You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Berin Lautenbach <be...@wingsofhermes.org> on 2004/03/03 12:49:12 UTC
Question on JCE 1.5 key wraps
Peoples,
I have just checked in a new version of config.xml that works for most
encryption algorithms under SunJCE (have not yet checked sig).
One question - I am having issues with symmetric key wraps. The
Baltimore interop tests all fail where a symmetric key wrap is used.
The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
However I get decryption errors.
Is there something special here that someone is aware of? (Am hoping on
of the Sun gurus in the list can help me here :>.)
Cheers,
Berin
Re: Question on JCE 1.5 key wraps
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Hmm. Interesting - must have a look at the signature stuff. I am
currently only trying encryption.
Davanum Srinivas wrote:
> Sean,
>
> Here's my run with JDK1.5 with BC commented out:
> http://nagoya.apache.org/~dims/xmlsec-junit/
>
> -- dims
>
> --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>
>>Sean,
>>
>>test_five_content_aes128_cbc_kw_aes192
>>test_five_content_3des_cbc_kw_aes128
>>test_five_data_aes256_cbc_3des
>>test_five_data_aes192_cbc_aes256
>>
>>Basically any interop test where a symmetric key wrap is used. The
>>wrap/unwrap tests work, which leads me to believe that I am calling
>>using the wrong cipher spec for the unwrap cipher.
>>
>>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
>>or DESEDE, so I *think* what is happening is the JCE is doing a straight
>>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
>>respectively.
>>
>>Anyway - still researching, but all ideas welcome :>.
>>
>>Cheers,
>> Berin
>>
>>Sean Mullan wrote:
>>
>>>Can you tell me which test vectors are failing?
>>>
>>>--Sean
>>>
>>>Berin Lautenbach wrote:
>>>
>>>
>>>>Peoples,
>>>>
>>>>I have just checked in a new version of config.xml that works for most
>>>>encryption algorithms under SunJCE (have not yet checked sig).
>>>>
>>>>One question - I am having issues with symmetric key wraps. The
>>>>Baltimore interop tests all fail where a symmetric key wrap is used.
>>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
>>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
>>>>However I get decryption errors.
>>>>
>>>>Is there something special here that someone is aware of? (Am hoping
>>>>on of the Sun gurus in the list can help me here :>.)
>>>>
>>>>Cheers,
>>>> Berin
>>>>
>>>
>>>
>>>
>>>
>
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/
>
>
Re: Question on JCE 1.5 key wraps
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
> Sean,
> Update the junit test result -
> http://nagoya.apache.org/~dims/xmlsec-junit/. Here's my config.xml
> http://nagoya.apache.org/~dims/xmlsec-junit/config.xml. Results are
> just slightly better.
>
> Can you please update config.xml and send us something that passes all
> the tests?
OK - The failures on the interop signature tests look like a bug
somewhere. I will follow up.
The failures on encryption are because the Sun JCE uses straight
encryption when wrapping keys - it does not support the CMS or AES Key
Wrap algorithms required by the XML-Encryption spec.
So the best we are going to get with the Sun 1.5 JCE will be full
signature support (assuming we can fix the RSA-SHA1 error). Note however
that RSA key wrapping works fine, so if your requirement is purely around
RSA, you should be OK.
I might also see if I can write something into the unit tests to skip the
symmetric key wrap tests if no provider is available that supports them
(with an output to log.warning).
Cheers,
Berin
Re: Question on JCE 1.5 key wraps
Posted by Davanum Srinivas <di...@yahoo.com>.
Sean,
Update the junit test result - http://nagoya.apache.org/~dims/xmlsec-junit/. Here's my config.xml
http://nagoya.apache.org/~dims/xmlsec-junit/config.xml. Results are just slightly better.
Can you please update config.xml and send us something that passes all the tests?
thanks,
dims
--- Sean Mullan <Se...@Sun.COM> wrote:
> Here are the missing algorithms, please update config.xml
> and rerun the tests:
>
> MessageDigest: Provider "SUN" supports MD5, SHA-256, SHA-384, & SHA-512
>
> Signature: Provider "SunJSSE" supports MD5withRSA, SHA1withRSA
>
> MAC: Provider "SunJCE" supports HmacMD5, HmacSHA256, HmacSHA384, HmacSHA512
>
> We do not currently yet support the key wrapping algorithms.
