[openssl-users] OCSP_basic_verify certs
Hi, I am implementing the OCSP for my application. Have a doubt on the 'certs' argument for the API "OCSP_basic_verify": int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags); Here the second argument 'certs'. I understand we need to push the below to this STACK_OF(X509): 1) Issuer certificate 2) Signature CA certificates - to support trusted responder model I have multiple signature CA certificates as individual PEM format files (say 5 PEM files), inside a directory (say /config/ssl/signature-ca). How can i push all these 5 signature CA certs to this STACK_OF (X509) using sk_X509_push ? Any openSSL library API is there to push all files from a directory to this STACK_OF(X509) ? Thanks & Regards, Murugesh P. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
Am 24.02.2015 um 16:19 schrieb Salz, Rich: As there is no documentation and as noone seems to know the meaning of the -no_explicit for "openssl ocsp", should I file a documentation defect in RT for that? yes, please. Never mind, Stephen already fixed the doc in master :) Sorry, I sent already a message to the RT address. -- Stephan ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
On Tue, Feb 24, 2015, Stephan M?hlstrasser wrote: > > Do I understand it correctly then that "a local configuration of > OCSP signing authority" here means that it is a deliberate choice > inside OpenSSL itself to look for the OCSPSigning flag in the > extended key usage of the root CA, although RFC 2560 does not say > so? > No it's a separate thing called a "trust setting" which is not part of the certificate itself . This is something which has to be explicitly configured to trust that root CA for OCSPSigning. It's OpenSSL's version of the trust settings you see in browsers. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
Am 24.02.15 um 14:47 schrieb Dr. Stephen Henson: If the responder root CA is set to be trusted for OCSP signing then it can be used to sign OCSP responses for any certificate (aka a global responder). This comes under: 1. Matches a local configuration of OCSP signing authority for the certificate in question or alternatively: Additional acceptance or rejection criteria may apply to either the response itself or to the certificate used to validate the signature on the response. from RFC2560 et al. If the -no_explicit flag is set or OCSP_NOEXPLICIT is set then this behaviour is disabled. Do I understand it correctly then that "a local configuration of OCSP signing authority" here means that it is a deliberate choice inside OpenSSL itself to look for the OCSPSigning flag in the extended key usage of the root CA, although RFC 2560 does not say so? -- Stephan ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
> > As there is no documentation and as noone seems to know the meaning of > > the -no_explicit for "openssl ocsp", should I file a documentation > > defect in RT for that? > > yes, please. Never mind, Stephen already fixed the doc in master :) ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
> As there is no documentation and as noone seems to know the meaning of > the -no_explicit for "openssl ocsp", should I file a documentation defect in > RT > for that? yes, please. ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
On Wed, Feb 18, 2015, Stephan M?hlstrasser wrote: > > What is the meaning of setting the OCSP_NOEXPLICIT flag resp. using > the "-no_explicit" command line option. What exactly is checked by > the X509_check_trust() call above with respect to the relevant RFCs? > If the responder root CA is set to be trusted for OCSP signing then it can be used to sign OCSP responses for any certificate (aka a global responder). This comes under: 1. Matches a local configuration of OCSP signing authority for the certificate in question or alternatively: Additional acceptance or rejection criteria may apply to either the response itself or to the certificate used to validate the signature on the response. from RFC2560 et al. If the -no_explicit flag is set or OCSP_NOEXPLICIT is set then this behaviour is disabled. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
