1986) Taidan: Kindai Karatedo no Rekishi wo Kataru (Talks on the History of Modern Karatedo). Tokyo: Baseball Magazine.
Iwai T. (1992). Koden Ryukyu Karatejutsu (Old-Style Ryukyu Karatejutsu). Tokyo: Airyudo.
Iwai T. (1997) Personal Communication: Shiraguma no Kata.
Kinjo A. (1999) Karate-den Shinroku (True Record of Karate's Transmission). Naha: Okinawa Tosho Center.
Kinjo H. (1956a). "Pinan no Kenkyu (Study of Pinan) Part 1." Gekkan Karatedo June 1956. Tokyo: Karate Jiho-sha.
Kinjo H. (1956b). "Pinan no Kenkyu (Study of Pinan) Part 2." Gekkan Karatedo August 1956. Tokyo: Karate Jiho-sha.
Kinjo H. (1991) Yomigaeru Dento Karate 1 Kihon (Return to Traditional Karate Vol. 1, Basic Techniques) - video presentation. Tokyo: Quest, Ltd.
Mabuni K. and Nakasone G. (1938) Karatedo Nyumon (Introduction to Karatedo). Tokyo: Kobukan.
McCarthy, P. (1996) "Capsule History of Koryu Karate." Koryu Journal Inaugural Issue. Australia, International Ryukyu Karate Research Society.
McCarthy, P. (1999) Ancient Okinawan Martial Arts: Koryu Uchinadi, Vol. 2. Boston: Charles E. Tuttle, Co.
Miyagi T. (1987) Karate no Rekishi (The History of Karate). Naha: Hirugisha.
Motobu C. (1932) Watashi no Toudijutsu (My Karate). Tokyo: Toudi Fukyukai.
Murakami K. (1991). Karate no Kokoro to Waza (The Spirit and Technique of Karate). Tokyo: Shin Jinbutsu Oraisha.
Nagamine S. (1986) Okinawa no Karate Sumo Meijin Den (Tales of Okinawa's Great Karate and Sumo Masters). Tokyo: Shin Jinbutsu Oraisha.
Nihon Karate Kenkyukai (1956) Zoku: Karatedo Nyumon (Introduction to Karatedo: Continued). Tokyo: Wakaba Shobo.
Okinawa Prefecture Board of Education (1994). Karatedo Kobudo Kihon Chosa Hokokusho (Report of Basic Research on Karatedo and Kobudo). Naha: Nansei.
Okinawa Prefecture Board of Education (1995). Karatedo Kobudo Kihon Chosa Hokokusho II (Report of Basic Research on Karatedo and Kobudo Part II). Naha: Nanasei.
Sakagami R. (1978) Karatedo Kata Taikan (Encyclopedia of Karatedo Kata. Tokyo: Nichibosha.
Sells, J. (1995) Unante: Secrets of Karate. Hollywood: Hawley.
About The Author:
Joe Swift, native of New York State (USA) has lived in Japan since 1994. He holds a dan-rank in Isshinryu Karatedo, and also currently acts as assistant instructor (3rd dan) at the Mushinkan Shoreiryu Karate Kobudo Dojo in Kanazawa, Japan. He is also a member of the International Ryukyu Karate Research Society and the Okinawa Isshinryu Karate Kobudo Association. He currently works as a translator/interpreter for the Ishikawa International Cooperation Research Centre in Kanazawa. He is also a Contributing Editor for FightingArts.com.
To find more articles of interest, search on one of these keywords: Pinan, Heian, Channan, Anko Itosu, Motobu Choki, Pinan no Kata, Shiraguma no Kata, Annan
Read more articles by Joe Swift
Return to Kata And Applications
Return to the Main Reading Room
Advertising Information Feedback Home Forums Reading Room Estore About Us
Copyright © 2017 - 2030 FightingArts.com a division of eCommunities LLC. All rights reserved. Use of this website is governed by the Terms of Use . Privacy Statement
Ryukyu Art Artifacts from the Ryukyu Kingdom missing since WWII. Visit www.ShisaLion.Org to view pictures
Best Stun Guns Self Defense Products-stun guns, pepper spray, tasers and more
Surveillance 4U Complete surveillance systems for covert operations or secure installation security
Asylum Images Book presents photo tour of the Trans-Allegany Lunatic Asylum. A must if you're going to take a ghost tour!


text:
This delicious heart charm bracelet is a perfect gift for so many occasions, from an everyday treat, to a thankyou gift to someone special. It is handmade in Britain & a very unique gift to send, or even to keep for yourself. The charm bracelet is presented in a beautiful transparent packet with gift envelope.
The jewellery will come packaged on stylish frosted cards with an envelope for the perfect no-hassle gift. You can choose from various greetings to be printed on the envelope or even personilise it. When typing your message, please ensure your spelling is correct. All text will be in upper case & we will print your text exactly as it appears.
The charms are made from a flexible vinyl sheet and gold foil which is very lightweight & delicate yet very durable, hung on a gold plated bracelet with expander chain. Store Flat, clean with soapy warm water only. Keep away from newly dyed fabrics such as dark denim.
