
From nobody Mon Mar 13 11:32:54 2017
Return-Path: <asanso@adobe.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40F98129771 for <jose@ietfa.amsl.com>; Mon, 13 Mar 2017 11:32:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level: 
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=adobe.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id afk3q-9lDgaE for <jose@ietfa.amsl.com>; Mon, 13 Mar 2017 11:32:52 -0700 (PDT)
Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0061.outbound.protection.outlook.com [104.47.38.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B3D712945E for <jose@ietf.org>; Mon, 13 Mar 2017 11:32:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=adobe.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tqKQioiDfAVZMkyCxgNvWjqP0llfxm7C4Qxhy73/j20=; b=MmFxmWmoSDXyBpWuCAktHduNLovi7u4ELAexoBv4Hunwpyd2kFLOYLC+DZV8vFAssWCTjiNYvbKHjlfRMjkHaR/bns9G5Ch6Eirtp0xdmgtWGYb1a6WxwynfE9uO4jzzJWGPpI/kN0HqGhFmGh0GpuhO1Y9yj1+fK14lQNzbnXU=
Received: from BY1PR0201MB1030.namprd02.prod.outlook.com (10.161.203.148) by BY1PR0201MB1029.namprd02.prod.outlook.com (10.161.203.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.961.17; Mon, 13 Mar 2017 18:32:50 +0000
Received: from BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) by BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) with mapi id 15.01.0961.021; Mon, 13 Mar 2017 18:32:50 +0000
From: Antonio Sanso <asanso@adobe.com>
To: John Bradley <ve7jtb@ve7jtb.com>
Thread-Topic: [jose] Use of ECDH-ES in JWE
Thread-Index: AQHSgsDPoQk+ME/+VEGhScUUvt0P5qFmgv4AgABHsQCAAE0iAIAsMyQA
Date: Mon, 13 Mar 2017 18:32:50 +0000
Message-ID: <5CEC6DB2-A491-43C4-B765-AC0813C1CF69@adobe.com>
References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com>
In-Reply-To: <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: ve7jtb.com; dkim=none (message not signed) header.d=none;ve7jtb.com; dmarc=none action=none header.from=adobe.com;
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [85.5.8.6]
x-microsoft-exchange-diagnostics: 1; BY1PR0201MB1029; 7:T7TJkV6V/FPhztUO094/Y0UNptWyDpLHOnbvSzTJfmHnF0Qa5gSNufKzlRTZ2kkUzmTCPlQitGUC1kYR0Oir/GPZRyVY/dBMtXyXbPv3HHqSlJLgrvpk6Ft+8/pyLDVReWbA7wXqEEe3SMD3aG3L4gCqeTfiikUZ3OFvbODlG7tdCXmhTIhriCN+ivdH7DU5SKPYEoniBx2DrHRdH3CFuzG3iVNatwDC4d+kxRqFA9WL4rrBVNiYfQafncD/MD2bvdSIJQ2ogcNAZxBE+iMPFTaZ/dSyAKGDyUGv9gwGHNPy2OfR6yXE0CvI6TIp1VdeCmj04m37pqlqsY5oOqc5DA==; 20:QoxlkxQVSY76p4SWklrIC52AIsquC2LsWti0tAUVi81eVOq6eb2SmMeoKwxTpIp4PW60pOli2c1//L+tfSUIh5+boFiNgqUqyOgo/dTJEef7RdkKwOMFnbZj5zhEJB9DH78KXVPA7VhgJKEMkj7enf4MGe2bn8L6dAVbGJEEn4g=
x-ms-office365-filtering-correlation-id: 4b5ed7f3-e5bc-4ede-184b-08d46a3f5abf
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:BY1PR0201MB1029; 
x-microsoft-antispam-prvs: <BY1PR0201MB1029E445E6B4FE132757B09ED9250@BY1PR0201MB1029.namprd02.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(201822940525970)(158342451672863)(192374486261705)(211936372134217); 
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123558025)(20161123564025)(20161123555025)(20161123560025)(6072148); SRVR:BY1PR0201MB1029; BCL:0; PCL:0; RULEID:; SRVR:BY1PR0201MB1029; 
x-forefront-prvs: 0245702D7B
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(39860400002)(39450400003)(39410400002)(39850400002)(39840400002)(53754006)(24454002)(377454003)(93886004)(76176999)(7736002)(305945005)(966004)(33656002)(2906002)(81166006)(77096006)(6486002)(86362001)(50986999)(122556002)(25786008)(54356999)(345774005)(6116002)(6436002)(8936002)(3846002)(53546007)(102836003)(2900100001)(3280700002)(106116001)(3660700001)(6916009)(2950100002)(6306002)(4326008)(189998001)(54906002)(66066001)(99286003)(6506006)(6512007)(5660300001)(53936002)(110136004)(38730400002)(229853002)(82746002)(8676002)(6246003)(36756003)(83716003)(10090500001)(104396002)(579124003); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR0201MB1029; H:BY1PR0201MB1030.namprd02.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <929D1D9B05A42E42B7063F31BE70287C@namprd02.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: adobe.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2017 18:32:50.1070 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: fa7b1b5a-7b34-4387-94ae-d2c178decee1
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR0201MB1029
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/BfmV4C9FtOsfn-akb9-F-fgGs5E>
Cc: "jose@ietf.org" <jose@ietf.org>, Vladimir Dzhuvinov <vladimir@connect2id.com>
Subject: Re: [jose] Use of ECDH-ES in JWE
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Mar 2017 18:32:54 -0000

hi all,

as said in order to try spread the voice about this issue I have wrote a bl=
og post and posted in different sources [0,1,2]

I will also submit an errata shortly.

I hope it helps

regards

antonio

[0] http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-=
web.html
[1] http://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovere=
d-in-json-encryption.html
[2] https://auth0.com/blog/critical-vulnerability-in-json-web-encryption/

On Feb 13, 2017, at 4:34 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:

> An errata is possible.   There is no way to update the original RFC.
>=20
> The problem tends to be that most developers miss the errata when reading=
 specs if they ever look at the specs at all.
>=20
> We probably also need a more direct way to communicate this to library de=
velopers as well.
>=20
> In the OIDF we are talking about developing a certification for JOSE/JWT =
libraries like we have for overall server implementations.
>=20
> John B.
>=20
>=20
>> On Feb 13, 2017, at 7:57 AM, Antonio Sanso <asanso@adobe.com> wrote:
>>=20
>> hi Vladimir,
>>=20
>> thanks a lot for taking the time and verifying.
>> I really think it should be mentioned somewhere.
>> The problem is that Elliptic Curves are over the head of many people/dev=
eloper and it should be at least=20
>> some reference on the JOSE spec about defending against this attack.
>> Said that I have so far reviewed 3 implementations and all 3 were someho=
w vulnerable. And counting=85.
>>=20
>> regards
>>=20
>> antonio
>>=20
>> On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov <vladimir@connect2id.com=
> wrote:
>>=20
>>> Hi Antonio,
>>>=20
>>> Thank you for making us aware of this.
>>>=20
>>> I just checked the ECDH-ES section in JWA, and the curve check
>>> apparently hasn't been mentioned:
>>>=20
>>> https://tools.ietf.org/html/rfc7518#section-4.6
>>>=20
>>> It's not in the security considerations either:
>>>=20
>>> https://tools.ietf.org/html/rfc7518#section-8
>>>=20
>>>=20
>>> Vladimir
>>>=20
>>> On 09/02/17 12:39, Antonio Sanso wrote:
>>>> hi all,
>>>>=20
>>>> this mail is highly inspired from a research done by Quan Nguyen [0].
>>>>=20
>>>> As he discovered and mention in his talk there is an high chance the J=
OSE libraries implementing ECDH-ES in JWE are vulnerable to invalid curve a=
ttack.
>>>> Now I read the JWA spec and I did not find any mention that the  ephem=
eral public key contained in the message should be validate in order to be =
on the curve.
>>>> Did I miss this advice in the spec or is it just missing? If it is not=
 clear enough the outcome of the attack will be the attacker completely rec=
over the private static key of the receiver.
>>>> Quan already found a pretty well known JOSE library vulnerable to it. =
So did I.
>>>>=20
>>>> WDYT?
>>>>=20
>>>> regards
>>>>=20
>>>> antonio
>>>>=20
>>>> [0] https://research.google.com/pubs/pub45790.html
>>>> [1] https://tools.ietf.org/html/rfc7518
>>>> _______________________________________________
>>>> jose mailing list
>>>> jose@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/jose
>>>=20
>>>=20
>>> _______________________________________________
>>> jose mailing list
>>> jose@ietf.org
>>> https://www.ietf.org/mailman/listinfo/jose
>>=20
>> _______________________________________________
>> jose mailing list
>> jose@ietf.org
>> https://www.ietf.org/mailman/listinfo/jose
>=20


From nobody Wed Mar 29 09:31:54 2017
Return-Path: <scott@paragonie.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBA5F129444 for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 09:19:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level: 
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paragonie-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id quIPXbyjpsTO for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 09:19:55 -0700 (PDT)
Received: from mail-ot0-x234.google.com (mail-ot0-x234.google.com [IPv6:2607:f8b0:4003:c0f::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CACBF12943A for <jose@ietf.org>; Wed, 29 Mar 2017 09:19:53 -0700 (PDT)
Received: by mail-ot0-x234.google.com with SMTP id t8so13658354otf.3 for <jose@ietf.org>; Wed, 29 Mar 2017 09:19:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragonie-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=CPtaEoMlpVUnhDbeUpDLzLFdc47/UBScgKK75BKkGfA=; b=B5UwZAzwJmlgwzdiY3f1TJbis6VyhcIJ2+RRNIoUE6Pwv7Lz+cgxgpVAgiELhtSYM9 TivYL9bnrsyfOkhYmUap16IxTREeOwddkFvl8F0KJJd7nd/UVl2J0U2NB8vOS6sZQh8H dei9XrJxR0TAVXYV7ysPI16StwlgTWKJBkRXrRgetwYk8p4iAJBrsyziIjp3hhoWphb7 3OO4WtLdEXustYgtabZHtISFdpgGsOFtrDIyEgDjQsId75PX6kMr7MJeY+kYX1XmkjQ4 X1BPFHNmhNG5fk3y1VhDh4+z86iDB7dx6zrTHn6Vv+5Y/85hZslp2xbdtGxTfrPlTXQ9 /SAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=CPtaEoMlpVUnhDbeUpDLzLFdc47/UBScgKK75BKkGfA=; b=AtbOYo8pfDYGHUoP17XNGJy5SqFneKfxIHTYX+RoA2QsOs1+a9Exd5yQuFn8BVXDhq zJuOggnaf8XGEjBGB/g2ICZ7fc4JWowoNw7AJ9uUXunCEYKKwkJbvHPmFDkh5RltPHSi XDaQPA6RW3GQAP+nfw/yd45g5ZvUBE9edhiZApX6rLaTy1l2LODI49GGb69BB/KBt3n0 cgHflo8/+7HK8K4VI12C/pTWB/XH3y2h27O4Db4LL9YO60Ntyv6biVwffG5itN1ZP6c2 d4hAgTfEDDYXfg96xpTcZZ5M5koI7DFo6K9wWbr0LOWqwuN0MGW5kN8x7EC357tiLCMF WUig==
X-Gm-Message-State: AFeK/H2d8v1s9FXq4Zh1ucpyBAqcNp1UV0kvnXHzeJmS3dzsAhEbRN1WTKi1ntlByX1J+2Ptmsg5gziCG76PrQ==
X-Received: by 10.157.28.142 with SMTP id l14mr641914ota.199.1490804392895; Wed, 29 Mar 2017 09:19:52 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.46.198 with HTTP; Wed, 29 Mar 2017 09:19:52 -0700 (PDT)
From: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Date: Wed, 29 Mar 2017 12:19:52 -0400
Message-ID: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com>
To: jose@ietf.org
Content-Type: multipart/alternative; boundary=f40304354d8444bf1e054be0f2fc
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/Y8gLVAXVPorvF_hnv0L5F4oS8A4>
X-Mailman-Approved-At: Wed, 29 Mar 2017 09:31:52 -0700
Subject: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 16:19:58 -0000

--f40304354d8444bf1e054be0f2fc
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello,

We've outlined some suggestions to make a JOSE replacement/upgrade more
secure. Our suggestions are outlined at
https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03,
but I have mirrored them below.

Changes to JOSE that will prevent insecurity
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#d=
eletions>
Deletions
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#j=
ws-and-jwe>JWS
and JWE
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#d=
rop-the-alg-header>Drop
the alg header

Neither JOSE users nor JOSE library designers should be required to
understand cryptography primitives. At a lower level, this can lead to badl=
y
implemented primitives
<http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1>. On a
higher level, this can lead to reasoning by lego
<http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wrong-w=
ay-to-think-about>
.

For all the reasons outlined here
<https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-tha=
t-everyone-should-avoid>
and here
<https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens>, the
alg header (and algorithm agility in its entirety) should be considered
harmful.
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#j=
we>
JWE
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#d=
rop-the-enc-header>Drop
the enc header

For the same reason we're dropping the alg header, we should drop the enc
header.
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#c=
onsider-dropping-the-zip-header>Consider
dropping the zip header

As we've seen with CRIME <https://en.wikipedia.org/wiki/CRIME> and BREACH
<http://breachattack.com/>, as well as this error oracle attack against
iMessage
<https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-i=
message/>,
compression can introduce side-channels that totally undermine
confidentiality.

This one is less of a hard-and-fast requirement to make JOSE secure, but I
still strongly recommend it.
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#a=
dditions>
Additions
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#j=
ws-and-jwe-1>JWS
and JWE
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#n=
ew-header-ver-version>New
header: ver (version)

Instead of letting library developers and users mix-and-match cryptography
algorithms, the only choice they should be given is, "Which version are we
using?" Versions can look like this:

   - Version 1:
      - HMAC-SHA256 for shared-key authentication
      - AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key
      encryption
      - RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM fo=
r
      public-key encryption, min. key size: 2048-bit
      - RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital
      signatures, min. key size: 2048-bit
   - Version 2:
      - HMAC-SHA256 for shared-key authentication
      - AES-256-GCM for shared-key encryption
      - ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key
      encryption
         - Libraries must verify that the point is on the curve
      - ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979
      (deterministic ECDSA), for public-key digital signatures
   - Version 3:
      - HMAC-SHA512-256 for shared-key authentication
         - As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not
         HMAC-SHA-512/256.
      - Xsalsa20poly1305 for shared-key encryption
      - X25519 + Xsalsa20poly1305 for public-key encryption
      - Ed25519 for public-key digital signatures

Libraries that support version 3 SHOULD NOT support version 1.
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#n=
ew-header-mode>New
header: mode

Only four options (case-insensitive):

   - se =3D Shared-key Encryption
   - sa =3D Shared-key Authentication
   - pe =3D Public-key Encryption
   - ps =3D Public-key digital Signatures


=E2=80=8BKind regards,

Security Team
Paragon Initiative Enterprises <https://paragonie.com/security>

--f40304354d8444bf1e054be0f2fc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:monospac=
e,monospace">Hello,</div><div class=3D"gmail_default" style=3D"font-family:=
monospace,monospace"><br></div><div class=3D"gmail_default" style=3D"font-f=
amily:monospace,monospace">We&#39;ve outlined some suggestions to make a JO=
SE replacement/upgrade more secure. Our suggestions are outlined at <a href=
=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c0=
3">https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
</a>, but I have mirrored them below.</div><div class=3D"gmail_default" sty=
le=3D"font-family:monospace,monospace"><br></div><div class=3D"gmail_defaul=
t" style=3D"font-family:monospace,monospace"><h1>Changes to JOSE that will =
prevent insecurity</h1>
<h2><a id=3D"gmail-user-content-deletions" class=3D"gmail-anchor" href=3D"h=
ttps://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#del=
etions"></a>Deletions</h2>
<h3><a id=3D"gmail-user-content-jws-and-jwe" class=3D"gmail-anchor" href=3D=
"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#j=
ws-and-jwe"></a>JWS and JWE</h3>
<h4><a id=3D"gmail-user-content-drop-the-alg-header" class=3D"gmail-anchor"=
 href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#drop-the-alg-header"></a>Drop the <code>alg</code> header</h4>
<p>Neither JOSE users nor JOSE library designers should be required to=20
understand cryptography primitives. At a lower level, this can lead to <a h=
ref=3D"http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1">bad=
ly implemented primitives</a>. On a higher level, this can lead to <a href=
=3D"http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wron=
g-way-to-think-about">reasoning by lego</a>.</p>
<p>For all the reasons outlined <a href=3D"https://paragonie.com/blog/2017/=
03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid">here</a>=
 and <a href=3D"https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-we=
b-tokens">here</a>, the <code>alg</code> header (and algorithm agility in i=
ts entirety) should be considered harmful.</p>
<h3><a id=3D"gmail-user-content-jwe" class=3D"gmail-anchor" href=3D"https:/=
/gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#jwe"></a>=
JWE</h3>
<h4><a id=3D"gmail-user-content-drop-the-enc-header" class=3D"gmail-anchor"=
 href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#drop-the-enc-header"></a>Drop the <code>enc</code> header</h4>
<p>For the same reason we&#39;re dropping the <code>alg</code> header, we s=
hould drop the <code>enc</code> header.</p>
<h4><a id=3D"gmail-user-content-consider-dropping-the-zip-header" class=3D"=
gmail-anchor" href=3D"https://gist.github.com/paragonie-scott/c88290347c258=
9b0cd38d8bb6ac27c03#consider-dropping-the-zip-header"></a>Consider dropping=
 the <code>zip</code> header</h4>
<p>As we&#39;ve seen with <a href=3D"https://en.wikipedia.org/wiki/CRIME">C=
RIME</a> and <a href=3D"http://breachattack.com/">BREACH</a>, as well as th=
is <a href=3D"https://blog.cryptographyengineering.com/2016/03/21/attack-of=
-week-apple-imessage/">error oracle attack against iMessage</a>, compressio=
n can introduce side-channels that totally undermine confidentiality.</p>
<p>This one is less of a hard-and-fast requirement to make JOSE secure, but=
 I still strongly recommend it.</p>
<h2><a id=3D"gmail-user-content-additions" class=3D"gmail-anchor" href=3D"h=
ttps://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#add=
itions"></a>Additions</h2>
<h3><a id=3D"gmail-user-content-jws-and-jwe-1" class=3D"gmail-anchor" href=
=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c0=
3#jws-and-jwe-1"></a>JWS and JWE</h3>
<h4><a id=3D"gmail-user-content-new-header-ver-version" class=3D"gmail-anch=
or" href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8b=
b6ac27c03#new-header-ver-version"></a>New header: <code>ver</code> (version=
)</h4>
<p>Instead of letting library developers and users mix-and-match=20
cryptography algorithms, the only choice they should be given is, &quot;Whi=
ch
 version are we using?&quot; Versions can look like this:</p>
<ul>
<li>Version 1:
<ul>
<li>HMAC-SHA256 for shared-key authentication</li>
<li>AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key encry=
ption</li>
<li>RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for pu=
blic-key encryption, min. key size: 2048-bit</li>
<li>RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital signat=
ures, min. key size: 2048-bit</li>
</ul>
</li>
<li>Version 2:
<ul>
<li>HMAC-SHA256 for shared-key authentication</li>
<li>AES-256-GCM for shared-key encryption</li>
<li>ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key encryptio=
n
<ul>
<li>Libraries must verify that the point is on the curve</li>
</ul>
</li>
<li>ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministic =
ECDSA), for public-key digital signatures</li>
</ul>
</li>
<li>Version 3:
<ul>
<li>HMAC-SHA512-256 for shared-key authentication
<ul>
<li>As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not HMAC-SHA-5=
12/256.</li>
</ul>
</li>
<li>Xsalsa20poly1305 for shared-key encryption</li>
<li>X25519 + Xsalsa20poly1305 for public-key encryption</li>
<li>Ed25519 for public-key digital signatures</li>
</ul>
</li>
</ul>
<p>Libraries that support version 3 SHOULD NOT support version 1.</p>
<h4><a id=3D"gmail-user-content-new-header-mode" class=3D"gmail-anchor" hre=
f=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c=
03#new-header-mode"></a>New header: <code>mode</code></h4>
<p>Only four options (case-insensitive):</p>
<ul>
<li><code>se</code> =3D Shared-key Encryption</li>
<li><code>sa</code> =3D Shared-key Authentication</li>
<li><code>pe</code> =3D Public-key Encryption</li>
<li><code>ps</code> =3D Public-key digital Signatures</li></ul></div><div c=
lass=3D"gmail_default" style=3D"font-family:monospace,monospace">=C2=A0</di=
v><div><div class=3D"gmail_default" style=3D"font-family:monospace,monospac=
e">=E2=80=8BKind regards,</div></div><br clear=3D"all"><div><div class=3D"g=
mail_signature"><div dir=3D"ltr">Security Team<div><a href=3D"https://parag=
onie.com/security" target=3D"_blank">Paragon Initiative Enterprises</a></di=
v></div></div></div>
</div>

--f40304354d8444bf1e054be0f2fc--


From nobody Wed Mar 29 11:23:05 2017
Return-Path: <jricher@mit.edu>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E399212778D for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:23:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level: 
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hHZrq3KUyYYL for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:22:53 -0700 (PDT)
Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51E031292FD for <jose@ietf.org>; Wed, 29 Mar 2017 11:22:52 -0700 (PDT)
X-AuditID: 12074425-62bff70000001350-d2-58dbfb7b1753
Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by  (Symantec Messaging Gateway) with SMTP id 92.AF.04944.B7BFBD85; Wed, 29 Mar 2017 14:22:51 -0400 (EDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id v2TIMo6P027857; Wed, 29 Mar 2017 14:22:50 -0400
Received: from [192.168.1.71] (104-182-133-163.lightspeed.cicril.sbcglobal.net [104.182.133.163]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v2TIMljU005579 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 29 Mar 2017 14:22:49 -0400
From: Justin Richer <jricher@mit.edu>
Message-Id: <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu>
Content-Type: multipart/alternative; boundary="Apple-Mail=_43069A7D-907E-40F7-B1A5-28974F62E1A2"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Date: Wed, 29 Mar 2017 13:22:46 -0500
In-Reply-To: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com>
Cc: jose@ietf.org
To: Paragon Initiative Enterprises Security Team <security@paragonie.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com>
X-Mailer: Apple Mail (2.3259)
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphleLIzCtJLcpLzFFi42IRYrdT0a3+fTvCYPdhdos1a7qZLB50rGJx YPJYsuQnk8f1Rs8Apigum5TUnMyy1CJ9uwSujMkrXzMV3CmqONf/nLmB8WhqFyMnh4SAicTD V9eYuhi5OIQE2pgkPn3rZYRwNjJKnHoyEypzj0ni17c2dpAWNgFVielrWphAbF4BK4mZUw+y gdjMAkkSR/avZYGI60vMPnMJzBYWMJdo33mcFcRmAep9sXcJWD2nQKDEpRlLmSB6BSUmPd7A CGKLCHhKnNowBywuJBAgcXvzAnaIU2Ul3v5awjyBkX8WknWzkKyDiGtLLFv4mhnC1pTY370c i7iGROe3iawLGNlWMcqm5Fbp5iZm5hSnJusWJyfm5aUW6Vro5WaW6KWmlG5iBAe2i+oOxjl/ vQ4xCnAwKvHwVqy9HSHEmlhWXJl7iFGSg0lJlPeEIVCILyk/pTIjsTgjvqg0J7X4EKMEB7OS CK/WJ6Acb0piZVVqUT5MSpqDRUmcV1yjMUJIID2xJDU7NbUgtQgmK8PBoSTBG/ALqFGwKDU9 tSItM6cEIc3EwQkynAdo+MOfIMOLCxJzizPTIfKnGBWlxHlFQJoFQBIZpXlwvaDEk7GtdfEr RnGgV4R5o0GqeIBJC677FdBgJqDB4ja3QAaXJCKkpBoYfXKuPgj78WzamsqPbsV9uUmHLzwW feVofGttr6uljs6CWeu1W3tv9E+b3/bs+bEFzilCQj+/ddu+evpJZmO5BuMBM/vuNb7O1ode 7Tk1aU/sEyE2XRbllJ9uKvZ8D4MitvXW+vQ73rVknPUjlsEx2mBiJJfXXNd1hYvTtLMq2x52 PbSokpNRYinOSDTUYi4qTgQAFZt4ThcDAAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/HCO1UxeJWbD4lVSF3-Da4wL2lTg>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 18:23:03 -0000

--Apple-Mail=_43069A7D-907E-40F7-B1A5-28974F62E1A2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=9C=
alg: HS256=E2=80=9D or the like, how is that any different from =
substituting =E2=80=9Cmode: ps=E2=80=9D with =E2=80=9Cmode: sa=E2=80=9D? =
There have been some reasonable arguments for removing the algorithm =
selection from the JOSE package, but this proposal doesn=E2=80=99t do =
that. Instead, it simply defines *new* headers for algorithm selection. =
Ergo, unless I=E2=80=99m missing a key point here, this is just kicking =
things down the road a little bit.

 =E2=80=94 Justin

> On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Security =
Team <security@paragonie.com> wrote:
>=20
> Hello,
>=20
> We've outlined some suggestions to make a JOSE replacement/upgrade =
more secure. Our suggestions are outlined at =
https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03 =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03>=
, but I have mirrored them below.
>=20
> Changes to JOSE that will prevent insecurity
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
deletions>Deletions
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
jws-and-jwe>JWS and JWE
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
drop-the-alg-header>Drop the alg header
>=20
> Neither JOSE users nor JOSE library designers should be required to =
understand cryptography primitives. At a lower level, this can lead to =
badly implemented primitives =
<http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1>. On a =
higher level, this can lead to reasoning by lego =
<http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wrong-=
way-to-think-about>.
>=20
> For all the reasons outlined here =
<https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-th=
at-everyone-should-avoid> and here =
<https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens>, =
the alg header (and algorithm agility in its entirety) should be =
considered harmful.
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
jwe>JWE
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
drop-the-enc-header>Drop the enc header
>=20
> For the same reason we're dropping the alg header, we should drop the =
enc header.
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
consider-dropping-the-zip-header>Consider dropping the zip header
>=20
> As we've seen with CRIME <https://en.wikipedia.org/wiki/CRIME> and =
BREACH <http://breachattack.com/>, as well as this error oracle attack =
against iMessage =
<https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-=
imessage/>, compression can introduce side-channels that totally =
undermine confidentiality.
>=20
> This one is less of a hard-and-fast requirement to make JOSE secure, =
but I still strongly recommend it.
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
additions>Additions
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
jws-and-jwe-1>JWS and JWE
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
new-header-ver-version>New header: ver (version)
>=20
> Instead of letting library developers and users mix-and-match =
cryptography algorithms, the only choice they should be given is, "Which =
version are we using?" Versions can look like this:
>=20
> Version 1:
> HMAC-SHA256 for shared-key authentication
> AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key =
encryption
> RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for =
public-key encryption, min. key size: 2048-bit
> RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital =
signatures, min. key size: 2048-bit
> Version 2:
> HMAC-SHA256 for shared-key authentication
> AES-256-GCM for shared-key encryption
> ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key =
encryption
> Libraries must verify that the point is on the curve
> ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministic =
ECDSA), for public-key digital signatures
> Version 3:
> HMAC-SHA512-256 for shared-key authentication
> As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not =
HMAC-SHA-512/256.
> Xsalsa20poly1305 for shared-key encryption
> X25519 + Xsalsa20poly1305 for public-key encryption
> Ed25519 for public-key digital signatures
> Libraries that support version 3 SHOULD NOT support version 1.
>=20
>  =
<https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#=
new-header-mode>New header: mode
>=20
> Only four options (case-insensitive):
>=20
> se =3D Shared-key Encryption
> sa =3D Shared-key Authentication
> pe =3D Public-key Encryption
> ps =3D Public-key digital Signatures
> =20
> =E2=80=8BKind regards,
>=20
> Security Team
> Paragon Initiative Enterprises =
<https://paragonie.com/security>__________________________________________=
_____
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose


--Apple-Mail=_43069A7D-907E-40F7-B1A5-28974F62E1A2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D"">If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D =
with =E2=80=9Calg: HS256=E2=80=9D or the like, how is that any different =
from substituting =E2=80=9Cmode: ps=E2=80=9D with =E2=80=9Cmode: sa=E2=80=9D=
? There have been some reasonable arguments for removing the algorithm =
selection from the JOSE package, but this proposal doesn=E2=80=99t do =
that. Instead, it simply defines *new* headers for algorithm selection. =
Ergo, unless I=E2=80=99m missing a key point here, this is just kicking =
things down the road a little bit.<div class=3D""><br =
class=3D""></div><div class=3D"">&nbsp;=E2=80=94 Justin</div><div =
class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div =
class=3D"">On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises =
Security Team &lt;<a href=3D"mailto:security@paragonie.com" =
class=3D"">security@paragonie.com</a>&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><meta =
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" =
class=3D""><div dir=3D"ltr" class=3D""><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace">Hello,</div><div =
class=3D"gmail_default" style=3D"font-family:monospace,monospace"><br =
class=3D""></div><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace">We've outlined some =
suggestions to make a JOSE replacement/upgrade more secure. Our =
suggestions are outlined at <a =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03" =
class=3D"">https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8b=
b6ac27c03</a>, but I have mirrored them below.</div><div =
class=3D"gmail_default" style=3D"font-family:monospace,monospace"><br =
class=3D""></div><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace"><h1 class=3D"">Changes to JOSE =
that will prevent insecurity</h1>
<h2 class=3D""><a id=3D"gmail-user-content-deletions" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#deletions"></a>Deletions</h2>
<h3 class=3D""><a id=3D"gmail-user-content-jws-and-jwe" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#jws-and-jwe"></a>JWS and JWE</h3>
<h4 class=3D""><a id=3D"gmail-user-content-drop-the-alg-header" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#drop-the-alg-header"></a>Drop the <code class=3D"">alg</code> =
header</h4><p class=3D"">Neither JOSE users nor JOSE library designers =
should be required to=20
understand cryptography primitives. At a lower level, this can lead to =
<a =
href=3D"http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1" =
class=3D"">badly implemented primitives</a>. On a higher level, this can =
lead to <a =
href=3D"http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the=
-wrong-way-to-think-about" class=3D"">reasoning by lego</a>.</p><p =
class=3D"">For all the reasons outlined <a =
href=3D"https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-stan=
dard-that-everyone-should-avoid" class=3D"">here</a> and <a =
href=3D"https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-token=
s" class=3D"">here</a>, the <code class=3D"">alg</code> header (and =
algorithm agility in its entirety) should be considered harmful.</p>
<h3 class=3D""><a id=3D"gmail-user-content-jwe" class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#jwe"></a>JWE</h3>
<h4 class=3D""><a id=3D"gmail-user-content-drop-the-enc-header" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#drop-the-enc-header"></a>Drop the <code class=3D"">enc</code> =
header</h4><p class=3D"">For the same reason we're dropping the <code =
class=3D"">alg</code> header, we should drop the <code =
class=3D"">enc</code> header.</p>
<h4 class=3D""><a =
id=3D"gmail-user-content-consider-dropping-the-zip-header" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#consider-dropping-the-zip-header"></a>Consider dropping the <code =
class=3D"">zip</code> header</h4><p class=3D"">As we've seen with <a =
href=3D"https://en.wikipedia.org/wiki/CRIME" class=3D"">CRIME</a> and <a =
href=3D"http://breachattack.com/" class=3D"">BREACH</a>, as well as this =
<a =
href=3D"https://blog.cryptographyengineering.com/2016/03/21/attack-of-week=
-apple-imessage/" class=3D"">error oracle attack against iMessage</a>, =
compression can introduce side-channels that totally undermine =
confidentiality.</p><p class=3D"">This one is less of a hard-and-fast =
requirement to make JOSE secure, but I still strongly recommend it.</p>
<h2 class=3D""><a id=3D"gmail-user-content-additions" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#additions"></a>Additions</h2>
<h3 class=3D""><a id=3D"gmail-user-content-jws-and-jwe-1" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#jws-and-jwe-1"></a>JWS and JWE</h3>
<h4 class=3D""><a id=3D"gmail-user-content-new-header-ver-version" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#new-header-ver-version"></a>New header: <code class=3D"">ver</code>=
 (version)</h4><p class=3D"">Instead of letting library developers and =
users mix-and-match=20
cryptography algorithms, the only choice they should be given is, "Which
 version are we using?" Versions can look like this:</p>
<ul class=3D"">
<li class=3D"">Version 1:
<ul class=3D"">
<li class=3D"">HMAC-SHA256 for shared-key authentication</li>
<li class=3D"">AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for =
shared-key encryption</li>
<li class=3D"">RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in =
KEM+DEM for public-key encryption, min. key size: 2048-bit</li>
<li class=3D"">RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key =
digital signatures, min. key size: 2048-bit</li>
</ul>
</li>
<li class=3D"">Version 2:
<ul class=3D"">
<li class=3D"">HMAC-SHA256 for shared-key authentication</li>
<li class=3D"">AES-256-GCM for shared-key encryption</li>
<li class=3D"">ECDH over secp256r1 (NIST P-256) + AES-256-GCM for =
public-key encryption
<ul class=3D"">
<li class=3D"">Libraries must verify that the point is on the curve</li>
</ul>
</li>
<li class=3D"">ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 =
(deterministic ECDSA), for public-key digital signatures</li>
</ul>
</li>
<li class=3D"">Version 3:
<ul class=3D"">
<li class=3D"">HMAC-SHA512-256 for shared-key authentication
<ul class=3D"">
<li class=3D"">As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, =
not HMAC-SHA-512/256.</li>
</ul>
</li>
<li class=3D"">Xsalsa20poly1305 for shared-key encryption</li>
<li class=3D"">X25519 + Xsalsa20poly1305 for public-key encryption</li>
<li class=3D"">Ed25519 for public-key digital signatures</li>
</ul>
</li>
</ul><p class=3D"">Libraries that support version 3 SHOULD NOT support =
version 1.</p>
<h4 class=3D""><a id=3D"gmail-user-content-new-header-mode" =
class=3D"gmail-anchor" =
href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6a=
c27c03#new-header-mode"></a>New header: <code =
class=3D"">mode</code></h4><p class=3D"">Only four options =
(case-insensitive):</p>
<ul class=3D"">
<li class=3D""><code class=3D"">se</code> =3D Shared-key Encryption</li>
<li class=3D""><code class=3D"">sa</code> =3D Shared-key =
Authentication</li>
<li class=3D""><code class=3D"">pe</code> =3D Public-key Encryption</li>
<li class=3D""><code class=3D"">ps</code> =3D Public-key digital =
Signatures</li></ul></div><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace">&nbsp;</div><div class=3D""><div=
 class=3D"gmail_default" style=3D"font-family:monospace,monospace">=E2=80=8B=
Kind regards,</div></div><br clear=3D"all" class=3D""><div class=3D""><div=
 class=3D"gmail_signature"><div dir=3D"ltr" class=3D"">Security Team<div =
class=3D""><a href=3D"https://paragonie.com/security" target=3D"_blank" =
class=3D"">Paragon Initiative Enterprises</a></div></div></div></div>
</div>
_______________________________________________<br class=3D"">jose =
mailing list<br class=3D""><a href=3D"mailto:jose@ietf.org" =
class=3D"">jose@ietf.org</a><br =
class=3D"">https://www.ietf.org/mailman/listinfo/jose<br =
class=3D""></div></blockquote></div><br class=3D""></div></body></html>=

--Apple-Mail=_43069A7D-907E-40F7-B1A5-28974F62E1A2--


From nobody Wed Mar 29 11:36:15 2017
Return-Path: <kathleen.moriarty.ietf@gmail.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E8B112946A for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:36:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HO_uSdI_QKYL for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:36:10 -0700 (PDT)
Received: from mail-pg0-x233.google.com (mail-pg0-x233.google.com [IPv6:2607:f8b0:400e:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C152129455 for <jose@ietf.org>; Wed, 29 Mar 2017 11:36:10 -0700 (PDT)
Received: by mail-pg0-x233.google.com with SMTP id 21so15153253pgg.1 for <jose@ietf.org>; Wed, 29 Mar 2017 11:36:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;  h=mime-version:from:date:message-id:subject:to; bh=fay+0Eg8UklpIyO2+eU09/uV9xyQMH7wsKhiliTfrkM=; b=JqZeZhaUlBvhOMqHTnFJt+5nbAWFYFJyOer/Mt2/RHNhNIDy20BzGD+0eo5s5ZSKfV V6x9NgeAickKXnBY2lRtHJd0c72lhpCS5mtmfp2uWbpkwh/k6n1dBIvCYqIPvnprYizB QqJZHCjDvYaHO8EofimNQHVqYp1E6sGKKYMR+CfJsF4f6WUTczEQVguPC5OfdR4yJFFT YGkUxE+oG99bWc90BlxJyE8j5yuVdNI25o8ZICgwoB1iRACawtB2Gq3SmFz3mONJ66uu Jb0sZPlQBEep4CsV/kbGtrAHCSMnnJASw5jyehSktC7mT39hK3fJHYsMVyubx6EOnIdP HpcA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=fay+0Eg8UklpIyO2+eU09/uV9xyQMH7wsKhiliTfrkM=; b=C671pkMPu16SyotTzJ42F+Wdv32O4bo2rG7clgfEtd/LM8vjmkIZtT9nrXLWhBUpk8 U/Mxt2agGMX+JCndEA5qYK0dZdI1ipfVanIE1svT4dl/Lh/cJAiwh5jvtrddUCQnWWvc oRqDoMZBVE5uo5WVxUGZC9dsyyhsoMZ+qNooGwfMAr5dwCEIcEX2a9YzokhokGQHQVPX pMQEp0ZWvzOm93gY7HodwM/qxhKR5T45GEqf5x8hJwe+uUw6OCgmmxnNAuV0aPq8nKOg OkP7pGpwpgvMpGb9g0x5pXrKusu/O5xyc9UEgKVpGscvpfAMj3ehRvYbSX4S67YpEOeg XokA==
X-Gm-Message-State: AFeK/H1i/jYxpRD1qm4HNfj9mgkKo4Itm7DN9980NXvQv+8hQQiyVC+hUZC0dK5GP8gYA3fQyNS4g0hyOJQEVQ==
X-Received: by 10.84.241.139 with SMTP id b11mr2205583pll.107.1490812570092; Wed, 29 Mar 2017 11:36:10 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.100.183.98 with HTTP; Wed, 29 Mar 2017 11:35:29 -0700 (PDT)
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Wed, 29 Mar 2017 14:35:29 -0400
Message-ID: <CAHbuEH5NQ6+OJ+2kr-v0Lwm-xPthC3sVbzNL69fdBv=QabjD5Q@mail.gmail.com>
To: "jose@ietf.org" <jose@ietf.org>
Content-Type: text/plain; charset=UTF-8
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/iindmO_e2b3hp04DWH6GkymRano>
Subject: [jose] Code and CodeStand
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 18:36:12 -0000

Hello,

If you have an implementation to standards or drafts for this WG,
please considering entering them into CodeStand.  Listing can be to
open source or proprietary implementations, where the open source ones
would link to code repositories.  Before entering your code project,
check to see if the standard, draft, or set of standards/drafts is
already listed as a project.

https://codestand.ietf.org/

CodeStand is fairly new, so if you have any issues, let me know or
codestand-develop@ietf.org

Thanks to those of you that have done this already!

If you are not familiar with CodeStand, here's some more information:
https://codestand.ietf.org/codestand/about/

-- 

Best regards,
Kathleen


From nobody Wed Mar 29 11:36:27 2017
Return-Path: <scott@paragonie.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E113412946F for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:36:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level: 
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paragonie-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QIg6tmXQkNtb for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 11:36:12 -0700 (PDT)
Received: from mail-ot0-x229.google.com (mail-ot0-x229.google.com [IPv6:2607:f8b0:4003:c0f::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DA71120046 for <jose@ietf.org>; Wed, 29 Mar 2017 11:36:12 -0700 (PDT)
Received: by mail-ot0-x229.google.com with SMTP id a5so16374171oth.1 for <jose@ietf.org>; Wed, 29 Mar 2017 11:36:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragonie-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wlMwCtOh5L0Kqmw9sQMQkf7CWMvXbsfL+ZP01XZRlcI=; b=qMgeevG33HFahGte39xQ8TFo2Cm1SSs5O0D5nw9TmcuU6sK7v8hpG2KIrFac90jYaV mfv1WtAagFQ9DBIADfrP9Rb+L2AhaPifbOZB2gaTwvEeb77VZrjSZJu/bVJaqtwwctsl rqyGIaNV1NmiY9YP/8Gp+fNdubSy3z+pRdiQSJiLFs/TOU4qnFQ04khKdPzoJnhSl7Ha rV1bQCZ0q5L2B7KHNHs3BqyDh7OzWnvwagzyv30lh+N5OgErSKMvziPJuoRKZiNBXQmN ZTlfZqSX7XIoOZZ5PeTt236L4GliqjqJtipDzpnZ2X7AuCyp4pAnbwAU6PTZZiIr9AkH dWiQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wlMwCtOh5L0Kqmw9sQMQkf7CWMvXbsfL+ZP01XZRlcI=; b=VSVQm6KENsXKjDjqjI5EU0IbIHO1w55v59ndFjwOp7C3BjY745FsQZc2z5rtwzbzEv POLOQMOvaX486I1Pd1YKQoX4VD90l6/Osq3iGMUjl86lCxTY6yq9eMFZ3oS13KvBU5gQ b9/Wm4ldIGUaDP7ebj1NxF90ZVlH15anXVPTN52wmY78u/1gQoHSZ0OvUiC95ysxnJBC A/gt031oJG90YXJqZFfsuY9wi5lW1MI3o5LyVAXhUSqAezMUB/FsI1/r15UVmRZDtmeT MiSRzNZgjhFuBAM22jLQIq9uRuKSqzkpvSsuE/CmMTKXQt8a7c+QkHRyzMKc9+7JqsGQ +/sw==
X-Gm-Message-State: AFeK/H0wI49w4yggKRACPYgYXB/2xVMKnxceVekQqGuR+zqEkt3R5habAoMRcliMCOeP7r0Rgf2+yoyUQtDSPA==
X-Received: by 10.157.28.142 with SMTP id l14mr945547ota.199.1490812571465; Wed, 29 Mar 2017 11:36:11 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.46.198 with HTTP; Wed, 29 Mar 2017 11:36:11 -0700 (PDT)
In-Reply-To: <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu>
From: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Date: Wed, 29 Mar 2017 14:36:11 -0400
Message-ID: <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com>
To: Justin Richer <jricher@mit.edu>
Cc: jose@ietf.org
Content-Type: multipart/alternative; boundary=f40304354d84bff663054be2d9af
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/u4vxoRzY9xcQeoDzLEA-bf6F8Bk>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 18:36:16 -0000

--f40304354d84bff663054be2d9af
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 29, 2017 at 2:22 PM, Justin Richer <jricher@mit.edu> wrote:

> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=
=9Calg: HS256=E2=80=9D or the like,
> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D wi=
th =E2=80=9Cmode: sa=E2=80=9D?
> =E2=80=8B=E2=80=8B
> =E2=80=8B=E2=80=8B
> There have been some reasonable arguments for removing the algorithm
> selection from the JOSE package, but this proposal doesn=E2=80=99t do tha=
t.
> Instead, it simply defines *new* headers for algorithm selection. Ergo,
> unless I=E2=80=99m missing a key point here, this is just kicking things =
down the
> road a little bit.
>
>  =E2=80=94 Justin
>
> On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Security Tea=
m
> <security@paragonie.com> wrote:
>
> Hello,
>
> We've outlined some suggestions to make a JOSE replacement/upgrade more
> secure. Our suggestions are outlined at https://gist.github.com/
> paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03, but I have mirrored
> them below.
>
> Changes to JOSE that will prevent insecurity
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#deletions>
> Deletions
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#jws-and-jwe>JWS
> and JWE
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#drop-the-alg-header>Drop
> the alg header
>
> Neither JOSE users nor JOSE library designers should be required to
> understand cryptography primitives. At a lower level, this can lead to ba=
dly
> implemented primitives
> <http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1>. On a
> higher level, this can lead to reasoning by lego
> <http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wrong=
-way-to-think-about>
> .
>
> For all the reasons outlined here
> <https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-t=
hat-everyone-should-avoid>
> and here
> <https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens>,
> the alg header (and algorithm agility in its entirety) should be
> considered harmful.
>
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#jwe>
> JWE
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#drop-the-enc-header>Drop
> the enc header
>
> For the same reason we're dropping the alg header, we should drop the enc
> header.
>
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#consider-dropping-the-zip-header>Consider
> dropping the zip header
>
> As we've seen with CRIME <https://en.wikipedia.org/wiki/CRIME> and BREACH
> <http://breachattack.com/>, as well as this error oracle attack against
> iMessage
> <https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple=
-imessage/>,
> compression can introduce side-channels that totally undermine
> confidentiality.
>
> This one is less of a hard-and-fast requirement to make JOSE secure, but =
I
> still strongly recommend it.
>
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#additions>
> Additions
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#jws-and-jwe-1>JWS
> and JWE
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#new-header-ver-version>New
> header: ver (version)
>
> Instead of letting library developers and users mix-and-match cryptograph=
y
> algorithms, the only choice they should be given is, "Which version are w=
e
> using?" Versions can look like this:
>
>    - Version 1:
>       - HMAC-SHA256 for shared-key authentication
>       - AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key
>       encryption
>       - RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM
>       for public-key encryption, min. key size: 2048-bit
>       - RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital
>       signatures, min. key size: 2048-bit
>    - Version 2:
>       - HMAC-SHA256 for shared-key authentication
>       - AES-256-GCM for shared-key encryption
>       - ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key
>       encryption
>          - Libraries must verify that the point is on the curve
>       - ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979
>       (deterministic ECDSA), for public-key digital signatures
>    - Version 3:
>       - HMAC-SHA512-256 for shared-key authentication
>          - As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not
>          HMAC-SHA-512/256.
>       - Xsalsa20poly1305 for shared-key encryption
>       - X25519 + Xsalsa20poly1305 for public-key encryption
>       - Ed25519 for public-key digital signatures
>
> Libraries that support version 3 SHOULD NOT support version 1.
>
> <https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
#new-header-mode>New
> header: mode
>
> Only four options (case-insensitive):
>
>    - se =3D Shared-key Encryption
>    - sa =3D Shared-key Authentication
>    - pe =3D Public-key Encryption
>    - ps =3D Public-key digital Signatures
>
>
> =E2=80=8BKind regards,
>
> Security Team
> Paragon Initiative Enterprises <https://paragonie.com/security>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose
>
>
>
=E2=80=8BHi,

=E2=80=8B
> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=
=9Calg: HS256=E2=80=9D or the like,
> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D wi=
th =E2=80=9Cmode: sa=E2=80=9D?
> =E2=80=8B
> =E2=80=8B


=E2=80=8BThere are more problems than the RS256/HS256 critical vulnerabilit=
y from
2015, but nonetheless, you raise a good point:

=E2=80=8B
The mode should be decided out-of-band, not supplied by the attacker.
=E2=80=8B

Therefore, the mode header must be made optional (i.e. it's purely
informational) and implementations should be encouraged to only operate in
one mode at a time (i.e. not decided by the message they receive).

=E2=80=8B
> =E2=80=8B
> There have been some reasonable arguments for removing the algorithm
> selection from the JOSE package, but this proposal doesn=E2=80=99t do tha=
t.
> Instead, it simply defines *new* headers for algorithm selection. Ergo,
> unless I=E2=80=99m missing a key point here, this is just kicking things =
down the
> road a little bit.


