6. Future work & Conclusion 37
6.2. Conclusion
In this master thesis we proposed the first secure multi-party communication protocol which is robust against not responding members. For this we analysed behaviours of groups, like the admission process or course of conversation, and derived from this properties for the new protocol. We showed that not all present members pay always attention and for this reason relations between messages are more important than consensus about all transferred messages. Our observations about the admission process with transitive trust allowed us to build a key exchange based on a Diffie-Hellman tree which does not require all members to be online at the same time. The limited number of message origins and the fact that a group which decided to cheat
us as a whole, is always capable of doing so, allowed us to use ephemeral signing keys, which were trusted on first use if nobody did protest, to authenticate messages.
However, the analysis of the first protocol version showed that multiple attacks were possible. In the proposed next revision, timeouts were eliminated through clearer instructions and a new join process, which also prevents an UKS attack on the key exchange. With an integrated verification process, to verify group parameters, we complicate MitM attacks even for trusted users.
The robustness against not responding members could not exclusively be used for online communication, but also for other applications which could benefit from the tree structure like file sharing. TBG-OTR meets all our requirements by using human behaviour and it will be interesting how this concept will develop in the future.
38
A. Bibliography
[1] Chris Alexander and Ian Goldberg. “Improved User Authentication in Off-the-record Messaging”. In: Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society. WPES ’07. New York, NY, USA: ACM, 2007, pp. 41–47.
isbn: 978-1-59593-883-1. doi: 10.1145/1314333.1314340. url: http://dl.
acm.org/citation.cfm?id=1314340.
[2] Jim Alves-foss. “An Efficient Secure Authenticated Group Key Exchange Algo-rithm for Large and Dynamic Groups”. In: proc. 23 RD national information systems security conference. 2000, pp. 254–266.
[3] D. Augot et al. “An Efficient Group Key Agreement Protocol for Ad Hoc Net-works”. In:Sixth IEEE International Symposium on a World of Wireless Mobile and Multimedia Networks(), pp. 576–580.doi:10.1109/WOWMOM.2005.26.url: http : / / ieeexplore . ieee . org / lpdocs / epic03 / wrapper . htm ? arnumber = 1443570.
[4] Mihir Bellare. “New Proofs for NMAC and HMAC: Security Without Collision-Resistance”. In: Advances in Cryptology - CRYPTO 2006: 26th Annual Inter-national Cryptology Conference, Santa Barbara, California, USA, August 20-24, 2006. Proceedings. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 602–619.isbn: 978-3-540-37433-6.doi:10.1007/11818175_36.url:http:
//dx.doi.org/10.1007/11818175_36.
[5] S. M. Bellovin and M. Merritt. “Limitations of the Kerberos Authentication System”. In: SIGCOMM Comput. Commun. Rev. 20.5 (Oct. 1990), pp. 119–
132. issn: 0146-4833. doi: 10.1145/381906.381946. url: http://doi.acm.
org/10.1145/381906.381946.
[6] Philip A Bernstein, Nathan Goodman, and Vassos Hadzilacos. “Concurrency Control and Recovery in Database Systems”. In:ACM Transactions on Database Systems (1987), p. 370. doi: 10.1145/1994.2207.
[7] J Bian, R Seker, and U Topaloglu. “Off-the-Record Instant Messaging for Group Conversation”. In:Information Reuse and Integration, 2007. IRI 2007. IEEE In-ternational Conference on. 2007, pp. 79–84. doi: 10.1109/IRI.2007.4296601.
[8] Alex Biryukov, Dmitry Khovratovich, and Ivica Nikolic. “Distinguisher and Related-Key Attack on the Full AES-256 (Extended Version)”. In: Cryptology ePrint Archive 241 (2009). url: http://eprint.iacr.org/2009/241.
[9] Alex Biryukov et al. Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds. Cryptology ePrint Archive, Report 2009/374.
2009.