Bracelet min 16cm max 19cm circumference approx.


text:
RFC 7165 JOSE Use Cases April 2014 Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Basic Requirements . . . . . . . . . . . . . . . . . . . . . 5 4. Requirements on Application Protocols . . . . . . . . . . . . 6 5. Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . 7 5.1. Security Tokens . . . . . . . . . . . . . . . . . . . . . 7 5.2. OAuth . . . . . . . . . . . . . . . . . . . . . . . . . . 7 5.3. OpenID Connect . . . . . . . . . . . . . . . . . . . . . 9 5.4. XMPP . . . . . . . . . . . . . . . . . . . . . . . . . . 10 5.5. ALTO . . . . . . . . . . . . . . . . . . . . . . . . . . 12 5.6. Emergency Alerting . . . . . . . . . . . . . . . . . . . 13 5.7. Web Cryptography . . . . . . . . . . . . . . . . . . . . 15 5.8. Constrained Devices . . . . . . . . . . . . . . . . . . . 16 5.8.1. Example: MAC Based on ECDH-Derived Key . . . . . . . 16 5.8.2. Object Security for CoAP . . . . . . . . . . . . . . 17 6. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 18 6.1. Functional Requirements . . . . . . . . . . . . . . . . . 18 6.2. Security Requirements . . . . . . . . . . . . . . . . . . 19 6.3. Desiderata . . . . . . . . . . . . . . . . . . . . . . . 20 7. Security Considerations . . . . . . . . . . . . . . . . . . . 20 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 21 8.1. Normative References . . . . . . . . . . . . . . . . . . 21 8.2. Informative References . . . . . . . . . . . . . . . . . 21 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 25 Barnes Informational [Page 2]
RFC 7165 JOSE Use Cases April 2014 indicated that different applications hoping to use the formats defined by JOSE have different requirements. This document summarizes the use cases for JOSE envisioned by those potential applications and the resulting requirements for security mechanisms and object encodings. Some systems that use XML have specified the use of XML-based security mechanisms for object security, namely XML Digital Signatures and XML Encryption [W3C.xmldsig-core] [W3C.xmlenc-core]. These mechanisms are used by several security token systems (e.g., Security Assertion Markup Language (SAML) [OASIS.saml-core-2.0-os], Web Services Federation [WS-Federation]), and the Common Alerting Protocol (CAP) emergency alerting format [CAP]. In practice, however, XML-based secure object formats introduce similar levels of complexity to ASN.1 (e.g., due to the need for XML canonicalization), so developers that lack the tools or motivation to handle ASN.1 aren't likely to use XML security either. This situation motivates the creation of a JSON-based secure object format that is simple enough to implement and deploy that it can be easily adopted by developers with minimal effort and tools. 2. Definitions This document makes extensive use of standard security terminology [RFC4949]. In addition, because the use cases for JOSE and CMS are similar, we will sometimes make analogies to some CMS concepts [RFC5652]. The JOSE working group charter calls for the group to define three basic JSON object formats: 1. Integrity-protected object format 2. Confidentiality-protected object format 3. A format for expressing keys In this document, we will refer to these as the "signed object format", the "encrypted object format", and the "key format", respectively. The JOSE working group items intended to describe these formats are JSON Web Signature [JWS], JSON Web Encryption [JWE], and JSON Web Key [JWK], respectively. Algorithms and algorithm identifiers used by JWS, JWE, and JWK are defined in JSON Web Algorithms [JWA]. In general, where there is no need to distinguish between asymmetric and symmetric operations, we will use the terms "signing", "signature", etc., to denote both true digital signatures involving Barnes Informational [Page 4]
RFC 7165 JOSE Use Cases April 2014 asymmetric cryptography as well as Message Authentication Codes (MACs) using symmetric keys. In the lifespan of a secure object, there are two basic roles, an entity that creates the object (e.g., encrypting or signing a payload) and an entity that uses the object (decrypting and verifying). We will refer to these roles as "sender" and "recipient", respectively. Note that while some requirements and use cases may refer to these as single entities, each object may have multiple entities in each role. For example, a message may be signed by multiple senders or decrypted by multiple recipients. 3. Basic Requirements For the encrypted and signed object formats, the necessary protections will be created using appropriate cryptographic mechanisms: symmetric or asymmetric encryption for confidentiality and MACs or digital signatures for integrity protection. In both cases, it is necessary for the JOSE format to support both symmetric and asymmetric operations. o The JOSE encrypted object format must support object encryption in the case where the sender and receiver share a symmetric key. o The JOSE encrypted object format must support object encryption in the case where the sender has only a public key for the receiver. o The JOSE signed object format must support integrity protection using MACs, for the case where the sender and receiver share only a symmetric key. o The JOSE signed object format must support integrity protection using digital signatures, for the case where the receiver has only a public key for the sender. In some applications, the key used to process a JOSE object is indicated by application context, instead of directly in the JOSE object. However, in order to avoid confusion, endpoints that lack the necessary context need to be able to recognize this and fail cleanly. Other than keys, JOSE objects do not support pre- negotiation; all cryptographic parameters must be expressed directly in the JOSE object. o The JOSE signed and encrypted object formats must define the process by which an implementation recognizes whether it has the key required to process a given object, whether the key is specified by the object or by some out-of-band mechanism. Barnes Informational [Page 5]