=E2=80=8BThe previous standard allowed people to choose which hash function=
, which
of the NIST P-curves, etc. to use. The new proposal only allows for one
cipher/algorithm per use-case. These algorithm decisions should be made by
experts and given as non-tweakable, hard-coded configuration options. There
is no "a little of column A, a little of column B", you either use version
2 or version 3.

Security Team
Paragon Initiative Enterprises <https://paragonie.com/security>
=E2=80=8B

--f40304354d84bff663054be2d9af
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:monospac=
e,monospace"><span style=3D"font-family:arial,sans-serif">On Wed, Mar 29, 2=
017 at 2:22 PM, Justin Richer </span><span dir=3D"ltr" style=3D"font-family=
:arial,sans-serif">&lt;<a href=3D"mailto:jricher@mit.edu" target=3D"_blank"=
>jricher@mit.edu</a>&gt;</span><span style=3D"font-family:arial,sans-serif"=
> wrote:</span><br></div><div class=3D"gmail_extra"><div class=3D"gmail_quo=
te"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex"><div style=3D"word-wr=
ap:break-word">If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D =
with =E2=80=9Calg: HS256=E2=80=9D or the like, how is that any different fr=
om substituting =E2=80=9Cmode: ps=E2=80=9D with =E2=80=9Cmode: sa=E2=80=9D?=
 <div class=3D"gmail_default" style=3D"font-family:monospace,monospace;disp=
lay:inline">=E2=80=8B=E2=80=8B</div><div class=3D"gmail_default" style=3D"f=
ont-family:monospace,monospace;display:inline">=E2=80=8B=E2=80=8B</div>Ther=
e have been some reasonable arguments for removing the algorithm selection =
from the JOSE package, but this proposal doesn=E2=80=99t do that. Instead, =
it simply defines *new* headers for algorithm selection. Ergo, unless I=E2=
=80=99m missing a key point here, this is just kicking things down the road=
 a little bit.<div><br></div><div>=C2=A0=E2=80=94 Justin</div><div><br><div=
><blockquote type=3D"cite"><div><div class=3D"gmail-h5"><div>On Mar 29, 201=
7, at 11:19 AM, Paragon Initiative Enterprises Security Team &lt;<a href=3D=
"mailto:security@paragonie.com" target=3D"_blank">security@paragonie.com</a=
>&gt; wrote:</div><br class=3D"gmail-m_-60210410901096218Apple-interchange-=
newline"></div></div><div><div><div class=3D"gmail-h5"><div dir=3D"ltr"><di=
v style=3D"font-family:monospace,monospace">Hello,</div><div style=3D"font-=
family:monospace,monospace"><br></div><div style=3D"font-family:monospace,m=
onospace">We&#39;ve outlined some suggestions to make a JOSE replacement/up=
grade more secure. Our suggestions are outlined at <a href=3D"https://gist.=
github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03" target=3D"_bla=
nk">https://gist.github.com/<wbr>paragonie-scott/<wbr>c88290347c2589b0cd38d=
8bb6ac27c<wbr>03</a>, but I have mirrored them below.</div><div style=3D"fo=
nt-family:monospace,monospace"><br></div><div style=3D"font-family:monospac=
e,monospace"><h1>Changes to JOSE that will prevent insecurity</h1>
<h2><a id=3D"gmail-m_-60210410901096218gmail-user-content-deletions" class=
=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.github.com=
/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#deletions" target=3D"_bla=
nk"></a>Deletions</h2>
<h3><a id=3D"gmail-m_-60210410901096218gmail-user-content-jws-and-jwe" clas=
s=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.github.co=
m/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#jws-and-jwe" target=3D"_=
blank"></a>JWS and JWE</h3>
<h4><a id=3D"gmail-m_-60210410901096218gmail-user-content-drop-the-alg-head=
er" class=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.g=
ithub.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#drop-the-alg-hea=
der" target=3D"_blank"></a>Drop the <code>alg</code> header</h4><p>Neither =
JOSE users nor JOSE library designers should be required to=20
understand cryptography primitives. At a lower level, this can lead to <a h=
ref=3D"http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1" tar=
get=3D"_blank">badly implemented primitives</a>. On a higher level, this ca=
n lead to <a href=3D"http://www.cryptofails.com/post/121201011592/reasoning=
-by-lego-the-wrong-way-to-think-about" target=3D"_blank">reasoning by lego<=
/a>.</p><p>For all the reasons outlined <a href=3D"https://paragonie.com/bl=
og/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid" =
target=3D"_blank">here</a> and <a href=3D"https://storify.com/jcuid/thomas-=
h-ptacek-don-t-use-json-web-tokens" target=3D"_blank">here</a>, the <code>a=
lg</code> header (and algorithm agility in its entirety) should be consider=
ed harmful.</p>
<h3><a id=3D"gmail-m_-60210410901096218gmail-user-content-jwe" class=3D"gma=
il-m_-60210410901096218gmail-anchor" href=3D"https://gist.github.com/parago=
nie-scott/c88290347c2589b0cd38d8bb6ac27c03#jwe" target=3D"_blank"></a>JWE</=
h3>
<h4><a id=3D"gmail-m_-60210410901096218gmail-user-content-drop-the-enc-head=
er" class=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.g=
ithub.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#drop-the-enc-hea=
der" target=3D"_blank"></a>Drop the <code>enc</code> header</h4><p>For the =
same reason we&#39;re dropping the <code>alg</code> header, we should drop =
the <code>enc</code> header.</p>
<h4><a id=3D"gmail-m_-60210410901096218gmail-user-content-consider-dropping=
-the-zip-header" class=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"h=
ttps://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#con=
sider-dropping-the-zip-header" target=3D"_blank"></a>Consider dropping the =
<code>zip</code> header</h4><p>As we&#39;ve seen with <a href=3D"https://en=
.wikipedia.org/wiki/CRIME" target=3D"_blank">CRIME</a> and <a href=3D"http:=
//breachattack.com/" target=3D"_blank">BREACH</a>, as well as this <a href=
=3D"https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-appl=
e-imessage/" target=3D"_blank">error oracle attack against iMessage</a>, co=
mpression can introduce side-channels that totally undermine confidentialit=
y.</p><p>This one is less of a hard-and-fast requirement to make JOSE secur=
e, but I still strongly recommend it.</p>
<h2><a id=3D"gmail-m_-60210410901096218gmail-user-content-additions" class=
=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.github.com=
/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#additions" target=3D"_bla=
nk"></a>Additions</h2>
<h3><a id=3D"gmail-m_-60210410901096218gmail-user-content-jws-and-jwe-1" cl=
ass=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.github.=
com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#jws-and-jwe-1" target=
=3D"_blank"></a>JWS and JWE</h3>
<h4><a id=3D"gmail-m_-60210410901096218gmail-user-content-new-header-ver-ve=
rsion" class=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gis=
t.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#new-header-ve=
r-version" target=3D"_blank"></a>New header: <code>ver</code> (version)</h4=
><p>Instead of letting library developers and users mix-and-match=20
cryptography algorithms, the only choice they should be given is, &quot;Whi=
ch
 version are we using?&quot; Versions can look like this:</p>
<ul>
<li>Version 1:
<ul>
<li>HMAC-SHA256 for shared-key authentication</li>
<li>AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key encry=
ption</li>
<li>RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for pu=
blic-key encryption, min. key size: 2048-bit</li>
<li>RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital signat=
ures, min. key size: 2048-bit</li>
</ul>
</li>
<li>Version 2:
<ul>
<li>HMAC-SHA256 for shared-key authentication</li>
<li>AES-256-GCM for shared-key encryption</li>
<li>ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key encryptio=
n
<ul>
<li>Libraries must verify that the point is on the curve</li>
</ul>
</li>
<li>ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministic =
ECDSA), for public-key digital signatures</li>
</ul>
</li>
<li>Version 3:
<ul>
<li>HMAC-SHA512-256 for shared-key authentication
<ul>
<li>As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not HMAC-SHA-5=
12/256.</li>
</ul>
</li>
<li>Xsalsa20poly1305 for shared-key encryption</li>
<li>X25519 + Xsalsa20poly1305 for public-key encryption</li>
<li>Ed25519 for public-key digital signatures</li>
</ul>
</li>
</ul><p>Libraries that support version 3 SHOULD NOT support version 1.</p>
<h4><a id=3D"gmail-m_-60210410901096218gmail-user-content-new-header-mode" =
class=3D"gmail-m_-60210410901096218gmail-anchor" href=3D"https://gist.githu=
b.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03#new-header-mode" tar=
get=3D"_blank"></a>New header: <code>mode</code></h4><p>Only four options (=
case-insensitive):</p>
<ul>
<li><code>se</code> =3D Shared-key Encryption</li>
<li><code>sa</code> =3D Shared-key Authentication</li>
<li><code>pe</code> =3D Public-key Encryption</li>
<li><code>ps</code> =3D Public-key digital Signatures</li></ul></div><div s=
tyle=3D"font-family:monospace,monospace">=C2=A0</div><div><div style=3D"fon=
t-family:monospace,monospace">=E2=80=8BKind regards,</div></div><br clear=
=3D"all"><div><div class=3D"gmail-m_-60210410901096218gmail_signature"><div=
 dir=3D"ltr">Security Team<div><a href=3D"https://paragonie.com/security" t=
arget=3D"_blank">Paragon Initiative Enterprises</a></div></div></div></div>
</div></div></div>
______________________________<wbr>_________________<br>jose mailing list<b=
r><a href=3D"mailto:jose@ietf.org" target=3D"_blank">jose@ietf.org</a><br><=
a href=3D"https://www.ietf.org/mailman/listinfo/jose" target=3D"_blank">htt=
ps://www.ietf.org/mailman/<wbr>listinfo/jose</a><br></div></blockquote></di=
v><br></div></div></blockquote></div><br></div><div class=3D"gmail_extra"><=
div class=3D"gmail_default" style=3D"font-family:monospace,monospace">=E2=
=80=8BHi,</div><div class=3D"gmail_default" style=3D"font-family:monospace,=
monospace"><br></div><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex" class=3D"gmail_quote"><div=
 class=3D"gmail_default" style=3D"font-family:monospace,monospace;display:i=
nline">=E2=80=8B</div><span style=3D"font-size:12.8px">If the problem is su=
bstituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=9Calg: HS256=E2=80=9D o=
r the like, how is that any different from substituting =E2=80=9Cmode: ps=
=E2=80=9D with =E2=80=9Cmode: sa=E2=80=9D?</span><span style=3D"font-size:1=
2.8px">=C2=A0</span><div class=3D"gmail_default" style=3D"font-family:monos=
pace,monospace;display:inline">=E2=80=8B</div>=E2=80=8B</blockquote><br></d=
iv><div class=3D"gmail_extra"><span style=3D"font-family:monospace,monospac=
e"><div class=3D"gmail_default" style=3D"font-family:monospace,monospace;di=
splay:inline">=E2=80=8BThere are more problems than the RS256/HS256 critica=
l vulnerability from 2015, but nonetheless, you raise a good point:=C2=A0</=
div></span></div><div class=3D"gmail_extra"><span style=3D"font-family:mono=
space,monospace"><div class=3D"gmail_default" style=3D"display:inline"><br>=
</div></span></div><div class=3D"gmail_extra"><span style=3D"font-family:mo=
nospace,monospace"><div class=3D"gmail_default" style=3D"display:inline">=
=E2=80=8B</div>The mode should be decided out-of-band, not supplied by the =
attacker.<div class=3D"gmail_default" style=3D"display:inline">=E2=80=8B</d=
iv></span></div><div class=3D"gmail_extra"><span style=3D"font-family:monos=
pace,monospace"><div class=3D"gmail_default" style=3D"display:inline"><br><=
/div></span></div><div class=3D"gmail_extra"><span style=3D"font-family:mon=
ospace,monospace"><div class=3D"gmail_default" style=3D"display:inline">The=
refore, the mode header must be made optional (i.e. it&#39;s purely informa=
tional) and implementations should be encouraged to only operate in one mod=
e at a time (i.e. not decided by the message they receive).</div></span></d=
iv><div class=3D"gmail_extra"><div class=3D"gmail_default" style=3D"font-fa=
mily:monospace,monospace;display:inline"><br></div></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div class=3D"gmail_default" style=3D"font=
-family:monospace,monospace;display:inline">=E2=80=8B</div><div class=3D"gm=
ail_default" style=3D"font-family:monospace,monospace;display:inline">=E2=
=80=8B</div>There have been some reasonable arguments for removing the algo=
rithm selection from the JOSE package, but this proposal doesn=E2=80=99t do=
 that. Instead, it simply defines *new* headers for algorithm selection. Er=
go, unless I=E2=80=99m missing a key point here, this is just kicking thing=
s down the road a little bit.</blockquote><div>=C2=A0</div><div><span style=
=3D"font-family:monospace,monospace"><div class=3D"gmail_default" style=3D"=
font-family:monospace,monospace;display:inline">=E2=80=8BThe previous stand=
ard allowed people to choose which hash function, which of the NIST P-curve=
s, etc. to use. The new proposal only allows for one cipher/algorithm per u=
se-case. These algorithm decisions should be made by experts and given as n=
on-tweakable, hard-coded configuration options. There is no &quot;a little =
of column A, a little of column B&quot;, you either use version 2 or versio=
n 3.</div></span></div><div class=3D"gmail_extra"><div class=3D"gmail_extra=
"><br clear=3D"all"><div><div class=3D"gmail_signature"><div dir=3D"ltr">Se=
curity Team<div><a href=3D"https://paragonie.com/security" target=3D"_blank=
">Paragon Initiative Enterprises</a></div></div></div></div></div><div clas=
s=3D"gmail_default" style=3D"font-family:monospace,monospace">=E2=80=8B</di=
v><br></div></div>

--f40304354d84bff663054be2d9af--


From nobody Wed Mar 29 12:29:13 2017
Return-Path: <nmccallu@redhat.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4F2912963F for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 12:29:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.695
X-Spam-Level: 
X-Spam-Status: No, score=-4.695 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8NYoe99teCgD for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 12:29:09 -0700 (PDT)
Received: from mail-io0-f179.google.com (mail-io0-f179.google.com [209.85.223.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BB9D1200FC for <jose@ietf.org>; Wed, 29 Mar 2017 12:29:09 -0700 (PDT)
Received: by mail-io0-f179.google.com with SMTP id z13so5678986iof.2 for <jose@ietf.org>; Wed, 29 Mar 2017 12:29:09 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=8CanV+1qI0jwIqQbf6PjVp2/l7OtgZTdFb7YyqrkK7M=; b=rcEdGkMwEJwSHyyte15Zknj/IHsF2LuErS2zP60Izce45ti8VoBqYpqsfWmp3vkDcb HszaHYni/XL8UAHzJLQ+8PMPyRR122ooi8scN5t9smZ0K45i24K5glFDh89r8Cd7A2Gm TkSbYEIgOFlAe1yJAGu5Sd07ZdDJFgGVuZ5OCbkk3U0DOHROiYvKQRZYgOAtxVoYyPpw FZrrmL4fyjopcR9znmkafyUQAaU9psqJsD2X/SzzWFG5cL05nqeu7yJuuOiab1w8fuuV b0kHZoU7yj7HsF2xowCbz4xc5lv/W027y7mWMcgWb2TERVw/aD3zkuzvb5/kFYWjGPgz 4aAQ==
X-Gm-Message-State: AFeK/H2vIl42XZtws7X5xynP0Kw6VVTsfS59mmT0ZJ3feirR7kB15pvyESPpKFqu8Ep2K2+ZfbQ68lkAlTnqAnBz
X-Received: by 10.107.192.193 with SMTP id q184mr2836562iof.110.1490815748512;  Wed, 29 Mar 2017 12:29:08 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.164.82 with HTTP; Wed, 29 Mar 2017 12:29:08 -0700 (PDT)
In-Reply-To: <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu> <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com>
From: Nathaniel McCallum <npmccallum@redhat.com>
Date: Wed, 29 Mar 2017 15:29:08 -0400
Message-ID: <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com>
To: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Cc: Justin Richer <jricher@mit.edu>, jose@ietf.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/k602LrvKTC9DSM7rx1Lk17JHjdM>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 19:29:12 -0000

On Wed, Mar 29, 2017 at 2:36 PM, Paragon Initiative Enterprises
Security Team <security@paragonie.com> wrote:
> On Wed, Mar 29, 2017 at 2:22 PM, Justin Richer <jricher@mit.edu> wrote:
>>
>> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=
=9Calg: HS256=E2=80=9D or the like,
>> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D w=
ith =E2=80=9Cmode: sa=E2=80=9D?
>> There have been some reasonable arguments for removing the algorithm
>> selection from the JOSE package, but this proposal doesn=E2=80=99t do th=
at. Instead,
>> it simply defines *new* headers for algorithm selection. Ergo, unless I=
=E2=80=99m
>> missing a key point here, this is just kicking things down the road a li=
ttle
>> bit.
>>
>>  =E2=80=94 Justin
>>
>> On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Security Te=
am
>> <security@paragonie.com> wrote:
>>
>> Hello,
>>
>> We've outlined some suggestions to make a JOSE replacement/upgrade more
>> secure. Our suggestions are outlined at
>> https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c03=
,
>> but I have mirrored them below.
>>
>> Changes to JOSE that will prevent insecurity
>>
>> Deletions
>>
>> JWS and JWE
>>
>> Drop the alg header
>>
>> Neither JOSE users nor JOSE library designers should be required to
>> understand cryptography primitives. At a lower level, this can lead to b=
adly
>> implemented primitives. On a higher level, this can lead to reasoning by
>> lego.
>>
>> For all the reasons outlined here and here, the alg header (and algorith=
m
>> agility in its entirety) should be considered harmful.
>>
>> JWE
>>
>> Drop the enc header
>>
>> For the same reason we're dropping the alg header, we should drop the en=
c
>> header.
>>
>> Consider dropping the zip header
>>
>> As we've seen with CRIME and BREACH, as well as this error oracle attack
>> against iMessage, compression can introduce side-channels that totally
>> undermine confidentiality.
>>
>> This one is less of a hard-and-fast requirement to make JOSE secure, but=
 I
>> still strongly recommend it.
>>
>> Additions
>>
>> JWS and JWE
>>
>> New header: ver (version)
>>
>> Instead of letting library developers and users mix-and-match cryptograp=
hy
>> algorithms, the only choice they should be given is, "Which version are =
we
>> using?" Versions can look like this:
>>
>> Version 1:
>>
>> HMAC-SHA256 for shared-key authentication
>> AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key
>> encryption
>> RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for
>> public-key encryption, min. key size: 2048-bit
>> RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital signatu=
res,
>> min. key size: 2048-bit
>>
>> Version 2:
>>
>> HMAC-SHA256 for shared-key authentication
>> AES-256-GCM for shared-key encryption
>> ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key encryption
>>
>> Libraries must verify that the point is on the curve
>>
>> ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministic
>> ECDSA), for public-key digital signatures
>>
>> Version 3:
>>
>> HMAC-SHA512-256 for shared-key authentication
>>
>> As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not
>> HMAC-SHA-512/256.
>>
>> Xsalsa20poly1305 for shared-key encryption
>> X25519 + Xsalsa20poly1305 for public-key encryption
>> Ed25519 for public-key digital signatures
>>
>> Libraries that support version 3 SHOULD NOT support version 1.
>>
>> New header: mode
>>
>> Only four options (case-insensitive):
>>
>> se =3D Shared-key Encryption
>> sa =3D Shared-key Authentication
>> pe =3D Public-key Encryption
>> ps =3D Public-key digital Signatures
>>
>>
>> Kind regards,
>>
>> Security Team
>> Paragon Initiative Enterprises
>> _______________________________________________
>> jose mailing list
>> jose@ietf.org
>> https://www.ietf.org/mailman/listinfo/jose
>>
>>
>
> Hi,
>
>> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=80=
=9Calg: HS256=E2=80=9D or the like,
>> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D w=
ith =E2=80=9Cmode: sa=E2=80=9D?
>
>
> There are more problems than the RS256/HS256 critical vulnerability from
> 2015, but nonetheless, you raise a good point:
>
> The mode should be decided out-of-band, not supplied by the attacker.
>
> Therefore, the mode header must be made optional (i.e. it's purely
> informational) and implementations should be encouraged to only operate i=
n
> one mode at a time (i.e. not decided by the message they receive).
>
>> There have been some reasonable arguments for removing the algorithm
>> selection from the JOSE package, but this proposal doesn=E2=80=99t do th=
at. Instead,
>> it simply defines *new* headers for algorithm selection. Ergo, unless I=
=E2=80=99m
>> missing a key point here, this is just kicking things down the road a li=
ttle
>> bit.
>
>
> The previous standard allowed people to choose which hash function, which=
 of
> the NIST P-curves, etc. to use. The new proposal only allows for one
> cipher/algorithm per use-case. These algorithm decisions should be made b=
y
> experts and given as non-tweakable, hard-coded configuration options. The=
re
> is no "a little of column A, a little of column B", you either use versio=
n 2
> or version 3.

But the attacker still gets to choose what version to lie about.
Implementers will still have to verify that the expected algorithm (as
defined implicitly by the version) matches the inputs. Failure to
check inputs has been the cause of all the major vulnerabilities. This
plan adds precisely no additional security but comes with great cost
for implementers.

The bottom line is that implementers of JOSE need to know what they're
doing. The expectation that someone can write a JOSE library without
understanding cryptographic primitives is unrealistic.


From nobody Wed Mar 29 13:09:33 2017
Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CF1E129483 for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 13:09:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.02
X-Spam-Level: 
X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rrp5MCy3Gw7Z for <jose@ietfa.amsl.com>; Wed, 29 Mar 2017 13:09:29 -0700 (PDT)
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0105.outbound.protection.outlook.com [104.47.42.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52ABF12995F for <jose@ietf.org>; Wed, 29 Mar 2017 13:09:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0Pqtavy1wiJSaTRO6sqecconXq48Qj30DlHBveIJW04=; b=dncDuT80AriuomE9yjfJTqUiJF/8ql+tw/ZEuNmTnzWtkEDhUMTu5ycwaRfNx5mdtLNnUqpNWnd2PAHYvnANQZcWxuvx1+4/Gh6v1yC/G1D+EC2IHmLHf7B0QSwmeZTXun35NI4cFrzFi0SWpt2N7cFUer8PI7QFeLqh+Pyxr8M=
Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Wed, 29 Mar 2017 20:09:17 +0000
Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.008; Wed, 29 Mar 2017 20:09:16 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: "jose@ietf.org" <jose@ietf.org>
CC: Yaron Sheffer <yaronf.ietf@gmail.com>
Thread-Topic: JOSE/JWT Security Update Presentation
Thread-Index: AdKox9hGUhSH7/ucSU+mXltjus2wcQAAG4BA
Date: Wed, 29 Mar 2017 20:09:16 +0000
Message-ID: <CY4PR21MB05045AD34CD4194ECD77F562F5350@CY4PR21MB0504.namprd21.prod.outlook.com>
References: <CY4PR21MB0504F95D0B36D852BEF0AE9BF5350@CY4PR21MB0504.namprd21.prod.outlook.com>
In-Reply-To: <CY4PR21MB0504F95D0B36D852BEF0AE9BF5350@CY4PR21MB0504.namprd21.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: 
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [67.98.107.27]
x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:5J1KrsDlNBBIJL8iktIqObnZ2Q399rllQ96g5fmjBpTfmzx+hCAbfCbt0J5yDhv0CzwwIGuwuonRE1Xs1j6dsPWp4xx9SlCiatScIx3LHCdliorCoZkSDNTWsFX8/i6qXrNdPaneCroMUhynEmA3oj6+B7kYbcGFpiV1CjLq9SBbJxhk51YnGX+r6UdB39koN0OGPSJWQCVaAQk/GlgnjTgTKeOJR6XM28Qu/VpjLUyfdT7qysK0HYgg2lU9L7RgQp7lIEHoU+MKMml10u6YNKCNCeOV2EqFlW9w1/6NsAJd/06uC0w6ug1Xrd0c4zTUMJd1KV3WTCgzy0VAVWtnnnkTmWtywBE1xqWemE3A0Cg=
x-ms-office365-filtering-correlation-id: 2411dfee-d0eb-4ee8-efbb-08d476df7a6b
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:CY4PR21MB0502; 
x-microsoft-antispam-prvs: <CY4PR21MB0502F015670115F1B183CE73F5350@CY4PR21MB0502.namprd21.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(93006046)(93001046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406075)(20161123558025)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; 
x-forefront-prvs: 0261CCEEDF
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39450400003)(39400400002)(39840400002)(39860400002)(39410400002)(39850400002)(377454003)(102836003)(3846002)(33656002)(122556002)(6916009)(6116002)(790700001)(110136004)(38730400002)(74316002)(8676002)(7110500001)(2351001)(6436002)(1730700003)(81156014)(81166006)(2950100002)(189998001)(6506006)(7696004)(25786009)(8936002)(53546009)(7736002)(39060400002)(229853002)(2420400007)(77096006)(55016002)(106356001)(15650500001)(556974002)(99286003)(66066001)(5640700003)(6306002)(76176999)(54356999)(50986999)(5005710100001)(99936001)(10290500002)(2473003)(54896002)(3280700002)(86612001)(53936002)(9686003)(5890100001)(5630700001)(4326008)(86362001)(3660700001)(2906002)(10710500007)(2501003)(10090500001)(8990500004)(2900100001)(5660300001)(156073002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/mixed; boundary="_004_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2017 20:09:16.7279 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/VvilkxplzrU-hkv78mXk2NKQtGw>
Subject: [jose] FW: JOSE/JWT Security Update Presentation
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 20:09:32 -0000

--_004_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_
Content-Type: multipart/alternative;
	boundary="_000_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_"

--_000_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Also forwarding to the JOSE mailing list...

From: Mike Jones
Sent: Wednesday, March 29, 2017 3:09 PM
To: oauth <oauth@ietf.org>
Cc: 'Yaron Sheffer' <yaronf.ietf@gmail.com>
Subject: JOSE/JWT Security Update Presentation

Yaron Sheffer had asked me to give an update on JOSE/JWT security to the Se=
cEvent working group.  As promised during our working group meeting Monday,=
 that presentation is attached.  At the microphone, Kathleen suggested that=
 we may want to collect information about best practices for implementers a=
nd deployers and write a BCP containing them.  She said that JWT is being u=
sed in many places in the IETF at this point.

                                                       -- Mike

--_000_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.EmailStyle18
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:#002060;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"color:#002060">Also forwarding to the=
 JOSE mailing list&#8230;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><a name=3D"_MailEndCompose"><span style=3D"color:#00=
2060"><o:p>&nbsp;</o:p></span></a></p>
<span style=3D"mso-bookmark:_MailEndCompose"></span>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b>From:</b> Mike Jones <br>
<b>Sent:</b> Wednesday, March 29, 2017 3:09 PM<br>
<b>To:</b> oauth &lt;oauth@ietf.org&gt;<br>
<b>Cc:</b> 'Yaron Sheffer' &lt;yaronf.ietf@gmail.com&gt;<br>
<b>Subject:</b> JOSE/JWT Security Update Presentation<o:p></o:p></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Yaron Sheffer had asked me to give an update on JOSE=
/JWT security to the SecEvent working group.&nbsp; As promised during our w=
orking group meeting Monday, that presentation is attached.&nbsp; At the mi=
crophone, Kathleen suggested that we may want
 to collect information about best practices for implementers and deployers=
 and write a BCP containing them.&nbsp; She said that JWT is being used in =
many places in the IETF at this point.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -- Mike<o:p></o:p></p>
</div>
</body>
</html>

--_000_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_--

--_004_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_
Content-Type: application/pdf; name="JOSE_JWT_Security_Update_IETF_98.pdf"
Content-Description: JOSE_JWT_Security_Update_IETF_98.pdf
Content-Disposition: attachment;
	filename="JOSE_JWT_Security_Update_IETF_98.pdf"; size=149645;
	creation-date="Wed, 29 Mar 2017 20:07:18 GMT";
	modification-date="Wed, 29 Mar 2017 20:07:18 GMT"
Content-Transfer-Encoding: base64