Am 18.02.15 um 13:19 schrieb Stephan Mühlstrasser: Unfortunately the "-no_explicit" command line option is not documented: https://www.openssl.org/docs/apps/ocsp.html What is the meaning of setting the OCSP_NOEXPLICIT flag resp. using the "-no_explicit" command line option. What exactly is checked by the X509_check_trust() call above with respect to the relevant RFCs? As there is no documentation and as noone seems to know the meaning of the -no_explicit for "openssl ocsp", should I file a documentation defect in RT for that? If I understand the code in OCSP_basic_verify() that is depending on the OCSP_NOEXPLICIT flag correctly, it checks the root CA for the presence of the OCSPSigning flag in the extended key usage field. I could not find anything in RFC 6960 and RFC 2560 that would mandate such a check for the root CA certificate. Only the OCSP signing certificate must have OCSPSigning in the extended key usage field. So maybe it is even a bug in the code itself? -- Stephan ___ openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] Meaning of OCSP_NOEXPLICIT for OCSP_basic_verify()
Hi,
I have a question about the behavior of OCSP_basic_verify() and the
meaning of the OCSP_NOEXPLICIT flag. The OCSP_basic_verify() function is
the only place where this flag has an effect in the whole OpenSSL
source, and in the "openssl ocsp" application it can be set with the
"-no_explicit" command line option:
/*
* Easy case: explicitly trusted. Get root CA and check for explicit
* trust
*/
if (flags & OCSP_NOEXPLICIT)
goto end;
x = sk_X509_value(chain, sk_X509_num(chain) - 1);
if (X509_check_trust(x, NID_OCSP_sign, 0) != X509_TRUST_TRUSTED) {
OCSPerr(OCSP_F_OCSP_BASIC_VERIFY, OCSP_R_ROOT_CA_NOT_TRUSTED);
goto end;
}
Unfortunately the "-no_explicit" command line option is not documented:
https://www.openssl.org/docs/apps/ocsp.html
What is the meaning of setting the OCSP_NOEXPLICIT flag resp. using the
"-no_explicit" command line option. What exactly is checked by the
X509_check_trust() call above with respect to the relevant RFCs?
Best regards
Stephan
___
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
OCSP_basic_verify error: root ca not trusted
I made an error. I didn't actually add OCSPSigning extended key usage to the OCSP responder cert. My attempt(which I found at the mailing list archive) was bad: openssl x509 -in 03.crt -inform PEM -addtrust OCSPSigning -out ocsp_resp_cert.pem "-addtrust" is another command for another purposes. To add OCSPSigning extended key usage to the OCSP responder cert we must use "-extension" option during signing certificate request. OCSP verification works now. The problem is closed. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
OCSP_basic_verify error: root ca not trusted
Hello. I could connect to OpenSSL OCSP responder only by IPv6. But I have another error: 3908:error:2706A067:OCSP routines:OCSP_CHECK_DELEGATED:missing ocspsigning usage:.\crypto\ocsp\ocsp_vfy.c:350: 3908:error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted:.\crypto\ocsp\ocsp_vfy.c:148: I made and adjusted the simple test Certification Authority. I have a root CA and three certs issued and certainly signed by the root CA: 01.crt, 02.crt, 03.crt. Now I want to test OpenSSL OCSP responder. I will test 01.crt for the revocation status and use 03.crt cert as the OCSP responder's certificate. I added OCSPSigning extended key usage to the 03.crt: openssl x509 -in 03.crt -inform PEM -addtrust OCSPSigning -out ocsp_resp_cert.pem I start OpenSSL OCSP responder: openssl ocsp -index index.txt -port -rkey cert3_pkey.pem -rsigner ocsp_resp_cert.pem -CA cacert.crt -text After that I try to verify 01.crt via OCSP and I get the above error. If I would use the root CA as the OCSP responder's cert all is ok: OCSP_basic_verify not failed and I get OCSP status "GOOD". I see docs on openssl.org: ocsp(1) section OCSP "Response verification": 1) "Otherwise the issuing CA certificate in the request is compared to the OCSP responder certificate: if there is a match then the OCSP verify succeeds." This rule works. This case is when certificate of the OCSP responder is a root CA. 2) "Otherwise the OCSP responder certificate's CA is checked against the issuing CA certificate in the request. If there is a match and the OCSPSigning extended key usage is present in the OCSP responder certificate then the OCSP verify succeeds. This rule doesn't work or I don't understand it or I made something wrong. Please, say what am I do wrong? Regards, Vladimir. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: OCSP_basic_verify FAILED(returns -1) (all details in email)