RFC 7165 JOSE Use Cases April 2014 o Each algorithm used for JOSE must define which parameters are required to be present in a JOSE object using that algorithm. In cases where two entities are going to be exchanging several JOSE objects, it might be helpful to pre-negotiate some parameters so that they do not have to be signaled in every JOSE object. However, so as not to confuse endpoints that do not support pre-negotiation, it is useful to signal when pre-negotiated parameters are in use in those cases. o It should be possible to extend the base JOSE signed and encrypted object formats to indicate that pre-negotiated parameters are to be used to process the object. This extension should also provide a means of indicating which parameters are to be used. The purpose of the key format is to provide the recipient with sufficient information to use the encoded key to process cryptographic messages. Thus, it is sometimes necessary to include additional parameters along with the bare key. o The JOSE key format must enable inclusion of all algorithm parameters necessary to use the encoded key, including an identifier for the algorithm with which the key is used as well as any additional parameters required by the algorithm (e.g., elliptic curve parameters). 4. Requirements on Application Protocols The JOSE secure object formats describe how cryptographic processing is done on secured content, ensuring that the recipient of an object is able to properly decrypt an encrypted object or verify a signature. In order to make use of JOSE, however, applications will need to specify several aspects of how JOSE is to be used: o What application content is to be protected o Which cryptographic algorithms are to be used o How application protocol entities establish keys o Whether keys are to be explicitly indicated in JOSE objects or associated by application context o Which serialization(s) of JOSE objects are to be used Barnes Informational [Page 6]
RFC 7165 JOSE Use Cases April 2014 5. Use Cases Several IETF working groups developing application-layer protocols have expressed a desire to use the JOSE data formats in their designs for end-to-end security features. In this section, we summarize the use cases proposed by these groups and discuss the requirements that they imply for the JOSE object formats. 5.1. Security Tokens Security tokens are a common use case for object-based security, for example, SAML assertions [OASIS.saml-core-2.0-os]. Security tokens are used to convey information about a subject entity ("claims" or "assertions") from an issuer to a recipient. The security features of a token format enable the recipient to verify that the claims came from the issuer and, if the object is confidentiality protected, that they were not visible to other parties. Security tokens are used in federation protocols such as SAML 2.0 [OASIS.saml-core-2.0-os], WS-Federation [WS-Federation], Mozilla Persona [Persona], and OpenID Connect [OpenID.Core], as well as in resource authorization protocols such as OAuth 2.0 [RFC6749], including for OAuth bearer tokens [RFC6750]. In some cases, security tokens are used for client authentication and for access control [JWT-BEARER] [SAML2]. JSON Web Token [JWT] is a security token format based on JSON and JOSE. It is used with Mozilla Persona, OpenID Connect, and OAuth. Because JWTs are often used in contexts with limited space (e.g., HTTP query parameters), it is a core requirement for JWTs, and thus JOSE, to have a compact, URL-safe representation. 5.2. OAuth The OAuth protocol defines a mechanism for distributing and using authorization tokens using HTTP [RFC6749]. A client that wishes to access a protected resource requests authorization from the resource owner. If the resource owner allows this access, he directs an authorization server to issue an access token to the client. When the client wishes to access the protected resource, he presents the token to the relevant resource server, which verifies the validity of the token before providing access to the protected resource. Barnes Informational [Page 7]
RFC 7165 JOSE Use Cases April 2014 +---------------+ +---------------+ | | | | | Resource |<........>| Authorization | | Server | | Server | | | | | +---------------+ +---------------+ ^ | | | | | | | | | +------------|--+ +--|------------+ | +----------------+ | | | | Resource | | Client | | Owner | | | | | +---------------+ +---------------+ Figure 1: The OAuth Process In effect, this process moves the token from the authorization server (as a sender of the object) to the resource server (recipient) via the client as well as the resource owner (the latter because of the HTTP mechanics underlying the protocol). As with email, we have a case where an application object is transported via untrusted intermediaries. This application has two essential security requirements: integrity and data origin authentication. Integrity protection is required so that the resource owner and the client cannot modify the permission encoded in the token. Although the resource owner is ultimately the entity that grants authorization, it is not trusted to modify the authorization token, since this could, for example, grant access to resources not owned by the resource owner. Data origin authentication is required so that the resource server can verify that the token was issued by a trusted authorization server. Confidentiality protection may also be needed if the authorization server is concerned about the visibility of permissions information to the resource owner or client. For example, permissions related to social networking might be considered private information. Note, however, that OAuth already requires that the underlying HTTP transactions be protected by TLS, so tokens are already confidentiality protected from entities other than the resource owner and client. Barnes Informational [Page 8]