[10] Simon Blake-Wilson and Alfred Menezes. “Unknown Key-Share Attacks on the Station-to-Station (STS) Protocol”. In:Public Key Cryptography: Second Inter-national Workshop on Practice and Theory in Public Key Cryptography, PKC’99 Kamakura, Japan, March 1–3, 1999 Proceedings. Berlin, Heidelberg: Springer Berlin Heidelberg, 1999, pp. 154–170.isbn: 978-3-540-49162-0.doi: 10.1007/3-540-49162-7_12. url: http://dx.doi.org/10.1007/3-540-49162-7_12.
[11] Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger. “Biclique cryptanalysis of the full AES”. In:Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioin-formatics). Vol. 7073 LNCS. Springer Berlin Heidelberg, 2011, pp. 344–371.
isbn: 9783642253843. doi: 10 . 1007 / 978 - 3 - 642 - 25385 - 0 _ 19. url: http : //link.springer.com/10.1007/978-3-642-25385-0_19.
[12] Timo Brecher, Emmanuel Bresson, and Mark Manulis. “Fully robust tree-diffie-hellman group key exchange”. In:Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinfor-matics) 5888 LNCS (2009), pp. 478–497. issn: 03029743. doi: 10.1007/978-3-642-10433-6_33.
[13] Emmanuel Bresson and Dario Catalano. “Constant Round Authenticated Group Key Agreement via Distributed Computation”. In: 04 (2004), pp. 115–127.issn: 03029743. doi: 10.1007/978-3-540-24632-9_9.
[14] Emmanuel Bresson, Olivier Chevassut, and David Pointcheval. “Provably Au-thenticated Group Diffie-Hellman Key Exchange – The Dynamic Case [ Full version ]”. In: Advances 01 (2001), pp. 290–309.
[15] Scott Chacon and Ben Straub. Pro Git. 2nd. Berkely, CA, USA: Apress, 2014.
isbn: 1484200772, 9781484200773. url:https://git-scm.com/book/en/v2.
[16] Cryptocat.Multiparty Protocol Specification. visited on 03-24-2016.url:https:
//github.com/cryptocat/cryptocat/wiki/Multiparty-Protocol-Specification.
[17] Mario Di Raimondo, Rosario Gennaro, and Hugo Krawczyk. “Secure off-the-record messaging”. In:Proceedings of the 2005 ACM workshop on Privacy in the electronic society - WPES ’05 (2005), p. 81. doi: 10.1145/1102199.1102216.
url: http://portal.acm.org/citation.cfm?doid=1102199.1102216.
[18] Whitfield Diffie and Martin E Hellman. “New Directions in Cryptography”. In:
IEEE TRANSACTIONS ON INFORMATION THEORY 6 (1976).
40
[19] Niels Ferguson et al. “Improved Cryptanalysis of Rijndael”. In: Fast Software Encryption: 7th International Workshop, FSE 2000 New York, NY, USA, April 10–12, 2000 Proceedings. Berlin, Heidelberg: Springer Berlin Heidelberg, 2001, pp. 213–230.isbn: 978-3-540-44706-1. doi: 10.1007/3-540-44706-7_15.url: http://dx.doi.org/10.1007/3-540-44706-7_15.
[20] N Fips. “197: Announcing the advanced encryption standard (AES)”. In: . . . Technology Laboratory, National Institute of Standards . . . 2009 (2001), pp. 8–
12. issn: 13534858. doi:10.1016/S1353-4858(10)70006-4.url: csrc.nist.
gov/publications/fips/fips197/fips-197.pdf.
[21] Sally Floyd et al. “A Reliable Multicast Framework for Light-weight Sessions and Application Level Framing”. In: IEEE/ACM Transactions on Networking (1997).
[22] Ian Goldberg et al. “Multi-party Off-the-Record Messaging”. In: Proceedings of the 16th ACM conference on Computer and communications security - CCS
’09 (2009), p. 358. issn: 15437221. doi: 10 . 1145 / 1653662 . 1653705. url: http://dl.acm.org/citation.cfm?id=1653662.1653705.
[23] Jonathan Katz and Moti Yung. “Scalable protocols for authenticated group key exchange”. In: Journal of Cryptology 20.1 (2007), pp. 85–113. issn: 09332790.
doi:10.1007/s00145-006-0361-5.