Yes! I forgot about OpenSSL initialization. Thank you, Dr. Stephen Henson. From: Dr. Stephen Henson Sent: Wednesday, June 06, 2012 5:12 PM To: openssl-users@openssl.org Subject: Re: OCSP_basic_verify FAILED(returns -1) (all details in email) On Wed, Jun 06, 2012, Vladimir Belov wrote: Hello. OCSP_basic_verify failed(returns -1) although "openssl ocsp -respin ..." show "Response verify OK" with the same OCSP response and root CAs. I attached to this email the ZIP and TAR archives with OCSP response, the checked certificate, it's issuer certificate(VeriSignClass3ExtendedValidationSSLSGCCA.pem) and root certs of CAs. The checked certificate is certificate of the web-site www.verisign.com. I use OpenSSL 1.0.0e. OCSP_basic_verify failed(return -1) with next errors: 4064:error:0D0C50A1:lib(13):func(197):reason(161):.\crypto\asn1\a_verify.c:150: 4064:error:27069075:lib(39):func(105):reason(117):.\crypto\ocsp\ocsp_vfy.c:98: I debuged this situation and found that this happens because EVP_get_digestbyname for argument "name"="SHA1" returns "NULL"! Perhaps: http://www.openssl.org/support/faq.html#PROG8 Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: OCSP_basic_verify FAILED(returns -1) (all details in email)
On Wed, Jun 06, 2012, Vladimir Belov wrote: > Hello. > > OCSP_basic_verify failed(returns -1) although "openssl ocsp -respin > ..." show "Response verify OK" with the same OCSP response and root > CAs. > > I attached to this email the ZIP and TAR archives with OCSP > response, the checked certificate, it's issuer > certificate(VeriSignClass3ExtendedValidationSSLSGCCA.pem) and root > certs of CAs. > The checked certificate is certificate of the web-site www.verisign.com. I > use OpenSSL 1.0.0e. > > OCSP_basic_verify failed(return -1) with next errors: > 4064:error:0D0C50A1:lib(13):func(197):reason(161):.\crypto\asn1\a_verify.c:150: > 4064:error:27069075:lib(39):func(105):reason(117):.\crypto\ocsp\ocsp_vfy.c:98: > > I debuged this situation and found that this happens because > EVP_get_digestbyname for argument "name"="SHA1" returns "NULL"! > Perhaps: http://www.openssl.org/support/faq.html#PROG8 Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
OCSP_basic_verify error
Hello, I am facing a problem with the OCSP_basic_verify call. I have a client certificate which is having the signature algorithm as sha1RSA. I have made sure that i call SSL_library_init with initialization of the EVP_sha1 digest. But i still see the error while processing the OCSP response: Response failed basic verification; Detail 'error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm' Can anyone help me point out what possibly could be the issue. Thanks, Kartik
Re: OCSP_basic_verify error
Hello, > I am getting the following error in calling OCSP_basic_verify(): > > error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus > > Could somebody advice what is going wrong? In RSA you can encrypt/decrypt only as much data as RSA key size (size of RSA key is the size of modulus n = p*q). In this situation, RSA routine checks size of data to decrypt (probably signature) and this size of bigger than RSA key size, this if of course error. I think that in this situation this is possible when OCSP was signed with (for example) 2048 bit key (private key) and you have some certificate with (maybe old) 1024 bit public key. In this case this error may happen. My suggestion is to check signer certificate. Best regards, -- Marek Marcola <[EMAIL PROTECTED]> __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
OCSP_basic_verify error
Hi, I am getting the following error in calling OCSP_basic_verify(): error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus Could somebody advice what is going wrong? Regards, -wenwu __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: OCSP_basic_verify()