JVBERi0xLjcNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu
Zyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDMzIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0cnVlPj4v
TWV0YWRhdGEgMzEwIDAgUi9WaWV3ZXJQcmVmZXJlbmNlcyAzMTEgMCBSPj4NCmVuZG9iag0KMiAw
IG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCA1L0tpZHNbIDMgMCBSIDExIDAgUiAyNSAwIFIgMjgg
MCBSIDMwIDAgUl0gPj4NCmVuZG9iag0KMyAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAg
Ui9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8
L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl
Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyA0IDAg
Ui9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9T
L1N0cnVjdFBhcmVudHMgMD4+DQplbmRvYmoNCjQgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k
ZS9MZW5ndGggNTE5Pj4NCnN0cmVhbQ0KeJytlF1vmzAUhu+R+A/nEqLF9jHGNlJVKZ9VokXrBlMv
ql4wSghTAxl1NfXfz07WZllTtZEqbvzFe5735Rg66Ey9zAsDw8UIfvkeA0YYY8g5U6A4g1gw6Erf
u+pB43v0Io2huvc9hOr5MJPIovjg9LLne199DyZWlR7UYERx+L1VklslBhf2IMJP8GIlQcQS1v52
iIzDne+lr+gI7XQ8LiBC7d6RVtkNX33H+uvviJWWEv9a1RHiEatoV9wjNZECYs2BR4pEEgpbis7W
eVUqGLfwZBPoJZyd0cVoNgZ2fg7D8S7QbT1kiidW7GWZYWbVpgjWRrZ0ubqaCJgkhEWAkhGEbO10
uNsiArrq39k3m951sAj7PKiLVV7ehVEAYR8xGBKYt015H95ANve9Sbb/JEDTTd484yL9nDcVBGXT
Hw3CD2BXhFv2CEn0DvbZJJtCiCxI9CcYreoiD0VQtW9j84/F5lwRFK7rSPyeyPPOhV6swOJyhjZ3
dZR53xbR6YxRQhJ9yBkzopm2O8lTa+zu4pZq/iWdUMc1v8pC1AGkZeGmD11tHsO+7Y3vm9vclEdI
93fF8g6MyYtVeQvXdNga065vaPa4KellXtVNbuq2oenDD+OWpm1ryu50a9aZPDAmFRJujQli/wH/
G8M3shWnA2jC5GG0MpEEOYiEk5cEvSMEfwDduxypDQplbmRzdHJlYW0NCmVuZG9iag0KNSAwIG9i
ag0KPDwvVHlwZS9FeHRHU3RhdGUvQk0vTm9ybWFsL2NhIDE+Pg0KZW5kb2JqDQo2IDAgb2JqDQo8
PC9UeXBlL0V4dEdTdGF0ZS9CTS9Ob3JtYWwvQ0EgMT4+DQplbmRvYmoNCjcgMCBvYmoNCjw8L1R5
cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI4MC9IZWlnaHQgMTYwL0NvbG9yU3BhY2Uv
RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA4IDAg
Ui9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM4NDU+Pg0Kc3RyZWFtDQp4nO2dsXbrrBKF9Tp/
mTJtypQp3aZMmTLtKU+ZUq3LlOc1ziP8r3Iv17PMJTAzDBICRPa3vLxkRdZmYA8gWVKWBQAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgG+u6/kz1voGDmVjv/DT1voGDmSAjXa/XLo7q
qN43cDATkZdo4e/fv9Or9w0czMQaEDlqbvW+gYOZ8M6JjNTGUR3V+wYOZmJNSE11nKM6qvcNHMxE
aBu9Z3bvM6n3DRzMhNQDsyurd84d1fsGDmbCaKS0xz67et/AwUxEna00sZH8dl71voGDmWAtJDlH
6r3PqN43cDATRttYjhrOpd43cDATWZ9ke+nIb2dR7xs4mIn1O4qX0kNs5dh8fPW+gYOZSH3CeiNa
qdgv/Diyet/AwUzoZtANw26QfhxE/T//PkXSukrdwCN1MBNKf2s/TNATQZnntFR3NqYXSWe/uEc6
XCa5SB3MBGtdo6nsZluFVGqmvgQ29mYuzRGjdJpQrDqYjLTdLV7Kbslu//X1FUqzrquuviQ29ma2
FHtDuoUfFXUwGaVG2rbl+/v75+fnnz9/wjvgItdVV18EG7OpVEs6nNHp6mA/vqr7SjtXO2+zE/s9
fXK05fPz89vb269fv9yQFEUdbVxRfVFtnKZS3cCN6s1avJlWS8JG6SJNzU1Dg/O2GynsDilynVt+
fHx0efT6+uryKDQ5qZcmkVF94WwsraweeJF6gxb3dTITaaN0kaYFGoxcHpHJ7X42bvnw8PD09HS5
XNy8bv2OKw+pO+m6Q9Ii54vyp1qBb1A/usXDOp+DtEWaBSi5gpZ///798fFRt1t2I5FLopeXFzcY
RV+kd5rmuSwOpXeqL7lBR9lgf+Cb1Q9q8bTYEzyhhW0R/95SOlL/vOFSyY0atQYjGomiJGL3Q9Iu
lSw21tUXwaX2AWtP4DvVj2hxttqra7Vk/U7LABUD+I8+lYx+rpJEURaTdJG6xZ/bNi4NvIp69RZP
q90X4IxIHkiXD5XWjVHkZ2WDMImyJly5LC5StwwxbAGUr5QGXlG9bosruV9FqyWsc5T3g6R1J0t+
Lu2W0ySyjCmlqRS5esllhNSNZL9oCby6eq0WT5ejjzu1WpL1QETFVJK0lEpebaOStD46saBsyRYg
lLYPRoshF5RdWb6u7Ocg9SotrvcAJ5rgSYZJw0lTrLq01Dem7xY/pyaRRiJ9BFSk2e9G+1zMWaAU
Q9mJHvih6ntaXFKUCjAySjUqtRpuU1daqdt0ZXgGL9so1+TEgtJ8ehnWkgFxKRxKlKqQdqUE3kC9
itksf9rstKNha94YbEhdaakY7Er2gCX9ysodE+mRKmWQpNlOpnRCpUet7DD9bjP10hbX+222FYgN
TjsaS8ro0UVNtl+aLYaSwqyf2T2Ex0TZSO1lUFJpNQ8fSm2wxTDutrF6UYuz+1eqerPTjkavK7ZW
syNUqXTRoKCXTR8alFPcFmkpidIsDr+ylMzBlJWszaSdZzc4VL3IbEoW13JaG+yDabaP8stZUaUR
lT9lt7/KZ6TZs3O1hqQolfxh2mKbfWXjVZJdkeiorrd4trYjxh+PluSHA7327ElnUdR3rn+UGmX9
7mdSfLqhX7FgH4+kqkilLUclpWZO10tCfdWjFmcl7HWbFqB+JpwKtjmMzarUavROfl7uTewWXBJd
LpdSk1gKo0srNi4aBVbZe2v57UsN1Dt6bLnf59KSbP1XfC3q7+ZZ32YHr3A5Cm25zWA3+CQ7eGWl
FRvbB8FsqfSm7Kt+kJckXHmie5kb0D58Y9tlpx/KZmxckrTFMJbilSaRrpiuzBZGas2+6u3ziG5P
OzxzvtM4jzakEtuOyjilBMVK75zqhLDSi/xLTZFvt5m5r3qXPHp7e6PHaxyePAHt88iSSqxLs2aw
NOXCHfZaTKKXU8pft/LxhlRgi2/tpfrnn3/CYrjlh4cHpbo2q6crH240c5RiaXoswNfX1wS3AUZY
/Kw3oqVZWSFWunTSki2nFCOdb6f3rHt3JpGzMeXscn8gql+j1Gdp/bMfSYjOi3a0GXG5XNrnUVQz
Vd5981HFPj8/L7vvRMs2uiQhrc961W5gXYJqID1huK0AUhm8k50WFYmkaY1DqcyskP4V+oHbx+iG
A/f+ciOSrviuWLpXHtUlbFCqWKrVpfxnQTan2JXKzrM+lwrAWitdb9k5uevthhRjUbzRF72TKVXD
HXpvp8+dsKsruR9eJfL+/u4M/HHDLbtgfU6ttVEsfei8zh120e+D1Es83VHqbcM7DUPUdq4a32/4
WpUsZ59jsCuzu1W2WcutFa4xRuTeqR6oKnbGGy2nFw1GpfUNQVlcqq50a2ESOeu6o/vrHfo9mtIq
kq7yTodjj3f8yOsK4+Sc9HHnGVwBXFxOhXoJP/haGsuyHNaqqz0XC62nzehanayfJQmpi7YkkX3g
UKTTYti7BeL3Hfb+DmX0MdZ5qBVtRs1BrrZUrF6eSJoem7nefrWJum43KIStLxWvdNnPecjAlzt+
TFwPO+9NDyOliH7d8X3FzrjW4H4EX6vRI7LpuVXuT4qf04ZjF/yyvqv0u6XS0soN0vSuXxmeLUb0
J/YJLVIzOdGsNLsT9mPU3FfhgMXPrHzrV3FaNOehgZ4sTb33ob/D0p6pl6COwvcVfrKx7d13DmGt
RoHQx7VeKik7UXr4Uul0pTIIKh7wSKlkHArTOpee0JK+69KWjivtM93epCSSWr+K09I5D7maxsQ2
Zxj+3qGPvq9IG92CsWvyXG9PJV12PJbN7mR2J7q0biT961kHZkcl45iYvaWXDV+XzooqfaYdan2p
qDrKnCeydBf8w6vDh1ob37fVqp5KtZJImaJY9sD21Zu/uMp+tg8E6/c5lfSYI70ArLRU1GihtM+U
Wt+PI/b3yGlr8Nz10YhSSaneqEE31Gp2VJKacsNXWDda9hNi/Io0GqYbZB8rwe5Kui9eaan0oySt
F2PDdG4Ep3XBHuD+0Dakkn1jyY1FqRS+W6TZAigWtTzbga3zaDpnHMgUaVaOHQRrObml07pwDWaw
Uk+1c5IcaS227JA2s6SMZDZFOtzYKJ0dB9M/Wc7gRXWe3o0oSbCKirT0rYOc3NJpXbgG/6AkdUjd
Ws2mEiFtYLEu66U1lyPZDYz5y5Yq/KgcK/l35RS3nst6/aTSRzc32/pdpNtwTc6rUIAVJ8mR1iLb
VfqTbt2slyypVCqtaLEfaY1+wKIcE+kSlsKE0mniH9HcbOun5W8g3YZr8m+zjhtk9VSyHJiUjkfG
VNognS0SW0Jpgpc+ocU+GCkLobqUSs3mVC2d1oVrcDDorzs9KDQllYxnIbYNRquaSqXSqUv1jNNn
WXS9NF3xouzZIqHXT3ra4ejmZlu/i3Qbrrez/f7yXboI8KDQLKm0lNwDWGqqndJpGYylYv1MFc5e
Jb4/cIv00c2dtn4zp3Xhev+vrHSNVnThXHUtJZWWSo93UKZDdaVZCb2on3f8lZBSOJvjlXYVSTdo
7rT1mzmtC/6qvAa3vUuptNj+w8iGQ4Y1l0q1pEtLku6t1uwu+y2i8VMOlrZO60LL65fSVFpsjyIv
NRW70v6UA32HG9y73i50pBt5yEh0lT7LthmdsuBmdDQKeA93ufCm+5VyMxGm0nJ70AGZeadLs39N
n3LgbxazjxqKor6NO7h2xwXhlMZf/RhJsMPTnoVUGsyBTyW65dDf7C9ZUXG1cXYXPmqA7oV/+Y4l
U3RppQBO2ps5uoPG3xCXymVLYllQpMEEXG/ncOgMkj+JpBhGcpTFS/6xEuFN8aT7fie6NTtrYF0x
/OjUSZrOPKdVoe8hWxJlISsNJoBuj6I7sun8FfuIA6NdpY3DX8/pBrFPjuy/3rOPPuFXvDqd7GVn
Vm5leLtBpLh5RmeRBhPgb+P19/s7PxuvUk79lk2i6AaxP3foY3p/9LahMCy2/Sqy6/3OnW0poyTR
TL94Ah1/Gse5+srdVrltXGC9JB0gsPc8ZjPF6GTLz47X75fQbDsa2iYNJiM0s33mxhp786MGsqlk
Kcm24aBKKmEkAh7JUaVHJfsfNbBhRrfnUkzLgKgsTHYVKNhPkaPWYLCo9agBJZHZsbLWcBAeK9mz
GNM5IKGkUgMv6eppMdZ6d9awA6KUvxV7DzArkpkPGguK1KOVdedUaSopfQiSCGTRO2fPQYcGxjHx
CCdfk5vg2GLgmAgYSR0VLR96aJBN5KPvJlbGQYxEoIh0XGg5q1HOSB89HLCBN+g9wKywnXPjRw10
UWelMRKBzVy/X+3gL+Fu/KiB9upRKjUOHMyHn2L5f47T+FEDqXobJ/vflboEDubjer/ngv5FTmMv
dVTvGziYD7o8m2h/R0BH9b6Bg8kY4R/i/DRpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADATh4f
3/TX05N7vfcupki2/PZX71C+UTGuqDV7RxazMxz3en5+p1ffKB4eXvXXaB4LsZTf8hotxlpxRa8x
86hKaMijPSCPCvNouKlFrUj7dhHIozFjxHh0rhZEHo0ZI8ajc7Ug8mjMGDEenasFkUdjxog8OlcL
Io/GjPGgPBotzGWWFkQejRkj8uhcof2EPDrp77DIo9JGHDyKASvfc/bySyhu2em63pHF2CPqXVKN
s/uwynjUO4gC5nBdyBwR/YQ8Om90KXO4LqTWvG78KLoXUgF5dPagqhwJdo8XeTRydCnIozHjRR4N
+NOkAvJozHiRRwNecqaAPBozXuRR3/tWSkEejRkv8gh51Bfk0Qggj07XZBHIoxHY9jss3dfvjozc
C3nUl9Lfj1zDBS34/9f4UYzcKGcvfynOMD82j3qXVOPsPjx7+Utxo+cErgtBHo1AlevrRriwxMjL
y8cErgtBHo1AlaPUwWMMuVyQRyOCPBo/xpC3t98zhbMgj8bgp+XR+zvyaESQR+PHGII8GhPk0fgx
hhjzqPvvKXaQRyPw8/LoE3k0IGfPI+PvktMYz5hHJ7pIY5o8OvVvK/5/dvjXy8tH+B6+0r/697MY
z83rbq/P+7tf+P329r/X6+sv97pcfvUuqRWjA0c2IQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAABgev4LLSFUaA0KZW5kc3RyZWFtDQplbmRvYmoNCjggMCBvYmoNCjw8L1R5cGUvWE9iamVj
dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI4MC9IZWlnaHQgMTYwL0NvbG9yU3BhY2UvRGV2aWNlR3Jh
eS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmls
dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA4NDA+Pg0Kc3RyZWFtDQp4nO2c0VYqMRAE+f+fjseDchCz
m+pk1hli1/PQO11w8RoWbzdjjDHGGGOMMcYYYzakxU/yyLq0RlvgSR5Zl9ZoCzzJI+vSvgic5JF1
aXLb4SSPrEtrtAWe5JF1aY22wJM8si6t0RZ4kkfWpb2yPskj6/Krw2ELPMkj69LpcNACT/LIunQ7
dFvgSR5Zl4MOnRZ4kkfW5bDDrxZ4kkfW5aTDSws8ySPrctrhRwsw2XBkdT2DDk9iwOR9nES24q+b
YYfH/mDyPo5nUoufw5riSZHk8mfg/a/w8vZi0LtGdTHCCS1uex9PERPlDj8N973o/ngyWAxtg9qS
KHX/aCGP4PGWYVqUE9p0Qurgtm+jBR34hWlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuG
aVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbrvvoRcWsfx18ywAvwgltOjNP
9rSX76iZRatyfiyTvV0q9tLFr5cD7OUAe+ljL33spY/fYLqcaNlLjNYnQss7GPxuJJU6FgNSbo1O
JjLVafSagb+aR3W4AP7vQPto9tgxvFwuvSe7Pxh1Zoefh0wm2yyIYZdLZrrNtBh2uWQW2kyKYZdL
ZqnNlBh2uWQW20yIYZdLZrmNLIZdLpmANqIYdrlkQtpIYtjlkglqI4hhl0smrA0E3RZ7VVcuBX+o
umZD5CIt9Pf2P+0qcZUY9dPhclxjhQXnNh9gL33om+T47Oul7Xtr+QT8AHn83BiOPse+t5ZPBnWn
JvlgaXgHPLmDFuVGPzy5gxblxlA8uYMW5UZiPLmDFuXGczy5gxbliwp4cgctyhdb8OQOWpQvQuHJ
HbT8aBE1uYOWpxZxkztoebSInNxBy1eL2MkdtPjvEhtjjDHGGGOM+S+snhW2I6JyphZbD7IXkKBe
PmSDQY692IuSYy/2ouTYi70oOfayr5eJx3dzgr0s77P6+ABDMTH2Im0l5NkLSIjbYCKplxeTYi+D
rezFXpSt7MVelK3spZaXicef5u3y/92ZBc7ydvESUMleSN5kiL1clmIvIGF5A3vpb2Av/Q3spb+B
vfQ32MeLMcYYY4wxxhhjjInjAwlVoyoNCmVuZHN0cmVhbQ0KZW5kb2JqDQo5IDAgb2JqDQo8PC9U
eXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YxL0Jhc2VGb250L0FyaWFsTVQvRW5jb2Rp
bmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDEwIDAgUi9GaXJzdENoYXIgMzIvTGFz
dENoYXIgMTIxL1dpZHRocyAzMDUgMCBSPj4NCmVuZG9iag0KMTAgMCBvYmoNCjw8L1R5cGUvRm9u
dERlc2NyaXB0b3IvRm9udE5hbWUvQXJpYWxNVC9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2Vu
dCA5MDUvRGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lkdGggNDQxL01heFdpZHRoIDI2
NjUvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvTGVhZGluZyAzMy9TdGVtViA0NC9Gb250QkJv
eFsgLTY2NSAtMjEwIDIwMDAgNzI4XSA+Pg0KZW5kb2JqDQoxMSAwIG9iag0KPDwvVHlwZS9QYWdl
L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBS
Pj4vWE9iamVjdDw8L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMiAxMyAwIFIvRjMgMTUgMCBSL0Yx
IDkgMCBSL0Y0IDIwIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJ
XSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyAxMiAwIFIvR3JvdXA8PC9UeXBl
L0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRz
IDE+Pg0KZW5kb2JqDQoxMiAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMTgx
Pj4NCnN0cmVhbQ0KeJytmNtu4kgQhu+ReIe6tEdK4z7alqJIIYdRMsrO7ICUi2QuDGmId8CwxmzE
22+XIRMINo1RKwqyjen6/Lvqr+7uXOZFOkqGBXQfruDfdiuAgARBQBkLQghZAFIEkOt26/ELZO1W
52tPwnjRblEY/7k5UDTgcufu0Zd26+92C27MqJ3PMc7Wv6IyEvxwuICEDN7KsKoMG8BXMyqFf6Al
I1bePW2Xh8L8eNJu9exxw0gpuo7LhKCiIi41V/BPRUQJKIeXnHAFQxOtczdNxjqE6xm8h4LODzg/
7zxc3V1DcHEB3eu1mOvnDEIWm8H2w3T7ZrRbBjyG/gg1xZgUaMwIBaEEiTj0pzgOw6+IgHy8ffbT
iPHkdZPhb/+Me+N8tszw4MX/Bf37duum/yHGNiFtSsiB0R1CwQ0DD+lRgOdG8suLw0isKRIFHuwg
hSYqEztQ6xQtNbr/3ruBJHsBX3j3j33wz5T389Y/Y97VAq+N0ixdvGrzfeSlGTwkK/C5x0yOWrTk
zbWkETGgn9i5MOycE0E3ggojoCr/15J+nB8tqmguKlMk2GWLQxIGu2zbuvYw4b7/ZVFJuiChoSA8
qiN51AMLhHIBwbgklNdB9NJxWYFJscy1BSd0gcONLUW0DufZ5Hr5gp59C0zUFEZUwAhDwcIaGJOw
XWpJ2NiFJEIKEsd1kmyK3uaQjU28ikRSSWQNCfYfJSPoD5+8UFpthp7g2bU+w2JJ4tCdz9AT3LvW
aLbhKowGzRpL3ZyAr7ybbOifCS9fzYt0lq2vUlom/g2+6GcfbMo2dvDK1BeChHEN/DGpT52YtVCK
SFqn4Sb3wY9NyuEhVTZxGhv3obSTEZHcYdo5MfT3tNuCa97fqBMz3zS4GhR7g6ONXfxAh6uh+KZX
WHBYe1hk344sssbOXlVk3GS3kjVkxxQZc2LrPIqImbHXCLRfZKFFHObU2xk1jcVdkTGn3r4F17zI
WGOnPlRk1Sj2ImNOjPq9yKopLifjGUqSp4Vpd6/ThY3JyfyaK0nMOq+GCasdmS6tc0nW2JfrOqoK
a2iOKnYnnowdFYu9WpTjZpPMiS9LFpKAVZPgbFLQP7PJyAbU2I4POA6NOFHMneNwJya9cZxtOPts
sl9W3W+Nnxk6OCZ9f72AsrU43tjFK1tczHDJUI19TNZzJ34tqCCC16m33+JimzgnbJNgnrPPC0zC
zEyZooE72XbiJ5g5D/a4NntP22QfpYm7jso4GdbmXWYT6gQnrwCiASdmcVkJ9OS9pfjSXvRinmuf
e4ltv5CfMNGugGLYX2Qd1HKhzdKNeQM9MkyzXGNtljt2kbdIs6HGAi1eEdgqYmPnr97gjCNClaNE
O6EFVG9wbkFtzxjyIh1O9AJek/9KpXI91FkxWcHACKZ1htfmy8EkRTdbvBpt9Yv5gGQwW6KwVns7
YW+m+gEUq3qAdDqfaEzLqcHGpMT1vEmIdQ686Plkttp8Za4G3miSvFVNiz42/Q35ZVEkQ9zVfep0
Z0Uxm/7q9Fdz3fmRjNOsjNDpLQcFXrqdzQqdN3/GmMRq5ylVSAmLjLMQuf+UrIL4f8rUFWkNCmVu
ZHN0cmVhbQ0KZW5kb2JqDQoxMyAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHJ1ZVR5cGUv
TmFtZS9GMi9CYXNlRm9udC9BcmlhbC1Cb2xkTVQvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0Zv
bnREZXNjcmlwdG9yIDE0IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTIyL1dpZHRocyAzMDYg
MCBSPj4NCmVuZG9iag0KMTQgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUv
QXJpYWwtQm9sZE1UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNjZW50IDkwNS9EZXNjZW50IC0y
MTAvQ2FwSGVpZ2h0IDcyOC9BdmdXaWR0aCA0NzkvTWF4V2lkdGggMjYyOC9Gb250V2VpZ2h0IDcw
MC9YSGVpZ2h0IDI1MC9MZWFkaW5nIDMzL1N0ZW1WIDQ3L0ZvbnRCQm94WyAtNjI4IC0yMTAgMjAw
MCA3MjhdID4+DQplbmRvYmoNCjE1IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UeXBlMC9C
YXNlRm9udC9CQ0RFRUUrV2luZ2RpbmdzLVJlZ3VsYXIvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNj
ZW5kYW50Rm9udHMgMTYgMCBSL1RvVW5pY29kZSAzMDcgMCBSPj4NCmVuZG9iag0KMTYgMCBvYmoN
ClsgMTcgMCBSXSANCmVuZG9iag0KMTcgMCBvYmoNCjw8L0Jhc2VGb250L0JDREVFRStXaW5nZGlu
Z3MtUmVndWxhci9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRl
bnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDE4IDAgUi9Gb250RGVzY3JpcHRvciAxOSAwIFIv
VyAzMDkgMCBSPj4NCmVuZG9iag0KMTggMCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAvUmVn
aXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQoxOSAwIG9iag0KPDwvVHlwZS9G
b250RGVzY3JpcHRvci9Gb250TmFtZS9CQ0RFRUUrV2luZ2RpbmdzLVJlZ3VsYXIvRmxhZ3MgMzIv
SXRhbGljQW5nbGUgMC9Bc2NlbnQgODk5L0Rlc2NlbnQgMjA1L0NhcEhlaWdodCA3NzEvQXZnV2lk
dGggODkwL01heFdpZHRoIDEzNTkvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3RlbVYgODkv
Rm9udEJCb3hbIDAgMjA1IDEzNTkgNzcxXSAvRm9udEZpbGUyIDMwOCAwIFI+Pg0KZW5kb2JqDQoy
MCAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvQXJpYWxNVC9FbmNv
ZGluZy9JZGVudGl0eS1IL0Rlc2NlbmRhbnRGb250cyAyMSAwIFIvVG9Vbmljb2RlIDMwMiAwIFI+
Pg0KZW5kb2JqDQoyMSAwIG9iag0KWyAyMiAwIFJdIA0KZW5kb2JqDQoyMiAwIG9iag0KPDwvQmFz
ZUZvbnQvQXJpYWxNVC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAv
SWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDIzIDAgUi9Gb250RGVzY3JpcHRvciAyNCAw
IFIvVyAzMDQgMCBSPj4NCmVuZG9iag0KMjMgMCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAv
UmVnaXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQoyNCAwIG9iag0KPDwvVHlw
ZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BcmlhbE1UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAv
QXNjZW50IDkwNS9EZXNjZW50IC0yMTAvQ2FwSGVpZ2h0IDcyOC9BdmdXaWR0aCA0NDEvTWF4V2lk
dGggMjY2NS9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0IDI1MC9MZWFkaW5nIDMzL1N0ZW1WIDQ0L0Zv
bnRCQm94WyAtNjY1IC0yMTAgMjAwMCA3MjhdIC9Gb250RmlsZTIgMzAzIDAgUj4+DQplbmRvYmoN
CjI1IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0V4dEdTdGF0
ZTw8L0dTNSA1IDAgUi9HUzYgNiAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2U3IDcgMCBSPj4vRm9udDw8
L0YyIDEzIDAgUi9GMyAxNSAwIFIvRjQgMjAgMCBSL0YxIDkgMCBSPj4vUHJvY1NldFsvUERGL1Rl
eHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fubm90c1sgMjcgMCBSXSAvTWVkaWFCb3hbIDAg
MCA3MjAgNTQwXSAvQ29udGVudHMgMjYgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFy
ZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAyPj4NCmVuZG9iag0KMjYg
MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTc1ND4+DQpzdHJlYW0NCnicrVpb
b5tIFH635P8wj1ApA3MFqipSLm672e1ut46Uh6YP2CE2rQEvJon87/cciGNsQyamqHKAAWa++ebM
dy7UOcuL+D6cFuT8ywX5bzhwiUtd12Wcux7xuEuUdEkeDQc370g6HDifxorMVsMBI7OXh13NXKF2
nr5/Nxz8OxyQEfTq7I9xUr3FlC/F68O51OPkqRxWl8O65BP0yshPMlA+L59OhuWphJcXw8HYPK7n
a82qcbmUTDaMy6AF/2mfaknK7pWgQpMpjOb8kYSzyCOXGdkMRZyv5MMH58vFH5fEPT0l55cVmdU8
XY8H0NnhMOfX0NtHTkRAru+RUxyTEeZyCnRILakvyHWCHXG8RyXJZ/Wrb8DGd+ssLTL7hFtpnBH7
RFjjMF3hEa+4hSxMF5H9g1xfDQej6y1BddTsWNSCME19LneQS0FxNpwGvhn3B1iKs9PXYfFjYUnC
JXX3YHkwMjTVgVXm+wzjXIApaNdVynXlBRy96iihTcpTCY/IjzC4MKAVx6JlTWhhX1DRAtZ6fFjY
0kojW1h5OInhfBEXa1ho5llxCpfkavzP3+QmmuD5KJ3m6yU8W8RZedM+0datdXUzurWJwSJkL5PR
wqOSt83mxIBBdcHQuPSwl5g6GP/bR+DmwsSE7mKEu0vKNeW6BQVYFzuDnw8/eSrwMgCblK0GN16G
6Qs4r8PGhWU6YElIYElIqtjzzpWwU3X5q/bu9tqwe3fg+c/w4P2g7IGBBtCAlZ0GHtU+jMqp4qjj
XPj05RrEXHgBDXitQXGG0LcNWnPKdFMDo0rvvLJpeOl007AZdXO9QbW5nlfurGl2QQf7dPfJh/E8
d5/8Q7IOGivxnxcFbOzlewf+OpNFNqMx2DR4hAIO82i1hvYkiQo7sPI1hbZplsC5w11ma8tzXAEH
Zwp/8hgcRQhPLBr3w87E2dFermnmCpqCrhNv1o5dlEd7tWaUYBC8K0wQ7DTKYRFArVGq34D6aKfX
hFoL8MWdUb+F3C7ergEm7MaOxk/KgM73wa9Mv6P3M2Pu4tQOMStFVecN+xZqN37vWYpcD6WIcYHh
MHQFYQl7CbMbOzjaZb0mTMztMs+fqyoofcN0j/ZhTWgZLkdntG9ZFb8XmJKVoUA3mE8Rcjqhc1T3
pFmoa0H90f6pParnnqZe0FNU38V7tIb1dWS12O4yAtFdTfN4AlRFKwNVvIuraIjdfdijrZDKAP0x
xAg+vqvCcaat6UP+GJliUN7FKRziE9im2vCFRRFOfxEID8IZkBZiepGuCoCprD+RzjU5m+URniVR
Whgxd8qHGpdYejTwDvA+IcBiXqa5o0WZC2EsBGEMMqusiwdMk5BceOAS793fY2Icm7Jh3in52WOa
lUw3IzclPvz3Mx/BA+oGbQA+Ywa5QM4SkDjgh1mjZRkxJlEeLqAlsMZFWFJpgNrF1zSvMgsoO4R6
a40uLgHoZxOQLm5kX5w1dXUbEOOidXEQ+7k/ZIjN45fRjqxindHYBKVLZrIvZcAFb8GyhXJrUwMW
0Untd7BwSFl5CxZgY7WK0mn03oSjS42rLVVmfkCV+N1UuQaul6D/OWKrg6vxdFbYykKFRw2EnARE
kdiw8acZNlQ1wyJ/mOJjK7gjrasb+0RaIxOxvWQCApp00Ib9GWMRxmmczojtgzMFTxrfEVCG6QPe
LIXet5ZZnBYmxEfr+2umoF3q9WgJXaS/1RK22Gpkjh8mSWzkqJccgmnIlVpg3Ge5CUM/mUEAouq3
gLiLpmjj+XpZ1kgNeI5W+NfsRjAa9Gg3fRajathqXP0VhTmSZaJJ9lIdQl8o2qAUc5ABU1Ave6n/
cCYoa8ZR+kFWOcJwkj2Y9pTsReW59qknWohZlroeP2L8XpjiXNmPckPmzVULnl8RanNz2asGpJfC
jICd5XstQO7zLDGh6EV6JaTQvG15duWG2JD/hWUFN0qWRus5WpFfUx8XrLo/9ZG9KPVGfbbY6h9r
ytrHMgqNPHVR6Zayhw6o8GU/ZQ/ZKShvK3vUkdVYup7Dzn8KwaLyAvmK7uC6/O43WRMI7GrlB8ju
sCAxw2RZPpchlhnexWZM+z1rgnkiOOqIgOVWVmubHYA62gG89lUqwLJnb5aqenEKm9roFls9vsoS
k/KqXjwBU6r6utqE4ipE5X0MTUh68QEct6zfgmQRT/IQjTGPoxUWk0D3lBWmELxra1VG9gnE7qxK
OJQ1gnPW9FZgpdkTPo6ndxmxPatMAkJU0Obwbfu/QGDCZ1jgmkd35LtznhVFlvxwrtfLyPkazuI0
REV2IDYusOljlhVRfjw1AQ307tcCj1EOzEis4e8zIxoQ/w8OiTcGDQplbmRzdHJlYW0NCmVuZG9i
ag0KMjcgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA3MS40MjQgMzA2LjE5IDY2Mi4yNiAz
NDkuMTVdIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHA6Ly9i
bG9nLmludG90aGVzeW1tZXRyeS5jb20vMjAxNy8wMy9jcml0aWNhbC12dWxuZXJhYmlsaXR5LWlu
LWpzb24td2ViLmh0bWwpID4+L1N0cnVjdFBhcmVudCAzPj4NCmVuZG9iag0KMjggMCBvYmoNCjw8
L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBS
L0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTcgNyAwIFI+Pi9Gb250PDwvRjIgMTMgMCBSL0Yz
IDE1IDAgUi9GNCAyMCAwIFIvRjEgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1h
Z2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAvQ29udGVudHMgMjkgMCBSL0dy
b3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3Ry
dWN0UGFyZW50cyA0Pj4NCmVuZG9iag0KMjkgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M
ZW5ndGggMTc0Nz4+DQpzdHJlYW0NCnicrVlbb9pIFH5H4j/Mo1OJ8dzHXlVIkEvVSlW7S6TVKu2D
Q1xwCpiCkyj99XvO2NxiOw4uiogvzOWbb85854I/WGXJj2ickeHnc/Kr22GEUcYYF4JZYgUjWjGy
irudf9+RRbfjfxhpMll3O5xMto2Z4Uzqg9Y/3nU7f3c75BJG9V/O0ct7cR0o+fp0jFpBnty0xk3L
yAcYlZN70tGBcK3nXXeroPOs2xk1z2sDY3g+r1CKq4p5ObzBPxNQo4gbXksqDRnDbP7HeTSJLblI
yWYq4n8l79/7n88/XhDW75PhRU5mvk5mRQiDlacZXsNoV4LIkFz/QE5xTk5sSAWsWxlFA0mu5ziQ
wO+oIqvJ/tM/wMaNNxqnWUbOetIbrMbJ+nd81hPe0/pnQs6+k+tP3c7l9Y6Vfaj8j6EqIagI3g4V
t2Q8ixtwiWNxScJDqs0hNAlzK2Yp7HAjsPdgFoP+66jksagUEZaGgTrcXJhZqANg+VEqYAxlAwx1
LAxeCQP4CupgeJ++jC7PtEe+eZ/QrKJHtKhojf/HK/yfLDO8kDPlfbm9j8fYKiMj6JNMFviQLCZ4
AatUXrS4y+9fX5hutzBTRa+0kmpeWtflAuFL73npACcpXhbfzhy8ZJ2jhPWSYYTLuyOjLHJN3AIi
1/cO1mS862mUM3D56I7b6hm/S93a46aVmlOuVIY0LK90NE0fEMvsLt+n1wHZUwDiRlMZ1AEaPKaJ
47QBStDulB1CEVJTFdZAwUOmGg5Z2EKBDA1ebpBUsEFMUVRNJ0EKJMe4Ty5Cu+c3yxA/2sEAH4eH
P7TUskNkezs1zZxlL9d/+Xj1l9EqmqSLBM56TMfp3Ee7up3BOUknvmDcwhc+k/49nvWnrMnnHO10
SvA1h462Dn6vCcDR3qUCQICqWQPgHllbgxQ04Djan5RxGEF50JqINp7kBQAnQnUAnmKwkdsmFG1k
/xCF4eqV7WikoY0aK8qqz5SwmuoyiCz9GS+AjXUTmDZKXAbDIXAFKa4B08jI0RpcDcIaqkQ1CIKx
uJYQMo5vvKSRlaPluBpQKKltS4poJbslDKCX1NaYiSMFIhdHym3U5ClFKyUtI1KASLampZWaVoAI
qa3dm3WGISQGYI2ctBLVEhwJyQNvz0krYS2D0JzyWk4yDEAbcLSS1jKOkEM+2pqM08irDEMqeR2I
GIJwBTF4umhMLU8jsArkPtStOTmNwGqmaRjWHpppCpw8zBqPzGnEVYPatzYSeRpxhYy2VlxvIIvF
DEQ2ZiDyaF2tLT8IaajgJyo/HK20VZlRkTXuAzvIjIRlTAWMadPvCXhWBu51vyfx/hw+unhftMH3
TObfbZ419gmKPgft+tthQveYD6WgiSy64lBXxXtsZ/baILTzop2AD9+b3uK7fk+9mBJSBTYsxsD+
rq0pj4F43BKKpWrm8DXsSBtnU7sjTFBTTptB5jGtyshjNMutl4zxRV5vWGYpPriaxQzTjomraKyS
DC/TuStVPLi6Rtxo9kd7rTznFaX6Fma93FjKTpj1yqN9mXolSt9HV2H+fVWYota5OeEpUMpZry4O
iLK5BYeFdYLVOuMbOEN0LXVhU9hjmNsUHg3sZTY2zfMjUZjmUOYmm5vmFspQvcUaT+NolQkhCK1h
yBtHizPVWE6Sp3GymruErgZKNo0X5Lax1iZP42sNxO2QatdgeVhj/NF4wtpUlaodCwcdsafxK6qN
761TsT1ce/T8F2fElYh3qtWAqU1qU64CMlcXqMYUufp0kotq9pxXSQFhjM+/XO00wQflrZ2KRq5k
vNzWiLPU/eLy6OrDsyQvEGeuA0Etlt6kKa1VbX7nqKkyhlgJUqfTW/Xn1alCa/eR7deDl0DicpUu
VwnQBlxyhj4MaEvBfU3nyLpFvSGQ+zmqn7ACOZs5/elx7o2n0WKCRUl41F76GK+Ic3vJvCkJUC1d
XRXx2gKtp6O9lZuron2H69DB7XmyPDaS29Co3wvQF10U4VJQRHKFb8J7CL+ck7tyrmkziHNw8Eqf
56PoTQwo95wgerPLnZsM8qacbWPMvL/rYwsEwjXaOGOY3M047OtNdJhjcAOZwo0ews69qyrmt9vm
ZhMnDvtmM3zh54uODft0tLOt2ycRoF2V9ikPil1gvAmpN7i13VJjsaXe0amKpi4gCTfv4d1gy9k2
GhEFV3Zv08JNLOPY1gWlu+B7F7AMCtr1G/evmNVxfo52twuuHMBgY2B7U1Tswe43fdiJQZZF42l8
R278YZpl6fy7f/28jP2v0SRZRFmSLvzRw22Gr67SNItXx0ta+NKnGMvxB2+pnFt+oWmqQnf+BzvK
sokNCmVuZHN0cmVhbQ0KZW5kb2JqDQozMCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAg
Ui9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8
L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMiAxMyAwIFIvRjMgMTUgMCBSL0YxIDkgMCBSPj4vUHJv
Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIw
IDU0MF0gL0NvbnRlbnRzIDMxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kv
Q1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNT4+DQplbmRvYmoNCjMxIDAgb2Jq
DQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY3Nz4+DQpzdHJlYW0NCnicrZVLb9pAFIX3
lvwf7tKOxHjeNlKUKuSlVkqVFqQuoiwGMxC3xqb20DT/vtdGbaBAXBrEwmNjz/nm3DNzo/PKZVOT
OhjcXsB336NACaWUcU5jiDkFJSlU1ve+nEDhe9HNUMGs9j0Gsz8vU82oUBtvT09875PvwRXOGv2t
0Vt9xVQixetylMQcnlpZ3cpSuMFZGXwFTyW8fXvut0OJH+e+N+zWjROt2UqXS8nkDl2GT5qfToiW
0E6vBBEaUlSL3s/NzMZwWcJvKYju4PQ0ur14fwn07AwGlyszV+ukMe/jZNsygxHOds1B9GE0bTxt
NBlwqgjVILUkiYDRvJmIN/8RCdVs/e4zunEffLQ/HYQ9EQydXdThA4w++N7V6MWJdTx2KJ4Azjbw
pEB9EbN/gjtFv8/PXkfihyIxEHQDKUZVLjegVvls/bkq0nJZYc0gZDRY2HKR4zAJXAnfrF1AqAOT
WwxLMYNQBcsazLhculAG0GGmOBq5UCRhW+S1TZdV5p47MOSbMVgsiNqL0evQV2/XT1B/n3yKFmSp
ySEUQTbH4oU9Hsxt4fDeuKwssK4ymObmqSv8+jjh531ONDtO+ONjRWgdas28C+NMXs6avJtiAk/o
JYY/Dsa2drCo8HjMUouJrzDuOMxx3GFi8j/EBM/andRK76Ke2BqrPsYdiRsSVkVXq5qrtuZ4acrO
gkXmpk0O8rxJRd0sDfe1+VFmk4519I8UBoadITlOGNjBzWNvGtao1ny9W45bn7L6Ed3jgamaTYRl
b9pHE4P21CvN0j2SwrquXnJwM9nClSIhgu3DfbcD4KWtI8a5cyZ9tBO4jwalc+X8IRo9L2x0Z2ZZ
0Z4N0XA5ds2j67J0tjocuE/6egNZY5fhCQhJlN4iVjuIfwE25f79DQplbmRzdHJlYW0NCmVuZG9i
ag0KMzIgMCBvYmoNCjw8L0F1dGhvcigpIC9DcmVhdGlvbkRhdGUoRDoyMDE3MDMyOTAwMDA1Ni0w
NScwMCcpIC9Nb2REYXRlKEQ6MjAxNzAzMjkwMDAwNTYtMDUnMDAnKSAvUHJvZHVjZXIo/v8ATQBp
AGMAcgBvAHMAbwBmAHQArgAgAFAAbwB3AGUAcgBQAG8AaQBuAHQArgAgADIAMAAxADYpIC9DcmVh
dG9yKP7/AE0AaQBjAHIAbwBzAG8AZgB0AK4AIABQAG8AdwBlAHIAUABvAGkAbgB0AK4AIAAyADAA
MQA2KSA+Pg0KZW5kb2JqDQo0MiAwIG9iag0KPDwvVHlwZS9PYmpTdG0vTiAyNTcvRmlyc3QgMjM1
OS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ5ODU+Pg0Kc3RyZWFtDQp4nNVcXY/bOJb18wDz
tE8L9AB87Cy2Y5H6oNgYzKKSVKM73ekEqSwai8k+qGxVWSmX5JHlVNf+6v0Fu3sudeWyXKIlSzMP
i+6UZFk8JO8995DipRx4whOBL+JABIGQUSx8I1QQCR9nUotAC18bgQuBliIIRai0CD0RxrhoRBTG
IoiFlgFuE1pHIgyAZUToC6Ni3C1MHIlICunR7UpIqZSIPIED7jI4Gi0iLaQfhgLVywDFIlwPPSk0
7gu1D3w0LcRnlNdoAC7J2POERpNjXIwiIQ3aGIVCeWGEhggl0SYd4xijfeiTQjtiTygflaOdKkAP
Ne4PlSdiH0fcDCuoCG2OcV0r3I/7tDEiBl4cSwEoZdDOWAnf82E1CSOhH4aOuMngukJnjS983w+F
gVkCLxYmxBGFDewaopHosh/B0AZG1hI28nCk9hnYHTdJ9N03MKX0lAg81CA9XwRS+WRHnKCgRP8D
hZ6ifQHQBP4PAhhXenBbKAkFzgkN2Z48GAFOooyGF6UHh8YBfRXCjzC5lChu0AeyW+hZT8HbUtMV
BUfCRlJKOBZfheBAoPAB/g6BCdeE5Ccp4dMogNckfK994INDoaY2wJxhjAKSCGR8YgAc7VGD0b9I
+sQBDxRBqyVKRiqmr0AKn9yrAhEFxAvcBxfRCYqH9BUMGdlK8S+KYHuJjkUxGgsy4YRaDopHhmgG
lmsPJSSsoKlnErzREp6X4LpWPlEQzPAllTI4ARmkj3sCMiCcqiNqsw+cyH6lQDcyKXijYxhPgvs6