[24] Yongdae Kim, Adrian Perrig, and Gene Tsudik. “Simple and Fault-tolerant Key Agreement for Dynamic Collaborative Groups”. In: Proceedings of the 7th ACM Conference on Computer and Communications Security. CCS ’00. New York, NY, USA: ACM, 2000, pp. 235–244.isbn: 1-58113-203-4. doi: 10.1145/
352600.352638.url: http://doi.acm.org/10.1145/352600.352638.
[25] Yongdae Kim, Adrian Perrig, and Gene Tsudik. “Tree-based Group Key Agree-ment”. In:ACM Trans. Inf. Syst. Secur.7.1 (2004), pp. 60–96.issn: 1094-9224.
doi: 10.1145/984334.984337. url: http://eprint.iacr.org/2002/009.
pdfhttp://doi.acm.org/10.1145/984334.984337.
[26] T Kivinen and M Kojo. More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). RFC 3526 (Proposed Standard). 2003.
url:http://www.ietf.org/rfc/rfc3526.txt.
[27] Hugo Krawczyk. “SIGMA: The ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and Its Use in the IKE Protocols”. In:Advances in Cryptology -CRYPTO 2003 2729 (2003), pp. 400–425. issn: 03029743. doi: 10.1007/978-3- 540- 45146- 4_24. url: http://www.ee.technion.ac.il/~hugo/sigma.
htmlhttp://dx.doi.org/10.1007/978-3-540-45146-4_24.
[28] Leslie Lamport. “The Part-Time Parliament”. In:ACM Transactions on Com-puter Sys-tems16.2 (1998), pp. 133–169.issn: 07342071.doi:10.1145/279227.
279229.
[29] Hong Liu, Eugene Y Vasserman, and Nicholas Hopper. “Improved Group Off-the-record Messaging”. In:Proceedings of the 12th ACM Workshop on Workshop on Privacy in the Electronic Society. WPES ’13. New York, NY, USA: ACM, 2013, pp. 249–254. isbn: 978-1-4503-2485-4. doi: 10.1145/2517840.2517867.
url: http://doi.acm.org/10.1145/2517840.2517867.
[30] National Institute of Standards and Technology. “Digital Signature Standard (DSS)”. In: FIPS PUB 186-4 July (2009), pp. 1–119. doi: 10 . 6028 / NIST . FIPS.186-4. url: http://dx.doi.org/10.6028/NIST.FIPS.186-4.
[31] Open Whisper Systems. Private Group Messaging. visited on 02-28-2016.url: https://whispersystems.org/blog/private-groups/.
[32] R L Rivest, A Shamir, and L Adleman. “A method for obtaining digital sig-natures and public-key cryptosystems”. In: Communications of the ACM 21.2 (1978), pp. 120–126. issn: 00010782. doi: 10 . 1145 / 359340 . 359342. arXiv:
arXiv:1011.1669v3.
[33] Robert Shirey. Internet Security Glossary (RFC2828). 2000. url: https : / / www.ietf.org/rfc/rfc2828.txt.
[34] Dale Skeen and Michael Stonebraker. “A Formal Model of Crash Recovery in a Distributed System”. In: IEEE Transactions on Software Engineering SE-9.3 (1983), pp. 219–228. issn: 00985589. doi: 10.1109/TSE.1983.236608. url: http : / / ieeexplore . ieee . org / lpdocs / epic03 / wrapper . htm ? arnumber = 1703048.
[35] M Steiner, G Tsudik, and M Waidner. “CLIQUES: a new approach to group key agreement”. In: Proceedings 18th International Conference on Distributed Computing Systems Cat No98CB36183 2984 (1998), pp. 380–387. issn: 1063-6927. doi: 10.1109/ICDCS.1998.679745. url: http://ieeexplore.ieee.
org/lpdocs/epic03/wrapper.htm?arnumber=679745.