>
> I am not sure why the tests in org.apache.xml.security.test.interop fail
> to find SHA1WithRSA, something strange going on there ... when I have
> more time I'll look into it.
>
> HTH,
> Sean
>
>
> Davanum Srinivas wrote:
> > Sean, Berin,
> >
> > Done. Here's the updated JDK1.5 run after commenting out lib.jce from classpath.libraries.
> >
> > -- dims
> >
> > --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> >
> >>Just looked in more detail - you also need to install the strong crypto
> >>policy files.
> >>
> >>Cheers,
> >> Berin
> >>
> >>Davanum Srinivas wrote:
> >>
> >>
> >>>Sean,
> >>>
> >>>Here's my run with JDK1.5 with BC commented out:
> >>>http://nagoya.apache.org/~dims/xmlsec-junit/
> >>>
> >>>-- dims
> >>>
> >>>--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> >>>
> >>>
> >>>>Sean,
> >>>>
> >>>>test_five_content_aes128_cbc_kw_aes192
> >>>>test_five_content_3des_cbc_kw_aes128
> >>>>test_five_data_aes256_cbc_3des
> >>>>test_five_data_aes192_cbc_aes256
> >>>>
> >>>>Basically any interop test where a symmetric key wrap is used. The
> >>>>wrap/unwrap tests work, which leads me to believe that I am calling
> >>>>using the wrong cipher spec for the unwrap cipher.
> >>>>
> >>>>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
> >>>>or DESEDE, so I *think* what is happening is the JCE is doing a straight
> >>>>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
> >>>>respectively.
> >>>>
> >>>>Anyway - still researching, but all ideas welcome :>.
> >>>>
> >>>>Cheers,
> >>>> Berin
> >>>>
> >>>>Sean Mullan wrote:
> >>>>
> >>>>
> >>>>>Can you tell me which test vectors are failing?
> >>>>>
> >>>>>--Sean
> >>>>>
> >>>>>Berin Lautenbach wrote:
> >>>>>
> >>>>>
> >>>>>
> >>>>>>Peoples,
> >>>>>>
> >>>>>>I have just checked in a new version of config.xml that works for most
> >>>>>>encryption algorithms under SunJCE (have not yet checked sig).
> >>>>>>
> >>>>>>One question - I am having issues with symmetric key wraps. The
> >>>>>>Baltimore interop tests all fail where a symmetric key wrap is used.
> >>>>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
> >>>>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
> >>>>>>However I get decryption errors.
> >>>>>>
> >>>>>>Is there something special here that someone is aware of? (Am hoping
> >>>>>>on of the Sun gurus in the list can help me here :>.)
> >>>>>>
> >>>>>>Cheers,
> >>>>>> Berin
> >>>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>
> >>>=====
> >>>Davanum Srinivas - http://webservices.apache.org/~dims/
> >>>
> >>>
> >
> >
> >
> > =====
> > Davanum Srinivas - http://webservices.apache.org/~dims/
>
>
=====
Davanum Srinivas - http://webservices.apache.org/~dims/
Re: Question on JCE 1.5 key wraps
Posted by Sean Mullan <Se...@Sun.COM>.
Here are the missing algorithms, please update config.xml
and rerun the tests:
MessageDigest: Provider "SUN" supports MD5, SHA-256, SHA-384, & SHA-512
Signature: Provider "SunJSSE" supports MD5withRSA, SHA1withRSA
MAC: Provider "SunJCE" supports HmacMD5, HmacSHA256, HmacSHA384, HmacSHA512
We do not currently yet support the key wrapping algorithms.
I am not sure why the tests in org.apache.xml.security.test.interop fail
to find SHA1WithRSA, something strange going on there ... when I have
more time I'll look into it.
HTH,
Sean
Davanum Srinivas wrote:
> Sean, Berin,
>
> Done. Here's the updated JDK1.5 run after commenting out lib.jce from classpath.libraries.
>
> -- dims
>
> --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>
>>Just looked in more detail - you also need to install the strong crypto
>>policy files.