jonCuMdYLoMyHrkT/Y+lPdEgEcwmEUCxT35FLMAhuBn8RAShXyASDIb2wOJxRM6Ci2MtqS58pQ3h
4GZDteM+43l0Alp5ILpE8BhJERIRMTV9FYGZVDtcZQJqKr42ATUVXxtrTISGscZEWBkNH0sEn4nJ
KZoIS+0BujEBxSARyKNGk688j1pN1vaotLWpp9BCSXbyfEXRSrT0DdVIFKagsBTzIrBWUku8iNyE
iACPA0Kh+2JbB90X0zfkCc8QMnkbMD7FP/ETvJPGqgzZi3gHLuEz1QjqKOgDsTOAr5VH34aKrlm2
G6qXIkFbFCJ+TBZF9OIMYUvSBYrD9ZIMo2y9FGiKQk159oy0h6ylVK1GOPMDqoNKBQgWJe0ZaQ+5
UoVgmbIoEXgAAAoRn+4jlDig+6xOUksVxY0xpG8+xQuco6h/PnlAKctHqk1RXPhAVYriKsA3iqLc
D6isDZ+QrEFx6EcICkXB6lPPlU942pBWUh0x/KGoz76hsQERgECTVDaiM9JMit2AqFyHD6EqG2O+
R6MJhaYPrlifBEFI6kuBB1EhHaYQhPcVDUBBRFpNhIaBIjsSIRzpPmJPYGBFZaOFIlGRF0Lyjwoo
yhR4YfkW+tRSG14heQYBjdCT1AJNZ9Q3kqJQh3RG12KyUEj3GYtiA5FQaKyKiFcqpBAiximKIegT
XVMUlcBXiE3wEt6jVuAMLCQGYNxCtCnS0ygiH9FYGGn8VTS64RKd0TUSfkVqoSmiFAWa9qilFMOa
It0GsSYvK02hSiGsSHY1cVfZ0TGisc0GsoZ/QEyKNHBFeYRsOeRRCWPHNIpNGjAxylE0UwmKS4Qb
zijeYmov9RRxTRanCI0D6q+xcQ2eKYqy2LaAojuObNmQ4hXfKIrLOA7pjK4Zaj3phPHAGkXxa2zf
KGoNMVNRrBqqyfdshMOyPsUqRnj0gyLUhNQWG68R2YA0B+pOZ4QCcwgaGRHNYA2R2MQ0JAcU/Yg5
KuwRPai/HqkviIkTkDekr3yyASINEU2Ynp1NEHuIw5I8++c/zz/QTMkTH+dX86tNks8/PW7S+VVV
7hbV5Tq9n18sql2y/pT+Xn37LlusknQtXr0Ub4s83b4Q85//Krz/FPMPt8InkL/85Y9/OA/zp8tP
P0CO/1W8XmWL5LaoMeUkzHdJuViRLuoaTXWixYz2o3yGhTIBTSg/0pTSHgI6dMJohqGar4vfu7Dq
hneVhiwM69Lb91eX87e/fRJX6WJXZtWj+PfNMqnSuoN+J3bI2B86+6en9Khud2etQ530L3XTg06Q
+FTTQ29S053O8P2m6emi6vRjXJMhrA+xCyj0B9rgVbK4uy2LXb5shRJCtAWnGqaqTnMccPO4pOy3
R93YzuKRN7Af//O//71uBe5YIKK5SPKlIKp//OH1VtxkebZdpUuR5eJd8khRHbai+rjLDf9+eVUs
H7s6HNkC9AznNFtDo19+6gTw3BYbGs9PFvOnAb29ev9rK5LGAv2WXtc44TScq+w2T6pdydIUTUP7
/O3b364+v6ix9FSbi3+qgeJpQCBmjWOm4eiw4bLsjvwo7CWzrslcK1NkyU/LDfZQE12r+lCPZNqt
FpF/mvaRs6Q+n/ayWykGIxHvBTgrLvNF+bipsiIXRJbLzy8E19AtEGe0taGL7I7RwUjgi4CvI0br
DlTd62td+1rXvta1r+MTYnTan9rtz1id789u2RiM9KRjslsyBiPthUx268VgoJ/TR0upn58o1S0c
Z5hrT6lu6RiMxJRqJrjd8hHLPkrFtSjEQX2oJzZxVB9qusXxWILF7hHWnD+zUN2CMRjpiWCqWxgG
I+0Jprp1YTDQxfq2wFx+dc9PUqpbGQbjEVkvmsFSdQfkGZZvuKq6A3Iw0n64VN0BORgIhI8ZyRGI
vZM/U4+Jph4TTU1/U9Pf1PQ3Nf1NTX8zmv7Grcy05n02/7sVYzjUfsT8VNyl9WD5aa9sfreCnNPQ
hi5+d6AOh2JtMwzniNZeV1PygTxIuYf66PNx9BSI+9Dz0DC/EJGtonMWVZNMs9TWTax5y31yWG/E
k0W3PA2H+ilnoG5dGg70kC3T7aZME37O9bu1aTjgbpuK6/SmKFP7tLjN8kUqqlXaNLhbsShJ1Esa
zSSJ+Vi7hjJO/Z53kMY90aLEzdlu7VbR4VAXZZUt1ulWrJKvqSjTRZpX60fYE6qw2V2v6+ft5LrY
VY06dMvt8Cqz+w2uoJ7ETtTJZ8t0sy4e6Zq4WScPPAT6DpWTvVMZSvzVngr4GI72mDyxNtBQlMI8
jF1hXi9DsJ40xGu6MX6tRjuL9y5e1atI3H6HkeOhDMqrIs8KcZXk20Iwn1pLWCo8gm4s3r2GRQnX
fbOelY36LcNt7wZQ4cB+PVvHmoAkvpm9npWzbFbh32KWzNYz0Vq4Go39dbfO0zK5zta0Dpzlov9Z
2J9Y5XetJabRMDSytxaZJth3pmfhTM4i8afGrpEDM+iVDlVP+SilXx9Z/BWLv+/xUZ4gWaOFDk1R
oaOsvfn9q7cf5++vv4i6CV0V+OfPAHR3U08j7QvMfxbxiOpXVbX5fj6/Xhe3LzMIBYbl7eP9fVqV
jy8Xxf2c8jJzz58v8OiTLZJ1ayltdKe/ay+kjcZpBVd7qWpy2xyBPxgny9vrUZMb5Ijn4fyQ4Yja
v2yLpiOOkD27I6OIfjhBTa9frqr7RvxjB9x++pjld51B7rOAcKZI+iwgnE2kDT31kR9JOL0oA56z
cGpJBixIAeMFjBecGCb9fp3zoxPFe/TLd+lXS/swKZI8FekECdwg+wnQGaO0QzUGQ71Jt5Ch6yaV
rRzqMRgvy78m62wpFrsSU+v2wtVo0KSqksWdSG6TLN9WgpYlL27L1M6nmzoc0jK4joesWonL9TrD
7GEhXtvmv8lubrK0vdQ1uoLv2ktco3F+TNfr+yQXl5sVDFAma3FFDxWLxhCOicVg/M/fXr5+82N7
4Wtypx3yNBjn8qq97DW+dy9etleTxjdpu03x0P19e/noGVyz5uPWJH4ukSFLYchSGLIUhiyFIUth
yFLIT1gyYmnltK6MGC86yGufO1cLT8zzIj3QQgdP7A4FGAx1YRUgLcWigALQHVuB6X17gWw0OkAr
SEuW34q2fm0KzN/aa0nPKol6Hcy5ScnJSam9E8YNTjsm0u6yesRSikONBkNd7a7vs8ZEDukZDHZT
lO3lq9FIy7R5DmwvGT0D7F9V4bSx1ByWvHAp9YmpRJ8XtTrhxaFrEAdedKjiYKhf0qRsLOXQxcFY
1QpxxNOJwKGKg8HsGhxjOTRkMNamzL7uN4wFDs0YjHaX8sNR4BCGwUg3ZXHPUK5oHAr1RHuBOVN6
v2ls54pM3U9/Fq2YRxlesJcxjzKcQJWcQZWcQpXxlPA4sZQVnx8egUNNBkN9TDdp0pjSoSRxvyk5
ySHNBP2PT63ytR5CeOtM5yDCMwreH8M0aPrQDW7OH1wChywNhvq0ekjKKl2K60dhh2XMczFGH4zN
TQ7kWO8Dh4qZfr3nlKg0J57U+qZP5oS+m/MJHDpkdDDUVXHPuhc6VHQw1Nvka8JQDgkdDLXOrsuk
zNJtncJCG2lOJ54u58WDWBZ71zfODR2Ka/pDsE4w2ndH6qPk4ymHhT3OHhySdWK9G+RE6Cl5CKLc
iwuKNdhvniiaJwO+zrl/7tGEXINym6s3DcOZkKZbnSBqn6fsZfaiqCpxUS6y7X+lD9u7TLSzMPFI
3FZKRzrAGq3uTumoOu1pXyJ66ugxht9vbm51N4AcutX6YCPFZCTxTTurMhbJ7nb+bDWFlqE2lXh/
/QW8EbSHlqSehKGdeRlb1VNm6PMLkUFyxKtkSUsn+TIpl+LTKqnE5de0fCzy9ChFM7bKq1WxWy+P
cjNjwS6+FtmyndSY4L8/tbYBP0Paq5ZLSBXnmFWdY7avvdVHzceYjyy4yjtB4f0aSafAcse6y+5z
W8PpbyYiUXpn+/18vknK5LbIs9QmdSjbs8/sfHmojrIxYytr1vcdEjQY5yDl4Aj/s5vkCP7BOA/7
baqO2D67RY6AHYxT0b6w7VFmZmqjHNE6GCdrGuQI1rMbNJX/180mJvV3IreaSu4tq/hRKmBqs6YS
vFo1D43q78RwNZXhKY9wR8v7U5s1leNbO1IeLfFPbdRUnidPI67vYvp+t6RzoFQ8QPIOC8U7LBTv
sFC8w0LxDgvl8xMJz+FVPZ+2723XR8bzGY8TrooTrooTrooTrooTrooTrooTrooTrooTrurwhcZn
3dw/gHQP0Cpwl30a3PHwovh5qBPkxCi/fx1yRMphPNTszSydbWcLu4np2p4LnG3x327/6QZ/k9kG
/615mxNtdypmOa4vcaT7cvHPuCrwLV2/wffl7L7ZtOM75GpwQ0lmBGctaIpbiKTZVi9227ShsEPN
gt6HZhUwpfhxUrWSQ2fO5Q7fGT0uG56/S813COsZUNbLG3gkZe+l8Juw29Vu4a96A9sK/traqzl9
K77BkXyZPm2+8h3aPLgpiyRvoBy6PBiKNgKL6+Y5xnfI82C4AxY5xDns3XqhOI2pOI2pOI2pOI2p
ohNPCOHp9TbuyRABCp2rJyo8oWLRiNSaY/wZDPUfacUBfZRMGQuY3NYbJsv0b7uspGW3zWYrqv0C
W0rC0WRuHPIZ9S6gKt7yq3jVSUWDnNPt2MN3lJ81ZeiL9gcr0g6tHQx1sdmUxabM2Fj88pKg0KWl
iodsvRaLVZLfpqLAVEtUWbPwGjj0N4p7Dcpvsyp9Qnef0tAOQxp3WX3+ElLg0N0zoGavSU15ZPyC
EXVrz7bQ2zU0OMen9ezRXtlYFc5nd/YbYUfkR1ytoMECx2z2O/6ldsRtcFipcfV33EHaXjVKHTiU
+pzG10M+DQl1I65t9Vtcv7FnDzxsFGgQNeerHVAyNKmeIOQYXI47Qvens0eYpLQYO2sM3HmUxjpu
dv9qDeeuFeeulT4x2etjkj4xT2trLe+/6KQji78+Ed+eOQTj9x8614d4aquaqW4zwvB13hijohO9
HrQOK91DVO+yN68WN91yuHKoDv2KP+KqSjdHP0HjHeHtf+Kle4X68N3pZ2UH/JQIN7gbIB7xTvxE
pMt8UezKBOq7SYvNOqXB7S5NN9DqtLS5w9229V6Pmljhln+MprUcPhqt/ZLBaJhmX7k4euno4C2j
0FFF7+thil+KVjFHMCe1leFBysgTjDj9cqE63DNwXNacP0hFE5FeJ1WyLuokxANsSm/cbSuxKZMF
7Evzp+Y9sta6/Oj6lvVeXLsNre25TVbdJOu1nawdLEvEjgr7BwR+4VfxG7/KnLB8n9eMf8Jr5z+4
m4lIH+oX+J6cg6fjItlVq5d5erQqP7qOf2uvyj/D6X+m5kQ0/TBafZwQNocJ6GdlDxPQKna+lcuh
35Cn6cOEoSF206J/sNSNuigHyEGhT2WafiyKav6xWKfvko3g9wA+JCUCiL4V/N6CfRa2wCFnwpu0
Fb8ZzT2j+vaFaailHecR1/wDqsqLKp3/Sn8u8+XTh8Yctls/pskyLetzKtOc/5Svszy9WiXUAbpw
kQPBxjl/BnFvIDH1p9+K8u66KO7mb4rFjhTBXtmu0rSiRlbzd8miLA4+v17h78HnNxmJ2MGFKzzs
pQf31vXgttsyuZ//kN3uypT7+uvufovJhWje2hC8J1nZX9WzxG3eqRD17+tZ49rf17N2bHCS+3T7
1/pj9y/L8c+x7X/ajO7jjdCtn6sa+3s/p347ZviPgIz99YS+V/H73rp2v9tLduJ3R899i+8f/ZLO
P3pnu2tjdd+W3al7Go838h1vGevfZUROO9odMjaj/v8tweBaTR66PuhaXjpeJXE/81rjs+cHzmZd
8yX3MP7HP/wfuOa7oQ0KZW5kc3RyZWFtDQplbmRvYmoNCjU4IDAgb2JqDQo8PC9PL0xpc3QvTGlz
dE51bWJlcmluZy9Ob25lPj4NCmVuZG9iag0KNjQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVy
aW5nL05vbmU+Pg0KZW5kb2JqDQoxMjMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05v
bmU+Pg0KZW5kb2JqDQoxMzMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0K
ZW5kb2JqDQoxNjUgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2Jq
DQoxOTYgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyMTEg
MCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyMjIgMCBvYmoN
Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyNTMgMCBvYmoNCjw8L08v
TGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyNjcgMCBvYmoNCjw8L08vTGlzdC9M
aXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyODQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVt
YmVyaW5nL05vbmU+Pg0KZW5kb2JqDQozMDIgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M
ZW5ndGggMzA4Pj4NCnN0cmVhbQ0KeJyFUstqwzAQvOsrdEwPwZJfacEYEpeCD31Qtx9gS+tUUMtC
Vg7++8orNw3pIQJZzO7M7LLrqKofa60cjd7sKBpwtFdaWpjGkxVAOzgqTXhKpRJuRfgVQ2tI5MXN
PDkYat2PpCho9O6Tk7Mz3ezl2MEdiV6tBKv0kW4+q8bj5mTMNwygHWWkLKmE3hs9t+alHYBGKNvW
0ueVm7de88f4mA3QGDEPzYhRwmRaAbbVRyAF86ekxZM/JQEtr/JxUHW9+GotshPPZixm5YJ4iijh
qF1Z6a/mXILfI43vAztDbZwHpx0+aYLBNBhmoUrOMZhlIVjhs4vXYsGeX3d44J4WM55c9sT/9XQI
JQ5pYFc3TPNAe7g0Xca1bPW8C3Gy1q8BV4/zXyavNJz/DjOaRbXcH0nPr0UNCmVuZHN0cmVhbQ0K
ZW5kb2JqDQozMDMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTAyNTc2L0xl
bmd0aDEgMzE5MzEyPj4NCnN0cmVhbQ0KeJzsnQlgG9Wd/38zI2l0jDSj2zosjSxLTqRYju3Edhwn
8RHnLDmwCXYIxY6TEEJCAqQcbbe4SylUQKHdLqWUAmUp/y5tF9lhWwe6DW0oUAoUCqUtZyDQm0K3
S5eyLfr/3htZcYrcxHFUYft95Pedd7/fXE96bw4DBwA+FB1cv7Rr5fJvfaxrB+ge2Avgf3750s5l
Q0v2fRmE+u0Awrzl69Z2Xf7gr5aC0HAzcOrby7tOa39Xdq0G3emfA9i5cVVX97JdiXMMoDv4JtYa
+kB314or+afeAmgrA1A+s7arps5Ve3k3AI9h6FvX8YHuv35kcQfWPxfDDRuWntKz7rM7MP/6rwPY
Pzewq3/P46HOa4F782Es85uBi/aq3zjw0qeBt2B7hvO27Tl7V9NXPEng/ngPgCVzdv+Fe8AHEaxP
xfqUs3deuu3Z5ANfAd6hA3jyou1bdl3y56/deR7AQCtw1161fWv/ll9saekA4G4m7W/HCEe99xoM
P43hyu279l7yWGfNc9j2JQCLbzt36wXn6e6DZ0HQ3YhxO3buHuh/ebMnDvzhjwJEgrv6L9njWWeN
Yvm3sby6a+vefv1jjx7E7algePN5/bu2zn/qA98DQUR7ku/s2X3h3mwCbkB7geTfc8HWPV8e/tVv
gMtuAZBqgOwbwy+23fTxlsfOklveMgaMJB/cfrgqQZZPfunwX9+5+69nK2Bcj0ETzU/Apbj43TXQ
ocA7d7/zYQXyKTlsB0mMci0MggK1IACPy1b4JIDei+3ymCoIV3HXgx6M+pv0aB4X0JbCk7CNdxj1
vMWg4wm6Q5DK3g+XdFALkO5TOlSsS409qn/q3fVcvbiYG8bNnc1m8SCL6+8jawpuQ84kfkHeZfif
wgehAPxd8FHihHKsVytzF4bbcHkvKau7EE5D9xK6FnQb0Plzcaeg60fXRcKYd//f1o3xG8lSvyH7
V/0GuEH/EGxDdwv6b9cdhq8aFsAuDN+BZQ/gTmskebDMDYa74EaMvxnTBzDuFlz2YPjL6N+E5ebm
/CbxWvCRJTpDoXUbY8cqdJ/ENtbhchm61dimE5ft6K7kHoKruIeyt2M6LuFybP9KEo9uaW65ArfJ
FZi+BMtVYvhy9PvRDgMuZXSRv9c+Y+LoLsz+hSxxu3ehW078uG92/m0+bsO7C/4R9uB+f/A9cXfB
aye9nbvgXHQ+dOyYYjAYDAZjBsF9NXtvqW04XvSBqWMrg8FglBIOsvca0SnA+k0Gg8FgMBgMBoPB
YDAYDAaDwWAwGAzGyUP3XdhWKJ7cB/uPtoXBmCpwN5XaAgaDwZjJvPvY34S/j+4JdE+i+z26Z9A9
XxLTcuguhE2CA5bo1sEK3TJYhOFa9C/S/RNs1lVhPHmW6lLoJs9OCT5YOOb5qjr6fNXHMF8NrKbP
V30ETtN/H3bon4IB/dtwp2kV3InLmwUeFurb4A7DAujTXQDLuIfgU8LbcCVvhk9huTX8OrDpLoEr
iC3UHsxP0sjzTrrz0cZPwY26g5j2S1zuRmeEG/U1GH4TbuR+AzcKF8Jskkf4Nn0e60bd73BZi+m7
csvnMG4XrNIpmO8F+IxuOxgNvRDCuoy6nWAs5fb/R4Lb6spS28D4x8PfBRVjn9dC583FpdCtRJdA
V58Lk2VFqW2ezozZ/nTbl9oeBoNRCOVakeO4r2lPbRsMBhANomjII9JoiOklxBFcHNQbPhR0BB0O
/U3B8BWHbsjVEp9viFZt7Wpc8NqZC85vrJzfZUg6Gh+84ycPFMNkA7hcoCc+btw82XGTyToyZjDj
HzSTyco4BtjLlNoEBoPBYDAKwI3Rqc90WY/3LWQDc5RjZdQI5JaciaqAHwLPcS4H8SzgOA9XwwVp
IMXN5ebKHBfnamomsSdLexBwYyliG0WqmlEqBNDODb0gkPMDyvS/s9wPbxuzYARj9l0wgSn7VzCD
GdUCFlQJJFQrWFFtVGWwoSogo9pR/wIOsKM6wYHqAieqG/X/wAMuVC+4UctQ3wEfeNHvBx/6A+BH
DVIthwBqCILZP0OYqgrlqBEIo1aAihpFfRsqIYIagwrUOOr/QhVEUWdBJepsiKMmqCahKvsnmAOz
UKuppiCBWgNJ1LlQjVqL+hbUQQq1HmpQ58Hc7P/AfKoNUIvaCPWoTTAv+0dYQLUZ5qMupNoCDaiL
oBF1MTShLoEF2f+GVmhGbYOFqO3QgtqB+gdYCotQO2Ex6jJYkn0TlkMr6gpoQ10J7airqK6GDtQP
wFLUU2BZ9g1YQ3UtLEddBytQ18PK7O/hVKpdsAq1G1ZnX4fT4BTUDVRPhzWoPbA2+zvohXWoG1Ff
hzNgPfo3QRfqmdCN+kGqZ8Fp2d9CH2xA7YfTUTej/gYGoBd1C2xE3QpnoG6DTdlfw9lUt8OZqOfA
B7O/gh3Qh/5zqe6EftRdsBnjz4MB1N1U98CW7C/hfNiKegGcjXoh1b2wPfsL+BCcg3oR7EC9GPU1
uATORb0UdqF+GM5D/QjVj8Ju1H+CPagfg/Ozr8JlVAfhQtSPw17Uf4YPZQ/D5XAR6ieoXgEXZ1+B
T8IlqFfCpahXwYdRPwUfyb4Mafgo6tXwTxhzDerLcC18DPXTcBnqdfBx1OtRD8Fn4J9RPwuXo/4L
fCL7EnyO6r/CFag3wJWon4erMPVG1JfgC/Ap1JsgnX0RvghXo94M16B+ieot8GnUW+E61NvgetQv
o74At8NnUP8NPot6B/wL6lfgc9nn4U741+xz8P/gBtSvwudR/53qXXAj6tfgC6hfhy+ifoPqf8DN
qHfDl1AzcAvqEOqzMAy3ou6D21DvgduzP4f/hH/L/gy+SfVbcAfqCHwFdT/ciXov1fvgq6jfhn/P
/hT+C+5C/Q7VA/A11Pvh66jfhW+gfg/+A/Ug3J19Bh6ADOr3YSj7E3iQ6kMwjPow7Ms+DT+Ae1Af
gf9E/SF8E/VR+BbqYzCC+jjsR/0R1SfgXtQn4duoP4b/yj4FT6H+GJ6G76D+BA6gPgP3Z5+En1L9
GXwP9edwEPVZeAD1OarPw/dRX4AHUV+Eh7JPwEtUD8EPsj+Cl+ER1Ffgh6iHqb4Kj6K+Bo+h/gIe
R/0lPJF9HH5F9dfwJOpv4MfZx+C38BTq76i+Dk+j/h6eyT4Kb8BPUd+k+gf4Gep/w89R/wjPov4P
1bfg+ewP4U/wAur/wouob6M+An+Gl1DfgUOo/wcvo/6F6l/hcPYH8C68ipqF11BZn178Pv0PU7xP
/+1x9+m/HqdP//V7+vRfjdOn//I9ffovjqNPfzXfp19wVJ9+eJw+/TDt0w+/p09/hfbpr4zp01+h
ffortE9/ZUyf/vJ7+vRDtE8/RPv0Q1OwT/95ifr0p1mfzvr0KdenT/Xf6VO3Tx/vdzrr01mfXrhP
f3ga9OkA5H9bXG/xGEEQeB2dpdHpdCDoBOHI3SICiTaAUSS3kBhFXi+iGtGJBtFoFkdvQ6V5dQYD
z+t5o+bHSszFuTHDgHYCT3z8uHloiq5QCllHxgxm/IPmPYjFs2LGwVk8pTaBwWAwGIwCaN/2E/h5
8L5muqzH1IcMjHLkfUaj0WrUiSYDrxfIUMmgE3gDvU9fFAW9QU8HWCRkME1mECWcvLU4AXRjKWIb
RaqaUQKkMhMIgjA6H6Gn8xFiHnpAiyAaTSajaDIJBqImLSRaxNEBGz17sJiAJ5eFlNNhSG/S64th
skjmI6hh4/e5NJnNRzDeywS+qGfMU9//AHiprNQmMBgMBoNRAO3HbGmHcCcPNh/xfkHUk3kFMkIS
9XRQhT4cRNlMeqNJxAETGTiJ+tyoCwdYgl40mESjqM1JmMVJXBVj8xGMqYXVb8Z9KmgTB2Q+guzg
I/MRdF+LYCIYzSYBTxSLyYwfE55SVtGUq0WbuyDzEeLofIRO1JsmcyqND5uPYEyCCfTRbD7i5MFb
/aU2gcFgMBiMAmjf9tNlPmK6rMfUJzcLIebnI0QyH2GWzXqTmc5H6EbnI4xG4gRyVwR6aYjNRxy7
jSJVzSgBcshCpiG0+Qi93gA6vU5nzEP3tRFMZovFbLKYBdFstJgls2QhcxKyaXQ+QsuLp5IgClbi
12NozP0TJxUj2qmdaeOfbjSl4N0Z+uLctMGYKkygjzYXz4oZBy+HSm0Cg8FgMBgF0H7MTpdx/HRZ
j6mP0ZAfTuV9FovFbjGYJaMg6sjAyWjQCUZyzddoNum0i77oMxpNRsk4iatipR2q68dSxDaKVDWj
BCiqROYjtGeURucjTHnoAW0Ci0WSLGbJIhgtJqtFwo/FZLHIltH5CPoIh85kxJNKsJLzqpjzESYy
H0ENY/MRjAnD5iNKAq+opTaBwWAwGIwCaN/20+VqK5uPeL9gMmi3l6PL+yRJckoGi2TSGXUmPUkh
oy6z2WQ0m3WiSZTQS0Mma/6i7wnA5iMYUwt7hZXs09H/fiqC3qDXH5mPoPv6yHyE3jR2PsJuseRq
0fKaTHQ+gvgNeJqJFnESp9L4mNDOY81HULsLvgiG/ffTGc4E+mjLsbMwjhPezv7fPIPBYDDej7D5
CEYxII+2m8gj7uYjPkmyuqwGi1WbjzBr8xFmM3osFp1oNkpmHGDRIlN4PsIwliK2UaSqGSXAGbeR
2yK0GxlG5yMseei43gJWq81mlWSrwWy1yFb8YMhqdVqlXC1mi9liMVjMeFLpFPRaDGb9JE+l8bGA
KB5rPsKQl/eksON3ZjOBPlo6dhbGccI746U2gcFgMBiMAmhXH6bLfMR0WY+pj0U0k/ERGRaJdFCF
PpvN5rGJkmzRmfQ4cMIUvQ6VXPSV9EaLySZJ2iVgs2yZxFWx0t46wOYjGBPFnVDIPtXmI0TRCAbR
YJDy0H0tgdUmyzarYjNYbJLdptgU2SbZrG6bLVeLRM4lPK30OrNOIXdPiOQkk81FucAskfkIeqaN
3+dSuws+LSIW5yESxlRhAl/U1uJZMeMQ3IlSm8BgMBgMRgG0qw/T5e5vNh/xfkEyWugt5TicMtJB
FfpkWSlTjDZF0pv1EhlvGfV6SbJaJYvNqjdJZtlKBliSxSrZpUlcFSvtwSyOpYhtFKlqRgkom+sg
0xDajQxGXJJ/M2PNQ/e1FWTFbldkp90gKVan3ak47YrNLntlJVcLPXtEm01vkAwum9VmM0qizWK3
FOUCsxXtPK75iIIvgjFO5v0wjKnPBPpouXhWzDiEsrmlNoHBYDAYjAJoF9emy3zEdFmPqY/VRIdS
EjrT6LjKbncEHSbFadVLBisZb5kMehw2yVZJkQ1mHDrJilWRyS3pTuskroqV9tYB41iK2EaRqmaU
gECDi+xT7dk5k8kCRpPRKOeh+1oGh8PlctjdTqPVIXudbrvb5VCc9qDdkatFlm2yLMqywWAzeEg5
k82Ip5JkG6/ZySCjndqZNn6fS5MLPi1iKs5DJIypwgT6aHvxrJhxCIGGUpvAYDAYDEYBFKrT5e5v
Nh/xfkE2k9ERdWY6qEKf0+UKu8wOt2ywijIZb5lFgywrdtnmsBsk2eqyO2SHItsU2S1P4qpYaQ9m
01iK2EaRqmaUgPJmD7ktQpuPMJstYDQbjUoeOh+hgNPpdjsdXrcoOxWv2+v0ujHGGXI6c7Uoiox5
FUUUbaKPlDPLRsXqnszU3vgoaOex5iPoMVrw3yOYzey/JsxoJtBHO4+dhXGc6MqbS20Cg8FgMBgF
0K4+TJf5iOmyHlMfxUJGR9RZ6KAKfW63p8JjcXoVg00kAyfFIoqKYncostMhWhWb2+FUnBhyKF5F
OfGmS/sog3ksRWyjSFUzSoDaWkZui9Be9GCxSGCymEyOPHRc7wC32+t1u3xek+J2BLw+t8/rdnrd
qtudq8VuV+x2s92BJ5UYcNjtdoticsheW1FueHegndqZdoz5iIJvr7BM5v0wjKnPBPpoV/GsmHHo
1NZSm8BgMBgMRgG0qw/T5Wl0Nh/xfsEh2e0O8nE4JDqoQp/XWxYrk9w+h6gYHWS8JRlFh8Ppcihu
l9GGQyeX2+F2OhSnw+dwHLuJ8SjtowyWsRSxjSJVzSgBkXYfmY/QXvRgsVgLz0d4PGVlHpe/zGT3
OAJlfo+/zOMu81QcmY8g55vZMTof4XBY7GQ+YjK3Go3PkfmI8ftcNh/BGIcJ/OBwHzsL4zjRRdpL
bQKDwWAwGAXQrj5Ml/mI6bIeUx+HlYyknGQ+Iu8rK/PFfZLHT+cjzLn5CCd9KN5ltDnlMjIfgSGX
w8/mI47VRpGqZpSA2KogeUxDe7BCkmxglsxmdx56L4wbfL5AwOctD5icPnc4UO4rx1AAzyhvrhaX
2+l2YTHR5BTDpJzkMLvtAXtRHsB3o53amXaM+YiCb9OUJvO+WsbUZwJ9dFnxrJhx6GOrSm0Cg8Fg
MBgF8FCdLm/HY/MR7xfcNpfLTUZIbreNDqrQFwgEk0FbWbnb6DC5LSTFJLrdHq/bWUZuQrcHvGWu
Mo/L6XWVuydxl25pX60gjaWIbRSpakYJSHSrZBpCu5HBZlNAskmSNw/d114IBkOhoD8SktxBbzQU
CUYwFAomAsFcLV6v2+u1er1ms9tcScrZXFhJuacoF5i9aKd2po3f51K7C75N02Yryks2GVOFCfTR
geJZMePQJ7pLbQKDwWAwGAXwUZ0ub8ebLvMqUx+v4vV4vWXo0OelvrJQOFwbVoIRr8lt8ZLxlmIx
e8t8fq874Dc7ylwhf8Ab8Hndfm/E6z12E+NR2lcr2MZSxDaKVDWjBKQ2RcFqtSk0IMsOsMpWqz8P
vW/CD+FwJBIOVkYkb9gfi1SGKzEUCafCoVwtfr/X77f5/Waz1xwn5WSvdZKn0vj40U7tTBu/z6Xz
EQWfFpGL8xAJY6owgT66vHhWzDgMqU2lNoHBYDAYjAJoVx+my9vxpsu8ytTH7/D5/D5/GQ6LHHRQ
hb5IpGJ+hT1U6Td7JT8Zb9kls98fCPq9oaDF5XdHgiFfKOjzBn0xv+/Emy7towzyWIrYRpGqZpSA
ui1xcluE9oyS3e4Em91mC+ahc09BiEQqKyPhqkqbLxKcXVkVqcJQZaQuEsnVEgz6MG8wKJl90ixS
zu6zBX3RskmcSuMTRDu1M238+Qhqd8GnRezFeYiEMVWYwA8OtWhGzDwMdVtKbQKDwWAwGAXQLq5N
l6fRp8u8ytQn6AwEgoGgH4dFTjqoQl9lZaw55oxUBS0+Kxk4BZ1WKRgMhYM+NSx5gt7KsBpUQ0Ff
KIjDqRNvurSPMtjHUsQ2ilQ1owQ07JwNsmzX3i3scLhBdshyKA+dewpBZWVVVWUkUSUHKkPVVYnK
BIaqKhui0VwtoVAA84bKrdaAtbocyzkCcnmgyl+UG95DaKd2po0/B0ztLvgiGMdk3g/DmPpM4AdH
RfGsmHGIDTtLbQKDwWAwGAVQqU6Xp9Gny7zK1CfkLi8PlYeCOCxy00EV+qqqZi2Z5YomQlLAFlIw
zmWzhsJqJBSIRqzesK8qEg1FMRQJJUOhYzcxHtaTtxYngGMsRWyjSFUzSkDz3jmgKE7tRQ9OpxcU
p6KoeRQSrUJVVSJRFa1OyOVVak2iuqo6UVWZqGqOxXO1qGo55lVVqzVkrSXlnOWKWj47WJT5CBXt
1M608eeA6XyEs1CK01kwmjFTmMAPjljxrJhxiM17S20Cg8FgMBgF0K4+lHYId/KYLvMqUx/VEw6r
4UgIh0UeMjYivkQi2ZH0xKtVa7ms2kmKbFUj0Uq1PE5uQg8kKuNqPKqWR9WUqp5406V9tYJzLEVs
o0hVM0pAxyfrcJ96tP8k4PH4welxOmN56L6OQXX13LnVs+fNdVZUxxrnzqueh6G51e3J6lwtsVgF
5o3FZLlCXkDKeSqcsUiNGhmv2ckQQzu1CYfx54DpnJmnUIrHUzCaMVOYQB+dLJ4VMw5jxydLbQKD
wWAwGAWYRXW6PI0+XeZVpj4xf2VlrDIexWGRn4yN0BefW1u3ps43Z15MjtjJwCnms8ux+KzZsYrk
bKU8Hp47OxlLYmh2bH5sElfFlJO2EieCZyxFbKNIVTNKwOobmsDt9mo3Mvh85eD2ud2JPPS+iQTU
1TU01KWaG9zxusSihua65oa66oa61bW1uVoSiTjmTSTs9rh9CSnni7sTsfmVRbnAnEA7tXdDjN/n
UrsLvr3C5yvKSy0YUwXl+LPOLZYNMxDT6htKbQKDwWAwGAXQLq5Nl6fRp8u8ytQnUT5rVmJWogqH
ReV0UIW+hsam05uCtc0Je8yZ8GBc0GlPJKtTiXhtyqEmow2p2tm1qdnx1OyWxOwTb7q0jzL4xlLE
NopUNaMEdN25GLxen/afBIJBFbxBrzeVh/6DjBQ0Nra0NNa3tXgTjanOlrbGtpbGeS2NXU0NuVpS
qUQqVZZKOZxJx3JSLpjwpmYvTFQVw+QU2qmdaeNf6qZ2F3wRTHAy74dhTH0m8INjfvGsmHGYu+4s
tQkMBoPBYBRAu7g2XZ5Gny7zKlOflFo9J1Vdk8RhkUrGRsTX0rK4b3G4sS3lmO0mA6dU2O1I1dTW
pxIN9a7KmqqW+oZUQ10qUZdqT6VOvGnXyVuLEyA4liK2UaSqGSVg00gn+P1+7cGKcLgS/GG/vz6P
n0TXw6JF7e2Lmla0+1OL6le3r1i0on3RgvZFZyxelKulvj5VXx+YV+9y17hOwWLzwil/fXVbdfV4
zU6GerRTO9PGnwOmz5+EC6WEwwWjGTOFCTxutrB4Vsw4pE0jpTaBwWAwGIwCNFIt7RDu5DFd5lWm
PvXRutr6unlzcVxUScZU6JvX3tF5bme0ZUW9K+WtD2Bk1Ouqn9fYVJ9qWeCZNS/ZvqClvqWpvqap
fmV9/Yk3XdpHGcJjKWIbRaqaUQK2PLyazDFV0kAkUgXBSDDYlIfOPTVBR8eKFR2L1qwI1nU0da1Y
07FmRcfiFR0D7e25Wpqa6pqayhubPJ46TzcWa4zUBZtql+ef5zipNKGd2pk2/hwwff6k4NsrIpGi
vNSCMVVwH3/W1qIZMfOwbnm41CYwGAwGg1EA7erDdHkafbrMq0x9muIN85samubhuKiKDqrQt2Ll
6r2r4+1rmjx1vqZyjIv7PE0LWhY11rUtLksuqFmxuK2xbVFj/aLGtY2NJ9502clbixMgMpYitlGk
qhmlQci5IHAkyJEQCm8AHbyKEXWgos8BFZCAZlgCvXAp3AbfgH2wn6vlG/mfG1pVk+pUfWq5WqMu
Vfeol1a4Y49ms0D+F8YsmINl2qCflhl+T5lgrsxerUz28JjPQHYAFkND9g7jz97l/pL57eOHbjn0
pUOf/+1XD138+p8AXrzztUWazceJUVvYvmM7YNtiu9/2XdtWXF8D5CvheB5X/G9KkQ2i01OvRbKC
rNgdTpfb4y3z+QNB+qBLBVTG4lWzZieSc6pTNXNr6+rnzW9obFrQvLAlV8fSzmXLV6xctfoDp6xZ
u279qV3dp204vad34xmbTmB//V0EqkOw7x74JvHdN37WnxB5VvPPiD3desYVey+84Pw9u8/btfPc
HedsP3vb1s1n9py+4bTutWvaWpcsXtSysHlBU+P8efV1tXNrUtVzkonZs6riscpoRUQNh8qDAb+v
zOtxu5wOuyLbrJLFbDKKBr1O4DmY0xld1qdm4n0ZXTy6YkU1CUf7MaJ/TERfRsWoZUfnyah9NJt6
dM5WzLntb3K2ajlb8zk5RW2Bluo5amdUzTy2NKqOcBvX96D/2qXRXjXzOvWfQv3XU78V/ZEIFlA7
y7YvVTNcn9qZWXbR9nRn31Ksbshi7oh2bDVXz4EhswW9FvRlvNE9Q5x3MUc9vLezeYgHoxWNyvij
SzszvuhSYkFGiHX2b8msW9/TuTQQifRWz8lwHQPRzRmItmfkJM0CHbSZjKEjI9Jm1HPI2sDV6tCc
+9PXjCiwuS8pbYlu6d/UkxH6e0kb9iS2uzTj/fCrZUeCWLmjo+fKsakBId1Zdo5Kgun0lWrmtvU9
Y1MjRHt7sQ4sy8eW9aWXYdPX4EZc3aVia/wVvT0Z7gpsUiVrQtZKW7+t0U4S07dDzZii7dHt6R19
uGv86Qycemlk2O9v3Z89BP5ONd3dE41klgSivf1Lg0MuSJ966T5fq+o7OqV6zpBi1zbskE3OeSTr
WM/WfBr10ezEt/rU/JbliEXRlXhAZNQBFS3pieI6NRHZ2gTpgaYA/RHQy2GpzBbcI+dkTB19aaWZ
xJPyGX1MiarptwCPgOjrvzs6pj8XY4gpbwHxkuMkf6hh+qg/k0xmEglyiIgduE/RxsU0PL96zkUj
fDS6R1FxgZsP1uG27e9trsHNH4mQHXz1SCtsxkBmcH2PFlZhc2AYWmuSvRm+j6TcP5riPo2kDI6m
5Iv3RfFIvod2DO6MMZ7/kxWPs3N7c4bz/J3krVr66q7o6vUbe9TOdF9u267uPiqkpTfl03K+jLOj
RwjwOR8fEGgqHpSb8plJoEfK6GL4Z6AH9ZYR0YhHJY3h1GUZpW+Fpr3mSOQ4C41k3ySl6OJIsZyZ
mebk0eGFR4WPMk9KC2iwLs6v7t6YTpuPSsNDTWtwZW6BRzx090TUjgychmdmDP9Gsvc3EdcbyLTi
JusgGfD406JywaMyBnL+XoQcndVzlmFHl04vi6rL0n3p/pHs4OaoqkTT+/nv8d9L7+nsGz1wRrL3
Xh3ILLumF7fVdq65ek6UpKTTW4ZAiGEzrYEhjnoaO67uzaxN9kYzm5PRSLRnK67LUDNIke6+DvTx
0D4U5a5aP9TKXdW1sWe/gt9bV3X3DPMc39HX3jtUiWk9+1X8qqCxPIklkSSgkgCs5nDTDPNGmj+w
vxVgkKbqaAQND4xwQOOMo3EcDIzwWpyiNRSnDbXib42BEZ2W0jqaW4dxRi1uUMs9K5fbiCkKSbkX
ePILjSRqDGGgu6fV3Nja3LqwdTG/hMctQqKGMeZezLuQg32LuSVcYAjrPJVGj3CDQwtbA/tpTafm
cg5iThI3mI9Dy0m2MRVhe9qKn3ZkDU7b2LNvMWD9VDFHO4H0tGjE2HOIdkzkOD892SPx6dVdeASS
RHNTwDwmWSUFM1w0c1b0kghZu8yG6KURjIxmVOytMdMQLA/2ptMqfqK4VQY29GhKkrg5QaypNzO4
eTRvIIjHxJGghEXpcbUvSPqQfGsfGW3tAmyNeNKjzWUGCraG1me4M4jSP2r+UANEtfbxW1prNL0p
vRGPx0imnDScswODtmAvrQEtuZFawtEvpwH8TbCNnEsq6eSwm4yuGuLXJOmSo8v0qmjnFsxBHH7p
zsedFVG39JJcUXLSkAN/3EzcmEzki4RWnlYWjoa4XEg7fdOZs48Obs8HlxGHv1FiKa2bwHWhp2wk
syOQ2dmbzGfpJ+ucxnO7mZzgzbTwcuL68GtneWZwoB9NxO+blQNRjFiFEWrPZm0Lki/qNPnlNNCP
xchWzrWUOS95VJXYJ3DYRWFFZHUyg+vUvl61D/sQbj1u7ICa0eNS3YY/n6L9pN9Yp63POuz8cdGf
7sKyQHZbICNif7atf2uUdK4ZcrxrW5/YqEProKsnA4F0OorHEJoYW4aZsfp4xhBfSRb4tycZ7d9K
ftltIz/stmo/OdBcunVIbYHOaKQXs/Axui1xw+GJtpnIQJr8bjyzL4lbwp52pNUFaTzhz8S+Shcf
2NCH/ZqqqMtUuqv7AxjCjbCShHqxIi2jKUYyYnn6F8/sSg6dKcaOxNC/3Ukts5HWSn9EZNaNZhHp
H3rOT2Z4bxMmkpXnTt1IvxdwR5GNp4+txM3bikdVgJTGs6g797WhlV9JigZGd5hWDGN6R78A8Hgf
inFXrRvbE27KOFafekYAN2z1UPcVbRZhDvnwFVAOYSEpJKAFl4lhQ3l4RJi1L14WfuLbwmw4hI4X
Zg8ny8P7hSqhfHhhuHVEiO5zuOvktmpBxS64hqqKuhvd3egOCGS4c5YQwngF9TJ0g+juRncA3RPo
cHCISlJVdLvR3YruEEkRyoXgsBpW2qoEH5b14SrIghfeQJdFJ6CdXmzVC2vRnYXuOnS3ojPQfCRm
N7rL0B1A9yZNaRW8w5+tR9u9w1fTxb4dO+tosF8LbjqTBved3qstT1mvLZeu1LI1a9lq52nRqXZt
WTVHWzpidYNkabbW3d/mETy4kh40fA8qxz8AMsdBGG4T3JBBxwuGXEyr4NhXGa+79YCgA07gBQ62
QDh7v8ANW+11bWY+y7+B48Yw/3v+dS2Ff32fzV53a9sq/hW4G90BdAL/Cn5e5l+Gy/hDZJujLkF3
K7oD6H6E7g10Bv4Qfl7Cz4v8iyDzL0ANuiXozkJ3K7oD6N5AJ/IvoCr883TC4nla5/OY83ng+edR
Ff45XK3nUGX+WfQ9yz+Lpj013Ligbj/1JGtynnAs5/EGch6Hp26E//Hwn2fjERXHPY1H1H1CBY5S
64WK4VgtHn5lwy3nhEf4w/vUZPi2trn805BBR2YQnsaWnwYV3Tp0fej2oDOg7xn0PQOD6K5Hdxu6
DDo8ylAVdCr/CLpH0T0Dc9G1oluHzsg/MYzNjPA/Go63h9s8/OP8Q+DFLf4Y/zBdPso/SJc/5L9P
lz/AZQiXj/APDofC0GbBdMAyCi4VXNZgup7/7r5KRzjbZucP4LYLo9agW4JuLbqz0F2HzsAf4CuG
t4QdWMl98AiOrcP8MPyaLu+E243QuiPcGu/AA1AlEm9ehD6UW9Vb43xr/IYvYJBI/NOfRR+R+Ceu
QR+R+Ic/jj4i8Z0XoY9IfMsO9BGJbzwLfUTia7vRhzLC3/Ktyqpw49pzObVN5i/GrXQxbqWLcStd
DDr+YvKBP+uIbV8cTiRwi93UmpydCA/ib5tvc4OncoO3c4NbucGPcYMf5wZbuMEPcoNJbjDIDYa4
wVZu8D6uCTfFINd6z1HBBa1l3OAj3OA3uMELucE4NxjjBiu5QZVrbB3hI8Mr6+miky72tZGTDpeL
FmPvI/MR3KIRPOYj2CccQP0RuiwNtWImtULL7AuRZcW+xBItnGqu242nz0EseBB3w0F4CZ0Od9BB
PIwOYiUHsQIZdQm6s9Ddj+4NdFl0BsxdgYZfR1VGrUG3BN1Z6C5D9wY6AzXnDXQ87M6ZeDc1jBhd
kzN8LTodfxA/FfiJ8JHWciWoJJUVwnVBTg5xa0PZEN8I/5+0LwFvqkr/Pstdstyb3KTZ2qRJuqWU
AIUWKIVKLwgyCgVkqRQJi4CsClhwQZBFNhEFNxTGBRcEVLR0gRRwRIfRvzodHHF0dEZhnIroN1V0
+KMjNPnec5Jb2tF5nvmeL7f33pNz33uW9/ze9eQB/u8KOx0mRxyrB39Qf/xBReYhZnI/2cpUN9mW
vm+t/xeobvxYfeRIaIgbP4qCAiAPl6MILoD7AFTLv/dDARO790UB8iLcS+oD1fCavT7SI3QY29hb
B0P/CrSGvgrECRTPBo6EPgrHBVwf+hPUvHgw9EHgntDbxXET1ByNxDHcDoc5aXNgQGj/O5x0DTzY
WR+6i90OhlYGRoQWBPiD2akHU2vhm24PjYtMDv0K2hsWuCGk10KbB0OVgamhihRVP/bOwVBvGEI0
VewOgy0K8E7zglDTGOo3cWJZHM/Ve8jb5UnyGLm/XCL3kHPkkJwt+2WXyWnSTDaTYrKYTCbJJJiI
CZlc8eRpPcoSkC5JYzdJYFeBlzXCrixXyVQfNhF0DarLoCPJyPFD8ci6YzPRyBvCdRfG58WxBQI/
MW8oBsuKRk4YWjcgOjIuJ8fVlUVH1sljr590AOP7a6C2jmyC0GXCpDhOsqr1fpZiaUYYO9bf52f3
buvvq6lBPs+tlb5K52BH+VXDfuEyPX2NXv74upSzh9ZtHzl+Un2/F17IHlpTV8LLySSUR9Y9xFIx
zfh7fG74sGb8HbvVTGqmg/H3w8exejp4WE3NyDiu5nQojL8DOoDOd5zOBFaa0aGwKZii25miK4D3
gS6f3YDObEYFnK7AbOZ0AmZ0B2rzhw87kJ/PabxhVMtpar3hzjTvFABNQQGn8axG73CadzyrGU3d
YE4SCABJMMBJcBYKcJIAzuIk1ZdJitMk93SQ3MN7ovgyTSBFo542aNTTQBP9bz+zh0ajuGFQzcwp
LI01PW/4bDin191761wf88jDB2bWpPNbkek3zJzL7uCT1uTNHlY3M29Y+MCgKb/weAp7PChv2AE0
ZfiESQem6LOH1Q/SBw3PmzGspmHE2L5lXfq6p6OvvmN/obGxrLG+rK8RZb/wuIw9HsH6KmN9lbG+
RugjeF+IQ33spAMmNLTmyimpewOxWgC208GPH+rRFg/mGB6U47vLfxhcl73IGq2pU/KG1qlwskc9
h/Qcwh6BaLFHNparTD/y3TUox38Y700/0qDakTcURZcuq12GfMPnDUv91cIHqpYuYwxPXaO1/+kD
z4bX6TOG1S5FaGRd9/Ej6yoh+D0gy1A7nU2pbqBRZ7UOjyePpSp7QeVAVklpByGrq2B1ZnOa8Ofr
vyx9v5JJwWpypAHrQbwU1dbQuuDICQQ0woR0UugwOFbMVtTWwARrcRTXGm2khx2NotR3xOZsnEuX
pUtpXixN31Nvwiu1Bks6PoxZ0Q6OLeXNcnZGp0waYqP9aTEaAr5zb7j3hHtPuJfAvYQW685IiJKy
kNlUFrJahoVkaVjIaLUmisTDKBPOLHEPyhQibDM2+SWcZ9k9MS95lj1nd/I1aM14+kRoL9qP56H9
6DX0Bj4Hb72CmlEjYl7VMPQ4WoEeRhvBUk6GmnvQODhEqH8YZyYbUTF6Gmzl06gFaK9Dd6HDyIN9
ya/QKrSenoS31iMV5cJkxqJF6D48KrkMTUGnhLtRGRqFbkaL8erkpOT9yQeTz6HdqJn+T7IdWVEW
mglHS/Ib8c/JvwIDpqBH0A50Cj9obkI69LIaKJ9At6CdNCbg5JzkTzCCHHQbjEFAVagFHyNRaH02
+hL78Ap6JbTybLIueRyoAiiG5qKd6DDuh0eQHHFKsirZgjzQx+3Q6g5Ujw7CEUevok+wIp5LPpc8
hzJRD3Q1zKcR/QEfo4n2NYlK4JgIXCpC5fBkEfoNegu9h/Pw62SRqIgloi4uT36AXKgPmgij3QNv
nsE/kLvgWEXfFK5KDkU24MsDjNvod+hvOAsX4zG4mhSRReRJegsyQY994JiF5gG/H4PWPwMwHiQK
OUGfFV4ULkrZidNJG6xIBP0aPYFexyrMNIxr8Vr8If47uZJMI78mn9OHhX3C+/IMmPVUdBO6D72I