RFC 7165 JOSE Use Cases April 2014 The confidentiality and integrity needs are met by the basic requirements for signed and encrypted object formats, whether the signing and encryption are provided using asymmetric or symmetric cryptography. The choice of which mechanism is applied will depend on the relationship between the two servers, namely whether they share a symmetric key or only public keys. Authentication requirements will also depend on deployment characteristics. Where there is a relatively strong binding between the resource server and the authorization server, it may suffice for the authorization server issuing a token to be identified by the key used to sign the token. This requires that the protocol carry either the public key of the authorization server or an identifier for the public or symmetric key. In OAuth, the "client_id" parameter (external to the token) identifies the key to be used. There may also be more advanced cases where the authorization server's key is not known in advance to the resource server. This may happen, for instance, if an entity instantiated a collection of authorization servers (say for load balancing), each of which has an independent key pair. In these cases, it may be necessary to also include a certificate or certificate chain for the authorization server, so that the resource server can verify that the authorization server is an entity that it trusts. The HTTP transport for OAuth imposes a particular constraint on the encoding. In the OAuth protocol, tokens frequently need to be passed as query parameters in HTTP URIs [RFC2616] after having been base64url encoded [RFC4648]. While there is no specified limit on the length of URIs (and thus of query parameters), in practice, URIs of more than 2,048 characters are rejected by some user agents. So this use case requires that JOSE objects be sufficiently small, even after being signed and possibly encrypted. 5.3. OpenID Connect The OpenID Connect protocol [OpenID.Core] is a simple, REST/JSON- based identity federation protocol layered on OAuth 2.0. It uses the JWT and JOSE formats both to represent security tokens and to provide security for other protocol messages (performing signing and optionally encryption). OpenID Connect negotiates the algorithms to be used and distributes information about the keys to be used using protocol elements that are not part of the JWT and JOSE header parameters. In the OpenID Connect context, it is possible for the recipient of a JWT to accept it without integrity protection in the JWT itself. In such cases, the recipient chooses to rely on transport security Barnes Informational [Page 9]
RFC 7165 JOSE Use Cases April 2014 rather than object security. For example, if the payload is delivered over a TLS-protected channel, the recipient may regard the protections provided by TLS as sufficient, so JOSE protection would not be required. However, even in this case, it is desirable to associate some metadata with the JWT payload (claim set), such as the content type, or other application-specific metadata. In a signed or encrypted object, these metadata values could be carried in a header with other metadata required for signing or encryption. It would thus simplify the design of OpenID Connect if there could be a JOSE object format that does not apply cryptographic protections to its payload, but allows a header to be attached to the payload in the same way as a signed or encrypted object. 5.4. XMPP The Extensible Messaging and Presence Protocol (XMPP) routes messages from one end client to another by way of XMPP servers [RFC6120]. There are typically two servers involved in delivering any given message: The first client (Alice) sends a message for another client (Bob) to her server (A). Server A uses Bob's identity and the DNS to locate the server for Bob's domain (B) and then delivers the message to that server. Server B then routes the message to Bob. +-------+ +----------+ +----------+ +-----+ | Alice |-->| Server A |-->| Server B |-->| Bob | +-------+ +----------+ +----------+ +-----+ Figure 2: Delivering an XMPP Message The untrusted-intermediary problems are especially acute for XMPP because in many current deployments, the holder of an XMPP domain outsources the operation of the domain's servers to a different entity. In this environment, there is a clear risk of exposing the domain holder's private information to the domain operator. XMPP already has a defined mechanism for end-to-end security using S/MIME, but it has failed to gain widespread deployment [RFC3923], in part because of key management challenges and in part because of the difficulty of processing S/MIME objects. The XMPP working group is in the process of developing a new end-to-end encryption system with an encoding based on JOSE and a clearer key management system [XMPP-E2E]. The process of sending an encrypted message in this system involves two steps: First, the sender generates a symmetric Session Master Key (SMK), encrypts the message content (including a per-message Content Master Key), and sends the encrypted message to the desired set of recipients. Barnes Informational [Page 10]
RFC 7165 JOSE Use Cases April 2014 Second, each recipient "dials back" to the sender, providing his public key. The sender then responds with the relevant SMK, wrapped with the recipient's public key. +-------+ +----------+ +----------+ +-----+ | Alice |<->| Server A |<->| Server B |<->| Bob | +-------+ +----------+ +----------+ +-----+ | | | | |------------Encrypted message---------->| | | | | |<---------------Public key--------------| | | | | |---------------Wrapped SMK------------->| | | | | Figure 3: Delivering a Secure XMPP Message The main thing that this system requires from the JOSE formats is confidentiality protection via content encryption, plus an integrity check via a MAC derived from the same symmetric key. The separation of the key exchange from the transmission of the encrypted content, however, requires that the JOSE encrypted object format allow wrapped symmetric keys to be carried separately from the encrypted payload. In addition, the encrypted object will need to have a tag for the key that was used to encrypt the content, so that the recipient (Bob) can present the tag to the sender (Alice) when requesting the wrapped key. Another important feature of XMPP is that it allows for the simultaneous delivery of a message to multiple recipients. In the diagrams above, Server A could deliver the message not only to Server B (for Bob) but also to Servers C, D, E, etc., for other users. In such cases, to avoid the multiple "dial back" transactions implied by the above mechanism, XMPP systems will likely reuse a given SMK for multiple individual messages, refreshing the SMK on a periodic and/or event-driven basis (e.g., when the recipient's presence changes). They might also cache public keys for end recipients, so that wrapped keys can be sent along with content on future messages. This implies that the JOSE encrypted object format must support the provision of multiple versions of the same wrapped SMK (much as a CMS EnvelopedData structure can include multiple RecipientInfo structures). In the current draft of the XMPP end-to-end security system, each party is authenticated by virtue of the other party's trust in the XMPP message routing system. The sender is authenticated to the receiver because he can receive messages for the identifier "Alice" (in particular, the request for wrapped keys) and can originate Barnes Informational [Page 11]