On Tue, Oct 25, 2005, Steffen Fiksdal wrote: Hi! What return code(s) from OCSP_basic_verify() signals that the verification process went ok, regardless of any flags set ? Anything >0 though at present it will only return 1 for success. I see in the function that if ocsp_check_issuer() returns !=0, the explicit trust will never be checked. When ocsp_check_issuer returns 0 (uncritical fail), then the explicit trust will be checked. Can you please explain the logic for me, I am kind of confused about this function :-) Best Regards Steffen __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: OCSP_basic_verify()
On Tue, Oct 25, 2005, Steffen Fiksdal wrote: > Hi! > > What return code(s) from OCSP_basic_verify() signals that the > verification process went ok, regardless of any flags set ? > Anything >0 though at present it will only return 1 for success. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
OCSP_basic_verify()
Hi! What return code(s) from OCSP_basic_verify() signals that the verification process went ok, regardless of any flags set ? Best Regards Steffen Fiksdal __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
RE: OCSP_basic_verify
Steve, Please, please, please put your comments like this into the CVS source or man pages. Your knowledge of this stuff is priceless to us mere mortals! :-) Thank you. Rob -Original Message- From: Dr S N Henson [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 12, 2001 12:57 PM To: [EMAIL PROTECTED] Subject: Re: OCSP_basic_verify Tat Sing Kong wrote: > > (sobbing) I have been looking for the documentation, but there is none. All > I can see i the definition of > some flags: > > #define OCSP_NOCERTS0x1 > #define OCSP_NOINTERN 0x2 > #define OCSP_NOSIGS 0x4 > #define OCSP_NOCHAIN0x8 > #define OCSP_NOVERIFY 0x10 > #define OCSP_NOEXPLICIT 0x20 > #define OCSP_NOCASIGN 0x40 > #define OCSP_NODELEGATED0x80 > #define OCSP_NOCHECKS 0x100 > #define OCSP_TRUSTOTHER 0x200 > #define OCSP_RESPID_KEY 0x400 > #define OCSP_NOTIME 0x800 > > What are they? > I meant you can check the ocsp.c source code and documentation and see how each option is related to the flag it sets. Most of the time you wont need any of the flags. However for the OCSP_basic_verify operation here's a summary... OCSP_NOINTERN don't look internally in the OCSP response for the signer's certificate only look in the certs STACK. Same as -no_intern in ocsp app. OCSP_NOSIGS don't verify the signature on the reponse. Same as no_sig_verify in ocsp app. OCSP_NOCHAIN don't chain verify the signer's certificate: this effectively means all other certificates in the chain must be in the trusted store. Same as no_chain. OCSP_NOVERIFY don't verify the signer's certificate in any way. Same as no_cert_verify OCSP_NOEXPLICIT don't support explicit trust of a root CA. OCSP_NOCASIGN don't allow an OCSP response to be signed by the issuing CA certificate. OCSP_NODELEGATED don't allow delegated trust. OCSP_NOCHECKS don't perform additional checks on the signer's certificate. Same as no_cert_checks OCSP_TRUSTOTHER if the reponse signer's cert is one of those in the 'certs' STACK then implicitly trust it: don't verify it or check it in any way. Same as trust_other Steve. -- Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ Personal Email: [EMAIL PROTECTED] Senior crypto engineer, Gemplus: http://www.gemplus.com/ Core developer of the OpenSSL project: http://www.openssl.org/ Business Email: [EMAIL PROTECTED] PGP key: via homepage. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED] * DISCLAIMER: The information contained in this e-mail may be confidential and is intended solely for the use of the named addressee. Access, copying or re-use of the e-mail or any information contained therein by any other person is not authorized. If you are not the intended recipient please notify us immediately by returning the e-mail to the originator. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
Re: OCSP_basic_verify