[36] Marc Stevens, Pierre Karpman, and Thomas Peyrin. “Freestart collision for full SHA-1”. In: Advances in Cryptology – EUROCRYPT 2016: 35th Annual In-ternational Conference on the Theory and Applications of Cryptographic Tech-niques, Vienna, Austria, May 8-12, 2016, Proceedings, Part I. Berlin, Heidel-berg: Springer Berlin Heidelberg, 2016, pp. 459–483. isbn: 978-3-662-49890-3.
doi: 10.1007/978-3-662-49890-3_18. url: http://dx.doi.org/10.1007/
978-3-662-49890-3_18.
[37] Qianhong Wu et al. “Asymmetric Group Key Agreement”. In: Advances in Cryptology - EUROCRYPT 2009, 28th Annual International Conference on the Theory and Applications of Cryptographic Techniques 5479 (2009), pp. 153–170.
doi: 10.1007/978-3-642-01001-9_9.
42
[38] Paul D Yacoumis. “On the Security of the Advanced Encryption Standard”.
2005. url: http : / / diamond . boisestate . edu / ~liljanab / MATH509 / AES -security.pdf.
B. List of abbreviations
AES Advanced Encryption Standard MAC Message Authentication Code
HMAC Keyed-Hash Message Authentication Code DH Diffie-Hellman
TBG-OTR Tree-based Group Off-the-record UKS Unkown Key-Share
MitM Man-in-the-Middle DOS Denial of Service SIGMA SIGn-and-MAc D&C divide and conquer GKE Group Key Exchange
AGKE Authenticated Group Key Exchange AES Advanced Encryption Standard
DSA Digital Signature Algorithm SMP Socialist Millionaires’ Protocol FPD fundamental problem of deniability TLV Type-Length-Value
PFS Perfect Forward Secrecy
C. TBG-OTR version 0.1
This protocol is heavily influenced by OTR v3 from cypherpunks and uses the Tree-based Group Key Agreement protocol from Y. Kim, A. Perrig and G. Tsudik in an authenticated manner.
Author: Klaus Herberth
C.1. Very high level overview
TBG-OTR assumes a broadcast channel which delivers messages in the same order to all participants.
1. A new member sends a request to join.
2. After a group approval all existing members, which agree with the decision, add the new member to the group.
3. All group members exchange data messages to send information.
C.2. High level overview
C.2.1. Joining
This section outlines Tree-based Group Key Agreement used as AKE. All exponentia-tions are done modulo a particular 1536-bit prime, and g is a generator of that group, as indicated in the detailed description below. Public DH keys, also called blinded keys, are bkeys or bk and calculated as gkey.
1. New member Mn+1 broadcasts request (signed with long-live DSA key) for join to current Group C
2. Mi ∈ C knows $ M {n+1} $ or gets to know him. If he thinks this member is trustful he sends an approval to C. (Multiple approvals could be required) 3. Every member
• updates his binary key tree by adding new member node and new inter-mediate node.
• removes all keys and bkeys from the leaf node related to the sponsor to the root node.
4. The sponsor Ms additionally
• generates new share and computes all [key, bkey] pairs on the key-path.
• broadcasts updated tree including only bkeys.
5. Every member computes group key using the updated tree.
NowMn+1 knows who is aware of this key. To verify those he has to contact everybody, because pseudo members could be possible.
C.2.2. Exchanging Data
This section outlines the method used to protect data being exchanged between all members. As above, all exponentiations are done modulo a particular 1536-bit prime, and g is a generator of that group, as indicated in the detailed description below.
SupposeMi has a message to send to all group members (C): -Mi: 1. Uses the key tree to generate a shared secret (s) for C, and generates the sending AES key (ek) and the sending MAC key (mk), as detailed below. 2. Picks a value of the counter, ctr, so that the tuple (s, ctr) is never the same for more than one data message. 3.
Picks last received or referenced message id as history. 4. Generates signature (sig) of history + msg with short-lived DSA key. 5. Computes T = (sender id, receiver id, ctr, AES-CTRek,ctr(history + msg + sig)) 6. Sends T, M ACmk(T) - Every Mm ∈C:
1. Uses key tree and receiver id to generate a shared secret. 2. Uses sender id to compute receiving AES key (ek) and receiving MAC key (mk), as detailed below. 3.