>>
>>Cheers,
>> Berin
>>
>>Davanum Srinivas wrote:
>>
>>
>>>Sean,
>>>
>>>Here's my run with JDK1.5 with BC commented out:
>>>http://nagoya.apache.org/~dims/xmlsec-junit/
>>>
>>>-- dims
>>>
>>>--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>>>
>>>
>>>>Sean,
>>>>
>>>>test_five_content_aes128_cbc_kw_aes192
>>>>test_five_content_3des_cbc_kw_aes128
>>>>test_five_data_aes256_cbc_3des
>>>>test_five_data_aes192_cbc_aes256
>>>>
>>>>Basically any interop test where a symmetric key wrap is used. The
>>>>wrap/unwrap tests work, which leads me to believe that I am calling
>>>>using the wrong cipher spec for the unwrap cipher.
>>>>
>>>>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
>>>>or DESEDE, so I *think* what is happening is the JCE is doing a straight
>>>>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
>>>>respectively.
>>>>
>>>>Anyway - still researching, but all ideas welcome :>.
>>>>
>>>>Cheers,
>>>> Berin
>>>>
>>>>Sean Mullan wrote:
>>>>
>>>>
>>>>>Can you tell me which test vectors are failing?
>>>>>
>>>>>--Sean
>>>>>
>>>>>Berin Lautenbach wrote:
>>>>>
>>>>>
>>>>>
>>>>>>Peoples,
>>>>>>
>>>>>>I have just checked in a new version of config.xml that works for most
>>>>>>encryption algorithms under SunJCE (have not yet checked sig).
>>>>>>
>>>>>>One question - I am having issues with symmetric key wraps. The
>>>>>>Baltimore interop tests all fail where a symmetric key wrap is used.
>>>>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
>>>>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
>>>>>>However I get decryption errors.
>>>>>>
>>>>>>Is there something special here that someone is aware of? (Am hoping
>>>>>>on of the Sun gurus in the list can help me here :>.)
>>>>>>
>>>>>>Cheers,
>>>>>> Berin
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>
>>>=====
>>>Davanum Srinivas - http://webservices.apache.org/~dims/
>>>
>>>
>
>
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/
Re: Question on JCE 1.5 key wraps
Posted by Sean Mullan <Se...@Sun.COM>.
I'll look into these failures and get back to you. The signature algorithms definitely
should all work - my guess is it is likely a config problem.
Thanks,
Sean
Davanum Srinivas wrote:
> Sean, Berin,
>
> Done. Here's the updated JDK1.5 run after commenting out lib.jce from classpath.libraries.
>
> -- dims
>
> --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>
>>Just looked in more detail - you also need to install the strong crypto
>>policy files.
>>
>>Cheers,
>> Berin
>>
>>Davanum Srinivas wrote:
>>
>>
>>>Sean,
>>>
>>>Here's my run with JDK1.5 with BC commented out:
>>>http://nagoya.apache.org/~dims/xmlsec-junit/
>>>
>>>-- dims
>>>
>>>--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>>>
>>>
>>>>Sean,
>>>>
>>>>test_five_content_aes128_cbc_kw_aes192
>>>>test_five_content_3des_cbc_kw_aes128
>>>>test_five_data_aes256_cbc_3des
>>>>test_five_data_aes192_cbc_aes256
>>>>
>>>>Basically any interop test where a symmetric key wrap is used. The
>>>>wrap/unwrap tests work, which leads me to believe that I am calling
>>>>using the wrong cipher spec for the unwrap cipher.
>>>>
>>>>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
>>>>or DESEDE, so I *think* what is happening is the JCE is doing a straight
>>>>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
>>>>respectively.
>>>>
>>>>Anyway - still researching, but all ideas welcome :>.
>>>>
>>>>Cheers,
>>>> Berin
>>>>
>>>>Sean Mullan wrote:
>>>>
>>>>
>>>>>Can you tell me which test vectors are failing?
>>>>>
>>>>>--Sean
>>>>>
>>>>>Berin Lautenbach wrote:
>>>>>
>>>>>
>>>>>
>>>>>>Peoples,
>>>>>>
>>>>>>I have just checked in a new version of config.xml that works for most
>>>>>>encryption algorithms under SunJCE (have not yet checked sig).
>>>>>>
>>>>>>One question - I am having issues with symmetric key wraps. The
>>>>>>Baltimore interop tests all fail where a symmetric key wrap is used.
>>>>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
>>>>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
>>>>>>However I get decryption errors.
>>>>>>
>>>>>>Is there something special here that someone is aware of? (Am hoping
>>>>>>on of the Sun gurus in the list can help me here :>.)