RFC 7165 JOSE Use Cases April 2014 messages for that identifier (the wrapped key). Likewise, the receiver is authenticated to the sender because he received the original encrypted message and originated the request for a wrapped key. So, the authentication here requires not only that XMPP routing be done properly, but also that TLS be used on every hop. Moreover, it requires that the TLS channels have strong authentication, since a man in the middle on any of the three hops can masquerade as Bob and obtain the key material for an encrypted message. Because this authentication is quite weak (depending on the use of TLS on three hops) and unverifiable by the endpoints, it is possible that the XMPP working group will integrate some sort of credentials for end recipients, in which case there would need to be a way to associate these credentials with JOSE objects. Finally, it's worth noting that XMPP is based on XML, not JSON. So by using JOSE, XMPP will be carrying JSON objects within XML. It is thus a desirable property for JOSE objects to be encoded in such a way as to be safe for inclusion in XML. Otherwise, an explicit CDATA indication must be given to the parser to indicate that it is not to be parsed as XML. One way to meet this requirement would be to apply base64url encoding, but for XMPP messages of medium-to-large size, this could impose a fair degree of overhead. 5.5. ALTO Application-Layer Traffic Optimization (ALTO) is a system for distributing network topology information to end devices, so that those devices can modify their behavior to have a lower impact on the network [RFC6708]. The ALTO protocol distributes topology information in the form of JSON objects carried in HTTP [RFC2616] [ALTO]. The basic version of ALTO is simply a client-server protocol, so simple use of HTTPS suffices for this case [RFC2818]. However, there is beginning to be some discussion of use cases for ALTO in which these JSON objects will be distributed through a collection of intermediate servers before reaching the client, while still preserving the ability of the client to authenticate the original source of the object. Even the base ALTO protocol notes that "ALTO Clients obtaining ALTO information through redistribution must be able to validate the received ALTO information" to ensure that it was generated by an appropriate ALTO server. In this case, the security requirements are straightforward. JOSE objects carrying ALTO payloads will need to bear digital signatures from the originating servers, which will be bound to certificates attesting to the identities of the servers. There is no requirement for confidentiality in this case, since ALTO information is generally public. Barnes Informational [Page 12]
RFC 7165 JOSE Use Cases April 2014 The more interesting questions are encoding questions. ALTO objects are likely to be much larger than payloads in the two cases above, with sizes of up to several megabytes. Processing of such large objects can be done more quickly if it can be done in a single pass, which may be possible if JOSE objects require specific orderings of fields within the JSON structure. In addition, because ALTO objects are also encoded as JSON, they are already safe for inclusion in a JOSE object. Signed JOSE objects will likely carry the signed data in a string alongside the signature. JSON objects have the property that they can be safely encoded in JSON strings. All they require is that unnecessary white space be removed, a much simpler transformation than, say, base64url encoding. This raises the question of whether it might be possible to optimize the JOSE encoding for certain "JSON-safe" cases. Finally, it may be desirable for ALTO to have a "detached signature" mechanism, that is, a way to encode signature information separate from the protected content. This would allow the ALTO protocol to include the signature in an HTTPS header, with the signed content as the HTTPS entity body. 5.6. Emergency Alerting Emergency alerting is an emerging use case for IP networks [ALERT-REQ]. Alerting systems allow authorities to warn users of impending danger by sending alert messages to connected devices. For example, in the event of a hurricane or tornado, alerts might be sent to all devices in the path of the storm. The most critical security requirement for alerting systems is that it must not be possible for an attacker to send false alerts to devices. Such a capability would potentially allow an attacker to create wide-spread panic. In practice, alert systems prevent these attacks both by controls on sending messages at points where alerts are originated, and by having recipients of alerts verify that the alert was sent by an authorized source. The former type of control is implemented with local security on hosts from which alerts can be originated. The latter type is implemented by digital signatures on alert messages (using channel-based or object-based mechanisms). With an object-based mechanism, the signature value is encoded in a secure object. With a channel-based mechanism, the alert is "signed" by virtue of being sent over an authenticated, integrity-protected channel. Barnes Informational [Page 13]