Uses mk to verify M ACmk(T) 4. Uses ek and ctr to decrypt AES-CTRek,ctr(history + msg + sig) 5. Verifies signature with known DSA key
C.2.3. Leaving
After a member (Md) is gone, the following steps have to be processed:
• Every member:
1. updates key tree by removing the leaving member node and relevant parent node.
2. removes all keys and blinded keys from the leaf node related to the sponsor to the root node.
• Sponsor Ms additionally:
1. generates new share and computes all [key, bkey] pairs on the key-path.
2. broadcasts updated tree including only bkeys
• Every member computes the group key using the updated key tree.
48
C.3. Details of the protocol
C.3.1. Unencoded messages
This section describes the messages in the TBG-OTR protocol that are not base-64 encoded binary.
C.3.1.1. TBG-OTR Query Messages
If a user (A) wants to start a TBG-OTR session he sends a message starting with
?TBG-OTR? optionally followed by an explanation. Two cases are possible:
1. There is already an active TBG-OTR session in the broadcast channel. The last active member of that group should send a TBG-OTR error messages, followed by a request message from user A to join that group.
2. There is no active TBG-OTR session in the broadcast channel. All present users who want to join should send a request message and user A acts as first sponsor for the first received request message. All other messages are handled as described below.
C.3.1.2. TBG-OTR Error Messages
Any message containing the string “?TBG-OTR Error:” is an TBG-OTR Error Mes-sage. The following part of the message should contain human-readable details of the error.
C.3.2. Encoded messages
This section describes the byte-level format of the base-64 encoded binary TBG-OTR messages. The binary form of each of the messages is described below. To transmit one of these messages, construct the ASCII string consisting of the nine bytes “?TBG-OTR:”, followed by the base-64 encoding of the binary form of the message, followed by the byte “.”.
For the Diffie-Hellman group computations, the group is the one defined in RFC 3526 with 1536-bit modulus (hex, big-endian):
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
and a generator (g) of 2. Note that this means that whenever you see a Diffie-Hellman exponentiation in this document, it always means that the exponentiation is done modulo the above 1536-bit number.
C.3.2.1. Data types
4 byte unsigned len, big-endian len byte unsigned value, big-endian (MPIs must use the minimum-length encoding; i.e. no leading 0x00 bytes. This is important when calculating public key fingerprints.)
Opaque variable-length data (DATA)
4 byte unsigned len, big-endian len byte data Initial CTR-mode counter value (CTR)
8 bytes data
Message Authentication Code (MAC) 20 bytes MAC data
C.3.2.1.1. Public keys and signatures
TBG-OTR users have long-lived public DSA keys that they use for authentication (but not encryption). And short-lived public DSA keys for message authentication.
Both should be never be linked and the short-lived key should only be verified over a deniable channel (e.g. OTR session). The current version of the TBG-OTR protocol only supports DSA public keys, but there is a key type marker for future extensibility.
OTR public DSA key (PUBKEY)
Pubkey consist of the type and the key parameters Pubkey type (SHORT)
• DSA public keys have type 0x0000 DSA public key parameters
• p (MPI)
• q (MPI)
• g (MPI)
• y (MPI)
TBG-OTR public DSA keys are used to generate signatures; different types of keys produce signatures in different formats. The format for a signature made by a DSA public key is as follows:
50
DSA signature (SIG)
(len is the length of the DSA public parameter q, which in current implementa-tions must be 20 bytes, or 160 bits)
len byte unsigned r, big-endian len byte unsigned s, big-endian C.3.2.1.2. Fingerprints
TBG-OTR public keys (DSA and DH) have fingerprints, which are hex strings that serve as identifiers for the public key. The fingerprint is calculated by taking the SHA-1 hash of the byte-level representation of the public key.
Public key fingerprint (FP) 20 bytes SHA1 data
C.3.2.1.3. Type-Length-Value record Each TLV record is of the form:
Type (SHORT)
The type of this record. Records with unrecognized types should be ignored.