>>>>>>
>>>>>>Cheers,
>>>>>> Berin
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>
>>>=====
>>>Davanum Srinivas - http://webservices.apache.org/~dims/
>>>
>>>
>
>
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/
Re: Question on JCE 1.5 key wraps
Posted by Davanum Srinivas <di...@yahoo.com>.
Sean, Berin,
Done. Here's the updated JDK1.5 run after commenting out lib.jce from classpath.libraries.
-- dims
--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> Just looked in more detail - you also need to install the strong crypto
> policy files.
>
> Cheers,
> Berin
>
> Davanum Srinivas wrote:
>
> > Sean,
> >
> > Here's my run with JDK1.5 with BC commented out:
> > http://nagoya.apache.org/~dims/xmlsec-junit/
> >
> > -- dims
> >
> > --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> >
> >>Sean,
> >>
> >>test_five_content_aes128_cbc_kw_aes192
> >>test_five_content_3des_cbc_kw_aes128
> >>test_five_data_aes256_cbc_3des
> >>test_five_data_aes192_cbc_aes256
> >>
> >>Basically any interop test where a symmetric key wrap is used. The
> >>wrap/unwrap tests work, which leads me to believe that I am calling
> >>using the wrong cipher spec for the unwrap cipher.
> >>
> >>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
> >>or DESEDE, so I *think* what is happening is the JCE is doing a straight
> >>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
> >>respectively.
> >>
> >>Anyway - still researching, but all ideas welcome :>.
> >>
> >>Cheers,
> >> Berin
> >>
> >>Sean Mullan wrote:
> >>
> >>>Can you tell me which test vectors are failing?
> >>>
> >>>--Sean
> >>>
> >>>Berin Lautenbach wrote:
> >>>
> >>>
> >>>>Peoples,
> >>>>
> >>>>I have just checked in a new version of config.xml that works for most
> >>>>encryption algorithms under SunJCE (have not yet checked sig).
> >>>>
> >>>>One question - I am having issues with symmetric key wraps. The
> >>>>Baltimore interop tests all fail where a symmetric key wrap is used.
> >>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
> >>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
> >>>>However I get decryption errors.
> >>>>
> >>>>Is there something special here that someone is aware of? (Am hoping
> >>>>on of the Sun gurus in the list can help me here :>.)
> >>>>
> >>>>Cheers,
> >>>> Berin
> >>>>
> >>>
> >>>
> >>>
> >>>
> >
> >
> > =====
> > Davanum Srinivas - http://webservices.apache.org/~dims/
> >
> >
=====
Davanum Srinivas - http://webservices.apache.org/~dims/
Re: Question on JCE 1.5 key wraps
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Just looked in more detail - you also need to install the strong crypto
policy files.
Cheers,
Berin
Davanum Srinivas wrote:
> Sean,
>
> Here's my run with JDK1.5 with BC commented out:
> http://nagoya.apache.org/~dims/xmlsec-junit/
>
> -- dims
>
> --- Berin Lautenbach <be...@wingsofhermes.org> wrote:
>
>>Sean,
>>
>>test_five_content_aes128_cbc_kw_aes192
>>test_five_content_3des_cbc_kw_aes128
>>test_five_data_aes256_cbc_3des
>>test_five_data_aes192_cbc_aes256
>>
>>Basically any interop test where a symmetric key wrap is used. The
>>wrap/unwrap tests work, which leads me to believe that I am calling
>>using the wrong cipher spec for the unwrap cipher.
>>
>>Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
>>or DESEDE, so I *think* what is happening is the JCE is doing a straight
>>encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
>>respectively.
>>
>>Anyway - still researching, but all ideas welcome :>.
>>
>>Cheers,
>> Berin
>>
>>Sean Mullan wrote:
>>
>>>Can you tell me which test vectors are failing?
>>>
>>>--Sean
>>>
>>>Berin Lautenbach wrote:
>>>
>>>
>>>>Peoples,
>>>>
>>>>I have just checked in a new version of config.xml that works for most
>>>>encryption algorithms under SunJCE (have not yet checked sig).
>>>>
>>>>One question - I am having issues with symmetric key wraps. The
>>>>Baltimore interop tests all fail where a symmetric key wrap is used.
>>>>The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
>>>>unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
>>>>However I get decryption errors.