RFC 7165 JOSE Use Cases April 2014 Alerts typically reach end recipients via a series of intermediaries. For example, while a national weather service might originate a hurricane alert, it might first be delivered to a national gateway and then to network operators, who broadcast it to end subscribers. +------------+ +------------+ +------------+ | Originator | | Originator | | Originator | +------------+ +------------+ +------------+ | . . +-----------------+.................. | V +---------+ | Gateway | +---------+ | +------------+------------+ | | V V +---------+ +---------+ | Network | | Network | +---------+ +---------+ | | +------+-----+ +------+-----+ | | | | V V V V +--------+ +--------+ +--------+ +--------+ | Device | | Device | | Device | | Device | +--------+ +--------+ +--------+ +--------+ Figure 4: Delivering an Emergency Alert In order to verify alert signatures, recipients must be provisioned with the proper public keys for trusted alert authorities. This trust may be "piece-wise" along the path the alert takes. For example, the alert relays operated by networks might have a full set of certificates for all alert originators, while end devices may only trust their local alert relay. Or, devices might require that a device be signed by an authorized originator and by its local network's relay. This scenario creates a need for multiple signatures on alert documents, so that an alert can bear signatures from any or all of the entities that processed it along the path. In order to minimize complexity, these signatures should be "modular" in the sense that a new signature can be added without a need to alter or recompute previous signatures. Barnes Informational [Page 14]
RFC 7165 JOSE Use Cases April 2014 5.8. Constrained Devices This section describes use cases for constrained devices as defined in [CONSTRAINED]. Typical issues with this type of device are limited memory, limited power supply, low processing power, and severe message size limitations for the communication protocols. 5.8.1. Example: MAC Based on ECDH-Derived Key Suppose a small, low power device maker has decided on using the output of the JOSE working group as their encryption and authentication framework. The device maker has a limited budget for both gates and power. For this reason there are a number of short cuts and design decisions that have been made in order to minimize these needs. The design team has determined that the use of MACs is going to be sufficient to provide the necessary authentication. However, although a MAC is going to be used, they do not want to use a single long-term shared secret. Instead, they have adopted the following proposal for computing a shared secret that can be validated: o An Elliptic-Curve Diffie-Hellman (ECDH) key pair is generated for the device at the time of manufacturing. (Or, as part of the configuration process during installation.) o An ECDH public key for the controller is configured at the time of configuration. o The configuration system performs the ECDH computation and configures the device with the resulting shared secret. This process eliminates the need for the device to be able to perform the required ECDH processing. The security requirements on protecting this computed shared secret are the same as the requirements on protecting the private ECDH key. o A counter and an increment value are configured onto the device. o When a message is to be sent by the device, the counter is incremented and a new MAC key is computed from the ECDH secret and the counter value. A custom Key Derivation Function (KDF) based on AES-CBC is used to derive the required MAC key. The MAC key is then used to compute the MAC value for the message. Barnes Informational [Page 16]
RFC 7165 JOSE Use Cases April 2014 In a similar manner, the KDF function can be used to compute an Authenticated Encryption with Associated Data (AEAD) algorithm key when the system needs to provide confidentiality for the message. The controller, being a larger device, will perform the ECDH step and use a random number generator to generate the sender nonce value. 5.8.2. Object Security for CoAP This use case deals with constrained devices of class C0/C1 (see [CONSTRAINED]). These devices communicate using RESTful requests and responses transferred using the Constrained Application Protocol [CoAP]. To simplify matters, all communication is assumed to be unicast; i.e., these security measures don't cover multicast or broadcast. In this type of setting, it may be too costly to use session-based security (e.g., to run a 4-pass authentication protocol) since receiving and in particular sending consumes a lot of power, especially for wireless devices. Therefore, to just secure the CoAP payload by replacing a plaintext payload of a request or response with a JWE object is an important alternative solution, which allows a trade-off between protection (the CoAP headers are not protected) and performance. In a simple setting, consider the payload of a CoAP GET response from a sensor type device. The information in a sensor reading may be privacy or business sensitive and needs both integrity protection and encryption. However, some sensor readings are very short, say, a few bytes, and in this case, default encryption and integrity protection algorithms (such as 128-bit AES-CBC with HMAC_SHA256) may cause a dramatic expansion of the payload, even disregarding JWE headers. Also, the value of certain sensor readings may decline rapidly, e.g., traffic or environmental measurements, so it must be possible to reduce the security overhead. This leads to the following requirements that could be covered by specific JWE/JWS profiles: o The size of the secure object shall be as small as possible. Receiving an object may cost orders of magnitude more in terms of power than performing, say, public key cryptography on the object, in particular in a wireless setting. Barnes Informational [Page 17]