fsBOPABfi6/Hc/EKvBE/gHfgFvwePkuGkAlkAfmWzqVL6KvCUDjGC7XC3eIG8V7pbGJS4njij4kf
kiXJDehawMMaGP0j6EmYWTM6gT6G4xT6HIvYim1whHEOnojvhOMufB9+Bu/F+3Aj9PIe/hx/BYbt
f/FFAmabSMQPvhTzqPLILeC0PkweJyfgeI/8g/yLemkuBLv9aAWtoYtgVBvpNjia6N+ELOGEkAQ+
l4jbxafEveKL4hviOUmR14LD8PtLz7Z3b/8sgRKbEtsT9YnG5N+QG9YQbBDEcBUw+hlwzIf13g6I
ewWdxArwLgt3x4PxKODMNDwfL8G3AyfX4Z14Nx/7y/gocOkj/C2MWSUBPuZepB8ZSsbAMZXMJkvA
t3uQNJIPyU9UplZqp27anY6gMTqbLqV30O20jv6efko/pxfoJTiSgkUICblCRIgKI4RpwjLhSeFL
4Utxiviu+IVkkW6SNkhx6TtwkQbLY+Vr5Zi8VT4of2CaDuj8LWpChzpv9OHTdA0dTpvQ/aRUyISo
6A+A52loFq0igFSyF28iK3EjyRdvlwaRQXg0OidEgNdvkqfIBTKIVuGReDyaT9I/nJdcwgtwqxB+
i9qEozC3P0DLt0sKvot8KymoHhyucujzd7S3EKXvok/oKSwLT6O/CBbsxW1kDx0LKHhVGCxOQjn0
cfQyXYJXoiYyHCHLRdMWwPFo/ALohQm4BP9IkxAQjwYUldG/o7vRAvJn1AZyvAk9imcJc9D9qBSv
QF+i50EqisSbpe6SG79N5gmbSQZuRETYB7Mrx/mYii60DsfoTulb8jFahk4IFvQZfQlGf4K8TKuE
c+I4PBckYCXagJYk16A7xEnC+3gOorgaFQinQbutoCVCDtxXgVaZAjrtIEj3YdADQ2gV1PgAOaMA
FxNBQ+yE4zHQEwIgaB7I+HWgxf6AGqUJJI7miDYMWgch4d3EODQ5+TzakZyDbk4+iHqCPtiYXAEt
7kVfoK1oL16fuBMthuj0Y5DtUeJV5IR4VbIn2Uw+JuPJ9q7rC9wuwD70NRwvw5fB4hG0WfgIjUeV
yS3JPwG6u4GG3YFuAO+3FWb5DfTwK3oMlSZGkwPJq+himO8pdG1yTzKELWhuciEag46i3bKIZshR
WOM6/D7M9040m4xLLqWzE/OAD1uBCzpwaxnon3uEJcLdwr/QFpD57aBvdoHcvACSw2Qf8SQ8KEOR
bbvLaGgjwa2SHCc79AwkCq0UWWShFaNMkyS2EnoUQGYGldML+aLahYr2itHa+Yqq9gpUCWXtElz6
9M5x5DgK4AJOProUpscu6SK6iMLCMfarhDrgxVawYSIyo+1166OTDkg8w0+QGCev6FZThWQxDxQq
pIEYF7e2t6LK9jOV/gMB/jQCTwmSLNZ3qXmgOECoQAOAjlYQEsYYv2uxWNfkPP0YOOowqlhFldam
tUITrdo3qLKySms/A056gwgOFNYqtIqamj69/bBMsi5B3IF8lZVZLSXFvfvUZFBHqYPSfqXuL8tO
9X32BF5IzXh44silHxIPt7TAHKbSBnIbn4MVPcTmAGxM/tiQW9BXjCd/1HMjRX2tkgWWB4JAUZSs
35hNJkoJkk0VFrt5tZmYwdPR3aq9r/kzTIUKgnXV0RdnKkv2+NjQo4yjWns0VsEZywbbXgEX7HCW
l7OzT28cjfp1BQuyBYkShFmpCWjHveV8AjB2Wsqv20paen7ap6U3bcDec+cSX6WuLN5akbiWTBdP
Ig2NZnPQLYV2CMicsknT4ri0AT1lM8Fdd8hP2aYiqtEwpfQlxxNb2MLH2i+0aRfaYHCVsOA45m9A
dhmzIUD3OEIcfcv6l5VKMhxuDeNTj/yhavLRNXcUXpEXxdHEtUfxj9j2zSftF9+r2bz9yKuJUCLc
dUS38hEp3Ug3jZgtGkZOMxuT5SmK4d6InqJTbfHkuUZNIxOh8GOj3c4LrY2qygv/0O0WC5lot4Vs
xPaSMz1q5mL9bOTYbjZGnpGHHH0LI3CUerwet0ba1wCjc68oXL7m6OSqE4lr8Wn8t6PN2zdPfv9i
+yffJL5PmNi4dTqT/AnG7UNv83FfY8VWix/7LYLFrNjsmkOWrJj42G8uZCRQk9epyrIksl9h8B9h
qIrVJcjUhC2SaEVIC7uw6zUJ0LVbiuNHdFXcjXRHRl+Umbl4SwogVeeZZFS0xyrKiyuc3nL4A3Dw
O7v16Y1ifj3gNKmqXaRer1t0u1wa4N5i10TNqltENuNiwLvWUuIoLW6BsxSA5UhdShkryjxeYIMk
9y/zSrLHK0cKJbmwf1lE7/XUrzLwA9Q1Z32vVcuvWHT7wDHXDLh1ackaYf/9A4qahs18pG+P+7vb
+m2aOGbTfddM3NorEzj0QuIzfDd4dxY0i3GoyQKq5kWY3Fg9wsUXW3AFshAKX5A0QB44BqzfItDl
u0DGdlmZSINAn2/V2kAKUCW7gmy3tzGBACFukiXM9hV9IMHFLTD4UkC+iw23f9nBlrHXlZT3py0t
S+6NVGXOuB5GMwTHyXxyE+i7K/h6ZS4miympwlUwkDxEssTFQJQpLL6PMbs1pp1BxVVtwNMlAJd6
pAPvgHWMR/1y3ENIEY43NcELhwEKG2GOFJXxVn2ETakiNZFXkLALaHYJfC4XYjFAIDQJ6DMGnh72
4RZQMSwbkvySlAOmaIpjzYgmP6t3lZN48jM97Cp/lGJCn6KvUEJvRdjFfvSFgdZCzyJyFmRkXxPY
sIbl0FeFdr5NS+F9o9grGlupHWe4B/3RAJrcQL4bl2K8b1tiUqb4j59coE4mJr8UHOIxkMVsnOB6
mqQ2Z7OCgugKqqoXlNhZLnesoGcywTM7kMJqkEdR4KqwOlQMQtcClxaYMZ9zSuN3bek8tCSxls6A
BPPCN3qm1SqxJjVWgzRFYVdW19Hk5Tb10YK0kWyybrK/bRPNstVHhmeMcl+TeaV/QsYU95TMcf4F
8gLrzIyF7gWZ0/13kNukW63L7Rulx+Tt2tu+T8iH0ofWv9izOoY0REueRwpSYHmqkTf5PWh6a7r8
I8RDKtZ1R7W31qzn5PXtDfrDrIFWH2KBlwxCM4RsnPBQtXlbyKEoShzrjdUOm9WaKoBwQqGh2lGL
mDlQoKUwYltIBikypUlRivRgNdoWfOtehh+YeizaBldWjC3hxTQrcGwJitWRK+v0sZMapXCmFgBF
WU/C1t8kTyMPnE447XDyXxVjOGtqavwHVFecFjcuVFUhCwr1CwUIjyqjlVEGc83Zv7TE43GCQpTy
cgsjGZqntKS/Q4vk5crSxAUnd91av3To/JNPf3DHA837VqzYt++uFdfEyEks4CtemtaQSH6SSCR+
u/+xQ/iJxKPfnoPAZf438zYAxk+BQ3ARMGbBNoawBkvHzI2CxeAWMgqWFC86mKLnVFNmPRcIq8hW
ssMkvCRgM5JEQs0iVgh+x8K5a2HrhDDbPIsnT3O7AYWvdQeHa4DD1cbhCtzSMxkYDcRx9GUpog72
WmRt2VhbIg5DlEjETOthXIHXo5SqWJJaEf6BLynPqJIpZ2azYygG5o9/wHgTbJZ0UTRjxcx4Xeks
B60CCg04npPnkCS5H6ivUnKxccjJCY9+XrxUuHPwitDLI96ZBnOoAOmWgXNBUnjZh9LNDk31ZWRI
E1UmUA4HL3yjmzUNSkGXGGSC6mUEwSB7GgzY4ElQYTMMxskRGJPF6w2HNAc4VCEYSvEHbEDFLaiY
ASxaya7HS5gIk44OFaeT8A51s91BjH5O61ZnBpkYdLE61nY9NM0UhtVKJnqZfebc/qXemFSz/lhv
vDN9xCBxkHREfE06Ir9lejsgX63UKBNsC5RZtuXO5Rn3OI86v8j6wn8uS3nNeiiDBC2aSZLeCWS5
AoEsUyALNKUpK0DVoBYnzzWMcWBHHPua2DgRG1gDJoqli7hbOom7pUPc1WpLrfckKFom8vgIWYPC
SMMDdMXRVAnR+iKyigjkMMlHIbz1ABfSGCjeC1Gmf7l0gg9X2dYea3UYxnqjrVfUBuo4ZcXSIqub
/VpAy9aCmvSb5Dkkg6Ca4G6G05DXATUohmO3gNSypVX9sqySYJyWNi4kikvl0utKS68DrDmwFCBV
4M6JlAGg+vfv1xfklhtHEGowk+CjSbIgXyoj3oJnd367d8edax/HzRk//vHkhV/teeOZKcH9+4dU
zDx21/Evblzw0OObM058/PX+SS8cfW7TjD6AxOrkGcEDSIziC52shDXTp7P19QUQZiITVeALLsqz
qHbFHrRYitzBgBAsCohFap6q+DLBwQtrTAjDcoShhJFHipmOB4MOB3KWg3cLdgwm0/am9qazXDse
LWEnw0dvUfWow9UNqjDccZ3jVj8d51mozXfN8ixT73BtUDe77vHvVi1WRbUJMob+MAMC+0HTEcxS
QCru16gobsF3mDyHMslc3QyjE2F4qrMLLpydcOHsZAactdPCi8Ik7GNyFF4td3lJ7vSS3OkluTbC
bUcEo4gWITDr84fY+5FtPX1xPKA+8yQ+jAeAG3BMt3ZYhm094vjBNLiibRxeaeV/PhrrsAHtrUyM
wD9iWEtBrQNe9WKYgnQCjGqYOsJLGIjAMRTyFNVuAew0LbTbA0UClA4tLFIzfb6AmyMqwBFVUlzK
QFUcLS0ph1vaUWTWgKNKLusoGgBjCJPZFeXlRqobQ48sWPXKMytLR7mc1tr4hvnztrgac75++fZ3
Ftw4a+22xNkPX0/iu307NtatXfG060ly+8qZa9etCze9Nad+1rTHewVfvf9Y4n/PsDgyCzSgBjGY
BakkwJB3FCnJn1Jsb6xWpbQBEQ1LIhkFc4dtMQqiYVsko2DusDZGQTaliU1GQTass8nUQZM2TSaj
IBoFySiYjULajull1c5Jylxlp7JPeVsRR9FR6sMCdYLKQopEZdFipTJYQ1V9hwouSgWqIqKoECwc
IUfAcSR4l25BggAk6B2LECc3HhJFi54d6msxzJwl5VPxwjfcubLEcZmuynpuXl95dU4/eZudMBm1
qq6+iGgkTChhL7N3oNB6kL1DmmxxvIVD7x/M92BW7jyzCRXaGY0bOe18xYUKR3k5D1I39ooKoNns
djuYPZ62V8F9dZaDnfhAt5aW09ye5VTIzq7gSW8AItDoLkW3liurx5YreqRcyQ3AvWd5Ki2Of2FX
CEX9BxXBLFGVxGnJIea6IEUwTGm0tLQkZUsdOf1wqaPUneegDky2t68jTzz05puNiX542m568NI1
uxNPg+Z+pH0BKATm9eaIz4NdlblHkmFgxGkUMpT0ajuNQoaSXlInFJqZoKeUYDPCwFWVsREHbJag
2x1wMiNrtQtCMKDaMJJ94IJwF5oXuMJk5o8pPCbIMI3246DkmI7r6+Rm2s6vI7PuyN6cvT1jT8Zv
lQ+Vv/hN5gyfrXsWzbC4nRkZ79jsLluGy2ZXQc/pGaxr3bYL4mCbXXfj9DAO2QV8kulAMIa6gw3I
MU1bpK3StmqC9l/rMB/XYT6IIjQf8Rk6zLct7DyK+yE7fgQoB9Tbmn5Jl4W66rIu2izGojzQX5wH
MdA0MZbL2WjqFRUBVqizwWw09xZ7Ww+DnaRcrzHNtiTGtlIMRwuhgJphA39DcKc0nNttDwjc3Q2o
didYzvqFdsEwmMXsLOWRcPG/qTfQaRk57hwKeg25XTL4wpGJr7p3LFzbuH/LdVu67buffNx+aMy6
B45h09L7zv9PO16tbb73+DM768dUesh3LyVunZK48Me3Hqg/DdOvAqS5wW5mo+74q06WM2THITwN
U+zvFtRVrKrgTvnF3KBLtQQxKtCYo8VjLS3o1Rh0vNxuenms5U0HRi0ftGi/MyAUa9OOxxiEei7I
xMNk3T0sc1h4snNCeAGdJc8yzXfOCi81LQusN20IfGj6wOOQw2wNC1MqQJqYx5w5Pyvl8AdsWGNV
AgPz45PMF40zi2kMEjPbhZoKuuCnoBN+Cjrhp6BW4/jRMNJAVcHczh1iPre2rQfoqAENQUPogoYa
DoLWPMLbCeJyXa30TvMu8q7yCl4tTQDc4GrVVu31sKa8HjZmb5zkN0Q7QqeUreyMt7aU4eQGExjW
Aa5m5oA1FobzwjlxA12sAWY7a/xNGIsWtRvHlKr6XbkcUy7VL3KT6RcvY6okhSYsRwp51CTJzDo6
mfuVl4scWhmzldjVCWv0YoOvx9ULqodMvIEMOTqnsf2299b9LdH6xD1n93/aXjbm/tG3PPfMnctf
EMbb5veu6j34m7/OnJ744f3NbXfhkXgF3vf63jcufRp7oSb+5GOvvAKrNAPspUfcA7y/l2cnbMdV
LMAfMQlmMCpMMfUmWDArai2lhC3LGO7VUpJlN9Wa/w8aA6icRmgl3BbhVRDbZdrSAsySrUsqqs63
jdYusJiHZRuYtwseQsq1BXn0N5oVClhhsoa5rJVWpjMoEqKSnNff6SybQZu2JNpG9rc307X/vEf4
af+WRxLOxMX4X/bjr/FbjyOKxoPUZILUeFEe6k3evCw3jQryB3sxMwbxDZnYq5czJyiJ3YJONcgM
Pk9SnD/IcxRRO8scMtGxGwEJK/CHdh810orUoKIdIkfz3Qojd/MW3Vzk3JdzEV0THcwGtbFUbTrf
cYgPRDIGIqUG0srzHnbDzKb7Z3VQuKTnskrWLXvTzXW/m8/08vyMzqAvXJwegHEyqa/q58FFnqs9
V0fOKF/1Fs298Uq0Eq8QlpqWWG9RlqnLvfeizXiLsMG0xrpO2aDe5/29480Mp4KCPqRAT7t64U7M
7CLXwU5yHTTk+mB1sPY1MzYPcZI5KNqJOtqJOtpJC0Rr7XoYtIAdI7tmJ/Y4fqCxxGeIvs8QfZ+R
BPHV1lFM42ROQ75BlG8Q5RtJlfxatxGqh926m7i39XnLsDXcwPDkyfkOe9PhPDvLY5yVqTR7hxrI
TZ6uD4SzQAnUh8PF7NYzDD776QNFYWz8s1fgUd+yBC2BuKwBONeLqwW/X3J242rBqUo5XC1IndRC
eTnPl0f69U0HY4arjKAmw9VJG3RWDXj+4oVnXjv29YKbNt6XuPDxx4kLD9ywYcHc9ffcOGfTwKu3
jV+zd//aVXuov+ix+bs+ObXrxkeLehzfdDQJbv6xra/jCXPX3T1t5sZ1l5JV28Y8v3rtC3tROt/H
JCuIupPJl3MKh6whsO4FDrDtFzgsmZHndsHHEiXdGC59Dg5MB8+XOHyOHlFrtyDLvI+xUZvNhcZi
zINAVXNIEzFzNXJZ8M24fTwaK+Eat4QzHDDLhEhj9uvT33XkGToN4rK7pHfn/pKDy+J/6LVrX//W
VXHnjvQRA7NGefS86z3X5d1IF3puypqTtzxrZXBL1r3BnZ59WUezvvacCV8IZ1zhedKz30MHFs2S
SLfgGNs05lcFWCf45NiUNWxk3YaGFHbCfqgT9kMG9lkZlyNrJzpr8kIHnbUTnRUP0B1dna1tPZit
bQJba0hBgSEFBYYUFNQ6OqTAoTuIY1u0ixSACUxLQBr/HS7XZRN4BBWCb5WXPN2QE5bCRv5hCY7V
cAMoWG0pAwg873CquCXsnIXoMIApd2ow6de3kFk+uCMAvtPBM4sRzOHt5rhfvN+zYsb4lWP74/5H
bjp4Cctvbm27c/l3z7z0CXl399Lb6/etWPk0Hq8tv3nUqj8vVnzVC7Dpz6ewtjPx98T3iS8TDS+/
Rvv++uDxx7eA+QN8NyOENwgRvseZ2u8KQ6wgyWYiVQi0AkuChVSA240IyxE+bUrvOSxhtqxN4zsN
5Vwl+JtEwWRsAlSmtgFK3WyvrbmlpYXWtLRc2sN3CSeDxVXEkyBRuehl3mMxoMlPVmSt8JMbsmb7
yQJlho1MVibYSH/bMBvxZ5pkAWmFDgdSi1w4iNiWZ15Obk5FyBKqyM0NV+TkBNHU4M2Wqd75+drU
sAM75uddN5kvKNvUgvWsYFsk7XyL5EIFX8pWh5fnHuGDYjFwhx2apiIU1kMmI1mE+TKx3c90TI9B
IZX1L2PLdDmUF5h6shGZTRX/GQc9ffKPDHjuttqdvubMH979CKPJd0/qn0XiLXhevnN+1cBB0d03
DJz31LYdnpZPvn5++jNLR18zfWHiUcabZDtCYg1E7zKykc2MN0OyIVr6sVMK7lJH2dypXuxUFoxy
p6BcEjqic0X5TfqVn1IiBWSS1fqb9LvnjUqiGJX4cqVkMWJ6j5GANsI9q5FasFiM/IFRMNuMYRg1
cqrmUDW22TUeTn/fmC78yLUoYc5FDfcLuI0X+bVY663NMc01T9c20W3a2+Kb0jHtnGY1iTW4mozV
5lrrtH8q/1T/aTMLiqAKNmq1mEVBUFSbSZJlBcomSZExQmw72s6T22FZccEjQimrc7M6GhYUF7xl
DoqiKShRKU4W62ZkUr7SCSbkMLaCxbDqTiWMZst03FjhhHBKoNsELMQx1q1jlWPyKYVuU7DCvmt2
+YRMVsmrZSI/ZP/wo5T4ZMIJfz4QoaxMra0NkFaR1VbZynHaxjakohDQbezl4/fUBnd5+Ubt+HHb
8eMbxdQd4Duyzjp+ZF3w2skprTR5UqNgpyb5cPIc23pPWd9blsR+IU3Q8fEfMElx2kdXFppMCIMM
mxRMYDyllZU87Qy4z8OlOI/m0IwcyrY7KSn9I5n06Yvtv376Y/zdjqtyA6Xi4Z+uwkcTw8hkvL35
tvvuBX2yHeT8K8Cyg8dyn6V26wBgehHbqxKEq/Kq827MqzWvM0vzspaJi8211rvFu61SocdMfYXd
g55sM3hVZzvh/ezPN5F0X7XZnOEMdu9eVIQC2UFYoFAw6EAmH7yb6HjX18nO+MCWKPxdS7UvIinM
qZXiyTN6ATOhkpOZT0liQJBMbKQSh57kYrCUJhR0abdrBGe0q1UXRJQAa1exsNYUBmaFtaVk9YAx
/ix6sxjBWTDMt2LC6X2YC9yq80J6D+anRo7aVEFK7cpY+E5MLDpoiq9jlyVW0c6SUKP596pUJjT1
uZx0hxPWF9RiBXMwWE7cWY6dXmNHxl9vdnaHwKRpodOJUSqRjkw4OxWrkE7OGtuideR0ymnaSB7O
KUnl1CN5OfAspTOhvJ1E9r5be+Oc9VuvW/36lsRD+Io1A64ZedXaJxN/wTdNjVw5eeCER7Yk9ouH
a5pnT32+tPDo6jkHpveh4xyeG6uuXlR0cZesDFhw1bg7WI79xuSX4q1gSbJxMd89n0nmZxOcCl44
b87q01gpjErUmWgxWpq9Gq3L3oZ2ii/S3WozbVTfUt9Drdn/zHbYnNmO7GzaXerm6B4Ih0ao1a7r
3NWZc8UF2Xc673XupDtsOwN78XNkr+NPtgzkQlmaS8sS2LZzfbdy7saFu5VrdhAgf0ZQof6gYNYi
9mtQhP0CJyvkNRbdayy6N73olmpvJGzCoJf5V7XaxJFiygzOnJL6UUM0xhcQ1hIK6ZA8ZbzgEdvV
hLj7Fr9uAb0m2DVNEfxxWtK4EGLWDCjUL1Roaq2cLH+TNmReScjLzYc1ceaDBfPKEWbPiNvlZC6G
0PjGFYnfftGW+OjXr+Ar3/gr7jHotdI3Htr39yk3ndnw7OeE9Pn24uv45ve/wBMPnH63564Hn0l8
+8CRxFebjzKP4kmwYZNB7u2wLimPwhkO4StNKel0aEE7Mnm7SFHXfWRDikKMMWYc4hsmZi4SZgvf
V/fxGi5U3EJkhbI1g62aJZ111FLuHwiV9l8L1Q+GUP1oCFXwF4Qq/TXWRZL69L7yDr0/9csmySSa
BJMgZfqyfESyWkAHWKjk9rg8GR4q+ak3BzttcPGZAjnYY3HkoCjb/WT/9/gaHPMfQNovi1payrwe
r8fpdhGQsYKckvTGVSFI1pP4Xy9Ovqtmae3o5Q+0rE8cwOUP7O4zvOrRhaP3J34vHnZnj7ohceL4
nkRi34yS/f37DP/q+TM/dA+y31Q8A8Bhv5+2oja+Xm5JDJpMsoyowJbMYg5akUlmGHdpzr7yBHpN
2BJWiSVLFcykw8YbewQdysz8/6DMzOb/oNWUQdenpSC9BFWGYotVnW/9mSZjsZFo4lpLFDEyG6wU
fqa1Uux056TPZ4T8S0/S6KU/0XXi4f2JypcS6n7GGwgChfXAGzM6yXmTy3mzVcYd7AHWPB4mYSsh
Wdb/T37o1tTvQ9LqK/EzblgGTfmP3GhNZZdYlNKFE4c4J/6NBc5/58Be+umlL0hd+1g2+4H722+E
kd4E+rUZ9GsB3sPnnuV3+d1keiGeasrATpqfj3KcXlKAgoQrQDcbLcaSN2ijOUHJjHGksCC/i6Tn
d5L0/A5JV6vzw5QCDwun8z2WVs4Z7hSmN1s+4UjhTqGN9UJuWV2IC7MNZmcbzM7uUKrZkbAFWzqU
qoUH4ZbMyMzruyjVKi12Ic1JjbOSuTwdeSpgJ/vhF98s/L+UfQlgFOXd9zzP3Pfs7H0ku5vsbo4N
JJBwLMRmUEARkKCyHLISq3gAKgHBu8a2AipVal+ttlqwWotWy5EQUvDVlPJZbWvhbRWVevD5glIr
ymcpVSCb93memdlstP3aN2Fn/jM7bHbn+Z+//7E5jNghGZ/MVEdjkVg4RnNKxkj7M/GMkGYy1emQ
WpGkAro3iS72eRM8Oqpi00kQk5Gw+zxoUykmk1SKxjPWCFiaxVVIrSVHDIs/VYjupK1UKqkRUHDH
MgA0jI+M3rmME02vVwsSla7Rw7KOHlIjgfX6mLRnmGYPBPmREKl2XHDoMxmk3Md56Bnw2vuL+ze9
WdzY0w3a/7QRgAcyW5Jf773+rj03JsevBfC73zj+Ndj2LBg4tGLlL8Clbx4AK3uu6vuPpuVdM2d/
e9a6jXuLn3ddNg54EI88ibR9FdYdYKrt4amIEwJefwtDV4rSJmm/BCUWQllAWnEYKwhlrCC4rLAj
LyR4nsMZOeKMIRawZOKQETSfw5i7nzhlgDhlhS4VqFB2+UB2+UC2+WBnXk44tS39loTe1L8hfIIj
fGW2IOCoooQKEmq72qEuV5mJ80PZQmepqKVkG2x2yrba3ETKy3KFRmIgAHK1aQmtqqUuo2kKIHdb
YCERyLYhXxunWJLoUY22T+6Bp/bsGeDYXQNPwQWnpsLugZno07yIFNOd6J7ToJ1k46D7+WmXgLxz
I2hETFKdMO6L0g2nXBpdyiq2waQRUbr0tL0e5FKH7s1jXQdxqU/3+LNIyU93c4u9H9Fk72vr7H11
2t5XVNr7UMQuEapXjZYEu4HdwiJ5R/7K/dQmaivFNFIW1U69Rx2nWDOBTm6gaNZOveK1CTlr9rG7
Zp+4a3bSMuwgjqzZj5kD88uM9TkL523vQpFaYX7nitaBUgiEc7LEdSrFP91IOUKn3g/f/Rf34GgG
3edxgx/Sl+EIBoSJ/jMWw6u4G+Aqbp26zsOJROv1yFjp9YFID1Opi+IwFhfLWFwcYnExI0n/hix0
54WMjJE9/PFlNxEq22aBELafi89YJKkjFxJekPBa3nZvh5fxggxFakZsG/uRy89vO8Zkutnr3q5j
RqHzZCk6QAGojXody7aRitkd6C6KOkNsKfqM5F5lh5c5jB2DbhxJ2mQmbuGXXz5tSe2e+b/85i9f
BZtCm287Z+U36M/OhPt+s+RdbFNRZMheiHUGvJjc10q6alxOECfUSGO4sdK50lx6Df0Gza+W3qLf
Qq4T1vrE5atl1zP3sM8wHwmsxIAxzAEGV4wfskQz2UIn8Aa5491KzsRnu9Gx4OwZvK8g+/5uM4DP
v2udE0Z/M50+SxDD4bOY+lDobBT28aIkChJLM0yClXwsi46QRuJ8SClJEsVCBiDRQnIr0VAGFNMH
J1h6Ews2sVvZfvYQy7DnC/ic3MSDBAr5t/I03wfXdP9TDYVMk5z434Z8nw05R5sxnJAd8kcHCp3H
MDqHDUsrVj+trfiBdAvGFHBVFdqHSBECLxitQiuYvjV00fSt0SEEAQfpb46fb+Pc+OB4t+LBt/a4
FUQEZ2ieFsHQjBYRU5KBRNrpHZyfHRIsXLjgEavQPW4I5xj8qIrmkFC/2xtAZCDH4SWQzZxQ5csx
li+Hl2RHGpH+XBk2MR+/MuhcUchSGMSIopfkOIZGS0G0JzNMezbjGm1HhkESoH+856E98E3ADzwC
vzlIDZw8jhRpHXxj4OdnHoYffFRkbF5k6knPwpN2bT2AyHKxlJDAeA786Q4elrQq7S4eXfLp6H/b
xz35ldiC+0exxQcF26XF7htFu+6rLXKudfCjT/UHpKP+SjzUhymK09EnMGjbGgj1sq3QISKG1V0g
1WIbOUFTPcSdQpoUESyuhqzFlGLip1ldoUUKQEGUNUoQoSRzRAcZjgI61UsUkEHhEhrnk3/ufvIz
PcOqm3HWr62/39i/vx8XXGUdFqHcauc4T5Q3R7Y02TJky5KtgLm9GlOQeMXI6cLunzaEDEpky7vA
oYBvcJxUjLFASUhmi042LIqCgYbiGHQzScUPfjVCkBfZDfOUSRkwb6mO+825y0VelsI5xOyJxhMk
5EMiZX+YQpklsYUgat1BQV3wwajArFbWKC+jW6lMU6bpdB2TVhu0efQlzGr1Jm2tKsiQFXLqWG0W
nE5P5i1hpnq2Jj0MH6Ef4h8SNtM/5TkT6prWxEKkiKCgqGoTKyBSUC7ULwQWgFAQRElGRlLTDLxO
HWaXCc1dcDMyH6O2swmhD4zaoYiSC9o6yKwl5qWEpdwhA3kX+tgakNG1sA/tdEBNkspSLRSxRQp2
pKiEvtwARh/M70ywHWwXiyw03NztwX5QGDchFFpDA8R2YDwTHUXKDg8XMP+2ko4d9zdiHCM459rb
CcyJdsjWlODMef9JKcjxEAYPUHDwAIExp29V0HO15YpKHfx8mybhJ51aqtd6kzmtIUnqqXrH5bTR
4wi5YwQ669RMZeev6CwgbYITNRReLxXrcxaPZ4C6A3ziX9sbQBF6cOw4kETuGKgGnodBClzSFAiP
AYsAu7uY31Kcx+46/dl3z2v/IX3m1FTmt6fHMIdOY43wKLJxcRw3Qkikkg65wLvgYprb86bsOqZC
SAmQlDqy1wEnt17t8Zw9R1DIFiJ/iReQGRIgT9OCyEAo8gJDIzfidMmNoMvcCNo9vwPpKI5jXfeJ
LbnUrC3ryNO1IkTgCgkZJOR2uUNeLnfJrCyUx7BOVJuwfWkVveV/L5ZlvupOl2LZMm8tW8i2En4p
dJ74sv9s4rRzLreWIczi2iV68NBOZI6EBNpQpKxpVBOOqRAn9AjW1By6hf29U3OCNdomR+d4ZI0w
YNcbRuRom8Rnq+3uEbk6x2s+9PDi4xO9XkRW2GQFIv2Y/HxbyTyBMqm3GUmhBQrwXzZLNjraDLBL
DzyP/pqGu359poi45k7mDsQxXae78HQsFGm/w75GaVQU2D7R9IgOfIbPFw1GowxjMD45KEeZp4O9
2ksaHQyGojBRYXlmeWcFrcg8dp4415jjWeRdEFwUykfmRu8NPgKNcCVNm5Wy6B/ma/rLmMTv+pq9
eX8mwQP+hbJGDR7xIl5e3nW4eVyCgReVx94kXlfeTXrzeMGJUuYjXRWgQndNpu6ykF6KzPUM5pxS
D4cTonvzFFemd8Oxy4eQDhf/LJSYZeaXGzsKhc7oNtkkwKcs0mESJdN0Wa8GlRzNYNyMRMfjDKp5
NOVpgZnqKupysA6M/S2Y+rOeYu+L+4q7Nr8MKt74E4je/Ofv/r74BvwNuBY8tqf4k7ffK27a8TJY
8ELx78V9oAVEu4H8veIRG/FkBpCsq1QIjLQ92sWepT443Zjuu8S4xMfISiVS5FQwZONF5rAF+Yfl
0915MyPsRstjZzm0vEAyCYLhGMUTlonvkxBJRAD6Fwmp7h1X3TuulpwU9X8LPH0VhguX+ypD2YVO
e0mc5XBxOBLsYihjm6YQAErTMAAV+scA1OhgJUTrkkx6EF0CM2HdAzOXPTD/k+IrxXXg1ud/VJgx
6tvFu9ldmrm499rdxYGBZ2mw/o6F3/KrGHOeN3gf+wmSHz9VC2myAg8uymzMwHBonB/KMSaOQRtf
3FfN1bMjgtnMRLY1OCEzg50RnJYpsHOq52WuZ2+lb2HX0+vZB6kf0E9SP6Nfp14PHKGOBI+EIjE2
S9WzE1mmwD4QeijzeoZJB+ozLYFcZlpoWmxKfEr19ExemOeZ418QW1CRj89NzK26hr3SvzRza+a+
2H2ZP4XezoTlEPAjW7Q9mqNwtW9TNMeEfKF6dgLLQDpQS/O1mVCApbgk7Y2wEB9QbKqyUqehkKrk
xcgwpomUMU2kLKEVyXhDeHW9rtB63RDQi6UXr6/XFVpviY2858NIor6rHtYnXTZKumyULAluMoMM
hFySVzlEok8ir3K4bkheh8R1phOauNJK8hYOmhbMUZ5m4xXjlYKTyKBWYKPcuSJq+VmK4vVQJpOq
rA0EUjq0aJpPEdnmRb2SyLbuyHaz3RzU+OpQmybu6rAbM8uAMCz66OxYR+Y9WAGMy9Qwf1u7Ivej
x574P78uPr9lK5jyCtYD1w18sPnanyHxf6v4Poi+ffXCSxY/Vsiuzd16ST9YePAtcMWuXxZ/cnBH
8b3vNBYeBbntQPpe8Y0iurj4+5qJYcyPjyPr/xzSCCGqCt5B+DFpyhowx8YWxK8Uro0zImmfEsiW
J9sUBhPwQpEmJUwoLiG7hNk3+H63GWlB++PdVTUtHnxcUdNiOHvd2aPn3+yuyNjPo+sNZ4+ft6Yh
Iq2dHzs/cZG8MHZtbIV4k3azfpe0Tv+++rTepx/VPtQNpMsTHt3n8egeXRHNKExGAhJn4r4mNiSK
gWAkXBl8YbC/LG/TbyNzwSCVrCJ6LoQ4URMqh/Ht8NK4EiRSmdEe5dy+Sc7VTATuCxPgjyPZ10Ii
tTzVlaJTVSH4lTq4kroL/bvqjvunvkk1Dqy/irM7Fih8OOTkfrAj62g9FHujg1wj6WKym5jYUk9p
2Q92GEhZvyRYek43JnjMCdiFAJ3Eh9WQJxIJ5zzIVzHRQ7NiOQOFyEZVHD1Kzsf86HYxjKFgS14W
DlNAR14HqCKC4ehXG0/8Umo2GAh6q+mREGnYaqJtSeFc8nF4z97f3fKbP86snTNj8MSeOdfNHZGc
/n/B43c9dMH3nyg2sbtmvXzzowcq0qkLVhU7wahvrx8v8wOr6OZxN597Ne5XXDj4IfMX9o9UEz2J
1Kx4qJqyGq1MGV2qckbrZTgrGHaJCCImxcl1almuXymj5TI6VkZHXRrF5iGHIaBLAJuwavOX05cz
K+kbGCZdM4bOxc6hp/EzKqbEJ6em1lxEz+cXVsytvdurVePEA2aelEukXSLjEjUuUU34yr7YJtIu
kXGJGoxUTsVUrZpJwRRdkx6rt1RPTk9pXJDIV89JL5OXqEu1K32LQzfLt6i36Lcbq1Ir02voe+S7
1Xv07xh3pb6VfkB9SH/IX+mEzSOSGTOaiYiZOpChqLqIyYwelaEWI9Wjjrg5encURtMBdURlTRqk
2QBbSpWylSPEysoATVwnnDYo2PkNvCuQjqjGY/Zv1BqRTmmqzCZjFZVRgecYGnIgnapC5zi2Mjoi
YmEZuh/5HscC1AiSACIBhQESoB10gOVgA+BAH9hqKSMqE17v2XPwH2axSKv4CL8V9AnOF4eVzg6H
TEuls2KGqgN12O3UNDinDn8eIsJ1kdFJ5SsWy62IRfcIZEwc+eD/ZboawCxV/5gXY0URHuUkhQoz
DxMw1Mm2u5aMpNxx26UxUMgexpsT+E55gmTmBK6YmI9h0s4hGQflB0TioztBFIyIBkawBNIZIQcq
iTcUoN2MJBJXuxCwEjaPdpK6qRpSAkv6xZwcvd8XDDBBIs/YvGUW7lQXvXz79c9c1L5wYnHZ7Guu
+sZn//HEF2vYXfpzT299PDcevDWv65Y1px/7dfGvj4A3jOu+M/fslZOnXFUdvCw77onF1//yimt+
d6d27313XjKruXlp7cQdq1ftW3kDmYPRhLzaXbgWDQRJBMu5Kpd3Cc7NMvD/MsvAuVkG/l9kGZD+
ZmElYjaKfPmG2AdXdifs0qqdXALARlzjDMAO4OR1jloy0fOCo+Q/c/G2911tf8bV7kUbycGvKPQ+
Ug694akoxsDhwgcGmaPQ5qRrSj/RHkrgaEhWjCb6dXSb00KFc6fQW6xg7ilGWfW55079Fd+7x1E8
h7NiPjDRniGS0ecx84RXBCbQ5+THWpiJwlTmfGG1/hR7VOcVCnpwOzAn+oYZTF+ZQPiGUgO+DHQj
eliK6KHhZEkP2RE9LCQCIBFoD8COwPJAV4AO/NMooTevkoSpi0dICadHzraekis7Usl6SoyDoNnW
UypZT6ngx5H9kPW0kemZRsFJMpSCNxImZHGcwHnQve1dxokUlO3QGQcHoNnjxGsku0ASDR6mY88V
xdOv/b54avmec5+7/UAvu+vMtneKZ564D6h/pmed2f7ijq/vIZMfKBF5YVNxLyQ8h3Aw2+A2NLqm
gUGEY3KEYfmYUyWaGhYSl+dpPiuZHPdmQq0kB+LgRyWrJ7h0T17yqeoLzut+4J4EKadmBbqEFHHR
InyZU80JUm52DxFlwK5l4vw+iSwlihUFFkC28Z1XjXde9TQ3UzYKgUu5U40sqKdq6bTUqDQpHcrd
wt3iBqVfOa7ICaVdgQyUBeiUt4tAkQnu3NZGig/R/5ZEMSGwPkFgKSR8kPVByIroT/05IVGCuFgA
i6FAkna1uXYBdAkbBHQMgKVCqza3CIL74UYIIT7jSbDtLGxiO9gNbD97nGXZPriuW+7YbEOJnXhe
AH6EDHtCRyR8LGRP6XBqInFJpA0V+obgwO2Ujpjw/20XTYB3gg/j224HwvSttejqsbMXkJlE+Fsq
CHCA25W+2kNJFHYvSwmCC+TgmCIJmm0wsBnASQMv/wHcPjJeNQKsf2lgD7vr9Btdy2+6iakjeUMU
AvCrsfcP/2534Ooub6G1QxLosIhWxmX64EDpCnrYFS6/6UNVuAxXykOUMZ7N0K41pF0C/T3Xq9LQ
S7g8qZfxp15mgJXB19CfUZ0SYYe2mvN1VMZTZ2ZCOWosslVjQ9Oocz3TzHND86i5nnnm3JDxsPCw
Dj0hnEYzyNbxVJoNEAln/S1sizKZnaxM91/MXqxc4r+CvUJZ6r+BvUG51a+zfozOm8iJ1SG55202
eBYkTgnmvkqaYVnI8Yj7JKR+RFXTdcXnNU38VV0hFFe3drNUKIH3iunBe2uBXxATFItnYCE9DKgQ
KwiV/pDP7w+ZiihW+k1Emh5F1xOGx2cYHlNUhJCf1T0GUsboLbF0yNB1UURsgN5TyDQ9HkqIBIMR
Y5IIZlMJdMdmU370sCgWzO5N4Eq/cLgP3LvNDh4KkfDMgUhoYCASHghdMGXx5A9KEYMLguNgwZld
5Zb4ziyHxIfvEFuu1Yy9e9Gmda9LlW8Qm+uIzT1lQmFKuEXFFoE0eq6+HD8nkuCA7trQE92KxVp4
/gkg6ZoVBaoEd5bZREtVTKQL0JIB6BecimEMnduy4rVlxWuinbcZVANcOQzAj4q3/vq9VGS8BIIf
/WFWdWzEB78qXre7+NsaPugrvoJ0edv3H/xLin53IFL8+K/39tA/PzWVKaxPLD739BOORp+GJMtL
zyORhkwZZekK3aV78p5S9bo2JDdm6aQwVPzOciXRcZ9Vh6IJb8g9KX4lxLDq88jBDIOADOvMOu94
MI4eL4wXx6sTtDHmOK9kenFO2sQbzUlEq86+PEFtLcMZ6oSbw74R3CjDDFPH18r1WsYcy0wQJsj4
Fc8TLmYKwkJ5gXaxeRVYzCwRlsrXaIvNVcwtAg4bbjRv9K5h7uHvkR5k+oSd5kvMK8IbzJvCW9oB
80PmqHBU+8Bs4MhwF8WD/PQA3soC3iKF+Xk3JhyZlRXK7zNCkofDMfhRS8OUwVFQRSYGQoLKY35F
bGGLZwFJpigC/G1pNPLHvLqmqsAwVI/p9cpo2aAq04pXkgFnQK8oeb0JSkQmWqShqiYU2qcoNDIv
NA2hV1UVhRIa/cCPJC2hWApEemzRzoS0QeqXaKkP9O1Y5FiSPkvieiyj3dhn0Aa6yJISVNjn35PE
liR7wQksf4XQkfCxwrECIogIFobJ4Fp2mLjhBmr0o+tYwlqFveU7W8L2zifmwcY3SzJBIncZ5xDC
OYCj9lA0Z+LS4GjOa+8Y3EkZzQlV0Rwecrc9hvNS/VY8lvOiCJ9GD1ULBFu9ZiB4liAiimYQJeO8
xEgTvaaZk5WK5FmAqki2yhKmIKYUbxCd8wbROUxBRA2X0nKxnQ86vxyYRHeqAs4cQidfgeECMGTn
XKkV4bii8iGQLqoedQ6o+ePAAMweL94fT47yFzfAM/CF4rpVbe1zwV0DM898AeURY9oriwBPNHf8
LwV2EP9LZh33RkFEWRCglgUBjktU6iZRuJI1BMO8stJMCwY5opO8jn92psw/O1UWSQ75arpbgOEG
L8q/CF525gVxAs1MROv2YbcZxDL7oaUhggmjDY03IsbbQkSc37QmIoKpRRsTSbFQLzVqzNXgau5q
+V2OwfLBCbzIcSJHi5KCa5oTkuyTJJmjOZHGQEEAn6UTECAHC3CKzAEUcgC5D4YtUZKQyCA/T+uD
IUtUxAstqUuCSCh2WKosKwmKvnAWvJ8Ixw4LTzHzuSCYJZMASXGCovedMAmGelXNERjinONY6Jgx
YO8+wLFQK6JJuhtZqrUjs1kBeV8s6UzB1Frcj2KgzfStQWRFYmWdKIIiKswupH7pwRN2fxwOkwEB
v0RSGoIeSDDe3RbGuNb8f8i0jrHZDmQOw13SMhkFCEMcSyZakFBsiGs9cOLAbz8GyfYpZ18KYu8P
7ITX0jOLU2+7beUGsOVM98D3MEJ7/uBRJsZ8jaqlxtFVJEZrEFWxPqxG6uvU+vqcOtY/Ljqhflp9
QS3UL1Gvqe9oukddU/eDwA8jT6v+Wrf4qobMeMPUU+FnanvDu2v3hvfV/sH/Tq0wOQAqMVDhweGR
aQ51MY3BSn8WpuLBeCjbUN+SY3IN05jzGvLC/OyVwjXZ1cpa5RXlC/WLrGdciwYYozHVEhyd9IUW
1V1fB+tijVqbdr+2URvU2I3aFu1TjdZ2u+y+M68pztTHj9w5kCcsH551pZF+VI3D/apaxpFFLUQk
bUde02J0sA8+0x2ywySMpDZI0tlzQg/6YjGeKn0WakqNNDpGy3WXGZdRk4xh9QKfl0noGSd5Jecp
jrBdOpnCQasDrX1sB60pBnNiClf94h7yFMa68f1M4Uo1Gb/tFHnDKTeST/XBSyytxsLzgRKZpsyW
DJvD2DnGeDJ9gwdsYrfr63bnM6NyJGddWd3SlOvPwU05kAvimRz4xYOCWxMRTIeqGt0xNI2u+9xo
e9aWJ9+YepHbx8E418ZBzudGkr7SJBv7dUbmOY2A2ETSuBBBr0l3PEeya5xGkGxSjsyNGj9UQIoH
o9loUzZrIDVNZtkdK8XQJOOWPXIEx82Hs23H0OFheypY6T932lieO9mIIrgzmflBdUZ3UnQ2qyha
XR89AifkYjUSPZrQtBwKBmM+e5oRX6orbiOtPSSlghMqpLQPY1HjyO+Ylhq7A/JrkIBTAb/fFwhW
Z2jcCmk3qqKL6NYrfrFky/PnrjxvzNKDV4HmKevuuLlia+i6/Xeve6bdEINVz8eCX997/cLR115z
9Y8zFd+aM/Vnd11w5wU+TY2k0tJ1I86a3xnqvHe6ddn5I286fvqus8aDd2pjRu3MxvM6Lpl11o1Y
jtcgOcZ1FgZVAU0ix7cCVtFT7Bh2Csu2xbfGYTxeFWuOnR1bHt8Q5yZ4WwOtkRmBGZGCUFDn6YXA
pZElwjL1av26wHWR/vhbysHgwfD73o+DH4f/u+JQfDAeTrCNeqOviW3TLXaG3s5eyR6s+BtzylAM
v8ZwkIrGkImU/DFNxk1nQ2B3qCysKjWgWVX5UGq/DAzZkjvkLpmx+1tkIrNyyKmwOunmfY67JZ72
IEgZTx8hCTcCgWJWkm9ACs9hQo/NhL15TzNlugl2RnUT7IxdkUFQsOZSgEg7E5fCeToNYT8AG8Am
sBUcB0wctIFZgAYYOsNCC/DohQosXoBwNyB4EzAxdwPC3diR7MFiRS4N4LcMQqQtgLTPgXDlueOG
QUOYcVfYtffk3GHE/APDBcJOHLaR9jTbgHSuQAzdAyRD89st1jLDRUmLNcfbA3+zOReiq0YcPLZ5
dCX0G1R1VQ3tC5bNCxjx054V276+pdMqfvafzy+FLXO+u/rZn6xa/Sy7a+Bv98+6/zcri58WDzwG
Hnpxzr2v/nb/S68in6Z98Ch9DNmNCLzMju2Dg8ddT0Ry221Fl9BdwnAJvETl2E2LdocOdKw+26nl
FE0xZkzmQzFGBpqfF/C95sm95kk/P2/ge80TqX/1tZcIjG/sLYzGD9KtLyogHjvHe07wIu9FwQ5v
R/CH8If0D9QnjScjiqCGpSXwGnoJu0pZrnapTyk7xF5ph6IElDXKf0Naq1qkX6/fodM6QGbAyjSR
quwO9LY2UJuoQ9RxFH7pukwNvccYeutkuOcQjOGyuZ7XU5pA7E1VlCJ1ZSfKbMMnpcuolJyNI08F
Bc+WlrUTNpbDz8By7hoYa2vhBDpF+MwiTHYeYa0IYa1pMb+rvP0ua/sd5Z3M+1P7eBDn23jIa6Ry
RcIvwBOrzLuDqnjFER9+VLRlbwkgttmwrNR/hfOVl2SS1fj56NkVJ3COe4XbOIJUp1E4jP6RvABi
2Pml8Za4S89EFsJkQoRjkfNqEtUr86XepLIuPTIFp4XMGS0lADAD063bKj79+cHi31f8+e7n3o5v
Cd+xYN0zT357yX3gruDOfaACSM8CeOeWx6NLl/3qjwf2fBNpyqmIc9+z+3Ghl2jK2yTIqGm1RZ2s
smN8Y2Jz4cXShb6LYlfBK9jF4uW+jlh//DX2de874SPeI75Pg38JHyEaMRCPZyNYjU6PYJ3Kj4Qp
dWRgAhyjTodT1Km+abG5Ul69Sj3CfRg4BU5oBvDTmmzoSFPKvIdCqhLZnEnSMFVZ6lkPNQNq95C/
TqU9+jCtqv9Ddkvl9bRh7PcAw2N5OjxdHqRXsajY2tVjYvXlIR4M1rMeDguWh2hbD4HPMU94NMwT
Hrcm1OPWfnp2u+8OKdYbTKE01sydgWZzWW/eTPFuLhPn9DHnTcy/yO/j3+MHeQZz3yye5iuJCBPH
gK+0RZtwJHHO+AjhyHBlS3uZnsRRG0HNS6qRnLQL9ZG+bD3sAOr4MaQocZ1jdBuNlSRynGmkUjRK
km1NKfO6rSnbms0cQduTY7CJRzbe5jZcRF0+aGX84r13vL5qyWvf6niosXsg8eyq1T/ZfOtNj6/5
0frTT2wE9D2zJ0Ht1FRo/u43v3zp4O/2Yts8HdnmSqQr/YjjAoTjgnEq5kfRTYEtiHPkxfRS9npx
sSz47Qnl5J4fti7EVEWMTNsy32JP+U5GmFHmhPCo2CRzZmRSbLa5MHxh7DLz2shlsZu4m/wn4cmQ
QQWArgaD7QGc6qADMX2DscmAhsFEYxJP7YLPYFl1rVi/RZbaQDrnQS/SY7gd9fj/f6xxdz5ooZD9
bZIFUd2RgarbV0GiebGmvmWrCtRIHPcZpDMteL8Tu51xEA/sdh3i3nyguWQPhhpXBddOGyneStW3
uPzispmjpqxsHpdMl1goRljIVmoxwjykXQmz0HBTW8iSIobD6Bxip5MECHBTMbg9xplw0jrQ2epM
9XAawUkFftSqoIiJ6kLWgG1yiH5qP47yGSOAeUxdZlBGkwG9tCExXke9SVGi3iTebUJedGmhMetp
bix0lqk4ux7PxydJkgckyTgwjr50V8Mnv/hz8VPge/t1oIEzR6Xtd12+fuAgnK2Mz99929MgH3yi
B8SRj6KA2uK7xS+MxJZdV4MH15xz9VM4A+RFbNjF/pEKgkvtujyfCPRwY7gpbIWXh3+oPKo+rQoR
tVbdGu4PM2ECyUTiLRWCSit6TAJ+mPV5GZqjpI0+4Bv02ou1M++1mKFGblchBJ2OYxmFEgxFwwcA
KZbtHjW+hRTNZmPxlg0UCFtYBYUtFakgJz6vJbF5FVZKVIMToX/mFKn4nCKVj4hfRUruyRTmvsFT
ZCgc9UQo/DzYRSWpk0Ci3DC+tOY4oG81WomiOJY9VrAjejxyN+exGxp9hocTeU5AUY0hmlHKw+lR
gGLw+jvvBFmkQlZEd1BSwIvTnyN6ltGcpJM6Ewk4BVij7Urp6jHNeDgK0h3IUGE75cejJbdv3OiN
fGv1jIXR8aMvnLxvH/2D9Z1LW6bONR+TpnZ8ff2ZK7GeOLs4m/4I6Qk8Y6mOrFOHLLO+BjntmyFP
8XFiRbiiQc74Gqpz8ljf+fJUX56fJ18tn5L+5tdGVjfUfK36azUzajY0bGrgxybH1rU1TJWnJqfU
XZy8uO4a/vLk5XUdDV0NB2uOJj+p/rTGEwxw/j64rac25uWJp2MkqCbi53QRhkahLrzdMthYTJem