>>>>
>>>>Is there something special here that someone is aware of? (Am hoping
>>>>on of the Sun gurus in the list can help me here :>.)
>>>>
>>>>Cheers,
>>>> Berin
>>>>
>>>
>>>
>>>
>>>
>
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/
>
>
Re: Question on JCE 1.5 key wraps
Posted by Davanum Srinivas <di...@yahoo.com>.
Sean,
Here's my run with JDK1.5 with BC commented out:
http://nagoya.apache.org/~dims/xmlsec-junit/
-- dims
--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> Sean,
>
> test_five_content_aes128_cbc_kw_aes192
> test_five_content_3des_cbc_kw_aes128
> test_five_data_aes256_cbc_3des
> test_five_data_aes192_cbc_aes256
>
> Basically any interop test where a symmetric key wrap is used. The
> wrap/unwrap tests work, which leads me to believe that I am calling
> using the wrong cipher spec for the unwrap cipher.
>
> Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
> or DESEDE, so I *think* what is happening is the JCE is doing a straight
> encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
> respectively.
>
> Anyway - still researching, but all ideas welcome :>.
>
> Cheers,
> Berin
>
> Sean Mullan wrote:
> > Can you tell me which test vectors are failing?
> >
> > --Sean
> >
> > Berin Lautenbach wrote:
> >
> >> Peoples,
> >>
> >> I have just checked in a new version of config.xml that works for most
> >> encryption algorithms under SunJCE (have not yet checked sig).
> >>
> >> One question - I am having issues with symmetric key wraps. The
> >> Baltimore interop tests all fail where a symmetric key wrap is used.
> >> The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
> >> unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
> >> However I get decryption errors.
> >>
> >> Is there something special here that someone is aware of? (Am hoping
> >> on of the Sun gurus in the list can help me here :>.)
> >>
> >> Cheers,
> >> Berin
> >>
> >
> >
> >
> >
=====
Davanum Srinivas - http://webservices.apache.org/~dims/
Re: Question on JCE 1.5 key wraps
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Sean,
test_five_content_aes128_cbc_kw_aes192
test_five_content_3des_cbc_kw_aes128
test_five_data_aes256_cbc_3des
test_five_data_aes192_cbc_aes256
Basically any interop test where a symmetric key wrap is used. The
wrap/unwrap tests work, which leads me to believe that I am calling
using the wrong cipher spec for the unwrap cipher.
Unfortunately, the Sun JCE doesn't take AESWrap or DESEDEWrap, only AES
or DESEDE, so I *think* what is happening is the JCE is doing a straight
encrypt/decrypt rather than an AES Key Unwrap or 3DES based CMS Unwrap
respectively.
Anyway - still researching, but all ideas welcome :>.
Cheers,
Berin
Sean Mullan wrote:
> Can you tell me which test vectors are failing?
>
> --Sean
>
> Berin Lautenbach wrote:
>
>> Peoples,
>>
>> I have just checked in a new version of config.xml that works for most
>> encryption algorithms under SunJCE (have not yet checked sig).
>>
>> One question - I am having issues with symmetric key wraps. The
>> Baltimore interop tests all fail where a symmetric key wrap is used.
>> The BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the
>> unwrap algorithms. The SunJCE , I think, uses "AES" and "DESEde"
>> However I get decryption errors.
>>
>> Is there something special here that someone is aware of? (Am hoping
>> on of the Sun gurus in the list can help me here :>.)
>>
>> Cheers,
>> Berin
>>
>
>
>
>
Re: Question on JCE 1.5 key wraps
Posted by Sean Mullan <Se...@Sun.COM>.
Can you tell me which test vectors are failing?
--Sean
Berin Lautenbach wrote:
> Peoples,
>
> I have just checked in a new version of config.xml that works for most
> encryption algorithms under SunJCE (have not yet checked sig).
>
> One question - I am having issues with symmetric key wraps. The
> Baltimore interop tests all fail where a symmetric key wrap is used. The
> BC JCE takes an algorithm of "AESWrap" or "DESEDEWrap" for the unwrap
> algorithms. The SunJCE , I think, uses "AES" and "DESEde" However I get
> decryption errors.
>
> Is there something special here that someone is aware of? (Am hoping on
> of the Sun gurus in the list can help me here :>.)
>
> Cheers,
> Berin
>