RFC 7165 JOSE Use Cases April 2014 o Integrity protection: The object shall be able to support integrity protection, i.e., have a field containing a digital signature, both public key signatures and keyed MACs shall be supported. o Encryption: The object shall be able to support encryption as an optional addition to integrity protection. It shall be possible to exclude certain fields from encryption, which are needed before verifying integrity or decrypting the object. o Cipher suites: It should be possible to support a variety of cipher suites to support the constrained devices' use cases. For example: * Block ciphers with block sizes of, e.g., 96 bits, in addition to the standard 128 bits. * Modes of operation for block ciphers that do not expand the message size to a block boundary, such as AES-GCM. * Cipher suites that support combined encryption and MAC calculation (i.e., AEAD modes for block ciphers). 6. Requirements This section summarizes the requirements from the above use cases and lists further requirements not directly derived from the above use cases. There are also some constraints that are not hard requirements but that are still desirable properties for the JOSE system to have. 6.1. Functional Requirements F1 Define formats for secure objects that provide the following security properties: * Digital signature (integrity/authentication under an asymmetric key pair) * Message authentication (integrity/authentication under a symmetric key) * Authenticated encryption F2 Define a format for public keys and private keys for asymmetric cryptographic algorithms, with associated attributes, including a wrapped form for private keys. Barnes Informational [Page 18]
RFC 7165 JOSE Use Cases April 2014 F3 Define a format for symmetric keys with associated attributes, allowing for both wrapped and unwrapped keys. F4 Define a JSON serialization for each of the above objects. An object in this encoding must be valid according to the JSON ABNF syntax [RFC7159]. F5 Define a compact, URL-safe text serialization for the encrypted and signed object formats. F6 Allow for attributes associated to wrapped keys to be bound to them cryptographically. F7 Allow for wrapped keys to be separated from a secure object that uses a symmetric key. In such cases, cryptographic components of the secure object other than the wrapped key (e.g., ciphertext, MAC values) must be independent of the wrapped form of the key. For example, if an encrypted object is prepared for multiple recipients, then only the wrapped key may vary, not the ciphertext. F8 Do not impose more overhead than is required to meet the requirements in this document, especially when a large amount of application content is being protected. 6.2. Security Requirements S1 Provide mechanisms to avoid repeated use of the same symmetric key for encryption or MAC computation. Instead, long-lived keys should be used only for key wrapping, not for direct encryption/ MAC. It should be possible to use any of the key management techniques provided in CMS [RFC5652]: * Key transport (wrapping for a public key) * Key encipherment (wrapping for a symmetric key) * Key agreement (wrapping for a Diffie-Hellman (DH) public key) * Password-based encryption (wrapping under a key derived from a password) S2 Where long-lived symmetric keys are used directly for cryptographic operations (i.e., where requirement S1 is not met), provide deployment guidance on key management practices, such as the need to limit key lifetimes. Barnes Informational [Page 19]
RFC 7165 JOSE Use Cases April 2014 S3 Use cryptographic algorithms in a manner compatible with major validation processes. For example, if typical validation standards allow algorithm A to be used for purpose X but not purpose Y, then JOSE should not recommend using algorithm A for purpose Y. S4 Support operation with or without pre-negotiation. It must be possible to create or process secure objects without any configuration beyond key provisioning. If it is possible for keys to be derived from application context, it must be possible for a recipient to recognize when it does not have the appropriate key. 6.3. Desiderata D1 Maximize compatibility with the W3C Web Crypto specifications, e.g., by coordinating with the Web Crypto working group to encourage alignment of algorithms and algorithm identifiers. D2 Avoid JSON canonicalization to the extent possible. That is, all other things being equal, techniques that rely on fixing a serialization of an object (e.g., by encoding it with base64url) are preferred over those that require converting an object to a canonical form. D3 Maximize the extent to which the inputs and outputs of JOSE cryptographic operations can be controlled by the applications, as opposed to involving processing specific to JOSE. This allows JOSE the flexibility to address the needs of many cryptographic protocols. For example, in some cases, it might allow JOSE objects to be translated to legacy formats such as CMS without the need for re-encryption or re-signing. 7. Security Considerations The primary focus of this document is the requirements for a JSON- based secure object format. At the level of general security considerations for object-based security technologies, the security considerations for this format are the same as for CMS [RFC5652]. The primary difference between the JOSE format and CMS is that JOSE is based on JSON, which does not have a canonical representation. The lack of a canonical form means that it is difficult to determine whether two JSON objects represent the same information, which could lead to vulnerabilities in some usages of JOSE. Barnes Informational [Page 20]
RFC 7165 JOSE Use Cases April 2014 [CONSTRAINED] Bormann, C., Ersue, M., and A. Keranen, "Terminology for Constrained Node Networks", Work in Progress, March 2014. [CoAP] Shelby, Z., Hartke, K., and C. Bormann, "Constrained Application Protocol (CoAP)", Work in Progress, June 2013. [ITU.X690.2002] International Telecommunications Union, "Information Technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, July 2002. [JWA] Jones, M., "JSON Web Algorithms (JWA)", Work in Progress, March 2014. [JWE] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)", Work in Progress, March 2014. [JWK] Jones, M., "JSON Web Key (JWK)", Work in Progress, March 2014. [JWS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Signature (JWS)", Work in Progress, March 2014. [JWT-BEARER] Jones, M., Campbell, B., and C. Mortimore, "JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants", Work in Progress, March 2014. [JWT] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", Work in Progress, March 2014. [OASIS.saml-core-2.0-os] Cantor, S., Kemp, J., Maler, E., and R. Philpott, "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", Oasis Standard, March 2005, <http://docs.oasis-open.org/security/saml/v2.0/ saml-core-2.0-os.pdf>. [OpenID.Core] Bradley, J., de Medeiros, B., Jones, M., Mortimore, C., and N. Sakimura, "OpenID Connect Core 1.0", December 2013, <http://openid.net/specs/openid-connect-core-1_0.html>. [Persona] Mozilla Developer Network, "Mozilla Persona", April 2013, <https://developer.mozilla.org/en-US/docs/Persona>. Barnes Informational [Page 22]