Tat Sing Kong wrote: > > (sobbing) I have been looking for the documentation, but there is none. All > I can see i the definition of > some flags: > > #define OCSP_NOCERTS0x1 > #define OCSP_NOINTERN 0x2 > #define OCSP_NOSIGS 0x4 > #define OCSP_NOCHAIN0x8 > #define OCSP_NOVERIFY 0x10 > #define OCSP_NOEXPLICIT 0x20 > #define OCSP_NOCASIGN 0x40 > #define OCSP_NODELEGATED0x80 > #define OCSP_NOCHECKS 0x100 > #define OCSP_TRUSTOTHER 0x200 > #define OCSP_RESPID_KEY 0x400 > #define OCSP_NOTIME 0x800 > > What are they? > I meant you can check the ocsp.c source code and documentation and see how each option is related to the flag it sets. Most of the time you wont need any of the flags. However for the OCSP_basic_verify operation here's a summary... OCSP_NOINTERN don't look internally in the OCSP response for the signer's certificate only look in the certs STACK. Same as -no_intern in ocsp app. OCSP_NOSIGS don't verify the signature on the reponse. Same as no_sig_verify in ocsp app. OCSP_NOCHAIN don't chain verify the signer's certificate: this effectively means all other certificates in the chain must be in the trusted store. Same as no_chain. OCSP_NOVERIFY don't verify the signer's certificate in any way. Same as no_cert_verify OCSP_NOEXPLICIT don't support explicit trust of a root CA. OCSP_NOCASIGN don't allow an OCSP response to be signed by the issuing CA certificate. OCSP_NODELEGATED don't allow delegated trust. OCSP_NOCHECKS don't perform additional checks on the signer's certificate. Same as no_cert_checks OCSP_TRUSTOTHER if the reponse signer's cert is one of those in the 'certs' STACK then implicitly trust it: don't verify it or check it in any way. Same as trust_other Steve. -- Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ Personal Email: [EMAIL PROTECTED] Senior crypto engineer, Gemplus: http://www.gemplus.com/ Core developer of the OpenSSL project: http://www.openssl.org/ Business Email: [EMAIL PROTECTED] PGP key: via homepage. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
RE: OCSP_basic_verify
(sobbing) I have been looking for the documentation, but there is none. All I can see i the definition of some flags: #define OCSP_NOCERTS0x1 #define OCSP_NOINTERN 0x2 #define OCSP_NOSIGS 0x4 #define OCSP_NOCHAIN0x8 #define OCSP_NOVERIFY 0x10 #define OCSP_NOEXPLICIT 0x20 #define OCSP_NOCASIGN 0x40 #define OCSP_NODELEGATED0x80 #define OCSP_NOCHECKS 0x100 #define OCSP_TRUSTOTHER 0x200 #define OCSP_RESPID_KEY 0x400 #define OCSP_NOTIME 0x800 What are they? Tat. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Dr S N Henson > Sent: 11 December 2001 18:21 > To: [EMAIL PROTECTED] > Subject: Re: OCSP_basic_verify > > > Tat Sing Kong wrote: > > > > Hi, > > > > I have been trying to figure out what the flags are for this > function and > > have come up with the following, can someone verify? > > > > int OCSP_basic_verify(OCSP_BASICRESP *bs, // the OCSP response > > STACK_OF(X509) *certs, // intermediate signing certs > > X509_STORE *st, // trusted responder certs > > unsigned long flags // flags as > defined in ocsp.h > > ); > > > > Can someone tell me what the difference between "certs" and "st" is? > > > > certs is a stack of certificates which can aid the verify operation. For > example if the response doesn't contain the signer's certificate it can > look in there. st is a trusted certificate store which contains trusted > certificates which are used to verify the signers certificate. > > Setting various values for the flags can change the meaning somewhat > too. The ocsp application source in apps/ocsp.c and documentation should > help clarify this. > > Steve. > -- > Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ > Personal Email: [EMAIL PROTECTED] > Senior crypto engineer, Gemplus: http://www.gemplus.com/ > Core developer of the OpenSSL project: http://www.openssl.org/ > Business Email: [EMAIL PROTECTED] PGP key: via homepage. > __ > OpenSSL Project http://www.openssl.org > User Support Mailing List[EMAIL PROTECTED] > Automated List Manager [EMAIL PROTECTED] > > __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
OCSP_basic_verify
Hi, I have been trying to figure out what the flags are for this function and have come up with the following, can someone verify? int OCSP_basic_verify(OCSP_BASICRESP *bs, // the OCSP response STACK_OF(X509) *certs, // intermediate signing certs X509_STORE *st, // trusted responder certs unsigned long flags // flags as defined in ocsp.h ); Can someone tell me what the difference between "certs" and "st" is? Tat. __ OpenSSL Project http://www.openssl.org User Support Mailing List[EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