VMUUKeBvTjfjWcjl848/KxvK4g7tSuWldCi0PwiMoBXsCHYFmQa0inBOA7FCQWKFgiUrFCRWCE/i
I2c/sq0QvgpP5nOsUNDuqEAEMpinynTUKedvKvngDTpIU1VxlyHjLkPGHYYM5uOpF/V9+nv6oM7E
9TZ9FvLxXLWiO5ZqZF4nakWPYLbTq8jYtxh+R/ZsTZ1YJj2cbbghiY1T9oIhzdLp1EkY5faJGCii
cU7iqZWHnSlKh+20bydyjJA3hIQ0QFOUN8YSTx7dcaWKzNhFd53ze2uJ7vDaUant1iMdhTQIYrkg
7oQncWaNPTEJ263gGLcNrXxK2JVb5NHn3HD7upAGVm/90/Hr/us7z9/y1OI/bXrho0eeuv22zc/d
ctPmeZHZ6dFXLBi39V7Q+s7DAKx/uOvMks/33fQzuv6/+l/83a9e+hXWJ2spij5K8vqv2N2uASTf
/iDujjpkkcg+zYyhp9C7VIac8gfDLUHBo3h8NAsoPcbyPllShvkzShlXKa5vY9XklbRoNY9tGRRB
vwgCxJkJWGQIQi3Z+jDziBhG8ZBxCCS4EyP4OpHgfeRbAgjuI+LcPAkW8QAFcnyyl3TQXEDKEYIt
Y1u2Bo4H4PLApsDWwGCACUCfy0Q+l1F8Ln/50nYTgIHe3nH8lQwJJDSHKIYUDjt44ykrSLQZ4/bU
lrUCnLIDQwoS9QVJOHqB/9z2ULmP3Zl1G2o7syeGc5U7wsQOCjEsSfSYxml8WuOUKFAFpMEoDCPe
SWXxaPloryxREs0izdXUs4zFE4DsINFt+bQnMnuqPYRdOL9nbc83+lf/fHrPqqXt32lF4eBnDxSe
fHRgEXx87a0X3Xf7wG6ktdYhhmjFXbgUDyW7D1f6cl52aF4SIiaFHZD5TBlgNkSzZTTj0j15KLtx
uktwLsEjovSiA2XR1RDNltFMWY6ZcVaXdgnOJXhElL3TIWx+iGbLaKYE843Li2PxOs8SN4ibxK1i
v/ieeFzkKTEuLhe7xI3OqUPioCjFRRTw8QykRY7ePdjvvEJ9nv4GoDiWYySOT7MUs5HZxGxl+plD
DNfPHGcgxSSY/eiIYWycAc5hSqzGEFZjJPwWGGI0GddoMm7tD4NRCQmzHXOB8GWGW0G+VQizVbb8
C4UKK8pTJsN/ojsZieXw0DPyVSX2d+XgqWeIpdb19PQwf9m377SfyZw+SMHBHxdngwmEX0ywxuaX
Uj+hSyilshyX0Mrz+MMz+4pLqKVrXKGlXUJxCdVxL9N5hk2zE5lmdg3LBgWW5RkG/g9jXwIeRZUt
fO+t6tqra+lO70k6nXQ6m+mQTgiBkBSKBIxsglECEVRAgShgAAmggqAo4wDigvqcwe25zMaSsIg6
Mm/cRkXxjTq/jijziY7OmBn+9xhmHEznv/dWdacDzvdPlqrT3VVdVeeee+7ZD+vyAKjKiPEqrOGS
+ZwxKaZjInN8xNC2YxnI78frgBqXpO0yLJRb5KkyQzICrQYyBk6GIDULydToKRdQ+5VChkEWqOWK
riZy0OP9eVHruesIsQQ1TdGJo245aJlMDD+VtPRCdkSMVGqzLtjlVtyCrpUKuhSGopsPA3vGnxNu
G95r8HjWW2KXocm5Q1XpjBW0a7OTACNSufjOvvT1sZGFDSP7UuN2TmK/fu+9b9c+7J60g51z9rFX
Js/H7A7Pe+YfJHuZMe3MLnfW/yR+X3wQnSRZfTYrzmcLrzul2K1IO2ergFw71yEymvq/rjMcI2bq
U9kR4FIGEDMAyRmzaAT55czNEjK5qIc6ok71mgnimDrVh/emi75BHc+nrE34HY5lXSzXILZicuAu
kK6UbmZWSh8zn3P80xws5kr5uNDIjRJb1KnqLHYWdyU/S7yF7XE9LL7G/Tf7IXeS+5r/O/etkGdK
kothWERSp0UBvxAFIW4nTDMsG7eTqCU8zVkSTcS6SAiHLAOJPQQ1S3Sx1C0SE8irvCi1z+h2GtF2
rEgNZUtnyFhWnMJxchxkp0+W7FG25g+KQ4hl7RYwFXNqkiA/gi5HlD6BXTSAcgpiJsXLD7UDAWqu
AkFF/UNR68JcyqSE6YjQJDR0+RkSGnq6sj/rTMZqt7+RRCixmRRrkmvNY0oVmhi6dVzrapsIC8VN
DBIDKklc61w+yy4Fb0liVX6jKOTnN5Hc6H35JEX6/X1Ruttb5BR8p5mLy4HjcuYGj+wroult+3xk
9+k+nSZW4x19pdDdXjmT+UisUORS5nEWCl4fvprX20Q3JOZ+X4Cc/M3esH047JxluxCGwllpmpsm
Ya7NAlbASyrL2UupHayTyb2mjmMec0D4k6/Ti+HLn6Yfv811+LsX4Z70qoH5qHBNmnSb2ojXzwZa
xWLD+atn1iH7PWvlOWti9tDvWQHPWelyvvW8de1gu4suX7ReRcMou25FXb29rxlh7+1WdkesOJb5
NFeha5frMxc7FW9OuZhC1zLXetegi8UokRBjC0nkm6iwlIe1o10AHgGnSE+6IYnpH0MSU36OxGQT
p637CY7il4lfHRzMRLQ6ixmYwg5fzMhqRlxGTq0L+uq8tasXSPbgOcO2sY+WvbClXK4U62PFzFIa
ZbMDeHKYmT4sX20INnLg/BwMR3LgcA4cyoHzc+paRnLgcA4cyoGVnGBNNQd258BaDuzJUdf0HNjM
gY0c2JMjoOcK62YObOTAqpNSJWRyq0hEgDVZVuvi7En2pPgH/xdR1weuM1HkF6LFYiAcFRmmuCDC
5RENi4dccSioS8ficHv8sTiK40XWHd9uQIOldkua0WVQjym1W3ppaV/atIiQiYGo9ZKusQb1lRqZ
FL4hG+Yh2NkbyBidhpJmHOeQ2h6Ibw/DML1SOHulML1SmJQHMMiVwlSED1PbeZhwVapUhBVyzXDG
PxvGlzoAUKo4c5HiDHsudtizt704Do8BSNwKqBAQJs1QJp1/HpOmQgTwOZrDdxkbyGnLS1UIm/zd
Nt8uiR+Cq3vPFSpsBxPVQ3PcTp25JRHJ6wEaHbT8JrtkRgttkkmy1XIqP7kVr6fUqxhhaKp5GQUj
YyH7lyKiJelSCLNKyMl5WBA50CXzIsMVYHBfF2crtrUkXyczD/NouL+f1r2mCgk1puSqJo/XPr14
1c7CW9/88U96i+c0L7u/78r5l24YzZY+MGXuNVce3n1gIIF+1DV39ANPDexE+1avnvbIvQMfZbTX
L/G89sEvqZXF42I4D3pWP6R/zvzRc4o54+FYIh/EMN326PAh/VjgRGAwwEYFr9vrM7H2CjmfKqlu
xT1MhXXnzHx3VoWNtLtLAlRjDVDtVaZ6q0z1Vjmrt8qU38kxegR1alKBkeqt+PW3jpNTcryfZ+yE
RZmqxjLEf/KUAOGvIaLDBk4F0LLAY4E9gSMBNsCgVJ4vQ3u+DDX6MnKXj3LoM32G4RTq+F7VVTpH
dTVyVFfW4cdHLPNcVXiKn5aQzv7Yyuxpqs4O+6AyU3OH5rq39A/psz7OECVB4iWG00sNzh2GmmQ6
ZEdKhS0nwkPYElXJh4mLcZmUpFwZW0mWnBz/fA4tbX5i5fF5j0/Tpb6KJRO7n2FLd+6+eNnk2lsG
utGdN94wbsfbAy/iRWr84FdsAlOLCoJwkNDLgbyAkzb6FeUppDuAtYBAQfqByUtBpZWbKLRzs4Tr
uEWCUKePNkf76gMX621mm+/iwBzXHPEyvdPs9F0WuMF1gzhfv8G8wTc/cDPMEzmXOpuZ6ZopzVa6
mAWuBVKXIvkjLG9gDukdZnvz5niAvFnbm97uLQlTO1uYkhufbWPHUz+P4zrNuNQp4KSu240FnPR2
Chyx3CXxuhoeAl7nozzDZ8NJiHPwM8wpaaQ7Me1j2J0hsqyy5nYcj+PwHACKm1h3aV1ZQL24IEKJ
itrsHeZFmTegVZyAhS9NuCICGcfkUOtDxXE1gREhYt53Oh7mUpK+vLITi6edw+krkytPXEI0/mqG
a4Z4jesakSViHmVUe2XD9gzJrN9udcjnpM832M1dqLU+17Q2/qm7X/099K398w8+S/c/v2/znft6
79i8D3lgYuuq9B8Gjv75dlgA1bffevu9V996Ez/S5vQitghTlQkK4AeUC61Q9Av0sXqbzrZE90RR
YbRcKc6vzavNvzB/WXR7VBjtHx2+xH9JeJYwW5njnxNeLCxRFuk3+JeEj0R/6z0eOB76bcFJ78mC
E9HBqK+YrdQr8+rZ0foE9hK9Q/9C/nN+WpcNN+OLkDANzhdxy8AdHEZQwRyCCmYJKtIeLDkmQV2y
pHnSeomNUrKKWk4azJd2RJ0UyKTFZPSzbGkZO2RDIrNEoykyK6AnhVJDDsQMS3I8iVaw3YwD8P0R
GJnACz0n8EIfFnhx5tzACxpshtcqGnhR2NoQgMMiL7KBF5WnT54fc2FnazcOD7kAbsPto+ZZt4xZ
Dhc5xFyQXcWoQY3QSmYN8+V5afX6hMHkEMzmp0bvuP6uY4tXfra2Y1u18fSq1T99ZkX33vQi10tb
pk+/Z/ChJ9Nnf3Dp6IGzzFNHX3nrg7fe/B2mmonpRcwJTDU6iMBfUqrpklElqgiMQW2oR+Fa8lqC
bcHtBY8VuOo8deGWgvGe8eEZnhnhaz3XhucVrC94n/vA/JL7WvlTQC9HMaUyrxHVK5PQBKUDLUIf
Kb8PfO77Ovhl+DukQVb1hiIy7+a8ERaTit+dAsOoBQwLZBgy/QPigNagrlnaPG29xhZQ038BpReN
mv61rOlfo6Z/jZr+NSpIUaO7j4ygZmfsc/bhNKVKW2FkiObchqmWv90oOc/HfE5Eg1XWzpdQ9keN
+zw17vM+W9G2vYX5Beea9R2rfo5JP2PQP910Pn3Y5AFZLyUPVnZzqhyi5CEPJw9oOEENIx1z/TAv
c1XFzstfSv916W9vfXX5EwNFP1vd/fTuVSufTC9CwpgpsBryj6U3Pr31nxcxPz969Nevv//h60Su
uQMA9BqmDgPS7mTWmKQH6iwsZuvYi9gZ7EJ2BcuJhiAKouoxRBUwApQpMwCSWLZdgEIs6oEeFDu3
B20utv+1zTurwf3DMnIEB47y+GEyq2325nJsDVPM1le+z+x9Uu88fRMp6Epw3JjpHgf032x20zpJ
nTfBzvBBIlRiWVI+xIzMkSVz5UjbFcfjNf+OJ5oXtcy+qvnCC8dc5S1gSx9fPnH0M4nWlnk3DbxP
cNgy+BWzF+Owhi2g2njWvZnVFYLEztVAyb4sZwrktvMoHdbcagguyYGLc+BYDlyUA0ezQuS6djbm
jY0WLxHHl7THFsTWiVvFTSVPe35a9V+MKvpDAX9NW9WHflcYXY6QXgulwBxhjjhHmiPPUeaoi4XF
4mJpsbxYWaz2lfYlNJJSW1I+sqRDmiXPL51ftqJ4Rcn6kvukR5UdZTurHqh5SnpOeTLxVFlv6aul
vrKMMhfLAMUZoCQDlNlmOOcYAhRngJIMkE+i+M2Cxg4hEVckNhQtzWPl6vwQcT3GglU0TCXYEpwa
nBvcHXw3yGnBwuDS4GdBtjC4LYiCL2EyysMUTiMYLC85XCfVv3R4DCIAdUjrUPZ6fXU0soEU5YOw
ek5+Vz7Kj+TxrB1QS03lX2bM4V9aHkKLbKRaLgzBUEnQ8gTqasnptdQ5HbC3hE0Eac/qYJScGYyS
s4LUQhekYQbk03GivXKi2UMJkr2Y4VTg79sfaTxWASvIpcnXVGRqPFRkmFyFXdgSAy9kBr23vSJE
76UoUVE3r/ZILWqpXV+Lakm4RgkI2NohnT5RexjwqkwAcocEOEhuMuqwR197tESjC6VGH0SLOjz3
n0SFxBCtWuS4OO2kA8to12KfZYyHwRFOHAXmh7k19LGcUdl/05RMqG5l5XISTZGjUvaTcLBK0q93
OY3TJVYYkj1Odtmqwn5b1rcSFxQUu7xVpYZu6h6d4WJqNAzEMj4MXRfgTYEXvyxyF4dBrFhVhHIp
DMsSosRVsmFQqOcTrcCuJUw3VBmtqNywYQPI4d3Ek9E59Aa0lVMAYb5cWppfbbc2rZaDoVBePpX/
8oaCgUm/3HP7miZKE9Wovm5kw3n56fiXlPShbtiWfdrda9etro/f99rDU8eNqrh3xi0vdRh7lO5F
6xb7fMnwppd3ti967ZZ3P4JjI0tuWjB+bHEgXjtpw5TWnrLCyolrrwtcNueyhuJIvkcqSY1bN6dj
1xU/w9yqZPB/UIXrYeCHN1ILVXSYRUgelso7BPM5MJcDS6RibSmxjR+xSjCwPggBVFQJMsCni5Wa
hKVGRtb0GIhB9XvEN6esXgyLbwoc5IWLxYvn8cv49fx2ngVYfXiM38Mf4Y/xHC2l5dTUOk3nAU8y
1mmUp22pcQCnytY/KU0TxYQIm8Q14OgntgLGH0aLQQCO3LvwHOMfFuj6HffpSbJY95OMdrJYG6mU
/puckiThvYyP1tVhZFJvutYSuyCWOAy3JNK1W+JoS7ra2qSjCMT9dpAYCfcwGmj3UJqXjfTQpU3X
dFVt2tS7f7+nsqzg8V1684In0LX3QL4r/cN7Bu6bXBUi68xGvM6cYEvxbR+0PeghEjiV569DUY+P
FKg5ZQVNb12lB5YIHp8CPT4ZL9MGxj9I+YZZHXw5Mpkvx+rgiwf8xDwQorYHP7U6+E0aapFNOvDT
NdqftTf4vU7QheMn91OTlp/YG1SC8kE/POKH/ikhmr1PTA2hUyG0LPRYaE9oMMSGsm62rAPPcc71
Ej9+VnAQIRCj4jHxhMiKGcFBzAoOjgtfoo57mglEnfXU1iBSN7k4JTjM0Ov4ws83KthCBI2cbmp0
ug1iNhNidbeqqSSPlnQpYDidVcJAFQzbeVZRscFOasOiHCZ+g5qrGNnHUTJoyYRU23GCiVLqM/MP
lf9lWtZ9cNWTU3W5TzZunD5965i+R/sm3jC1vhvtGOj94YjW6TO23YUaz36MqSBE4igwFUjoWjuK
OiebPieJHnx/Ej3yZU35ucK4MBSJTSoh5EZZ+10CkAQOctkE+RJaDDFZmZsnT9PkD9a7IIgZjRJZ
tVWjUfSZkTqBbBBeqnrxHjp7idh4xYKiOlCGN1TPE2PxOuDDG/zqY+vWsuo6EMUbTSkHZWKp1Ajq
pYmgVWqH7WiWcKW4EC5Ei4RF4mpwM7wZ9QirxZulzXAzupO5m79L2CL+CDwk3iv9DDwhvQQO8nul
34BXpY/BB9I34HPpLDgtVeHHkQLAJ5WBUqlBmgosSXRZpq/Ohcm4zvE4iaQ6AEeEXULuGi3RAOh6
R3BBa4BR0zXGCn0XuVyKTFJLjldi3OD/o5VHK0EyW0agQeIFIS5KXlGUAINQ3E6vdkkSkOxcaY6X
RAZAV1KBSkywLEtcLyLxEAzvt1zrXciFIUuMIgvG5D/9NyHn/lBwoHOgMxToP9npNBTLetaMxuFV
QkkSmZPWMvSTm8ZPMvfpWOdm7tNsZE8Kwl+ku355Ml4YqPzm+fSNbOnApuuWzlyF7qJUSfIVD2Kq
NF3fvIgpK0uRxJrzy5wAHdXxNTqNRjIeJlc2lgJl6ZMZ5mrKUrCeSW/khtIbxZzwLvdQeqM2dISZ
c4QwdARZFTK3N2wW2beXyW/m2JziFN8NM9g652hK9ggzp+qFMHQEP3SElFNMgM3AWFGK5RzxVY4H
PJs9bUQzylUMP5nbOfTTnDCVLJwpXGwSvZkujnYiGefYXN7vU1Qq2H6FFWgSyx1V7A+O9Lnt4JAj
VpJAhkVfSwYDgYL1IchpmFpVhbZ5UgyIWIk1JMetYq/DBmkUelT/8Kj+Pq1h7Pg4KfUNyU8+zQsr
2HIJXWLMNrYajBG1O4k7TYLZDGCQhU0sLKrTI/m2W946WFhSx3KK6OHCYtB0sYDlZFF2C6YOPIyX
jwhhOd9dAuJ8hVDprgP1/GhhjHs808pZ/GShTb5IazUuMWdrl5lL+PnCdWYPt4ZfITzPHdYOmH/j
zoplslEGytSEu0xLmEnvKNBg3izcKTzE7FSegc+iZ+Wnlf3gAHfY/Qb7IfeR+BX7lfZH8zT3TzEi
02JrCt3qnJ0yaIvH1MrrsJWw5NZYExgCL8R5Le4mpis3z6hQiauHBj+0GsgypmLuUEHtUyr0ejhJ
NkqlSmMme5k0x+gy1hlbDMmQWMwryHDYA3Nu7Ydk5emkXXBJP0l+bdEZ/4UtL0NrQvAuUZIEWVEk
3TCwBNHW6wImVgQmWQslzR39tcELUd4wzUoX73W5eDce57jq9qqqWzA0rVISvPh0UijC4WQAQd5k
Bc1Q3Cq9PRPLAKQfDmFtpkYqeUreM7oKSSOI9SqDqfkZS4pOleBS6TaSjYsut8SpBlxq3GaQoj6X
W7LugvOoe5jBzO+Z/fCM58xCqlQEJ5/u7AxgpQD/ESbYGfj+IhEOVzTo9t+oEcG79SbyT2Dy37an
cEY2MVeNKlH04uAJrFCewPP/WB+o0aJmppEzzdRt21M3Y6hOhDB4bC9fA+n7RTPa9qRyi0gIgyf2
8lH7Q3N4MzpSzu7YAaxy4QvilebYPr6GXGYfGIUO25fPXjF7uj/3dGPwRK8UZaOAfO4ESpAvff+A
2QiqTFpJc69nKHvY9nSTGUoLPA/Xdv7VD1ke6Org8dNKFUyCgW3pFw4/18Kmnnt+V/3YA7vTfS88
V/47vFz8x0njTXTjwENvHUULz36M1u3/7l0i1WpYnvm/eOXQUaUtz6hDnFh3D5WQGFYyKFdAydOg
zLFI5BCn4qmgUQVcS1bS2UCbfYUPaibUYkG7cv60YGOH9iD7oPCw+xHtiOsId4R/SxM1y9cYYjxi
nhrS6+FoeQPcKgtJ8wp2Fj9LvtK9Ez4kPSQfRIeUN+Q33W/rHzMfiO+pv9e/kExzqPKDaWgBVc9U
fiCQRis/SBLizq/8sJDjGLv2AyfS6g+appPiD5qm6tnKD7rEaUiT9NfAayLS49naD6+pUI3nln/g
dFr+QZpqQnOSeqsSk7SrOfFWS8Iiw0GLm8atp+0YL7LcUeZWFJuKUT/JWEdNaJ2nbSkCCxH6F/rp
/vMqPVRXdjrTpPMW3S71oGmbaXWHV+wt3vG04kOTQ2p97kB+Iy3CIOc3KjF/I4P/yet9RY06LZWV
1whjRY2iFcl2LZhFHXM0fIZKI5ZC0UeEIzy4w8tCQ5jyE8GkgUTMMAmowU3ph//wZHWkKt77u/S9
8AfHPx6d/hqVwfS3rTUXps6mlYF34CWz0p2E5orS05m/YJoLoVepxQ6PWiZiN5sHl3F+ZgCNzZSf
MoeWbHfmUzUDKNnjsw6t82INiYKT+aosWSvnkHW+5NUYmYkENZOTOY9lalHZUqIOeQeTlaHjocDR
UFAnO2rupEtsuFeLQI3gvTvSWOZt13ZLjKVamIaiZTV1Otnwimj61ICZkBNKQh2pjFTr3Q8bcplZ
5pnom2XO8szKW2Qu8izK6+FWqT3GGu+avDvULcY95j2eu70PSc/KL+ovGIe9f5L+6P2bOqB/6x2M
FJiegNudLVzk88iRMKuN1zZpjBbMPoRtlDWzlYkaNE3R8eqCZeGg1+OJm5IXv9AUvHzEZckry5KH
JP/LHPkCENEjKBl5OYIih1DLfg1jxPIeQjMtucW0TDTXfNlE5iF44QENxsDFYYl8RHFmRZUaZarC
TFMGaUGUC3uTGsYQaukLR9fhpQSjcIA0FMXUTwruB/TTJ4P6yc7l/aGA3k8hTHn9Q1NByA1TI3PB
KXXStseNeXBgiAe/YNffHPyKMHja4IOyYO/gpwcaGqVYQ6Mbs4n9eY2GU5x0FtFDSbMOh/5zZPTK
8N4g6WhhSV1BTZMkik0qo9s+xoQdzd9AywY58joWCbC2eZt3TFXTRL9R6pLTN/zX8cpYYeXnfemu
cSU169rr0tc9p5eVhJdo+WzZwMMrN6xbhZacfWP3hbNmABLpBd9kl6LZgAEXUN+ABusBCrlo3Ue2
dw1ZhE926l+C5OR+2nKD9C8mOgNTX5THst3wzXvvBQjMYP4Xdbh+i8ncD/5Jv2fOruDuIPor/1cP
+oz/zIPe5d/1oJf5lz1oN7/bg3bxuzxoG7/Ng27lb/Wgs8JZL+oSuryoQ+jwIkVQvMjrEXi/osmA
0b51M98it4qg0qSCJhUegtOspGcpfxu/jWd46BnlbXKrShMWPSx/qM69EvKjhCYEQRPDbEMQBQPL
n7FNlDR+Vh84qZ8hFfQJBFo6mwaa+nXaEUZ3OjbjP0BKL2Nh9qbly5fD5c4PJH2QkSy7/V4PFCwe
2rGyR5NHU0naXiyvmDZA9nMcX5QDQ++vohWzqxrqGHh/BmJfee8/72yaVj7BP/uKIQjjspX5Gk1x
/YbicoDicgrF5SnhlBdBAXrRCf6EBx3jj3nQEf6IB+3h93jQE/wTHrSD3+FBt/O3e9AyfpkHLRAW
eNEMYYaDS6y+MMD7Uw/BnqJipLoxOqHwU568UQMxihFogtCtNSkYownV34z5HEGouhIhpglgpCYA
KeK1mOITLylNxDPaRJF5Uqcw7SDdrw/0Z/bD0ZnF5PLlGLMUnVhu9HoUFQyFHmfRScKPvTxtI92Q
yoGv+FVh5eyqkfXM/8kA7D8wCsdML2/1zZ0xBJFVoIv5Go6l2Lyb4rL0t/znPNrL/5pH/yPA+4TH
BdQt3C6gy4UFWDUXoIBx5KCkgKIEyhgpIPv8FAFB5Uc9WYJynnvAph/7iUGGdAjthPsEwK+njb/f
puta7nOt+75HADDdOPg6U4xnFAPanL47ALQwyIuFAMAcgrdYEqZvPFFhkH3nefgzEKgM4pmKJ2qg
pWlyf6NTDJAsFVnE4iu7YAp/NTv5R2d7Gznl29MEQ6/hzRra4Xwt7RKLiCnERRJNdWoDepLGaoIo
DRQ+mXHmfdOn2gVFTw21X8p49CzqAAH5NH7jSda2YTgWOTzZvqSl8OmtSbYVwomwfK2PpgLge/qC
/Ql8xbUly5XcCDJ4GPAgvMV+9DdqEgFJgnH8LfuAjdsMxXzxGfuTEyfItyxBx+EnrreBCLrt/mSk
ThSD/3nSyJkRwSFY2CswX7GH0JOWxvN49MV6iC/BrJSueB4mAblQ0xkaJ9qkk/StJqfXIdVyw6Q3
fKEl8haW6yCk3AA/RjIV0vttRy5fTyjXgG0L1zQ/lOxCx1HF9Oha7+KxAwa5vyB+4y58fxHwBL2/
MMMqAbQyQGrqf8ewkguGggGGVwNBM3QYXQ0isPCAoSZa3NB9GB0CErra8howHBnNl3tfBmq5OwGC
+c9dTylzMrndfmLcHjjdiSl0wHAKn9ir9/6AEWGMELBn5ywn8iW8X1VDUojgZZ9k0Oc5WUtMXQS1
eOEpaRiZ29ndR6mYsLogV94Co+H4hPEXjsvbmb/tzp0/HHPBYzOK4e3oeGNj+3sF5ZU1zcmL9KWL
Vl0+s21U99iSHiKhobfQnfj5K8Fu+vxGsaB7ivXJmuZzwUQNPuJF/Jgu/OTlGM9KfjAxN7Q0hFpC
MESe34efP5gPtcc85dGEUF76GQiWhxKwHASrMkjot7EwcJqi4SaCB4wN8kTfkTgygxrsVAhdxbom
y7rucpXjZz+YHwoGfb787IDqJ2tpc+AUiXW0qxD7hupk8Fxxg+9cxNiNnokluGiHN1o5prV94hVK
nlvwTW9rGjOqxb+t/JbV2ze2XjRr5o933HM/87jW5CuY0lCLV60bYVNlvK5qtH/xzCXTGto9vgXj
O7csJWv1YRiHz0LCEwIvAYT+CiD6M9bGT+11waROrNl4GIvqi+CzaRP+BcZ/4ZzjCv//z3GF/7nL
dfXQORD8q3O+GLoOSB+GE4bOEf6NcwTw98NCzjn6v3GODv56WLfP0cFC0MHOZqcAHuuUflAIEiAJ
GkALaAVTwRVgLrgOLAU3g9vAG9a113dNmzlzzpWr141qWrairGre/JJLJyrCeIsFAv6NREuaqkpK
qpqYKyN1NV5dD0SmXLLqppuuWTjhwlvXjKy9cbHpu6wdcaOb2/Fv7KqOglDHmsUdHYvXMAtjkrui
uro0thAkPz3amDx67CgtDZ5M6seO6kfxTMPQUQLm/tPjYNLe6+/Yx59z8HnHYwx4i2P1danahLP3
OHu/s898zp/z+tz9uZ+f+zp+zvdnrse8X1NXV3M/2fw9NSI1ooRA6YZa/PPz1IgRKXQZ2Q6EyBto
Y/bYgV/U1NXW0oPhG+Sz9Byy/Ts5+H4CMQ/iTQ1+lf5dKjXiM/wC7sRAO/mytXgDX6pN1g9MxNAD
NTV1KOoclOYx8BU57aO6mrpqDBBKorljeA3TwCLba4awbl4tKHVuToywGuCgynBqHFjAqhtVB6y8
QJ2GiQdNBYMkwhovb4ZOuAK1j0CsE0weeGXuVZ3EQWT3JWVFmhrJam4u02rORfOhEiQ9qoH4d+Do
1IUPThofG1k42Sf1jf71lPmeh91Tihezcwivz/kZgWk8fRQshilmCZZLwqDwAChXuHKv/iJmdRII
4C0Lkv2f9MNk/6dkEpArRQ0sTaaiDC0sxVM/MrkwTE2a+h/po3gDU496Y1dfHfPaW/jnvfO74Hq8
Sa9f0TB37qgVdEuu/SpYB5vwtSWs4Y6zCnhOLL9DhQvVVSpSUSk7kkUslBUXdwUDGfkQuroXii4A
kkePvzJQ2/kKXgGTr6Q6jzZ2dg68ggm0ob6oHpKAmuI8xmDGpzfAB9Zcf/32L9c9shZ+nPZ3PQI5
yKe/xTLNMfzMI5hZoADMsgpL80bmIV33l/OGYpa7VRUzeR5AVYH4l8Ga3dV9ptfLGAQnbsDgbZji
hLjZ++msMUjbqOSn/bX4jdpaHe9H1HRCZzwoY054ivKK+MxKhQerNH1se6hnQjJ1RfOECT+cCj9M
b4lNnbVs1zUdty2dPBOONRfFy8c3T7eCsKfnx/Xbl667dEJqFMbYe/jOkxhjPkw0UyzNb5S7Ivh+
oVweAbAA36vl5l38dv4xHmE5gGeCL+D71chd7/VoIPkJiZUnt9xppDCE77o/lezXP+lP4cElIUgk
Ctlv32TU0EkTc+ily0txDObvMq99tPq21W2XXTHjtvRbsHlpW3N65V3N07fdhXWpyR9OaB6/euXE
8fAGeH9zKn3D5gnjNmJc/wWPsQfjWgBYQkHABcpZgUP4TveygNwQHsS3+98mC2DC9JAy7YjZGehP
r0fx07F1cBws7pmWPpneBpj0h/jZK/Gz54FizGsnWnlAElC5z+ctL6kQyiMRpbwC0ywhk+rqaCl5
cB1EyXX0zIMn+7HsYT/yp2RrkMRRprS+rsh+6OzoYIXJa4+eTeRMzqt7bofC8klz7nlm7vQ1PZfN
29szorisrDiVjJVGHmgpT9ZUWDuQlOx+OVF7ffcF5du6W0bWjb3p/l8t9IeTIyKBQDi95bb8oqbm
WAGZAZ/gZyrDzxTAYu0llpsMpVqeH/SUYwospMMp8uIucbeIoIiJP0yI0KCSSJ5DhMMH8xPyWHgs
bbGgPvMweL7i0cQwxAOZhx8m/ckuLr8ktbO6Z9WEtulTboUXpF9fOsWCP1i/ccPtsJQP+fLxeF7U
s6p1fPq+dFdzHdyxefNGUgOC9BDxs2OBB1PgRKtqiQk7TLhEgR0KnC/Ay/EfWoCQq3u7H/r9Rfnd
UQ1q3gJJDRWAQ4wd3gyTnbSCCb7RTvsHkrpfXjcqjpFIlWbkycQZ5nl9qHF17+oxLT293Tf33tzU
0rOv+74d23feu+Nedmzb1nc2bXx3a1vb1nc3bnpna9t3zcdef+PYu795/RiNlMO3O4dtwNwlflB6
U3RBhLUJUrmfkw4xFXuhgqV/SgQw+U4K30tRscE5kjKas298X/ejHzSsZCaO7CzdXb2plXzjRACY
r/Gzl4H/tBZOisM1vi0+tCUP9uTBBQZsN+DdbrjaDScJcCILY4mysvzuLRwcw63lUDmHuY8sV7yV
gI8kfpI4nGCWJzYk0LTEvAS6MAHLEqMSKAHNbo9nKtbrPFwsYZoJvSBwGOMsgV7YCxSKOkzDZmMj
HupOQsRHbeyZ5E28x4yHzKPO7E9REcZlQzNTX0d6i/OJZiblIJp3M3wR8/V3cwvbH1mz9PaLveHG
jua/5R3iL1752LULHl3cUHb5xo72lZeU8mjfyJ61axpqJzY3J0rG1eSf9nT8YG5N9czVkyYubr+k
vLSptsJDcDM2PZ9JY9w0YYln7R1j4B0NcNNIeHctvHsEvLaquwq1V8HWKriovKccXVkCF+fBbhPO
N+HlJpxgwrtVeLcCFzJwPliBiSza2F1aFI1Wl5a6ugMBrbm6G8sm3bdqcKpGSp8xWrKlGlZXV4Km
ooJovqbX6DBfz9c9lQV1mMh6PQWS20GXPT2MVD/xyWCsYcx10qmPkYb3RJomnKEzF22ZH1jAZIgy
QYOpmpGNSY5vyIGzaOV49I21sDXedsf+RVc/0XOpvD+0fbXVNe2CirZFVsiKe8fd3DGypGXmiO4t
nj5z2soHr5j98NKx8+fDB1XrqtUTFjyz5qLRXQ9dFbxva8W0Za1jF11aKYk/DjZ2Xjzy8jGFd91e
NHfr3Jr6eZsv637gAjITR6TXsmPYFKZvN2i1wv+PvS8Bj7I6Gz3v+b7Z98xMJpNMJjOZJZMMWYeQ
hUAGCGRhFchKAoTsARIghFWLihBZFNwoIq3YWrdatDYixmpdcmutW62/F61rf6v22mJb6+/1Khnu
e843Mwmoffx7n/63ff7kJCfvd8753nPO+77nXc636RQaEYjql4P6PXraiaGZXOzVQhUaMSWK+wMa
uQqFfxhELUXalKMFHS0P4Rxzny9A+/n8qHG0oICvAY9JMqNukwfE6T8fHttA77/x55G9sogvshP2
3CFcc26A9o1dz3neKSpFH8aNV4fnb7NfbacBY7GRFulhnxq61dvUtFoNNaomVa9KmKeAuQI0AaSk
yAYSEjROe1KSxkFsNu2AhlBnkk2jtdq0WptVMDhG6CMkWcj6icGpjPKRO6mcjwWo5tDQ8nCIM5Fb
23GeSY8/EE+6NyN2A1zcAkNw6PApMEb++M6pyCfWRxOP9O2/5+T+e1fec5ieGTsNf26ORF57LfLC
i8/qD+x78dvHHrjGQj8+iZRegzovU/YE+vkecjTcNdVT4bnKI/g9MJQOW9JhyAXVdvBaQWa1WmmP
GYaMsMUImw1wUAeluhodnauC5Yp2BW0XYJkAxQAmJAHqyBSkhs9NbAPsg22mBKcTo48ki1MvS3Iq
dbEFHzr7QgFTmQUFXGlyBf9lYeUzZx9Pk97S5ObvofOkUxNM0KWQtPP94XOfv/Ry5Ax6N+T295OG
85/e9zTMu+zmm3dvvfce+smTkU9ffCnyOo7xEAzBwYeHjf8r8lHktbGhZ6655pH7Dl3Hr6KVR3YJ
nyDf1aQ8nHqNAtYpLlXQ+YoVChpApwPtulYYEJVKkSgYJ9WobAUmc4x3oVyjpMTYkNFQyYngSSDM
8AufnIk8mfywHFLeHgsJDwrHPhqrihyAIH0WKEZcAqlDLqQgFxJJOskhd4U3tedALf5mdWTRtQFo
CsBaLzR5oS0dOpyw1gG9SbDHCputsNcMW82w03jASHfo9uvodvU+NR0C2IKOE9FbBpKT6YDRf9hP
/X5lnmtAr58ykKYEpTZRQ0SbMzPTk+o0yTxOWZwlZ20lkBvXIy1xX+Ir2NICoskiIlPYHZiF7M2s
kheYMYEtE82doARz5C8vn4l8cnTXG7//6c/+cObFjn0HOjqHDrTvuuf+y3bffpdgb4j89tEIkCcO
vGgT57x/22/eufXVhXOuaG0f2tO8ftdYyu27d991785d96LkLo+0c2udRLzkcLhlmmuei9Y4ocQJ
+1IhmAjJiaBKhM0W6LRAowlWMBJdqYd5epiqhxo19CphBf6Ka0Xq0A6Qw0mQlCT3m1F60wfkCWa7
kwhCmtVp0Kc5VTHzHhfZOH1CzL/8CsrIpfcB8VeKsbd++nkQk2CSTaTH6sLT64cjQJ99HjIjfzr3
g7eS7s189gc/jjy3+/iJnZf+6C7IresF9SuvQWLkqcj2yEBk24On9R9ALig9jxy67qkXbzh4Pzl/
ntSi9Jhkj1M5e9cYHk9HFVovexzjd8v5Zl5SRoio4C2s/Lju/PtiIj9O5McFWB+QjeCxLSmG0S27
g10r5PVMS2QhRjmxW9nxfGxPZHficfKH7HgZ1ts5vhQSO9/O2zsI0+e959+UrZe9jP1Ukp3hhQfm
wo650FMBHWGoC0NnKdRnQlcAagNQ6YSKVKixQ6YRyBRXogiuSqis1Fe7/G73DL/e7Qo5ExNnpzj9
wmynqFKh842uTlR0L+RMaPRswUW8cXv8/gy9EPPFitAh4pYOvYaYqTNZLE4B0IfQo4Vk38FCayhb
/5YhSRlo3nZzx/ZHr6wouerVWx8+k+W85Jr+VQfXTDc8bmm84aWD333limkyVULKeeLt2XWouu1b
VQ7/Jd9qWPHDPZektxT7F5VnTF9/S2vT4f7F9pRcY8sN3UWe+YNLk/rv2VQ679oz10d+2X2kf/Hs
GfQNrd1u1xhKFjTllays8E3tuH5l9Ou8/UhBJ8kgt4bX7/VDuw8UPpuP9qZDnR0UdqhLgsok8Ju2
mPaahP062KmFHiX0KqBQgAwBplE45IRvofpwQrMTqp2AbrrVT1xGF3W5MtMS2ceXDOo0NVUTpwuJ
nOJxGoQUp0wVVw1cWaO25ooBLVWLpOm+JPyMwn4/fx0Wvy87wWp1OwV2ZQ3c7A5tPZX1uzYef2rT
bWP3taw6+dnN171/ovaLRxU1O+/uPvFW4NwVwqD5fz7SftvWanhp60OXhnufAc/Dt4P+id6eJyN/
uLfy8p8PzXvsIaj5w6fTtz3ItPYdhMiakToOUhx2b1HtVdE9SigVIcXFLrIRp0Hj0pnkzkRBT4kW
JWYUNTYLKgrGfXW3KSoJ7CnVkDUUEwfxWO6qw61X3t2W8fgpZdrqHYcXbfvFdUuEmqGHBwrqr/tZ
17m3ZSNnQvWzfOEb/2P43D3R0ShP4mimkt5wxZ582JoPgSnFU2itB+Z5oDIZ5tnr7HQuqnAVbFVB
QCwWaUrIRfyuAGEjJTlOh9sdHW9Ay0R8lI8Y/QKMMN44W2BkQd+Fwv3V47fF5+EZrxdrgnVX1g8e
bfLglByNG/dULdy3qTFVmdGx/cDCvtNX1TyO9Q2DRxs9XzHNtLn9S+asWxCQpjuxAfviOErpUtkI
8mFaOO2ACnaooFAEg87FnACNk7hS2KxUeqUWRTrOBcnO8NmAKbbm2LeqCz3RtWqClTmrDjEuBJ44
pXKt3nEIuXB4iWzk3ENXj2xi/XcLrs/nvVJQH0Y+/HVYaGB8YHrwafaWHBIM2zQKDJMEl0t1WEVV
osqpUKoFJ/vMz9go/qJcj705anxzND8PvSlGQHchDmA6Pfi7341tfv992cjJL7538qS4kuG9HaVt
NfumF9kTXvKFEt5Xw0PqM7hu1ESpULrYbalqpfJTFShUGaqtqiHVQyqZSpUA6VAAgppgsEbBRdQW
REC0CuoSVXKqUICcCgQkXiNFSow4qLFR9AWHgkbyxBD7kCdsDCXhAgyxw+CQ8rJR4MvP7QbGcxO4
QbY68slYwpNP0reBjJnoJ2Na2cjYAjo8tgAJvvr8arkN5TKJ5JIz4Wt250JdDlhzYG82VGbXZ9PK
TKgLgDUA8gA0eiHZCyovVHlgexr0pkFJGhxwQq8TulOgIQnmJoLNWmmlnQboQWMqwl4CzkRbqi3V
n0KSHA5H0J3kt9nMfuI2ul1uwe3OD7LvexsUaQqq8Du1QqrDmWJHEU1KJBR1TCj01qhxrKDgrVEe
Rkfj6AJJm182NDoKSWeN7D97duBrf3z8i4Rc9XhR8EX0GhXggYIiIWQb1/ZMs4sbb3r0tsjY6bbu
EaC3dD50y2UNuZu7wPbh2J93dHz24c2zquiCvQ/2rnt4aEH1VaeLlmz6BeiPPwiuX6zNb9l79zOb
hiNvtkceh+x8SL1//m8OHHrz6KKaox98Z9evjyzjbzr+QHgbvRMrySTrwjVFgcoALUqvTKfFzion
LU6qSqIYVDfou/W0QdmtpCkpVh9YLNKzVBD0eaUXW63SiBqr3OVIMCoSHYJcw/xSZu7wN7bVwNzO
0Hig4MZVw5wPycKFCmyhwhDEQzpp6sLbd4n513d3/GDrrFmDP+h4tF0cjswu7Vo4xV+9fl5lb6Un
d0nP0JIll9zw3M5dLxxedN32c3V5rTe0rfpO/4yydUeaOm/uCDGrvi/SDTOkt88RT9giUp+cXT5w
8YcSBb1Cxm7Weut5NtLRMbayUEbZQxv7hoeHI92yRz+fI9/7XPSdEJ/x9dQQzpcWEb+3W61SUKJW
+9hnSEBNfezVa1Rkb+lWUFCq5OhgE1BLyvEJ9tGB3BZcxnxxsMViTBrFtcOWCQv+okskBMJnb0Zc
w8Pw6JlICU0Zew+VyCB8GtGylb3v/MdUzb7tRLLCdpXS7AubgJhcpndMfzaJJjNRyhwqrQZl9WwB
m9XGsRcK2NYx/1xmkS1KdlMIqWLJ9CQEEpMCcxyrOnIVw5CdUewxyYQTSmV+3dZKke83LYosF4dR
RrykmLSFy4uKKotoUX5lPi3OrsqmjZoeDe2kUEshxWHxebOyErze0qneNGW5kipx5TjSDGZ5rtOo
U/icIPBRsd9yHkhy2RhF2Rh7Lm4nfJ4JcpHIBEPStvGR+y6Wk5DYc/eauy+tmjl4Z3fXTSHZ99m8
vFNi04p8Wt4zPyu4aF14VndNIGdxb//Vi2946Qo0kJdcsmTfF93+Io9JfkIpz8MpvxvqONK24pb+
8qK1xzvbj3QUMHrrkQzlsmzU0Olho0at9MlEqqFBuUwp55I++jxTzc+PYhAvBfCF7Bp2yOqBKx54
4okHHntMOHYAlJHPDrAncCNLhfcwcguSBeHsvenQa9hhoI0GSEggvsxMR7bGq1anYUDvclBHllOu
UXsdFpta55AZmH/D3Pry0QmRT2xN+WJ7dzZplyS+ukyhCbZKeK9g/cmddTf2l99vfnlWT01AnHlz
b8/B5enDuuz6+QvWVqQN29fcuX2ub+mVLSl3uefvbLxpxYo5A8eb6ODYyw1XLM/MbxmqpfbYLmQq
yqATveWB8ILafOAy0ZgBTW7osUK7Cbq0MKjZo6HtGtgqH5JTec4O534nbUSXboAQ/cBhL3i9U3MG
XBjTZDrl6CWnOc0Y8JHyaAgT36ZE9co22SY6ccA20KZNC120b1lUJFwsHRv3dx5sKTHn3Ny++nhf
2awdP1o/+NC3Zk/b9ONLm6tn9iycMmVRz4w5fYuDOUvWy0YO9R7b2lqQM3v21jvbO398Rc38a569
vOPJ5968fPXnT+TW7Zi/ePNCX+aCDfOqLlsxlVEBI4xUtFUu9KI2hqubQlASqg4xF6rTBr1m6NbD
Tt0BHV2ng6sxniXJA4fzIC/POK3LBbUu8LvAhaTwD7iMYAw62eve3E6rjAvVOAlCbPYtUpx7ARHc
RTNlRRO1aHRrUWGOzj22YQZpQxXdi0qy0nR5325vPd5fNmfn/esHH7w0nNt776XNhTN7FgQD1R0z
52xalpuzpP+ays2rFs+b5c6bM2fbnR0d919ZM3/fk9s6fvlv7+1aKSvPrZWoEFjQX1V1KVLhH+fB
/BfqOYwGo28pRWuwgEeD+CNuFDei1bCSk+GVBr1ZbbEKolkslh9FYUbAJ5NbZPJqGRTLQCEDmczc
aYYMc72ZmqlSpVaAGnxEYUEMZIcaStTVapqhBpXajk4YFRxKq1mtNlsxjJMrMHQflolROzGKGkXa
cEODBPZcxmt0qYbYXetG/agMnQwMakzcy2rhpdBiRJdDP2pKALYL4vYIbsEDIbOQI2Sgd6oQxI3P
XxYxbn4Knnph0Qa9xaiVizKNzqzvg3mREXHj2GY05oXBrGRHMLvQH3md7fYcxfkHcf4W4iY5ZEU4
j+QYvSkyb8CVAiRgDNCUQEpAk2fN8RGNS0M1xBrckA2Hs09k0+zsdHdQe1rI+kl6UKOOBWYtG9m1
phb0FhP4rnALf3EUe3NodJvXzb6/ziBffKfXg0VR0C0UzWie4QxvubM7UgC/eOYZW+68sT+endo8
NyNjdmPoE0hY2DnDnjJ7/SXnCV1tLK6py6m/bIlf3Dh02FM1uyRH752Zl1fiVJ57MSU37M+YlcOf
smw+/5F4GQqAl2wLV85Ph6I0KLJDjQ6qlNCogBoF1ApQj7bda7US72HvCe/9XiHfC8Rr9Lq8gtfr
d3jT1ICiQbxWTG6bw8B2wN0OmWZ8B1y6QClps5aLdxBhPNTnwZDC74mv32lF4mXJDd/6QcfQCwcq
a4+8uLP9lk2Lkk5VvtO0rxkj292Ld3/fBf0N13ZMqz3+xtD+MzcszGvYOd/9Sun677RtvnPd1AO7
UJIZJ/chJ5UoyaXh9GItVMhhDgXRazS4DNRgsFl9ROlCe60OKtXWIEHOfcV1IrPbxTc23UXj7DkK
JzFgcEc+iPw+Eh75pPfGlcGC9pvazoobIx9Gfhd5N/LWd0Pdt67rO7oyk1GbjcSDI9GQheEMpVIj
imEN5GuAaIwoQ4JGAzq5ykfAhe6lIqhSgSxImRipgxAXo7MxGWKkDCFp0QJiHMo+L83/RM+5QaEP
w4mhse30JXHjicizJyK3R3sXnsLeVRj3oRFjH8sWNVTmY08eUwUNiqIcgmyv/sfymAaOdhZiDiy7
B4V3gUIpPDV2iKaOvTsiBIWXIk+fiCgRryRNp1Ga3ChN1Xvt4LPDUBL4zXvN9GojdOhgmQ6K1VVq
Wi3CdBEGAdLSElP1XoPB7SOprtRw6olUMTXRhxGIQm9wBt3uFJMDF1LwgRQHJbkTNzjOjjsBF0TY
Prk7Jkwus8LvjosSuzrvFk//PvLh0NsnGpbe8tvDcKTurlmR/91xc2eouPvIqpFjkTuo9ti9y24+
c9WVrx2vj/zU+8LMjd9d1X1bX0nHSIyCYgPnX144QeNTUSrTKQWfTBmkVFQr2GUOEJkOKx9N4MST
GDUqXdxzc+fWbQqJDafHHhgZoYtOU/XYpygrJfC0hB2WInaBJIdVAorBr1AMBH6pkPEDuCCy7xTB
0pERTu/M8x/RdxFKIIGwtlgOCT6j0aLyKhPwpAeVKg1fhGgWyqX4nckxcG/BX1iUGHWK6Lt5zbuX
3X3fPcLdpRUe1Qj0dl/XlPmz+8z/7gvX5tHPY/Pew+e9I1yq0IBGLeDQUPFZCEHVpxZQnxOiVqpU
PrVgUQvoy6hdLNRm1CEyl4zKBOD0+UlMyZePmkrGhYuHA+yNqOj7J+UmlGAIqR8VR4dkScZobAAY
M4EiFh6Ie85GOk+ePk2zP44k0pQjkZ2oxJ+jUyPOqJyz9S4jmWGT1LtMIUaXlcAHEV1PjKSsf76C
kDXCvjHDCC0SN57LlfDIchGPldwWbj5qge0WaLBAtQUsCQk+UbCIQoI4pPm2hm7RQJcG6jQwF0mj
00l2USfbL4PtaBwNVQY6iOSjotEgExWC1UepTa7wsSe8qUqwsNeyZKH1A2XU+oVGpcst3L9lj7fh
jzEeMLXED5Pix5LbjRE0v3oGiRg2TGM3x8tyT8oj9x6InBRPAkqHJUVJNU4b2M8KB1BJHD/XjlRL
nLrGldZVRt+K8nk553NfuKgWF6GCXTCrBlCyuzqR40qFRYmBn8ZnVIFKpaMx7h6ksJbupJQq2KXt
sHa3EtqVm1GjSsuhoKWFZ7Fp4dIdMkqGOzZ8PvQQu+4nLn9s7JR4/09pjfiA0HTuDuTGHUIT97k/
El9B7WImGWR1uHyvH/a6YL8D9iVCaUJNAp2vhVItzFbCNCUUKaCCQiEFmZfYjXaXXbDbMShKYzcD
ONQap+Nv3AwgWaUv3RGA3vUEv5oe2/Xrby9bduTlXVe9ctOS5UdfvqzhYGshLWrbv7z2ms6SwrZr
xN21t7x61e5Xjy1vvOVXW69959jSc2JZ/4mOzu/1T5/Wf/fm5qP9M6LWyY001xM7mR3O2Ga92kp3
mPabqNxLzEb0pcz6FK3BR/QuPdUbghqNTm2Pm6gLzAGfgdkdGziqGzO//CgZqtGt9/ZNLVh7x+bI
70dGzu3fn1HVPeszcWM2xjXzr2ovjdTRmpa1JTVBE6f07eJnSOkU9OvfCx/bG4I9BbAvB/YFoDB5
bjItslfa6XTrfCudb4ESC1QIUCTAPE5wN3G52F61P0+r0XQYoB5JLqLzL/N2YcDTwDa0+fcYBb9/
Wp43zQa2vV7YilUOd7DK2eCkTpfDkaAJarVXG6DHsN1AWwww3wClBshEVFlK0ChRjpXYJM5EdAel
bW5+V8LYWyUt7JJ6S3zzBdPZghYUwALpmm1LiL0a6cvsZveqsteTZIxHFeaCInZViD1l8iXu1y8u
6CgorN5bVn7tJTEpWFY1f1FG1c5Ah/AlUbj6tcWuXNNuW0Weyz0uEqk5hj0Jxel9L36FXDyDcmHD
6KohnG1JZG+j8hr5LXpe9niQyyE4HOr0JKVPUrZWiyUpqFCoXEENN0Qqboi4xZTcr5iYFDCtV5IQ
9ZRzBA/XGlECWBNt4JYuf7nFZ373im9GeU3+90aoo/3EhrIf3b1z7dhKmL7v8M59kfuhaFpl0BQx