RFC 7165 JOSE Use Cases April 2014 [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. [RFC2818] Rescorla, E., "HTTP Over TLS", RFC 2818, May 2000. [RFC3207] Hoffman, P., "SMTP Service Extension for Secure SMTP over Transport Layer Security", RFC 3207, February 2002. [RFC3923] Saint-Andre, P., "End-to-End Signing and Object Encryption for the Extensible Messaging and Presence Protocol (XMPP)", RFC 3923, October 2004. [RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, December 2005. [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, October 2006. [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008. [RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322, October 2008. [RFC5751] Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.2 Message Specification", RFC 5751, January 2010. [RFC6750] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization Framework: Bearer Token Usage", RFC 6750, October 2012. [SAML2] Campbell, B., Mortimore, C., and M. Jones, "SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants", Work in Progress, March 2014. [W3C.xmldsig-core] Eastlake, D., Reagle, J., and D. Solo, "XML-Signature Syntax and Processing", W3C Recommendation, June 2008, <http://www.w3.org/TR/2008/REC-xmldsig-core-20080610/>. [W3C.xmlenc-core] Eastlake, D. and J. Reagle, "XML Encryption Syntax and Processing", W3C Candidate Recommendation, December 2002, <http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/>. Barnes Informational [Page 23]
RFC 7165 JOSE Use Cases April 2014 [WS-Federation] Goodner, M., Kaler, C., McIntosh, M., and A. Nadalin, "Web Services Federation Language (WS-Federation) Version 1.2", Oasis Standard, May 2009, <http://docs.oasis-open.org/ wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html>. [XMPP-E2E] Miller, M., "End-to-End Object Encryption and Signatures for the Extensible Messaging and Presence Protocol (XMPP)", Work in Progress, June 2013. Barnes Informational [Page 24]
RFC 7165 JOSE Use Cases April 2014 Appendix A. Acknowledgements Thanks to Matt Miller for discussions related to the XMPP end-to-end security model and to Mike Jones for considerations related to security tokens and XML security. Thanks to Mark Watson for raising the need for representing symmetric keys and binding attributes to them. Thanks to Ludwig Seitz for contributing the constrained device use case. Author's Address Richard Barnes Mozilla 331 E. Evelyn Ave. Mountain View, CA 94041 US EMail: email@example.com Barnes Informational [Page 25]


text:
The Train-Safe Pure system provides your vehicles with UV and dust protection. The vehicles will be positioned on their own tracks. (Please note the internal dimensions of the tube.) This allows for an even more natural presentation.
The tubes are available in lengths of from 0.50 to 3.00 m.
For a wall-mounting option we offer a flexible solution of profile bars with handles. These are available in a choice of anodized aluminum or stainless steel.
To simply present a locomotive or model train we recommend our table stand.


text:
Slice Engineering Hotends
Elevate your 3D printing experience with Slice Engineering's All-Metal Mosquito Hotend, compatible with most FDM 3D printers. The form of hot ends is changing, while increasing the functionality. The separated module design of the Mosquito hotend includes the frame on the cold end, which feeds the filament down, and the heater block - which are kept separate by four metal support rods. This air gap has a small, copper heatsink that guides the filament down to the heater block where a small fan keeps the right amount of air flowing. Achieve clean efficient 3D printing with the all-metal Mosquito Hotend by Slice Engineering.
Filtered Results
Clear Filters


text:
The Spice Girls
I can sing to you (badly) every single lyric of the first two albums
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either [email protected] or [email protected].
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email [email protected]. For other questions check our partnered communities list, or use the search function.
Reminder: The terms of service apply here too.
Logo design credit goes to: tubbadu
The Spice Girls
I can sing to you (badly) every single lyric of the first two albums
The first two Spice Girls albums are great.
Signed, a metalhead


text:
365 Limos is your daily airport transportation service in San Diego area. Our luxury car and limo service offers high style and safety to provide you with a luxurious transportation experience.
la jolla $109
Here at 365 Limos we value our customer's time. Once your reservation confirmed we monitor your flight status, and we will do our best to accommodate "early or delayed" arrivals.
encinitas $124
When the plane lands, you will receive a text message and phone call from the operator. You will be provided with driver's name and phone number that will be ready for your pickup at the airport.
carlsbad $129
Please let us know if you would like driver to meet you at the baggage claim area. The driver will meet you at the gate with name sign and will help to collect your luggage. Additional service fee will apply.
oceanside - vista $138
Once you collect your luggage please proceed to the curbside and provide your
zoning location information. The driver will meet you in about 5 minutes.
zoning location information. The driver will meet you in about 5 minutes.
poway $124
Our cars are 3 years old or newer and are perfect for corporate, private and airport transportation. Let us redefine urban transportation in an elegant and useful way.
rancho bernardo $134
We know how to provide superior experience to fulfill any need with class , quality and safety that will set you free.
escondido $139
20% service fee and other fees will be added to the flat rates.