Length (SHORT)
The length of the following field Value (len BYTEs)
(where len is the value of the Length field) Any pertinent data for the record type.
Some TLV examples:
\x00\x01\x00\x00
A TLV of type 1, containing no data
\x00\x00\x00\x05\x68\x65\x6c\x6c\x6f
A TLV of type 0 (\x00\x00) with length 5 (\x00\x05), containing the value “hello”
(\x68\x65\x6c\x6c\x6f).
C.3.2.2. Request Message
This is the first message of the AKE. Alice sends it to the group to request acceptance.
C.3.2.2.1. Format
Protocol version (SHORT)
The version number of this protocol is 0x0001.
Message type (BYTE)
The request message has type 0x01.
Sender id (FP)
The long-lived DSA fingerprint of the person requesting acceptance.
Blinded key (DATA)
The public DH key of the person requesting acceptance.
Plaintext message (DATA)
An optional plaintext message which is displayed to all members.
Signature (SIG)
The DSA signature, using the long-lived DSA key, of everything from the pro-tocol version to the plaintext message.
Signature (SIG)
The DSA signature, using the long-lived DSA key, of the blinded key. This signature is transfered along with the updated key tree.
C.3.2.3. Tree Message
The sponsor sends this message after a group modification (join, leave, timeout).
C.3.2.3.1. Format
Protocol version (SHORT)
The version number of this protocol is 0x0001.
Message type (BYTE)
The tree message has type 0x02.
Sender id (FP)
The public DH key fingerprint of the sponsor.
Receiver id (FP)
The public DH fingerprint of the new derived group key.
Previous receiver id (FP)
The public DH fingerprint of the group key which triggered this tree update.
Configuration (DATA)
Initial configuration of the group. If no configuration is set (0x00 00 00 00) the default values apply. Currently it is not allowed to change this value after group initialisation. And if it does, it should trigger a protest. The currently defined TLV (type-length-value) options are:
• Type 0: Number of required confirmations (Default=1). Needs to be al-ways 0 or greater.
• Type 1: Number of seconds after a sponsor should be considered as offline (Default=8).
52
Top half of counter init (CTR)
This should monotonically increase (as a big-endian value) for each message sent with the same (sender id, recipient id) pair, and must not be all 0x00.
Serialized tree with BK (DATA)
Serialize the new key tree in preorder with every BK (DATA) followed by either 0x01 (BYTE) for leafes or 0x00 for empty nodes.
Encrypted BK signatures (DATA)
Order all long-lived DSA leaf signatures (SIG) from left to right followed by there corresponding key id, encrypt it using AES128-CTR and encode it as DATA field. The initial counter is a 16-byte value whose first 8 bytes are the above “top half of counter init” value, and whose last 8 bytes are all 0x00.
Signature (SIG)
The DSA signature, using the short-lived DSA key, of everything from the pro-tocol version to the encrypted signatures.
Authenticator (MAC)
The SHA1-HMAC, using the new MAC key, of everything from the protocol version to the encrypted message.
C.3.2.4. Data Message
This message is used to transmit a private message to the correspondent, and consists of:
• MAC of the referenced or last received message (MAC).
• Plaintext message consists of a human-readable message (encoded in UTF-8, optionally with HTML markup) (DATA).
• Zero or more TLV (type/length/value) records (with no padding between them).
• DSA signature with short-lived key of the first 3 items.
The currently defined TLV records for data messages are:
Type 0 Padding
The value may be an arbitrary amount of data, which should be ignored. This type can be used to disguise the length of the plaintext message.
Type 1 Disconnected
If the user requests to close the private connection, you may send a message (pos-sibly with empty human-readable part) containing a record with this TLV type just before you discard the session keys, and transition to MSGSTATE PLAINTEXT (see below). If you receive a TLV record of this type, you should inform the
If the user requests to close the private connection, you may send a message (pos-sibly with empty human-readable part) containing a record with this TLV type just before you discard the session keys, and transition to MSGSTATE PLAINTEXT (see below). If you receive a TLV record of this type, you should inform the