ihtd1VsbrrwtUcw/Bovq2hfz5w1qcLXaUYamk0fCm7eUwGAx7Mjdn0u3Z+3Lott8sM8Lu13Q4YLl
LtibBtuTYZsdOo1Qa4QDFHTKBG/GdC8h66bAiikwhWQYMw5nCBkZ+TNSvQ6H0kvyXfk0fzq/eZEQ
naCblu4gqcZUmpo6JX2KTXBMY25ousMWc0Mlvku3eUv3YcQvQpVIcnPW9OUrqOCPe6O2iXdjsAsl
khOYkSPEXVehXLXv8uJV8zIc83asWnliEOPoO9ovf2J3hfiAWNy0ZXa4uyaQsvjQQOf1zcGyDbe2
td+5bZ4opLWts2ZO97kLAl6zJW/RYEPNpY0FxR3X1mnLW2Y6k/PmZGaU5mXarGWL22ZUDGCM2nD5
UkZhdCmFD3iElhpWKcCHNlYMypm/QJm/wKLNF8ae524bu6fCLXwQ2Xk6skt4THjpXK7w0gmG4zrk
0iLEkUaawtMak3uSab21y0oPqAFDNunawJAMBmWwR4QtIqT5ojR2G6MayWlkBjXJoeB0Dn2lNkWf
Q0SyidJujBh1PMRFKvfM3uP9O+9YW2wXHpaZfeXNs7u2zzQ9Am8XDvS3zZ9SsLSnvzdIrx/bEFw+
f1Zucn7TZQvoYRy1EtfGahy1Af3M6fUAdRiBaHRyUaByKvrYwyFUEKjOQEAHqDrBQmAJWziwG2AT
QDsAUINIBL5OqOSwYVQ5g18s44Hl+HY+90gmHpbwPQj25vIQRm6SpRVXR/J/HpnxDBQqtWqljCot
BqgQN35xCI3Xz63pbrfFU+EXShnFnYTIp+PYfTAtPJxhBKNepzVq9T6d1qLT3qADnU67TwvdWsjQ
glYzYoOADZJtoLHBTSpgVyqoza7S2DQqn91msdtU9lu461GlgSwNJKEDYq+xgz3Zg9P2gI9PnoDo
gGMiBERwJIvUgTRKdliSHWLycU6VLkaPpyicpnAjhS4KjRSKKAQo0K7krclDycK05LpkmuxL1uuI
nXkrGgraWKw+KpEuroKRgBINJZ8lflmEBevozk2gK2s5wZuZ2FJC8yVmALtlg31s3J/hYY+TsSCf
eTszBfZUdpQbZvn0yNP3RD4z6gV00fSRc6civ3r4LotNjoM26GXvvvasNtGkBlFuNg4zHgndhSUm
Q3XuuRPoDoWWXuU3TS8vNdJPxlYHGpfOTsjbMovyp2iY1LVzf/Db4aVWi5JoTSoz0SYYVWaVgUFq
lVkDCovcotSAjGVmpUXpU5ktKpXZhm6jRacnWkIFUaMFDbrPWgseEptGo7KYtdwLVAJRjdOV3a3C
Ly1JGx+jo0b2EW3gJOHuE3uEmmWs2GDg6tzPv8PuAYkw/DPXYvvbb2aXGFRZkddfhlcia179g8Wp
UWaB+ulIA+SWLbcYyyOX0uU0NXLakZOgK4eGsfcmzldPysJOuU8mqkXQ+1zkftS4EN3nRzIKgp4r
HYHvBSfwO1PG3mxhqtX4JrsXlG3qR4eDzBHbIxkjkaLXP0nNM+mC/s+R5hsiafBbejhyXXCBJ7Wy
GNaz/aghHEKn7DXq112HkJz85nuLSSL7KqaooMIsAPFhYQqqwCAEC7F1+vk/06vpX0ChK4ba83uJ
6ifYEFVSYSHDtRYxvEH/JCjInwgZ8xDFA4RtMvI6tp17Na/7c6zOEatzI9a99C9Y9xes87G6TE20
zobnXUv/hD2WwdLzV/EeOVJem46R2W76JtbO4LV4ZkrszBysO8jPnAkt0TMN8bFWI94+fmY5rJDO
jI81C8/cxc8Mw3Ks0wxTIEZ+Kq8PxetnQX0UszWOOYc+Rw/Knpf6pWt4rVmI1YawdhevxXOjtaZ4
bTrWXs1rkb7RWnW81oa118oekWhBl0jUpxPP3c1rkRZ4Ls5IT6MzqqZv0T5eh7OV6sRYXVZ8RDhb
rOOzFQVptvxnWjQdJV+MJ6iAExR9A7qNfp/+UlCLZeJrcqeiSblHNaL+WFOro/pN+h/GkqHEUGK8
1fSrhFvMmy3Ucrn1+sQFNmK7N+lj+7IUp6Mw1ZL6Slqq68b0XZ5Uzzs+h/+ZwInMjy5MwV9nq3O6
ck/k/TZ/OKSaaijMmKYpuq/40tLu6bvK7pnxP2b+W/mWWc/PvmfOjyo+q7JWL67593+VNF+G6YcL
lmI6GU/v/ufTwux4WvKN04lFrkWnJ9Nkmkz/TdOv/yHpj5NpMv3zpcXyxa7FpZNpMk2myTSZJtNk
mkyTaTJNpsk0mb5JWjJ3Qjoymf6p0ncn02T6l05vSOmSpEsGL3nhkr8ubVl66v8tLdMsm7rsyeU7
l/+0Nq/2dO1f666pT6hPrvfUB+tD9dPr59TPr19Wv6K+rUFsuKHhN431jd9t/GWTv+mNFYtWbFrx
0IqPmvubb2r+Py2XtpxfGVy5ZmXvyg9Xtax6cbVl9bLVV63+pNXTWta6ofXp1j+saV/zkzZnW3d7
Vvv+jukdLR2nOxM7/9q1tuue/y/pif/G6Vddb3X9sevzblW3rdvfPbW7ontZ95rujd2X/4ulQ93f
6f5h9yOTaTJNpn+2RPibFmkn5u1wOZGTV4lAvOcPYV50/nXMyzC3EMv5buIlApZ7sZzBJTwvPT+M
eRmHG7GllzTxvJnnp7A8kxjOp2Ju4jnDnIt4htk7SLE2l+PJRTwsL+N5M689hS1D2PJ1zA2RzzA3
8dyLbQr52ArxXJaX8pyNs4i3L+I9FhEjYiji/RaRVJ6zc4tIAW9TwUvm8byK5wuw3yKylMO1HK7j
cAOHmzi2ZsxLEH8F5kYOmzicim1KOP4SxMzyKl67APsqQZwMruVtGnjO5liKeA5hbsQ2pYiHwakc
9vLaCp5X8RL2pF0p4mFwLc8beN58/iNSxmddxqlUhtgqMDdxOBVxlvFRlfFRlSE2VstmWobYGLyM
ly/ncANv34h5NalGnNXkFPGRWj7OWj7CWixZQBqxpBtzE+ZNvLaJ1zbz8mZefopz+RTS8HXMT2HO
fkrpY4Q9M8ceHEzmJQKXQDU/EvjzhHp6PAoLpIJ+KwqLE9rISBJ9MgrLsf1vorCCtMfbKEke/TQK
q8h+mTwK63RJssOxt4uCLuGuKAxEZn4wClOiMP9HFBZIuvn9KCxOaCMjWosyCsuJgj3rz2EFyY+3
UZKkhPuisIrMtaREYZ38oGU1e9pdFNgn2ZP/yGEZwsbkcxyWs/IULYcVrDwlicNKDgc4rMKBOunv
o7BEQwmWaCjBEg0lWJzQRqKhBEs0lGAFWZNSHIUlGkqwREMJ1umyUo5xWD1h/Bo2tsAoh7UTyvUM
Dvwbh41sbIHfcdiMcELgYw5bJrS3cjpIcOKEcjs7N1PkcArvS8KZOqFN2gTYy9sncDiLwy4OZ3M4
h8HKCeNXTuhLO6FcG5vL3cRFCkgeyUdt4yLLSTfpwP8LST/pw7/NZDvZwEvm4NEmhFneiuU9vEUO
1swi6zC5yFIs68LzN5MBftSB/zuw9RbM23lLHaYqPFqDpR1kK5Ys5tj7sN9YPwsQ+3bEPYh4XIi3
H3H2kDaE2xDegHWb4v244qPPQx3qIv74URGZwsfQihg2YFsX9tuK/TAcbWRttG0NHnVjKasdxDEO
xOfE6NDD57Hua8fTyWnhIrPxeA3WsNJWTokL5yjh6Y/O1MV7GcTaNj5fdtSJuLfiuZt4ySC2aueU
c2F5jB/VOCZGnR5+Xh+n7XR+fgdv0UHWY5+M0u08d0VHFGvr4uUDWMLotyHOwfF5sPrNOIoePHMA
qTCLt5RmFJtFKx8Tk4B23iMb81o+u86/S3oubll6Qa9MhrqQHut4Py4SwPY9fAb9cbplkjpOq4H4
fKYh3hKUgXFMC3Fk/7VyruZ/k7L+ryLrX5aDcS5VcEnYim37kB6Mj52YeqJzyua078fx9PAeFvGa
bixh1BzgvFnCJWkTr+nha2gZ5uNzZzTLR5ktRo42coq5+NrazikkzWhznEudfKyb+Wpkxxs4jvVY
uxmTRI81/NwYReeih7MA5Xd8/rGaDXwttWMvbRyjNIetvK82Lktf1a903MNlbB2XJqnXzdiC0ZbV
b4hKk4vLYnu0r54ohrYorg6e53ANc/HMWYt1HArgeZkX8P3rxtX3JdzfnEoTpSrG601cjmK8i8nR
V89e6v3L45o+gQZsJtJcNvP+YnpmE5fE7Zx67LsFfXz1tX7tTCVKt15AVWkV9UdzaVYSzNbzhuiq
ZqPdEpdeCQ9ryXTH3+YRs94xvdnJ5XsdH2uMVheuwSmcvq0cbo9y88tr/OJ1G+C6jo22FKOlXF6T
w/tYy1dyB+dNK5axeXZhi1hdbhTnqov0RiYfSSueu4H31sEpKc07Npr/jGb+hprQ5bgIx4IYDldq
XCZ7sUyidoz3HdyKrItq0HEZ/VvaPSZbX6/hGeeWxOV/YIKtlORKkpSOaF9dXCL7oqtkCp/zpqjm
lew80wytnP4Sn2PS2MfP3xDVaVIPTDNKmrYvLimtZNzCxXD+A3kRp1Arn3t/VAvHtEA7LxlE2kiS
Pm71XVzPr4vKTCA2xq/nLdfsF9g4V2pUAmO6sSM6wp4L1sM3xse1cw8/L9b6q3XUlIt0VIz2F5/N
qCZpxYnzjo1r3P8YXzWD8fUd4+EUrrX7eS+d8eOOCRLCtI/EoQHENiVuJaRRr+FjkVoOxFteqEsk
HuZGOT7AV8m6+Bhi6/pCWfrmVB3vITbLifbiQpkep8RWTsf1fycfYzqd+Ud9UcpcaEf7ieQzjdOl
F1u0TbAAm/+GPpb0dzufQcxulV6gxVsRYz/XOF/tcUoeUcxWjNMnZo/GaTRRp1x41gDXFRKv1kTn
/dWWs/VrOLopPvsBLqV9HLu0iiT7OdEu/70SELNvVegtsdrFZB4e1aPXtJSXVGMZ8+SWYk0dHlVg
aQWWZGCL/8vet8BFdZ37rr3nwQjMBtEgGoMbqohKfMdXCBEdEBSBAj5rDa/BAZEhwyBqrM1JPdRY
MV5PStRQ4gOpVYMGkaSUGmNQY65FYZj5GUltNB4Va73GGmtt6pz/WnvNMChac9Nze+7vZyb//X1r
7bXW961vfeu52dtUfn8wa6k5bB6KQ7pZbI5TykjBNRHheWyMiyUyC9PQDKRPRFk0bwyZy2TEoLRU
ljKFlT0TsQmgMTwdzTEVMbMQpvw0Ngoq8hKRS1k/x/M5UdE0DfGyu4ZdtYpnEl2azUQoBeXH8bvR
KDuelUf1p/JjGZ/o1jOWaxrNbERLpmVO5evOFBY7CzQZ6VKZ/GhWZ0XbRFaHWNxX6hLDNKCSh/O6
KumofWbzO7SNqH4J+HXWKprZII5p02m/qaDJ0JyWPw1309gMkYScBlbTVGa9GG4zWtsEFuqsldJS
U1ltqFWpDQzgZwLT3LZLYVdFlxSP0rrabg6735lKqV80v05llktiIaU1prJQGmsrejeCt2UKq8f9
UucwT4xhqaJZjVPdHhLLvFfR3uWdiowkD00UebRtPXVxebX8iD6ilOK6P4u39IN2oVaPZjaheqW6
JT+sZPTNX8mjR456Tk4zGeWZ5gKzdXmhUZ5qthSaLRnWXHPBcDk6P19OyV1kshbJKcYio2WpMXu4
rNfHGTMtxhI5qdBYkEbzJGQsNxdb5XzzotwsOctcuNxC88i0+JFj5DBKxkfIKRn5hSY5LqMgy5y1
GLHTzaYCOa44u4hKSjPlFsn5nuXkmC3ylNzM/NysjHyZS0QaM4TKReZiS5YRJMdakmExysUF2UaL
bKX1iE+TE3KzjAVFxuflIqNRNi7JNGZnG7PlfCVWzjYWZVlyC2kFmYxsozUjN79oeLQlF4IgIUO2
WjKyjUsyLItlc87DreOKnKTkTDEuKs7PsMjhM3OzLGaq2pDZRksRFTNu+MSRLNHMNHdJzHAGS0ZJ
bsEiOSknB9rJz8op5szcAjkxN8tkzs8oipCTM6yW3KzcDDk1g9WxSB41ccLoeeZieUnGcrkY1bFS
w+WYC6xyRpFcaLQsybVaUdvM5cwcMbMSolktaaDQYs4uzrLKkFBiggiPvKC5BVn5xdRQVrOcnVtU
iMaQMwqykSsXCbKQylhgHS7LLuHmgvzlcnjuEMXCnmUVuFJ3q5LSILTWFmMRrR01pod4ZHeX9TzT
IDwXUqzGJdTyllxIzTaXFOSbMzyFQukMRVU4Auprhihci62FcKhs41JqXqQxGfML76uRXk9bOMec
n29mbcH9JELOzCiCOuYCt1+5PCjcZLUWThoxwlgwvCR3cW6hMTs3Y7jZsmgEDY1Aype4Bw6JkDMK
C/NzjUVUNi2m+y7Tnau38hQJNIWNWjLPDLVp7Y1LjfnoBsyiXTsVtVaXbqXXJ1P7FzE3hK1gFCNy
LbJkoPLZEXKOBV0ETp5lyrAsQp2pGQuW00ZDdtmcia5RQI2Swbo1TfntakEVyigqMsOFqQtkm7OK
l8DoGUrvy82HZcJpiV1qK6fyfm0bwjTKNtKOqbRDt+nkklyriUZ7eFQE9yiqvet2fi5cUZFNy7Io
IxskFNP2pjWMkJeYs3NzKDUygxQWo0JFpgjaJVB0ZrEVkUU0knsJajgCFS8yYqhECbStuZW6VZVl
oCKVfsEtzZQoMZmXPKKO1NOLLQVQhvdRM8Y/pkueMcvqcrBOP4Z/Z+eyvjVJcfGMTPNSo8fwjIGI
9gqmD+1HhZ2ewm8VmTJQq0xjl86Z4VFRCxVfZIUz0REQ/VPpy48yAO1vcTFyalJs2pzolBg5PlVO
TkmaHW+IMciDo1MRHhwhz4lPi0ualSYjRUp0Yto8OSlWjk6cJ8+ITzREyDFzk1NiUlPlpBQ5fmZy
QnwM4uITpybMMsQnTpOnIF9iEmaBePREFJqWJFOBvKj4mFRa2MyYlKlxCEZPiU+IT5sXIcfGpyXS
MmNRaLScHJ2SFj8VY2eKnDwrJTkpNQbiDSg2MT4xNgVSYmbGJKYNh1TEyTGzEZBT46ITEpio6FnQ
PoXpNzUpeV5K/LS4NDkuKcEQg8gpMdAsekpCjCIKlZqaEB0/M0I2RM+MnhbDciWhlBSWjGs3Jy6G
RUFeNP6fmhaflEirMTUpMS0FwQjUMiXNnXVOfGpMhBydEp9KDRKbkoTiqTmRI4kVgnyJMUop1NRy
lxZBEhqelRrTqYshJjoBZaXSzJ6Jh+uxxjCz/QrdOxSwfUEmWS7osfrPQ7iD7Vxc91P5XiOb7Q+y
VVtU76l+q/oQ+LWqQbW3y3OK/55nI09Ogp+cBP9PPQlWnm89OQ3+//M0WGm9JyfCT06En5wIPzkR
vn80f3Iq3PVU2GWdJyfDT06Gn5wM/487GUbf7NzXZbB5whU+z/Z5xi77PmOXnR3b26mD1aPUM9TT
1C/gOhGpMzD60RW3MmaZhP3CNhVhYyjd9VnYX+7QMvjf/BLiHEzKSXf/CUihg4Y9icbpJH70L2Vn
ih+GihPVYYRMPqtpQFhWDmVd/znxH3nReS86JSFl5EikUsoh9FuZYqaYR/+dRXDriCCWiZuJStwi
bgH/tvg2+AqxAvwvxErw74g3wH8l3gH/V1VPIqgCVAFEpeqligU/TTUDfIJqFfgfq35MRNWrqlvg
v1Z9A/7vqnvgnSonUamJuogIaqvaCr5YvRz8CvUK8K+o/xf4jer/AP+m+k3wP1f/HHy5ZjQRNGM0
Y4lK85xmPPgJmufBR2oNRNDGaCFXm6CdCT5Rmwo+TTsL/GztHPBztXPBz9P+APwCrRV8sbYY/FJt
Cfhl2n8norZU+1Pwa7Svg1/rVUUEr51eO4nKq9rrIPh6XTQRdVN0K4lK9yMdaqf7sa4C/C9018H/
H90t8F/3gJQe83qUEFWPZT49iODj7aMnKh/JJxz8EJ8x4Mf6/BL8Lp994Pf7fAT+iE8T+KM+/xv8
SZ/fEdGn2acD/FWfPyH+us+fwd/yuQ3+Lz5/AX/HB5b3+avPXfB/Q+OpfAXfj4ng2+R7HPwnvjfB
/9n3FhF9v9b7E0HfU9+XqPT99LPBz9EvBP+SBLnSEekIEaWP/YKI4NfXL4SIfqF+YUTlN9gvCjEv
+r0IfrLfKfCn/a6C/6PfNaT5k99XiLnp92fE3PJXEcFf7a8mKn+Nv4aI/lr/FYh5xf8VxKz0hy8R
NfcykYSwtlZaWWlf3rKwagpsmKZDS+nm6mBD3Xwd9NRl6LJwzdEV4rpUtxzXFbA/tfy/4fqa7jXE
/ET3E/CrdaXgf6p7Hfxa3c/Ab0Dr0Ha5yVtBhP2HgY/wGQHrjfQZySz8R/DXfK4x6x3F9ZjvMdjw
OCxJ7RaIax99H1gsSA8r6ftSS7LaeJNrqgaiybBkZBI5a7klnyxbZDEuJmtNxkwLqcjPsBaQXaQ/
UcdGp2A9PzNhnkzGpiYaZDJ5VoqBjtP0S5wqokHf7cd5LfHn/4Is/TfletJ/PZbxOhJAnuF8D9KL
BDOb0rCaadKbDPCIEYgPeQojmitGIIEoV0xIi5NJcFrKDBljsZJSRM/vQ0J4SIURL4iE8pCafTf/
e2RgVmFRITnLrhfZ9Tq73qFXQVxstBQIvuw6kF0j2TWNXfPZdTW7rmXXDexazq4V9OGSsJ1d97Pr
IXY9ya5n2PUSu16jV5Gw6xR2nc2ueUsWL1ksrmLXUnZdz67l7FrJrtXsWsOu9ex6iF2PsTG2NywV
+C04b9grCHbph3bqjzYJhuXl/wfxAiGPuGpARWipBvfokJrNG93dEeBZ9A0MHag3/EKP9veDDxJo
EAKvgCeQQSQM681w7DKHkmHwomcxS45gf/k8mowhY8lzZBwZTyaQiVj7P08iyQskirz4kFIfN06k
b4s8Fg2g//7zP6D/LvgKvYX+wkBhuDBOiBJihURhtrBQyBEKhKXCKqFUWC+UC5VCtVAj1AuHhGOC
Q7gk3Ba1YqAYJo4Vp4jJ4kIxRywQl4qviWvFTWKzKkglq8JVsaoUVYFqpeoOuo4OA2KQWlaHq0eq
I9UGdbI6U12oXqZ+Vb1eXa6uVFera9T16kPqY+pmtUN9Tn1JfV19W31Po9VImkBNsCZMM1wzThOl
idUkamZrFmpyNAWapZpVmlLNek25plJTranR1GsOaY5pmjUOzTnNJc11zW3NPa1WK2kDtcHaMO1w
7ThtlDYW8+Bs7UJtjrYA89wqzG/rteXaSm21tkZbD4voMIPWMp8QxqYpNDqOxhJx6uSprzIPEabe
ZDHCtJOwNKWXFDr9tjKyJxgUmv6pQjMqFJp5V6FZZxT68kmFWuoUWrRJoStu0w8TE+GVV4kW7iy8
voBosfgRftbEvFsoW6XQN/wVumEs/X420ZRry8PLp5fnl6/n4a3lTeVX3vJ9a6QSfsvwlumtdW/t
f6uNh69skjaN3TR/06tKeFP5psZNFzbrNg9XwpsNm/M2b9hcv/lzFlZvvrml35YpW/KU0JbVW/Zu
advyjRJ6O/DtqLdz3l7PQ7vePv32nQpZsWDFJE4rFbu9s4tR1TvfbPXfOlC5t9XK4tTb0rblbFux
bQMLBW07u+36dnF70PaI7VO2p23P2/7a9orttds/3X5h+zc7AneM3hG3I33Hsh0bd+zd8cmOz3co
7RJaNa5qelV61bKq9VXVVYer2qqu7hR3Bu0cuXP6zvSdy3Zu3Llr5+GdZ3ferPatDq+Oqp5dXVi9
trq6uqn68+rbvwz45dBfGn6Zrmi1q7+i8bsLGPV9t/bdpnfPvHu9htT0rhlaE1mTXJNTs6xmnVKf
fWRf731DGe+zb9O+vfuO7Du77/p+9f7++0fuj92/cL9FqeP+2+/5vjfwvSgWev69k+9deO9ubUDt
0FpD7cLaFbVv1tbUflp76YD6QP8D4w4kH8g7UHpg+4HDBz4/cKcusG5sXVpdft3qusq6D+pa664d
1B0ceHDKwQUHlx7ceLDm4MmDV+rV9XJ9VP3cemv9hvqa+pP1F+rvvh/w/tD3De8vfH/F+2++X/P+
p+9fUur3wValfg1rON3OaROhb7sJDdyzfxOp0MYJSk0b7/024LdhStxveWseWnZo3SElv/bDyA+T
P8z+cNmH6z5UJKgPi4cDDw89rNRZOFyj5P0oQrl7pPeR8CNRR2YrWh2po1fQNk4/5/SC4u9HbnJ6
T6Ef+3Laj9NwTsdxOpnT6ZymcbqQUxOnVk5f43QDp5Wc7uW0nlPeHz9u5fQLTq9zekehTVpOe3Ma
yulITiM55fo1zeU0h1OuVxPv901rON3IaQWn1Zzu57SBU65nUzOnZzjl9my6xuldhR7VcRqotMdR
3kePr1ToJ5kKPTFFoZ+Gclqq0JPBCv2dmtMChTYncspH2FNrFHqa32/hI27rJMU7bFZOzyi0LVK5
37ZVoXbYd9gVOmYKvmKomCDOFheIR1S+qjzVB2qtxqS5q33V65jXaa9zXleAm143dWPZdYruTd1V
3R1vkYa8g8DNZ1w2fkHe1fhd9L7oc883wXeVb5VvvW8Vu1ft+4U+UHfH66Y+kP50d/T5+i36LyRR
Wi1tka5gp5DvV+13xl/09/U/1HOBtLpneUD/gJyA/IDtAWd8q3qJvfxRGn69onrF9SrtdbKXo3da
79an1L1OPjX6qW8CFwZe7LOqz64+DUG9ce9kUE7Q3qAjoDd6ney7sJ+h37Gns/sP7Z/fv5Le7f9B
/9ZeJ59JC9YGW3udDL4UfGfAuAHLBmwfsHdA64CLcoAcKcfKafJSeZO8W24LCQwZGzI/JD9kRcjq
kOqQppDmkGuhAaHhodNDq0IvfS/Su/p7qwaOHFg68PNB4xDn/g38nHOXQi8Nsg4ax2yDtMoP6ZXf
5/QXOn1Q6aDDwLlB39BrmHdYeNj8sE1htbqxLHxaNzbsdK+owcGDDYPPhcvhQ8NH4tccfmtI2JCV
Q44MuTbYMDSqVxTC18JvDU0eumXwuWFjh4QNKxi2dWjU0CiaGrHJw+qheXe/8O5+WDvRN8bp296R
znbhK+cbwl+BvznfEAWgh7Nd9Ab8cF/U73BOkHTOCfAt+rZ6X/a2On3HnL5hTt9Tp2+X03fU6Rvq
9P30eqdJXwFUAu846/TbQD8G/gzcAr4Gbjv36/+Oe/cAp7NOIoDgNEkioEJ5Aexdc/qOOfTUv+78
oX6j00o10e8GvwfYC7wL1AD7gCbgKHAMOOe0Sl7OHzKt+7D3pTv1NTF96Xvi9Si5U0/TQ/Q0QU8T
9DRBTxP0NHXRsxd7R5y+IU7fDB+IVK8DG53V0HUgdDVBVxN0NUFXE3Q1QVcTdDVBVxN0NUHXauhq
gq4DURptEfr2/SSlZaBfO/Rrh37t0K8d+rVDv3bo1w792qFbO3Rrh27t0K0durVDt3aJajVX0Q02
pG/UU1vSt/WDmU1N7G19+q4+fVOfvqdP312n7+jTt+np+/n0fXr6bv4CWKnYeUG/FFgJST9yPqP/
N+AnaDla158h7g1go7NB/xboZmAH+CrQh9V/P+41AL8BGoHfAocAT7scR/gT4ATwKdAK2IA2wA6c
g4wroB3AVdRYsWGDtMh5QTIBuUAesBjIB5YABYAZKAReBixAEWAFUEcJdZRKgGXAcmAF8AqwEnjX
+Yz0a3hpA/AboJF9oYF+sUCxroF9qyCYxsK69KsA9EsF9DsF9CsF1KrUovA7WNAEC5rcFtzoPAOL
bXxMbznDa7oRGpke0CiEfTWAfvmAfjeAfvUgmH4xAnfoVw/imDbt7EsHc1lvvQ5t6qBNHbS5Dm3q
oEkzNKmDJnXQpA6a1EGTOmhSB03qoEkdNKmDFnXQohla1EGL69DiOrS4Di2uk++7ewX9agLtGfSL
CcHOVzxsY+AeZ2BfSqDfSaBfSZjHvK0B3tYEzQzQzMC9rAJeVsF61lugm4Edzjx4WYW+Gni4p1XA
0yrgaRXwtAp4WgU8reI+T6uAp1XA0yrgaRXwtAp4WgU8rQKeVkF7KDytAp5WAU+r4PbPk3qAXwSP
MwG5QB6wGMgHlgAFgBkoBF4GLM4meFsTvK0J3tYEb2uCtzXB25rgbU3wtiZ4WxO8rQlWNWDfFc++
8TAIe28/5mNvsK9EiOxrEPRbEKI73v87j7gq6RlnizQYGOpsIb1h9TxYewKsrIV182DdPFg3D9bN
g3XzYN08WDEPVsyDFfNgpQmwTB4so5W8QfVAbyAUmOgsI0+Rg+ip/+xSVWx0Z9/CAKY88R3uOxrx
WWe6OA5IAL7vbBTTnI1dvITOd+nwkvRuvOT++S4dXpIOL0lnq4Em1KDpgbK+/dzp951mt9gns9JD
ZqVeGBUGYFQYINwhVVjXGbCuM2BdZxD7OXeJg8lc9CQDepJB6onxuzdoEGgIEAp+EJkvhYEPB4aQ
+cQXJbSjhHaUQFeFh7AqPIQS7CjBjtx2jBuHkNOOseMQxo5DpAdyHPVIeRQpjyLlUaQ66k6lFkY7
vxT7Oz8TBzpPiOucXxJvYbjzS2EEMAoYg7v+QB9ABkKBMGAYUurRxtWsPXeD7gH2Au8CNcA+oAk4
Chxjq6tq2gbkqf+Wuc6HjWmPMZbRcYz0FCKcduFZ2EfjtGOdbYKdTLCTSQyEdTFXwxrtaBc72sQu
9Yf3PAMEw25hzMIm2M5EdNS6j2wDGXLKIKcMNo2FPWNhz1j4w260jQmtaUJrmqBDmah3VooB4Hs5
68Qg0H6gT4NCLuweC3/JFIc4YyHNBGkm6FYGiSboVwa9yuA3lZBsgt8kQ8cy+E0l/CYZI5C3swU1
a+kyr/RiuwfsEP4pdpBoabQkXsrrrlL+Yc4A5PoI8t+AfS7D5y7DRpdho8so6SP43WX43WWxLzAA
kIEwYAgwzHkZpX+E0j9CiR89oIPpsXVw9Sz7Y/csb76uuos11V3PlnS3Dm2ZULoyQO+qRK+qJBF8
F8BGBKzDBmAdNgD6tqP27aj9AGEkMAoYw0aMxvs8pB0e0g6LDBCRX+ztTEQLJcJT8pinPAMajB2j
jHvfcyaj1d4QByFuMGkUw5FuCOKHOhM9vKede087PKedew4dcdrhOe1sxBnsrqW/M5bWlK8e33iI
T9+vcVefDgTfvV8v/7/yawnSa+ExtdCgFhrUwja18JTPUGotvKQWpdbCS2pR8hqUvAalrkFJa7A2
R73+5f0yAJJLoH8dpJfAS3ZDgxLUoQTS2mGt3ZDWjvpUQmI7JNLeuBsSS1C3EkgsQd1K4Fm7iUBH
b6J/oAd113tCu/Yglus8cp1HrvPIRT3sPFKfR+rzSN0CbzqFHOeR4zw86BRynWczxAnkOoFcJ5Dr
BHKdgKwTyHkCOU8g5wnkOEFU7tmFziw+D83nyhOm5IOUE0SUJjtt0mynjfih32jRb7TkV84Sshuo
xZ3hsCZshvVnifQCQFMbQKchfjqAnNJcrLZ6ShHOi0htQ2qb9Bz48ZgzJoJ/AZjs7EAuG3LZkMsm
zcD9BNxPdH4oJYOmOq+hpA5oMxMpk8ENwLiZjjLHsDJH8nLHsrLHSBNAJwHPA5FcRhQQDUxlGtqk
GCCWy4wD4t2yx0hJoN8HUoA0YBYwh9WkSpoHW1DpJf8y6b5SBOkDyR3Sc6DjybPMftOA6cAMxCUg
biZWWqmg1G4+SN0IHRt5OzXydmpErkbkakTqRt5WNjIatSsTo4hBjHZ2iDHkWREaivHgZ4DSNfRM
Z7WYiHX098FDM3E+6SPmgy5BmgLwJZAbgfZRrNMhjSEGWAf6Im48ViATwE8CngcigRdwPwqU1gMy
YSX4A+JiQGNZ3aiVOmClDm6ldPhHNSzVAUt1wFIdsFQHLNVB6wtrdcBSHSRIRDuwWsQx7TugfRW0
b4H2HSLsjBpU0d0AatEhIodoBJZAQgRszSwMOh7zdRcLIy4BcdSyIZDQKKJ1xclMUqMYw6Q1Qloj
pJVAWiOzVRJspkgrg6RGcSHS5QD54KndzMDL4JdDQoTz51z6zyG90UPyzyG5kfWCRNQ/mbVYBwnr
rm9CsxJoVgKtbNCqTIxFveNAoT/TYD74BcBCpHkJyARvBHKARYAJcXmgS0CLQZcCy4Dl8KHH7ffe
4kz4QyKzdIOYAZ8yIbwE/jGe+Wkf1MWGejQQNdNzMfMCZcQJ5C1nU1oO+WbCF9MA6m8vYfQ0sdbq
+Nb9oTdvJZdP2NBKHcwn0O+oH3zrFujZxcuUOjd8a700TIcfMAv1cY91PlyzDqXeALXhYiUVfKYD
/a0z9dPM510eSesJC8P7qnjdbGhvG/NzM6vn75mGY+DTz4FXRuQq6UWs7JRRucqj7r9HnatYnWkv
o2PFRKxNfoR1yY+wLrFhXWKD95W5PQ8leHifR1uyXmjjvbCKaTWf9Yl0tGs12rVaLEHcclg6wulg
GrJxBB6mjCMOtIrtwXEE96O4B7nHEcR1jiMdHuMIrZEDrWl7yDhic48jstumbESEpq7awBdYD09C
DZWThQY2ltCWSoenvsxs/N1nvsHuZwC/clbDxtW8h9Oxp1GcDGmKZjZoVcXGG8WmVejh1bBpGXp3
tZgNGBGXw2ycLuaC0h6+mPXyMnhEtVgEFANLgWXAcvTm4Wh1OnsoM0cHnzmqoHEV024UvOAGvOCG
2wsULaugZQf3hiruCY1sdExkY67ijz8A6Dj0Q6RRPKBETMf9DKZ1lZgFPhvUiPgc0EUAHZtyQfOA
xeDNoIWABSgClgHKOPX4854/b+VGpmUCpM9095oGSKe+eJmV9hzoeNSdlkhLm4EwfJr4sjq6Rn+l
jg18lLIxXSaztlZk0zFOy7xofjfjoZb5UHcjpUxXH3QE/5etQCLo6stjnGnk3teAfmHjvZz2jTF8
3Enn82vVv0zjp5V+gjnD1YOToK0yGjaip/ah7cvm4+X/hFGxP++Z1XwMrvKYa8q4TehoV8V743eX
qEZv6XCvwV6m63X0/hYm4yXEpAMZbNyn8tg8S31SLGDzQCNbeViBEmYB2hfm05kIoOuUzhLoCqmF
2Yl69WK3TKWkl1G6VVnDYH/O1yQoycb1sPESbMhNdbCxlCLy2OgcRnpwiTYPfRs9Vkg2qifq+gOP
uc9KnsUM6cr3klvLTg3ZqpSvriAJaxL0N5TxLJtLM2jbe8yp+bxsqo/IYqk1VUwCLRn3iM5DR6U+
LsubufVpihZ+t+H+u6zWauZ1ps4ZnFmMjfHM9tQvmd2xZlIsxmuDlP5IOQYpx5DdyD+frxk6c/Rh
OZRWuowxUslJbaC0bwfxclvMU3uXbj3cre+yZ2dru2xJfe6+u7DSSzy0hFkvHz3/ZaxGFXsxa7va
n+8YzG59XBZ1ae66SyWJ7vp6uVe6nTNNOmaadDofkh7s1PQfnZhqSKSzmTQAHc5mwQZ8CV5Hxjsv
4E4T7jThTpMwwHlBCAFs4L9EXCA7r9M4TcQb0DvzSB39Bjl7wl/azfOmUv0t4GvgNvCo503+7tl9
j/MZ/evON/Q7nGv0u0H3AHuBd4EaYB/QBBwFjjnfkLwAnXMNeYo9+9FAP2+gjp0rfvcn+v7up/l7
7t2BXiuh1yrotRJ6rYReK6HXSui1EnqthF4roddK6LUSeq2EXqvcJ26dz91RQ/Ie+Fr2twylHk8n
KjyeTqzhTydKIakUkkohqRSSSiGp9BFPJ0qhQSk0KH2MpxMV9z2dKOWW9HyOvQfo1JY+n77Anpc9
3vPpC65nXKzUzmfRaFWU2o5S29nZu1Jqw+Ocv/NS69gpfuADz5bRTijZgJIN30lfP/hSA3ypAb7U
AF9qgC81w5ea4UdW+JEVftQMP2qGHzXDj5rgN1b4jRV+Y6V/Hd3VE5WTYXff4f2m21Nh2dnc5WTY
y31eu8c5wP20hj6pCUU9vR55Rqzqcjrt5TothpXuPnBK7HufnIef0fLzWXoi5nEuizJh+VhYvvtz
SNcZJD9/JNqHPg2iNa6AJhXQpAKpmpGKPpuiz6Sa3X9l88CJ8D/UILgbLXqgTZrQJk1okya0SRNW
IglYgSRgfduMlUYC1rXN/HzBHyMsHXn3AO+BV87/DmIt1yKNdm7E2uU41nMtWMu1sPX2JNDngUjg
BdyLYucodE3XgjVdC9Y0x7Gma8GargVrm4NY07VgTdeCNc5BrHWbsKZrwZquBWu6FqzpWrCma+G7
shZ6toB1XQvxh75nPXZXZ9lufaLzq4fsrs6y3XsiJKRi362cKWLcR+wFIkijSDl2WhrMWN5AHaCc
8yV0s2alFmpg69aJD1m7vghJj7d+pVZu6LKGTXXm3beObWTr2O7aawq0mQJtzqCkKSjpjPuE0MZP
Hvrwkwcuz72f6Dx5eIrt4PzpSYbHLm4P+PcQh10c272MgKVGQ+YY7JuVHZWD76gc3e6o6Ht2ZdC2
DNqW0VNF96kgPRF0nQbS07/J/MSvs6WUEz6qm/djn8b1Rspf8T0fbaNfIXUHNL3I2uRF5hF3uEco
2s5AmgSk8TzPSWXnV3fY+ZX6gd1XAGRs42t1KmMbO4mYyHbHLhkur3NpuI2dMtA1eyos6Fqzhz1w
drLn3o9Q+lWP847j/Lzj6kPOO453c95x/BHnHVcf67xD4jO2zWPGdvV3ehJwGZJd+5LLXU4CfNHi
Z9DiZ9DiZ9DiZ1CfMr5nLrtvz1zG9syabvfFvl1GHLd9PEaeCBKJ/roOHh4Jj47EGrGY/gUMIezL
oQL994QQN5D+i0JkCH5q9s0SDRmDn5Y8h58XGY+fjr150wMlRBIf+m/SQPYs/PRkHpkPSyzAz59k
kix48zv49SJ7ybso+wB+geQgqcdKtwG/vqQJv37kGH5Pk0/w60++wO8Z0oFfMPkjfgMEURCJLKgF
NQkR9IKehAp+gh/5ntBT6EkGCn2FvmSQ8LTwNAkTBggDyGAhRAgh4cIw4VkyRBghjCARwmhhDHlW
KBfKyQjh18KvyUjhY+FjMko4Lhwno4UWoYWMEWyCjYwVHIKDPCf8Xvg9GSf8QfgDGS+cF86TCcKX
wpdkovCfwn+SScJXwlfkeeFr4S8kUvir8FfyovA34W9kskhEgUSLGlFDpopeojf2IL6insSJfqIf
mS72EfuQGWJfsS9JEJ8W+5OZ4gAxhCSJA8WBJEUME8NIqjhEHELSxGFiBJklDhdHkDniKHEUmSeO
FZ8j88Xx2HctELPFHPJT0YTdwFoxTywkPxOLxCKyUVwqLiP/IZaKpaRcXCOuIW+J68R1ZJO+WL+U
bNa/rn+dvK1fr19PKvRv6t8kv9Bv0m8ilfot+i3kHX2FvoJs1Vfq3yHb9PiRHfqd+p2kSr9bv4/s
1H+sP0b26L/Qf0n26f+o/xM5oP+z/jap1/9dUpEGyUvyIh9J3pI3OSL5SnrysdRT6kmOSr2k3uSY
FCQFkU+kflI/ckLqLwWTTyVZCiW/k8KkcHJaGiqNIDZpFHzyM2kMRo2z0kRpMvmDNFWaStBHpGnk
ihQvJRH0Ooy6N6RZ0hxyU5onzSNfS4ukleQ2EXz7+66j7xcKFvge+SwSmEKEz74BjQMSiXBWBE0D
5nNKke7B5xBy+iRoPmABliGPDnQVsJpjLacbOMqBCg7Kb0ceySNcToSaQIWe7Q26CzJo2TVAHdCA
+H6ghwnZN0XB6fkMwllZiadh1IXqcz+ofoqOxwCqeytwBnFhQAQhVDYgcMr4vXUK/9k5pBkNerH7
dPeFXXlI+xZCLm8Rd7f1d9xsC3XcOXW4LY/hRls1xekJbY7TUYCp7RbDWfsUitYA+7nWICDfns4w
DjzFKvCAbbdjt22/Y/+p/LbwU5a24aeWga5qG25LdlRRnFrdNvbU2rZJtkqkq0K6q21rGFYj3Vqk
P9yWwnCjbT1F621HQes3DuupY21zGW4jLcVJ8BTfgAc89P2coTN8gcEAnqIAPMU6u5ZhI0cj6kdx
hOOmfT7DHXs6kOMO30P4nj2nJdw+n2G4fRmDKzwWPMVk+9pHIta+oSXBXt7ymj29ZQ2QgvBchNeD
fxP4wL6L4VDbmpYme03LLXsrw6cIn7bXtPrazzDkwO4U2x0RDLtwj6LBMYHhmGM6Q6tjNsVpEbYC
bKJjhU3nsNokx6u23o5S22y0DwVvP9B60Ea0wZsMh2HrG5DtAD6HPnftrac2oM3K0WYVoNtBV7dN
RhvGutrStgDlUWRy1KPsRrR5K8oCTuugC3DqDMLAaQlhALIWMtxo28JwrC2b4XbbVgZX+t5I39sj
vyt8uK2Q4UbbXorT09HuFFa0O0UyeIoV4CncvvJBJXzliofvXGeYDX52d+nfD2LYZPdlWGcP4Ahi
2GQPZqiEf1UyfxvIUAWeYrd9KMN++0iGT+B3FM0cjfY4jkSONA4l3IY0FF9wcB9tUdvzKTx82MLg
uu9ttzB0+vAqBld4Evx3kocPL4RvZsM3t8Avt3r4JoXDXgd/qHOHL4C/4BG+An+5An/pTN+A9Ifd
4eu4fx3+SuytDFqOcofMUOEIY3CNOy5/D4bvU1jAUwwET7EMPIWv/SJDjv0bBjpGRXaOU61TwMcB
q8GvZuPYVdy/2rrKIeL+SYRvIHwDYR0gudKf2mBPp3D3txroTuEK14Gv6zY8mmGXvYGh1bGAAn1x
PUXrGfRPinMcrY5MCtzbStF6EXGAxzh2l8IW5lhni0A/Hu3YaJsARAGuvuyCiaOAw8qxguNVjlIO
OgYccRyxfQLa7Nh/ul/bmxS2dbhH0eb4BGNDM2gbo9ccl2w3Hddsd0DvOa55+Fk+Q+fYuJohz77h
tIGNdRUY67ZjnIqyGRybbNMdla1DYeeR9nOn69E/KHhfsPXDOCVjnOIU/Xspw422WoaTmDMovsG8
QdE5n33AcAw8xW3wFOfaVlLAtocokPY1hhttTQwXMaYAqPcahgWwOcWr6P+veo4BaAeKTfZxDOvs
kQyu+aTTFulATksh+tJS1L0a4f8i72ug4szKNG99kOI3QCOTjjRGxBiZiCyDmEGMESODyGAGmTRi
RJrJxFhhoGSySKrqq44MFAWybJnlIJNmMwymfqkq6g9ODg1VnHRCM2kWaaRpmomIEZHhMBmGEyOb
jRnc5976vqKoTmzdszu752zf89z3/e53f9773ve+94f0V3ZAHTK3xLnmCZlrC29PYt5MBz3fxPPo
3Cno6zQgzgNBf3Md4CkS397GvNmeO7+QBCTP3cSaQDGNNYFidKGAYXKhlGFuQUYh6mVuA3YHzKZC
B8DcFp6B2SN4BkLXndk19HlN8EvzQf1PQF8SsI4G9PY2YQj1pWL+A8gPzN5HHRRnkYdCC90Db1qw
xjjmS94cBh2dL4EtWt+6C1vNmJ+iYM/38JyN52z2fPettYV7GNtZire6YMcUV/2YD19Ym49euD+f
AHoANrw7vusMolwpkAsIPKfhGZg7A99TDVDfcIXug94pfMv1TsmbW++UUQTGSXjvH5d3KuZqMS61
C8nv5C9Y38ljc22K4p0cPGdirdyen6J4Jx3PaXh+gmeKwD5pcY5i1z4XFynetd8I+GP4ZoqHi6sM
U+Bn3x4OHcfFjoVchisLxRRv3VjcwtrtfXMD7QHi8yyHtim8i8sUos9Z1CxuUGAOlTEI5WY71/Io
fpS+VsGQuVZFEbqvXMtfK2QoefskBf0SA/t2EGFfDYpk3wuKYl/1iWPf80lgX/JJYt/weYF9vedD
7Ls9H2bfzDnCvniTyb5jk8O+V3Ocfanmc/Gz8W+Tk/FL8RukiH2R5ivsKzQVrL1/5bbQ3gfD0ggX
9tGwY0Qa9jdhD8mBfen7MkjHvuPST5PvSU9IPy/5nrRS+k3J96UXpBckP5D+lbRWcl16UfofJYYY
d8yIxBTLxX5L4oj7afxBLoV+JYcrjzfFv8nJE2QJf8VdTahLUNGvJEmuSB6zs08HeYmQ6XygkEh+
iOP8dAlQBl4KWgFUCZTiXBBfQ8iMFrQeaATUKINuTzcD7QJ0Au0WgHPAdL8AyptQJjHouZdIfpDs
pz88CGon5Dat2wOMAONIPwQ6Qcj1Qj9uVzFIfnjYn06f0RcqTyiofH4Zp4BZYAFYQtpRIIsQ2jYg
ESjj/34kwIvvGGau+tOmV1D2GOj608uHPItlyEyf//0P435Ib06e+z9kbxvkJLO0rzNLo/9/vSQm
in0fKBHIE77Pkk+/USLNkX6SkLhfxW0TLu5/xD0m4fGfiM8h0vg/js8lkfGfjj9Ooml5+j0roXyj
UP5z9Ldbwz4JqyVh3w3rgAX/a9gDEr6vaN8XSaQ0G/VGS/NgwXGw4M+SBNZGImsjKe7f4nbIAVhq
OjnI2ktm7aWw9g7F34q/TVLjJ+P/gaQJbUvCcsMsu+f2N3C2fqODSKYKQHG+fgPn5qliUJyn37gu
UApLEI+z9Gs4W7+Bc+0bo8BNlCkFxZn4jWkBcwJdFIBz7BurAii/gTLlQc84G/dV+elUJShm801a
9zbwhJApDulnQXH2/vsOP25eZ5BMyfzp9Bl9ofKEgsrHZJyKAyD7FOxoKhVpcqCBENo2IBEo4689
8fNTONtPqUAznp4v5FksQ/4b7PSdFfJhUkTKSTWpIQ3kMmknXeQaMREXGSUTZIYskhVyn2xjcKIl
SZJDknRJtqRAUi6pltRIFJJmSaekR9IvsUqGSZivczzN1zWe7rs6nkk4X6xv1Jfouwkuzuf1Rfpu
Ec77yGfyRfvs4B77LD7ic4Bb9XV5n/is4NZ83d4HPhO4Wd9l77pPA27O1+Rd9mnBeX013ru+enDj
vlrvgu8iOIuv3HvTpwJn9VV4b/ga2duTXruvCNyor8B73VcM7oYv03vVlwPO48vy6nzHwDl8yV6N
L5WVTfGqfPDMXpNP6q33xYK77ov0nvfFgSvwpXkrfengCn2HvWVezBzvsK8YOUpZ+w5fAVIsSHEg
ZRgpo75K5I71jnoPe9F/b5zX60323iJh3l4f8fajjUbWRoH3rrfYe4/W7F3y5nv7wWV5J8eWvNPg
cr0zY3PeTsJNXpysnlR40bdJ2eTZSflkJdrL9t7xlnpv3JlH3Rmo+99/TYti39Yj7Kt6/u/XRbFv
xz3Pvvz2fvZttxfi3x+fgtlOv9uWyr7PlhbwLsmCdzlJv/YTdyuBfQ2K++/7v4L1a5K7SL//IjlG
MNdfbwKwFr3eCXQB8M2v9wmUwhDEWwnxJYC6gBuAF7gF3BEwI9B5AXeBewIovxbEi7hPiJfW9QCA
hl/fIWQynJD/qvXD2+cHTaOUyep9NyajAcg2eQBIIaT3zF68HrcL+jyZBqS/O18waJ5/gH96a5l8
YXR5dBXYGN0a3R59MsaNRY7FjSWNJY+ljh0ZyxjLHssdOzFWMFY8VtpbPlY+Vjl2FkE2Jh9r6M3o
Le9NHVONqf6ur7cYfO5Y05i29+xYJ+O6xq6O9Y0ZEKy3L9/W3O64feX2xu0thO3bTya4iciJuImk
21sTyUJIncSZFBaSAouEzriH3K/oyMI6w5l1Spl1RjDrjIV1fgo2+umAjT4HG/0yOSj9c1hqCrPU
D0jPSM+QD8JS7SQ1xgF7/UjMr2P+jXw05jew2qOw2kqSAav9CMmGvf6IHIt/K36e5MYvxC+SPNju
T8hn4n8a/zPy2fifx6/Cmv8J1lzArLmIWfMXIesL/5dlpVLmMSmPMyk/y6T8HJPyT5iU2MHBO9Nv
8cSSs+QPsBeCbdzOBHIArPV/exIUe73bdN9UIqRTlAEV/vffv+enIuh+Kug58dXaVy/qc15VvHr5
Vc2rHa9eebXn1Wuvlb1W8drKa+uvbSKsv7bO9jO/5H4JbW1z21i18/blEU5aJi0jYfApXyXh0q/B
s+yLGYwZJNKYnZgdErH/6/AskfFH4FmimWeJiZ+LnyOx8W/Dv+yP/8f4H5O4+OX4ZfJc/Er8CkmM
/0X8GqG/N5/wv7kl2kYcayOetZFAJIkP31cBrxQrGSe1hPRgFvdgpvZgpvYcIJwTu4QezNYezLQe
aLwnU3iGZnug9Z584blQQImQB1rvqQhA0oOVy4lZ8f0+0EVGSU8V+GXw3iC4kLYKbPhB05xbwLa/
PMMTP1ycP78rEsBa5cJe05UcyL8rE3b2PdjRQwbS08jqoDKzMkK7pAe76J5mlo9zpQpp7f8LwKmg
pzsI2Pn39DN9cN+/j7qPBEB6TP40gPTYmWxMPvbseSb870co5ZZ1NSadQ6U/YChyNOkaLVqHVp+i
X3J06tMsnY4ufYqlC2/TkXJVn4m4T59jueow6PP0hQ4rS+nS51v6HC59ocXguKHPtFiRh+b3omyn
45a+BPwdVtuMPg2t3NIfAD+PnC7kTLPccNzVtZtrHff0Zci5xlLu6yssXkeTvspyy/FAfw71P9DX
GI4hrkcNj3Qmyx3Hjr7R6HWG62ssM85ovRp5HumbTTnOBH074gN6HUvpNo86U/S9lnlnmr7fchcp
JsQPUMM9lKqxrDnT9XbLfWeCbsLywJmp91geOXOQfg85Ryw7zjz9OMrmg78HfmQg3FmoGxmIdpbo
JwYSHHcRH4D80JuzTD81kAJtzA6koV8LA+nQwOxAJvhzA2rai6BYPdDMeMSGQywFvXM2Ir0d/XpX
bDg8oHPmGI4OdKO/OQO9TjXifodBtzBgcjwyZA3YUc8zYr1uwONspjHLiVhfz2I1yu7olwZynBX6
9IE8h9dwbGDE2W44PmBy6vSF1kVXln5lIB99XB8oRLwwUII8RQMTTpPh1MCU0244iZzdunMDs45b
r2gHypBnk2nAX+rhQIqzSkh5PFDhPGcgiGsM0oEqxLED55z1hkRWZ3B8cKDG0Ye4nsWUP22+CXtT
m3ROj75d3+gcMZwZWHCsGaoHlpx5hvNoRYcetTvHmb110n45ezEWjY77fgn1KQPjsDqa3m+oHVhx
3IDe1p0TkGcTOqyxdDqndCPQ/6zh4sBD54LOM/AY2lNQ3nCZ8joP8izpp6wE9omxc3oMGqvUuWLo
gD2sG65A8k5DD6y3ic2dLsM1a6xz09BhTcTb69aDji606HEuGSzWQyjrsB52phiGrUfRo2ZdDeUt
feC7DdXgD0Kffcjf7njwipfyhlFrFuS5aT0Gi1Jbj2NMpwZmIdth60nnQ2ib8pOwisfgU1xEt2Qt
co4bpi1al9QwZz3lijUsYhSawJ92JRqWWZ2r1jOwK8brddZqWAIte9CwYT0PTfr5LcrrGq216N22
9aLrkOGJVQFNwh5cxMjRHhkjUYMWUmWBj7NeDvBJVg3Gndr5juEg5WF74I3JlDemMv4IenTDmDHg
cR02ZqMeNi6uw/p0a4frqDHXegbpJ6iExgLrFccjY7G1A9KqrT3gS80bznPGcus1h8EgtV53GIzl
A72MtzAes8NYaaiGDTebylzHjGetDtdxo8w67DpplKP+Ir1a1+06ZWyAJ3lEPZhzneU8TVtxndH3
W0ddhzGvb8Br9Vt2INUCJPEaOTYWiQJ/0/HAqNIvuYqMTaZCVzVmAaxdtzSgdp3X51N7gM4nnTlG
raDnm5C808+z+egfCzpPHxm7aLu6fss99PqqddppN/ZZ59B3A/KoMKY3XbWGw6YVZ4rxqj3Pcc9o
tec788EXMr6E8bvpBlux45bhJCSvhT6XYTkm6yosJ9OmQo9MGMcdU79J53aZTJZb7huvaOkqYLLb
y9xeo9fW4L5Ffaz7jn7T1uDoMnnsFbAQxusWqO81jdir3DOmcfs5Z4ppwlTmnof2Stx3qed330PZ
u+41QyL4+yhb4+w1TVlcbnjdgXD3I6MWnn8G6fWwAZW1w71jmrU3OhuNBmhbZVqw14s85m+4s/EV
rX0WVu0ZaHYtot0FtFtjX3I+NCTaV+AxsqgfMyzb19EvHeVhsRuYxWiL+k/rFqzRCsu5anRhbeo0
VFu3HS6jy/rE0Wm8YeOgea8t0lllvGWLc2iNd2xJ0FKKLdJF9Om2ZNikzpYKr3IAOXfoquG6qKux
HWEpGa6DyJntUhhnbLmwZJfthOuycd5W4NJQT+XqMN41Z8EO72Es1owZtlK6Qhm2IXm1cd51xbhm
K0fOTGuHc8F43zLj6kGLlRipQttZWNcDmwwrXaNNjjl1wFYKq1DZGlzX9GV0VdWNYLXKMz4Cv2bc
MQy7Thnm9DWu67BkK7xQoz7TZaG8y4HWk6GNessN17Ap3NbkGjVk2VSum9CG1jWJtSzcNQ3PqXXN
wWPAE+p1VE5TiX1z6DD6OzN01HzG/nAoy1xtfzx0zHx+kAwdN9cOSodOmi8Oxg4VmRX6Qne2+fJg
4tAps2bw4NBpc8fgoaEzOpPN69gxXxk8PFRt7hkYGToPO6zFDgHrNfpyZPAo+Ho6301LGLsu87XB
LM85fbpJ7TpK7ce1YUgcPOY6SscX/JXB40O1et3gSczE7sGioYvm64OnIJUFUinMDkh12TxsXxF9
iE43eNq5QFeEIY3hin3dWYV0rLampcEzsKtq+PDeV7SUp3bl7EX91VitmP0YDYxn66NpBKuV2lgO
ezsn8gM694xRS23PmDF4nnoDyuvV4HdQT61jxjw6eHGoQ79JeX3j4EVngjF5UCHap1G7y+vzB6uH
rhjmjHeGevT1Jp3rlPmm7f7QNdND6+Wh6+bJwcuwAZ1+yblpnjYUOXWmRszTHTp2QxY6dkMOOjv8
vXAtGr0WraeXzlyqPWF22DEKc4Ma2MwSetpovG9VuBb1NTata9kUjbFYxn5sBj1NgCWs6vox45ZM
2A26NvRq2C1s3tbJ4i7kSbFddW2ZEhBvs/zbpjTETwynbX1uDvkjMTomm4HGmH0PTOmWGXekbtZm
dcxTW0I6a4vG7jh9s34E3iPTVBKIc/QH3En+WN9uqHYnw/Jdrh5Tnu2GO5XFR1icwebLKSb/Kb+l
YV83gxbzbbccN0yFtjvUP1PLNJXYZty5pjJ9CuIS4wP3Cb3dNu8uYHEyjZ0Jpgrduuu4voZ6DB18
I7z3iO2uuxiSpLlLTVX6THe56RxmNOaU7Z670lRjqnKf1XsQV0KTBozRum0N+qTaOG9Ks91HDeO2
B8580wHM9PNYZWZc5+l4OWdp7Jbpa6wKt5z6YbfcVIU8x40ZdGQhZzok6UfrDf5dGWp7JMijMtXb
dtBT7E7dTaZGXSNaR7qr1pRiD3drdQu2YsymMl2767ghC6vkjkltj3Z36pfsCe4uU7P9gPsqvNOO
S2Nqt6dAezp7mrsPcbrboE+3Z8JLNNpzHDOGalupc9zUbSt1W+ka4QnX2S23PNGmJey95+El+lDz
iqEIa8e6pc+ToM83FHkO0B24J+UVLVY9lTEDb610P+9Jo7wnnfGZhizK0xXTk6NbQJ4Gmu7c1OvA
y6ln8+RhHO94oimPdMYbrtAziGmT7vYNibZiTz729jNuuWEZbc0YLFQeOkc8haZGyFBiekjTTY8D
6WUsvYLxVZR3NxgrLVdd1fS8AEvYRP5bZoI854xerFk7tC9Yp8B7ahh/AxaLGvTN5lH3XbMUfL05
VlfjaWTp9TTdo2Z8M8tTYE60lXvazQftame7OdHezPh2J411Hp35kL3bozM9xPyaoeupsxerTLGn
GzuNO+41xhcy/g7jexnfoF+x92JNH4Zv7AnmjQbsQIj5MLVkoxwy95uP2uY9JsaXMd6O/P3wsVmG
Yx6Prsbe78k0HwM/QtM94+bjxnmP5138BMs/Bf9swrhjBfbM6vPtJs+CPkdn9ywF8SuMX6e8Oxky
R3o2YaU77jjGV1Ge+mSR9zyk+xMXMWzBeqexrhW7d8wnbXc9j41X6UkQexi7M1/Xba4dIvpxu31I
iv2AleY3nMIY7eXZPsFwytkIO+mkex7DKbaidQ7FmmYNp4YSKe9ZYPxB3YJx3n3HQOyeoUPmIvuI
M998yj7ubMTOZ8K1aD5tn3ImDKuGm4a1luLBZWeKpWBwebgYM6sU1giPBJvBKdI5RT22M8fUi9l0
1B+bFwc7hobNy4NXhkbNqwP5QzfNG4M9Q5PmrcFrQ9P+M7J5eyBlaI6eNIcW6SlyaNn8ZPA6dgX+
Ey472wqn2qATq3BWZadUCzdo2XtW9Z9GLZGDjqFVS9zg8NCGJWlwdGjLkjx4c2jbkjo4OfTEcmRw
EqVYPZaMwWnHA0v24NwwR9sdjqTton60OxwnnKZxdkaMs/NwEpVkOJn1OnpXkuFUfy/8HpKelIeP
0DPy8BF/v+jJHTWz8zX1S6zsHWc/XUGGM+gKMpxNU4Zz6RwcTrXkGo4NnxBqq2FynhhcHC6wlA6u
urX+2wn/jYGl3KQbLtWnYZ/TZakc3BguF+4i2KnfcnZwa7jSIhvcHj4r3DkwvQm3Cuz8bmlyJA03
CLcW/vsBP++/r0ApT5lFPvjEfcfS4OA8dkuuI3JYZlE54obl4+vGJtd1eq/GfgmFBP0SCsd+CSU8
8mRkBdnHfv0khf36yYfYr58cjmyMVJP/EPmdyP9EjrFfNvk8+2WT0pg/jMkip2M2Yu6TSvb7Ly+x
X3v5S7TxCXKYfIYQUkC+TpLJWfI3JId8F+E0uUL+C3mR9JMfkK8QE8JXiZ24yBnyKhklL5FJ8jb5
C3KP/IL8Nfkncp9cItvkN+RlCSc5StokHZJO4pL0SN4mQ5KfSFbJL8NrwuvIr8MN4Wbym3Bv+GuS
sPDp8LckUeHr4f8seS58e1+Y5A/2Hd73EcmHpR1Sr+Qj0pvS1yQV0tvS25Iz0jvSH0m+Jn0nQir5
RkRUxPOS70d8IOKQxBDxoYjvSExR34nScvuivhvVxe2P+tuoXu75qL+LsnMvRDmjpriPRb0VdZf7
QtRPora5P4v6dXQSdyEmKiaKa4mJi4nnNDGJMc9z2pifxqxznbH1sX1cT+yv9nPc6/tf2P8C99b+
D+z/MDe//+j+o9yP9398/8e5pfhvxX+L+wmRQDs17I6X/cYKXwPUA42AmiTz9Xwjr+ab+XZex3eD
6+X7eRNv5z38CD/OT4BO8bP8Ar/Er/Dr/Cb/kKf/EiCMjTCJ/Hzk5wkXWRxZTMLYX4wyuAxCuFwu
l0i4PC6PcNxnuc+SMO4k93kSzhVxRUTKfYn7EongXuReJJHcV7gzJIp7iXuJ7OfOcn9J4ti/N0/g
6rg68hz3be7bqPMSpyLvY//e/Hlo/TA5KP2R9Efk/ejTIllmPaN//SF8LjnL5/In+AK+mC/ly/lK
/iwv4+V8A6/im3gt38l38Vf5Pt7AW3kXf4P3gt7i7/Az/Dx/l7/Hr/H3+Qf8I35HHa6OVieoD6hT
kLamTlOnqzPVOeo8db66UF2iLlNXoMxuWPMH9YR6igbxGSmzQqhSn1PXqBfU9eoFfl7dqFbjXTO4
drVO3a0eV/eq+/GEzYnaox6hf7eOMEKbB/ZYO/2FvxxSD9vNI0pY/klm7X8KK3eRL8HOXyWnYOVv
kz8jGwilTEdfjvhwxEdIWcRHIz5KXoz4WMTHSHnExyMyyVcisiKyyFcjjkUcI2ci8iLyyNcijkcc
J5URX4goIl+P+FpEJXkpoiqiCrNGwv56S7WcRn9VBTZD+GagHdAB3eQ4P8yP8jf5SX6an+MXES/z
q/wGv8VvI+2JmlNHquPUSepkdSriI0CGOludqz6hLkAoVpeqy9WV6rNqGWK5ukGtQloT0rTqTnUp
7+Cvq7v46wjXwFsQX+c1fAd/he+BjiSRfx35bfZbKNF7tKVEyCFvInyS/BzhGOb+L8gfk3WE3IjS
iFLyqYgXI14keRHnIs6RTxNJ7KP9cezXg47S315pTgPSiaQ1GjQTyAGfABwI+0RzimaHIa01nIHy
6a3RzZmtCew5p/VAc15rCkvPb01rLmxNZ+n0PU0T84nlRL6kNTNQN02nZSloXSJP6xb5stYcBvqe
UtqO+E5ERWseey+Wozxtj1IRVWivSugPbfscaA1kpDS0vqfJFCxbMJ5VNhS0r/Wt+Uwv6tbCQN9F
uags9D3Vj6jXqqegEW0Gg5YTQfsiQpSN6oyWo3U2o01RN2LbwWNI6xD72N5askeP5wRK34v5RUrf
6VrLAroV66a0W5CB8r2tFYz2t1YF9C5SsW36TMdTpKKMVF9ULtoHU+u5d5UX+yZSe2tNs6e1vnmk
tXGPnMF9CZW1KkQPIs0Mko32R9RfqC00BvHBNpsi9EHUH00T6xhvVe9pQ6Rpz+i/2N+0kP6Lz9R+
KC+WQ1uaVH9aKA3kmWhtbp5qbW9JbJ1qOdg6+0y9PI12/47v3yvf79NOo6BfUc+ZIeP122j37rPm
iL/fz6KiXkJ1rcnw6+m9aGDcq55Cg/sRbPuUzrbqAn5jobW7eam1l/EiFX2yOD9XWvsD79ZbTaxd
aveiv95stTc/bPUEdJayaxuMPm4dCfQR+VtI63iLVLPTEts6EZjnQpmWQ60LLYdbl1g9ok2Cthxt
XaF1tGS1rgfsVaSCr2s52fq45VjrJtNhgXZOU6xd1JRqlzXl2lXq1zWV2g2Wdla7pZFpt1k+OXwi
9ZehYwwdarJRf2g65n/LqLaW2X3DbhuBMVdpn9A+BHT9XrbXGDK3Q20q1F+F+iVBR1QmTVMbJ/oQ
jbYtUtPZFqfpaksK6EpsM9Qfi3bztPUpJL3leOtDpmeKIi1pOaWVBq9TLae1sS1ntIkt1dqDe+oS
11mg5bz2UEut9jDjL2qPsjVXhFiPQpvF6GXtsRaN9nhLh/Yk6/8z0HJFW0Qh2l1Lj/YUo9e0p4PX
0pbr2jMtFm118NrT4tCeZ3QYdUCPbHyD1/Y8vx203NRepP1lfZzUKlqmtZdZuTmtJlhfLYvajpZl
7ZWWVW1Py4b2WsuW9nrLttbS8kTr0HDaYU2kdlQTp72pSdJOvssXPm3tE9eUYD/8LBpqX6H1iel0
HWsMsren+f3up9Qv+kRxfyDOE3HOpwTZEs1HbTFXWJ/LdqnmhH+8RRrAe/XzGb52jy0HU3HepIXM
o9D1L8iXsv4E0cC6H+KT9tBnyXsuRJ8h7QXWytB1NZQ2B/m7YCqOieiv8/367qvtuyjON83VtmQ6
DzR9bakaQ9sRTbJ2msHalkER2IeL9Yl1U/lcbdmBOUzbCd4fi/NP3BsL5Zn/xjqhudGWG5j3NB3z
js6/4Po03rYTT917C/VqbrUV7JmHIT5K9EWaO23Fe/ZE9B31iTNtpc0pbeXNaW2Vmvm2s4zPb5M1
57XJm8vaGjR321TsGe+bK9qa2Hu806y1dbF05GFUqIPxOW1aludeWydti57kI/9z5PcIifkj9ku+
/xLzL0SK1I/++9607Asjv2E3Ki+xG5W/kN6U3pZ0s7uUq+wu5Tq7S5ljdyk/Y3cpP4/6TnQSd5Ld
kCyyG5J/ZDckP2Y3JD9jNyT/TG9IwpLpDUlYOr0hCftDekMSlkVvSML+iN6QhGXjbGsg1t17hLpp
UiSPlMfJk+TJ8lT5kbpteYY8W54rP4G4QJ5RNy0vlpfKy+WV8rN1c3VP5DK8kcsb6hZpkKuAproN
xFqETnmX/Kq8r26xtkRukFvlLvmNuuW6ZblXfkt+Rz5Tt8rCRt1W3TYLT2iN7GmVQs4h95O6DXon
EPlVjEtMyClXhXF5mXwH51sHwqfYiTeP/IjM4Uw7j/AZyRuSKXIifDb8LZJP769QUkIq2L/sF/u7
QdIECZ7IOX/PwbG+B3pesNtnxDLaX7lK3oS4AXEGgpbJeA4yPs++60DIEQQJSUfgcKo+SsJIBkI4
+4XVfewXViNwOs8lUZCpgOwnhQhxpAghnhQjJLBfpX+O/WZ9IvkyKSNJsLwKcoA0ICSTRoQXyGWE
FNKE8AEyjXAIfX+LfFASJ4kjH2L/jvjybl8vLYdlX1q+tHpp49LWpe1LTxScIrKuWxGniFQkKZIV
qZc2FEfAZSiy69IU2YpcxQlFgaJYUYq0ckVl3abirEKmkCsa6moUKhrXzdZNKSoVTQotUooVnXjq
Qp1XFX0KA9pZVlgvbbNas1HDbriFevzhjkKG9mdYLUKomxKCR+FCyXlFpVJN6wK/priPmovBbzNs
K24ovCh/BP3ZYK3Q8ECRBGmymdyGS1uKu+D60Nd7kEyO3I8UO8hbSVHngYxJynBl9KWtus1LW8oE
5QHUepbVICIV0gE0vyIDzxnKFFq7Mk2ZDi11QldTDGjND2WmMofWK7ZCaxRBZaBQ5oFGohTFA8UM
DVQTynxlIcZDpSxByQbkK1NWQMIq5TmxNrTPerenbUBZr2zEeHG0t5CSciJo/2lJ5GJy/T7YVsUG
y78Xqti67roaVaLqoOqQ6nCgv0F4WjpNUx3dlTwYNF2VRUfZDyoDbSMg/wZ0WK5sho2VK9thlVdZ
rVuXNpS6Oo+yW9mr7FeaFJzSrvQoR6DRSGanU8pxRapyArmmlLPKBcU95RIbwyrlinKdalK5qXyI
lAa0ijFUPlYRWEeaSqpoovege+9A66L5Ndglpy5ho4kW6J0ohfIx0lT+EvQdvflkthPQpmAFD9Q1
dMR3xxTzLqOuCj30AOPUttT16kZWt1rdrOy/tFqXR2uA9d5iJah+ztZt1kUjpPFH+AyRZyGaz4Zk
ctBc4AT6f66uiga+IPh+uG6Tl0E/0YFb4iZeC93k19XwnSqFolK8MVat0jtj1kIeytzA7GznvbB1
tOG/Q1ausPlEW57n76pIXZpygu8Ub5WVVfwjRSq/Q0dJHa5oYLpYVZSrjqmOq06qihRW9AozUHUK
OK0qUp2Br3mkqg7o65HqvKpWdZH1/gl8kKB3RSSkZFTRoLqs0qg6VFfoLBLTlCWqImWVqodCdU11
XWVRORTJdbMBsLmtfKgaRj77rl8IjMsR+DYKNu9Vo8BN1aTqOrUd1bRqjnkZgadWBMlHVYuqZeWK
alVpV22otlTbqic8F7DwXEWXapqP9M9MPg7e9SpDsd/uFKUqBZ/EJ/OpmNsc0pLqqnTj1Nuq2/k+
dl9Ob+a7FVrmDyvxPk1lUdrVvYpyaEyGPk0pmmDvzBvT8VH3Kx5hvDDy6EWuotx/y470EfU4vbGH
fZ+D1c6qF9RLCqt6Rb2u3lQ/VD9+mdRFvyx9OfblRPUK/M8CRouuHHQs4J1ePvjyIaYTyP1ylt9T
UgtG3Pny4ZePsrXwG1j3jvz/sI9Cb2Wknt2eH0BMzucTCZB0/jjCSYQihKMIpxBOn+85fwah+nz1
Nx5+4+F5+t9phFqEi+cvsjQFwmUEDcIhhA6EK+fpr/lykS9FVqONfeRPyBeg1y+SP8W+4kvYHUjJ
n0N7MdDz18n7iCT2fuw2k4j91eub40RSUwg6AVoS9olvjsikDOMCKD8BTAnPs8CCkL4ErAjpU0La
VEg5kV8XqJi+JGAhiJ8N4jcFLAh0JeidiIfC+9mgusYFKiK4PyIVZQyt72kyBcsWjGeVDQXt62N/
mzIS1HdRrinh/XqIvKEIbX8qCONBEGXbFMotCG2KulkKShfHcGq3jzTs0aNIl4LyixTvZLFBug1+
J8oAKksU6MEgGcZD2h4XxlOkwbLP+qns0FPKT8j29FF2GDgKZO2Vc09fQmUN1UMoDW0zdCyCEWyz
Yh9E/W3u1iE79lvaelr/Q2UIpetB4yC2L6aFUiGP7DhwEugArvwWvfy/QkX9ivRZ4/UeNNDv96Ch
Ohb19F50z/wKpUtPkV+sv0gWmDuyU8BpgT8dlC/IlmVngvJU++tndi/4a9l5oDZIZ8G2Qcf/omzP
PJQpgMuAJkjvoq30ANdkgbkYmJPXBVkssr2+ZkIW8HWyUcDh5y9cBfoAA2CVMb9+wSWk3QC8QtuP
BX8ZOoZiH0LT0daFbH/fgtsQ31+45e/DHh/4XrYW6m9/m796ml+a9ct04c5u+oUZYB64G6SrZ/kh
sa9PW59C0mXDgp4pbgKTsj3rlGwamAMWQ+ra3IVsGVgV+A3/2AQg1rMl0G3gCfrBCf1/Bi5E+iHa
3YU4gSbJ9qylF5KBVNkeP33hiEAzBD1mB/VdBHR1IdffX9rHCyeAAqFc8V59XSgFyoFK4CwgA+RA
A6ACmgAt0Pk72EfwmvLb/PLvam8iFefWs9aeZ9Fg3xg810OpOObPoivPwHu1/16+92n6C50/T1v/
34sG+aKn0t9nfILrfcaa+dT2n0aXgtoP0rt2WBaYbxfu+efBhTXgPtAl4IEfgf2qWF6sm9ryI9nu
HJ6V7d0fi/NP3BsL5an/puvEhZ1dGdjcS/XPv+D6/id73wMW1XXmfc65d8YZQDSISgggIcYSQy2l
FIhB/sy/EAaGCVEKhlhKyfAnhMCEALKuodayrmv8rHEttdS1xFjWWurHUutnTWqstdYaw+Ma6rJ8
rrWstdZaY13LGoPfe353YGZgYhOSbfo8X5/znN99533f8573/L3n3nvu3Bq1KvDa22O3JqjKfxxO
mKPG5qKamVX+a6IhbRzXzPGWrybKp1949GriJvQTT33XLPLW5Xi7+Y4BqROvyeUuqOCg4OnYBfX/
1X17vkkw/KtDKMtirLiTYhfFboo9FPsoHqB4iOJRz+8TFE9RPOP5fdYThz06lyhe9Yk3fHRuMVZC
GZYYKIZq6UvCKUZ6+LFTiAsoJvjEJIppmh8lGRQtWl6IuXeITpZVvLR4eXFZsau4tthd3FK8GqHW
J6wdp9YXbyreWtzpkW+i2FXcXdxDoQ8ojxp1wPNrNWlt8qQ9RGmPUugrPuET5P8zhE3eA2wwGQqZ
aig2FLPZhlbDKjbH8ILhS+xuw5cNX2ZRhr8z/D2Lxu7fWOz+/WTwA8EPsk8HJwYnsuTgy8GX2WdD
joT8hKWE/DTkpyxt+l3T57CHpkdMj2CZf/b8OA/j2k7aA+xBxpZRv1p2dEI84YmnPEfqZ8uo7ywb
9onUtsuoby274YlnPPGWdiwSPrZIt4j6W1GoFsE/5Y2Qhf/J+OCy2mXuCaFlEufO/ACBWiAUe7yZ
Yanhc4xjj7cOe7yDsMd7uqHJsJJFGNYY1lDdrzW0U92vN/wDiw1OCP4Uiwu+FPxbtiDkaMhRFj99
7vS57IHpd0+/my38n7PLW5iOldIcmfPX+GeMgulEgkikE1SSSCI6WZQwPf47PCH0wdAS9klqmZnU
MqaP3dO/lCiYiv+VZ/xt/kem8P8WM1hQaFDoQnYvE6qB6Tj72H38a/xr/Gv8+KJg+Uxb7ZezKlrt
yxX+vbSq/x67D9+8+ASt6k+zeHznIpWdp5DGhik8RCv8X7PF+PLFw/jyRTqt9m+QpRH23yyDvUMh
i71LIRtfxDDhixhmrud6ZuEGbmRWHsyD2SP4RkYOvpHxKL6Rkctn8VnMzmfz2SyPz+VzWT6+muHA
VzMKeDSPZk58O+MxfDujkN/H72OP8/v5/Wwp/wT/BFvGH+APsCK64ljPPofvaBTzDt7BSvg2vo0t
5528kz3Bt/PtrJTv4DvYk7yLd7EVfCffyT7Pd/FdrIx38272Bb6b72blfA/fw77Ie3gPq+B7+V72
FO/lvczF+3gfq+T7+D5Whe90VPMf8h+yGv4qf5U9zX/Ef8Rq+ev8dfYMvt9Rx3/Cf8KexVc86vnP
+M9YA/85/zlz8zf4G+w5/iZ/kzXi6x7P4+seTfi6RzM/w8+wFj7IB9lKfOmjFV/6+Bt86WMVvvTx
t9Mfmf4IWz3970ON7IXxf7KL8PyTnVk+R9TnySu80GOhA8SZqGHBP3R+6w4aVmh03UHDBo2dd9B4
RGrMyJmgEY7/3NMio/4YyFd/nUcDeuuvkxvQX38de0CP/XXyAvgsSCcGmlq58n2kmveTdRz+OuT9
ZJ2CCTpdAXScE3R2BtB5zF+HvJflmkMxSv77HQWpVRiwpidqPS61Qn/xJ7SWQuvMn9BaBq3BP6FV
BJ8bJ9T4HBbr0Z0Drc8FrPOJWsX+WlSOQFolE7TOBNRaPkFrMKDWExPqvhHfK5ozrqe1UGkA7ydr
PRnA+8laKwJ4P1nr8wG8n6xVFsB7OX459S+FYgz6GcP7fJN7xWS98oD9YrLeFwP2jMl6FQH7RgT+
pTcCVAT0ngrY7pP1XAFbfrJeZcC2n6xXFbD1I8Y1uUevOmDLTtarCdi2k/WeDti6k/VqA/inQm9M
U+sHzwTwL5BeXQD/Auk9G8C/QHr1k/zjLInWG+M7Ly0X2IxWQcHQGtoa2RreammNbV3QmtCaVNBF
mNaaIdOJDrJjEN8W36Zrxe+K7xLne+J7TIhe0csU8X3xfaaKo+Io08n7h0wf/H+CD7FppHVMDJNf
IdhByiytTPhE+ZtPiJKv+ETJc7o7G4ZajjZueczVcL7lRPMiR2fDxZZTzckFlxuutJxpXlzY1nCd
jlnuroabLWebbe5ut77lUnOhu8cd1nKjecX4cUze545oudVc4ehzx6wUzfWPdbvnNyU1N43ZeazH
vXCloXmV+4A7cWVo8xqzxZ2yMrx5nfuQO31lZPNG80m3aWVs04g8tlxt3ibTr0xo3uE+6nasTGre
5T7hXroyrXlP/TH38pUZDecdOe6ylZbmFeZYt4uOvY/1uWuf72zeX3DQnbNyQfOWiccx/8aOY/6N
Hcf0xuy91/H91pvD4WYtw815Drc7hMpTPFZfY3yPHzUT62usngLVj1+9vM/6GGufcX998oOdYfem
5+qah8braWvDQMuh5nizwe1emdv8mvuUu2Wls/mIw0T2i5qPj7WT+4x79XO5zf1jfPdZ99qVpc0D
Be3u9S3rn6t6r3oZ80te9YsXxT9S3/+a+BozBh8OPsKCgkeCR9h0kk0TO8SrJDssjrMY8Yb4NfuE
vlnfzHAvnZkxFiwzrsx4m+XhS3vaGi4e47NB7vT3sy2tBmG0fV18nTFjibGEceMKI52VjF80fpEp
xhpjHVONDcYG0r4efJ08uRF8gwV7bMtv+lmw/mTM7eHJnd6JmOu9vHCsEIo8PPmPzC+Kr04pXzk/
bAFuJuyjK5zx2SVrHXNmtjeY3KUNYbmb3FUN3e4qdysdy9xt7nY6ptDvDbmOzHb3ZndHw3x3kXun
lNktuZtkaCijX+3u9lwH6e+W0cdaXUMP2arTbJElsiOteG24G91FDVvd2yn9pszNuQ6kapO/Gsrs
loatDWHucjtW6mLrlNpRrtKWowaf83DkNyccWHN7eYvouJhCsh83gubF+QgxHr7mh8Qd3nbA/Vau
f17/PBMGm8FG7VBibGIqWiAOLXDfjGsz/sDma3ZFIrVkikiHzUYPj1aDIk7+94MPz0D9LlQsFPN9
ufwaE3xE5PjxzjKFDwsmkv24x8iGf9p9pHeGH+SH/bg7mMoPU9hFV3y+/HVMJ68FKWzkW/wkdWRn
E2+kK01fbjHZaeUrKDb68bOIX07Bxkv9+PFkP5fCIooWP0koSRIRwvlCXwm7zvR8jgzsJuFMP5k8
E99kZ/kiP+5hasVhdowN8wg//m7iy7ce9nLmx9/MdDRC+lgHxYt+EnkHfBvCanbST7KC6fEeRRuN
4DZK5yuT/a2Cbffjyf7mpOBXf+hvixHG6s+/v8nx/zXGMP9oY/pXU+qFMuUp4BtazgrNSIpJWYNc
n/fw4pmi9CiLlDo/bhhTlQ4KEUqxL1/cJG2m9CkH/Li0slBqxCVlu7LTj3+C6ZRCpVCcUtqVDX6S
Xirlfn9PxHayPV/s9PdErCPboUqo2DjBk3oaNU3KQsXmx11O54dzokwJVxL9+CamoxXQMZEjbikR
fhIqv1gkziuqH5fKLzpEhDghrvjy+U2y00aBiT4x4Cc5R2PlgnCJBX7c42THyfuFU8z04/eSnTSR
xvdTHPGTdNAo2i5iRKHwKy9voxR63i70YrHI8pO4aKxcplDLL4vYCfnnklcy/0g/bjLlcYAv5geE
X6l5FI3HLgpxFC/7SQRJDHwdzSnD/JKvhMaOnuaJK7yO0hzn/X6yE2waL+SF7BRhO+/hfX7SHhoH
fTyZV/G1fvytlFcU6+RR5Hmtn2QV5SXvt60hTOGFfrIysuZiF3gkT/fj59BoPklngpOUZr6fZBGN
ZjkDJMsZgAeNyzjXVgbMwxk7KwVh1DHjE8Yn6Xz8eSPlaKwwVjC90WV0sWnGamM1MxifNT7LjEa3
8TkWZGyikRmC0ShXJ0HiW+NntWg6qw2wBeKMOM8SxTCd4R7WN+obWSbOc1k4z2XjPGfCeS53yjNA
4BnlDc+84p0jXvGZhb7BuDqoC6frhhC6TpvLeFouIvMcJ0a956h6jgpF4SP3TaebkPaxlKvWMtd6
a1n9AmuKq6Uqy1xljjRXZR+vnu86W5VX0ZZyoqKtorU60RTz1B5XrUnvqjV3mByuq1UrUvpMV1P6
KjeYYlw3qmpcPamtrp7qYVOZ61bVqorW7KGKVlftU/2VBtclj+beSmdlaNW6lD5LEP3aV728MnxC
uo3WpTWHrUsrD5rKKiOrNroOWbe6DtUsoF+xVVtcy7PXVPek9FWXVS5wXapoN12taPfY3GhLsATZ
EkwLTTmVSRNsVlgGSDpQWeoarkwz9VS0P1NX0Z7dVF1Lue9wHTW3u45a9lsGrClVu2wJ5nZbQuXl
anelpYpKm9rmqq28Vt1SmVu13xpm0lvD6i3ZG01lVa9Zw1JLrWHmjuz9qQuqjljdliCr2xZevbqy
qGqjuarmsLmq8mD2TSrDcevW+irrVssO8qy0aiB7qKYoe8i12nWmsqqqJjWyfkNqpCuFyhd6x18T
6sXv17bxenFVJvj/MvVYl2fvsi6vz6DSZsCXuuq++lz40i89qz5g2VG9trIcssbAso+oh9S7+mos
rr7qluqcSlG15qltlbuf2lZXXL3UGjOhT/hrvu8+MaEX3Knd79TSH03bNrkOPLu1urumvdpBfdDm
2lpfTjGheqFruKrQ1Wla6OqsT6pOcV2q6nWdMF11nag+4OqpdFZtqWisb6/uqS9Fifx6Qcqtikbq
842pbRVtrjPZ+23h9a3Za+qdrkOulqf2ZA89szN7yNyu1bw5yXTWnFRTiprfSLVENVVTrtVZ9lB9
W3VPahtyGNOsM8Vo4yh7nS2hvgjlG3Cdyu53napplSWivrQ0pc+61BpGNVg3oQzFrq7sVa6u+rTq
9Kf6qypc3dnnXd2VG6pNT+2Qv2qKXN2u1dWmSnkXyyi+QTMcwwzKjctpNhc0m3+B5vEKmsGNNIPX
sxmYwe8yPk8z6yzMprMxA7+P65LgPwb/keVh1s733MGOxHlIO580Tekqh65NydPldPapJ+84+fW8
5MHmVYraGqLZwzlL1w7h7IIf7zitBCTjlB+Xzsg8xo8jnyuc4SF+vI10lF+H98+lBWd/X46859jJ
Bvx4hXRcR+GwH1eeo3v9OHJPSxnb4cebQ0f5hvMGD5eujakW6j9w3U3tzNkpMfgXwDO4ayvXXXK9
6YA/LeAlMHkfT7BWuiLwcsfu/FfgnwUZ6ko7u46V4MOtBgKf2WVvu0JBruS03rZS3i2l66xBCpwb
fLgqteYIWpWzaz58wfawc/Rr0NcCreQ6KHJ21M/CPgprKHK2189CDV2JcUrha2E9K2JydbjWz4J8
Tz0L9ynq/CzEs276VeTHC6crMnmdNcb7YL2AaswoR38w1Rj1BcwB09EjQtEjZqBHzKQe0czuQo9I
RI/4NOo2acbvZvyOfQa9Izlg71DQ1jU+5W5FCR1sKfV+eX9ijQ9fx1JoDNRTkCOhxkeip34TRyWX
Qd4/do7LpjJvfJSlpjbQp+kzaATRqlyv3UP4G1lyfZx+QB9PvCKKW8f5Qh+kp6seSiH0R/EfA2P6
PbprOppL9HStoneN81X9Vv1W3aCOep8+lKLDJ8Uq3SHdUcZ118nWKn2yT5pyfblul4680Q2SrFwf
6U2lW6/P0G0iyWskselGfVIl6Or183U0F+voilU3PC7R6cP0YboifZCulPh03a477k2lu6FbrLui
o1lAV8cE/erxpiO/B3UxulM6mjt0hSQd1G321oSODBM/mairuhteD9WLuk6VxquO5grdGd1Zbwr1
pHqa+EKWQvea7ohPqerVPpVGjHqR0uzU7fbxr0hXpG5TaQ5VT5JsvSz7eKrF6mqVrrPUXknr6nSN
PulidDFquVpF0q0kjdEV6op9fLSoIyrNOCrNbFSOZN1ib0p1WI1Xh9RFJC2lHCN0Md4aUY9RCFEP
qWEkzaIS3aLSeFPuVq6oXcp1ksVRHrvVs6pPK6gb1A1Kv7pWoXOJqpJ8A9k56q0dZa9Cs44yTFZ3
qPt8+B3KduKfIP46dae3DEqbmqy0k6SPJPVqu4/EpUYq1J+VbSQpUt0+tvIUusJU2ih3g5quFvqk
uaIkKWkko/OdGqemeUulnKYQoVAtKHlyF5oa45Nqv7ilUA0oiZJWLqs+taF0Kp3inKAzthJO0k6l
X7ng9YRGurzHd4Mkq5Ve5aSPzQrRLagXiiGUvc/HYq6SKzbKu8HiMMlWK9t8Ui0SbkFnJLFL0kq5
stonXZgSJooE9X6xnqRhik0p96YUaeKyoBlA1BJ9XYlXMrwp6ewVJfoFzVnCSTmGKHE+soO4Y0Jj
QNAYEFcVvY9sBx8WHfKugoggqzvEaXHJp+xrxBrcd1GI2idOeH3he0QZ79XuvIgq0Sl6fWzm8U3C
wmku4kfIRpvwzko6kSgSeaOI5zSj8m6SVohWn5RhvEgEyTuYnMovwoRNlHq94WmcSizvSohcH0/i
+ACn+Y8XoXxe7SB555JSCH5URPno99AZl+Y/TvOf5w4M8sZunkF59qUzNvfcgdFSrGKHmOz/NP/x
VfyUT5pyXs52sT04Ywv6td+biq2nvOUcQPMft/FOn1QJrJ7Px1qURglf460dHsbDWBEPYrLUNP/x
Km8qdoMtptVFFs7Wgt3ged50WGHIf5aZjzWfYIM80SOd2nr3473bIp/CdNC58qO96+J7v+UNeeed
y6+Iep7JLrgwpehMjv304LL2xO5lbYnDid1JxY8nF+UtqyvemXi2eJDo+pK8oib5e1la8TniXbh/
sPiy5CcVJ14qKUw8m3ywaFFJcWJK8uXiayUrikfvHyzqLakoUUtqSoJK6pNPL9v8mZb7S0tmljQt
y1iWsPTGeCR7Mkp7njgi9XxjIN+KI4vTSmyJZ6Vfkvb1S/o05s+4L4H8kOUhu1q6ot77G0uypE+P
J1OZVpXMWZabZFu2uSSqZEVJXMmakviSdSWLSjaWJBdtK1ns64u0hSvCyU/ayseftOnwpC3I2Ghs
ZMFo7xC099SfOGprlFXoZV8PvsHGnvlN1PjbcQ3ZmzbLZ5PoTeokzdV+mhvFJs9TTO2qRT5bDKGx
G8zY/DbGnqSe8+RlLeL3NU8c8cRRHIXz8PzC93gq6vVcPj2R+wpMVB9sPs35nqj40NzZiKMA3arJ
nduhH+pMcuY6S511nmOjdvzkDu346TIfuZOOrZ7fY8c2n6OUtzvT6Fh+Xxsdi5zln4ocP3r03uPJ
6nu1t2zpkDs+d5ZXwhvZ+D9p3BeDyD1xTkF9wc33FfcU9Bf0FgwU7C8YKnit4DzFi/T7fMER4r9W
cIXk1xGPE4/0PS3zIvn0Vfm8V2yhs72Cmc/HU5QxCGUMxtPjEJRxOsoYht48C2UMR2lmo8ek4zqL
4/zAPLsu5RlUPnEr9+Gt8/Q/h4c3NtN/8CfXU33afRj4Y8J6thNtkEGR3bvtPSMPwAtxlDtCHZGO
Kk+sc5Q6wvPPOhoptpKkin63Eb9dxvwTDsOfrYyyPTOwK6DFcx3YhjN7LV1Nytqv8OHKK+QdaI0x
3lRr9UU5vmlENL7n6Odk9QNfiWKGE1QSuVrp9Xj5JfAq8A/62/14TrqSlmsQX146nqU2+fHiMZOW
+/HCWZ1PTXxpyjWxebwm5K+XmHeHxT8CvyaR6kTzd62Pv2s8/q728XeNx996H381XjnuEDnGeVP1
d6Ofv/8LuOmOreg9k2iruS/L8+Ed1l7VtPaSd0iDseqajlXXDKx8Zn6IlPLZ3j6cpYrkk7dcOgPl
JjBmp/nUHuShZ2rH6EGi53h4UdrRl7bHUYyHXlju1dzh3Eu5OYQuwqu5N3LTczsRhhFI9rGUV86e
coXdRbEb9b4WPLnfQ55LctgWH24Sxr9CxyS22ocv51753DMSweWRfHT3uL4K/C5yikPr4N+rotIR
+T21WAd8U2zHKDASBsn7YLd/LX/rHiY0MHnfS/slUG5x+9e3T8rIxr89T6l0N8ve9d0jK/OadvMM
qwjAXReIO3L0fXLJo9Hf/Y9wqBTvPDfZh3d+G8izd74RiPvf//Y+uZNzJ70bdYFS/1ENxL3e+j65
AXMa2RLQz4WBuDd2vE8u1d+t9gDtfSBg/Tn/QnvBx8uRNfNGoDq4Zf0w/U1EiSQau55riIh0Jnyi
/M0nROE5OuOCCq7f54ibaVuUP39uesHN/FP3dtiK88/ct9RWnFf8aJOT2Xc7Mh6Zn382v8Wx4dE5
Gmr8/K3OkLzjtpqCm3lb5gxYR/J2aals151hecX5ndbRvKH7s5wRedfj5jha8y/lnnHG5NXndzsX
5r1276gzMf9Mfo8tKp/dv8a2+NGauPj8G/k34uKdKfm3HrnlTHeIezucJochv8s5P/+qHyJfDbV8
NdSkWtrJeOeSOtJsM/Ou3HvYqc8f1sqocSaXUSudb7l8S3Tnsmj1pvmg2dRSOXJp/Zqg+e9IKrjy
aNB96Y8OOELzDxSojvC5XY7Njkit9hyWgl5HrMbJP1pQ71iQv8mxOyd8com0HN9jbfFB14b72SHv
+WX2EKJz3obZC+3psTPtJnuO3WFfSiHHvnze4LxS4iy1l9ld88pnu+y1s012d063vWXe5Zy+2IF5
l2WwLyfNUgrE04LXWk4nWVia0+mxtVTakVa8Nuw5sxfOG5xtsl6adzl2z7xj9tX2tbNdtnD7Wvt6
+ybNSuwA8+7V/WCl9duZG36FOXPW/2UHNrVnT/7l1DPnLNVyyDpo2RQTar1gXUBxxHrBctY6alPp
2Ge9YAuKPjFLtc20zbF0WU/b4qQs5nBMqAyWs5azNtWmRp8g/XgZfaxdtiaQrcuaLUuftCOteG1Y
r1lPW8NtUTY1JnTWzOgTSDUqf1nOkjTcssl6LubwFMuZgBWap5yzYliIZYElyZJBMcmSS3SaxUIx
15Iwbt8oukQX2X9F0HWP+GfxzzSKvif2MlW8Kd5kenFK/Cv58JZ4izQHxSALoryuyDU+L+VuXOdG
ypV7WC8ip+i0FdobbcX2VtsKe5utwt5uq7FvsNXbN9vW2HfaNtr32rbY9+H3Nk/cYT8I/jb7YfB3
2Y/Z9thP2nrtp2377YO21+znbEfsF2zH7Zdt/fZrpDdiGyDd8/ZR6I9Fjz1zoSVGRtiQekOW9PFj
IN+a7B22dfbd8EvSvn5Jn8b8GfMlkB+r7NthV6aTOjKt9CnPkmO7mKeO5zVmV6NHkNbXF/r9Hnss
PtRMdlcYojNmVdTaJZ2Z62b0Zx5fsnVGvzzG1GcOZTYt6ZqXk3k8+tqSrszzRK2LWURhY9TamN7I
kZkpMsTUk2ZTZlNMU0yvJ3it9Wfsk6jZmpcj7XiseGxkDmT2Zu7PvLhk08yUJZvmJUaORDkymySS
3hWSvJZ5JPMIm9rOCs4SPW8wobQz5yOGZAdlz8yeQ3Fmdlx20N0ns6MoxmUc98llyv3ff06ZQf0+
Ovae+PSsjITQxoy69MWhjfIYHZ7RlhGZbou+nFEXtTXdltFOVELUqahT0Un3xEcX3d0ZOihDdDhp
RmZERkdGF3mC11rjkuUSNVvRl6UdzcqYjYzW7NxsZ3Z5enLoYHpy9Om7OyOvZURKJL3NJCnKLs2W
V3naM/gPMaeEHmch5gRzUuYBc5I56SE90WnmDHPaQ/qsqnH7U6/TCvkUiPLKZTMorxVTjiGmGlP9
dIepnsIaoptMqyiuSe//CJ7nTL10fiNyehuik84mw5ZLlquWG+nHHt5kNVgNdOxcEmcNtdygs4E+
a6Y10hpLIdQyn84tSZZOa5qlm85ZFB7ufLjTGkphgTVNC15rlltWYTVYbmm2rOEeO6FeG+nHLMOQ
Oa0LliRbM6wWi9saazER5lpWe6x0M+/9/A8x/4RsRnSa+k0DpiHTedNF0xXTTTMzMzrGmfXmENNF
c5g5whxjnm9emJlnDjGnmNNN580mc47ZYU6UwRRHmiEUEomH4GPteoaTbF3XbJElsgMr4zYonwHI
3GTpuHmpeTnxF5rLCF3mWs2K2fHRlDZ4J6LTtMm01dSZfd3UtWTQ5DB1m7qXDGYnm3qyh0xdpj7T
QtMB0yHT0YwV9DvHdMJ0yrTUdMZ01rRWhuxkCkMkWUs8LYxbe3jPw1tM3Q/v8djqk3ZgZdwG5bcV
sluUfr1p2HTJdNV0lKRXTS2mG5oV09kpl/YcD0dpcY87aN8His7w0IdqjHmL3Yvd4QfD08JPUjho
Tpk7khVBVOmShRFHliwPj1xcm3llSfoShzl9TsycGOPFiEUyUK9IyYrIiohYJLkyeK2ZE8PLw09S
79BslUo7sDJuI/zgQzVzRzKvzO4lSwuNQ7JnhEfOiUEfi9CsGC9O8Z76hzhfGRsRQ+a2GkYmh1md
zHsXfCp3Y/3zMiCGzKmd1uMN4RbtOKf2o8zL0IkYMutMWL83GBZox1lnPmReIzzJe6fWkPiRRGdq
XZgruW5WQmp76ua7BlJ3p+5N3Zy6L/Vg6rHU3WHziT6Zejp1MPVC6uXUkTDXXfUkG01pSd2JsI/C
MQrn0tS0IBl9rHWQfC8hbJElaYes+NjYntqYejj1Wlpy6s6w+WlzZrWlRaXFhatp8WmLwreltqa2
pW5I+zD3ej/UVZO+nzk/89pfdvDcK/6A5bw9S+7yG/2/EplR/ZEsrdzLJb47zUL4MnCLnmY88Trw
CnBQ8pV7JK0cAqcf9JvAheA8qP6Y0AJ8VEPJ56Og+yXyS6BfBzYBF2s6sBMCO5mSf/tt8TZxYnX7
GVc3qnKnYQL23/1O0uqPwG+WqHtC3U30qKR5q0TFAek3wMnX/ZBxfRg0OfAZWDgMm8XA6eC0ws63
oBMEnCVxWi6s/Qqo2e9SumTZgf+k0HW68pauV9aM5IhCuXtRGVbvI/yB5PAEdQHhpyQqKaAXSH19
mMfCdwh/LPniBTWa6CcV8of/l/pZol9Fqpck6p4D7QJ2Av+3RP0K2LklUX8OOdZJvqoH/xI0C0FH
IK9Y0Guh+bAaDw8JdW9LVE5JVMERDaDbFJq9eDs0V0DnOHCPRHYPx1vUQCPQwAepBa+I7+Nr63JH
0gW8FTuk3CM9l0+1+Tn5zhwflajcI9/3E4mSFttBf0XJkf0B9BXgf0iOeBnYLzk8GvwRvCt4U4mV
KGnFBVwIab8aKcur2ZG06AZdCRyE5nHQLwOLgQ9yK6ED/jwIXAxvVdAL8LbfBXWvRNC/1DjSBwXv
IopMYDH4V5H2Ojj/IfH2VZXmcjVPV0e4V9dHqZ5GizwPb12gXwLdJZF06tDn++QeU4niZaRaCE6k
lCoXodPo4fShJ8v3DKKhGQLOlyXqngOdBv3NwCJYOAS6RkqnzYXOZuADsPASrI1KZLfhW4hE9kvY
/DF8btX6Feq5Uv0M0dPQx2bpPk86qUj1kFZGYI7E2+dxr3u7fDalzLlNo14clBwlVtI8GtKXpVQU
g34LdC9wPfRrPXypfx2cRKAFGDYqrwaHpA5J5ROwU9BfAAsLkOoSsBk6o0ArUMXd+R8Dl8t/EFAK
5TNjaulqwo2wc2VU7opthc7QbT3R9ZLWIRfSl5prR+XM8LK8uqSRIPnYka/OA/08sFVqvmu/jWeN
t9cBsXvw9l4g3mm4jfevb38fKMui8/Cxs/j2YxJHfwcau5c1a9L+u3bUA3sX75NIevQXcnf2u/+u
DyH69/pg+VxDIp0RsL9Z/TnOhdhN6zlTYBe1+gK12vc9OvKJf7WHhlfKH0DjXWUddlPK+Zz4vwGN
fbTqt4D47wDtfXkVpZBj6vZlaZ+FI5e3QTO1DIgSqVTS0fPTaA55d3jaYun5tFpw8NaqPgv5DoH+
PTAU+CoQb8nosd9Yj53K074CxO7qaQakDYcU+2h1N0E/A1wFNAO/JHujbgfwdWrrIkMy4U8lqr+S
qH9IogCqDPgc+LslTntRIoe+AMcAnWnRBuxkhf5vIV0G3CNRAV/3S9CwoL4Fzs9geQh0Jmgd8C5w
skC3Qr8ROIq8QoCxkF6D5udAG4Ga5SegD6kSDM47kC4C5z/B+Q3o74CeDv0ZwBagAP4epdgOrAPn
JWAtrD0OhOeqC6iVOhz4c3A2AMuA8cClwFIgyqg+DU803x5G6X4AhNSg+f8vkD4L+hDyjQKdC4Tn
ynlYSwPnBYlBaCMj2stQAQRf6YT9jbDzIPg28Fcj7S7YGQC2g4P616EtxFWkjYD0FVh4FNI+WABf
lwx6B+hi4AVgIvjoIbefkP2Q8HW5fgCuQs/8glxj8G/rZ8j+KUeH7qcS1V9J1D8kUQBVBnwO/N0S
p70okUNfgEM9vAM9vAN9u0P2WM2CpKdFa5YlzTRrv9VsSo5YBs09EhVIdb8EjVzUt8D5GXIfAp0J
Wge8C5ws0K3QbwSOws8QYCyk16D5OdBGoGb5CehDqgSD8w6ki8D5T3B+A/o7oKdDfwawBSiAmGfE
dmAdOC8Ba2HtcSA8V11ArdThwJ+DswFYBowHLgWWAlFG9Wl4ovn2MEr3AyCkBs3/f4H0WdCHkG8U
6FwgPFcwH6pp4LygtSnabgj4lkSalzowC3VgXupAP++Q/Rx5VQCRVumEhY3I60HwmaYP2gad1chr
F/IdALaDg/bSoe3EVdiJgPQVWHsU0j5YAF+XDHoH6GLgBWAi+OhXt5+gVQO/vew29fbbeTgLf2c0
X+71BjZIVKIkcqBgwIfAXwY8KpFBn4OjQkfZCL6m/zykC4FFwDbwr4KGBVEDHEbaOtD/BFoADeDs
AL0E9GLgC+C0AzcBVwJVoGbzu0Dw+VdAvwvpXHCugXMd9FugYU1MA6YDObAZOgXAVHAeBabA2gPA
eeB8BqiVNwj4FDg2YCIwHLgIGAv8LDS/BvwmrP07EKVWddD5N0h/APocpKGgXwH+HaRvg9ba60cS
dVq7oI3UJGAmNE/Cwk+Bs8G/D3ykEv8KfBpoBh4AvgqdFqTaAE4h6PmgByHV+NtA98s1EvWrUvQr
iXuADwGxgmIa/w8SqReVor9JTgfo/4JO/O0bcvWurWmB+9BjR7AC1N62vApaD+yEdDE092AluRv8
ddC8AA5WdEopNLeAgzc51V3gYDckra0ljXdHRTewHxZugj44Wi/X4eC8MirfxTkFTr1EvgKr33Oe
FaykcyHNACdZ0tPwXiuPA06HzWKkXQpOKLzC/lmh7To9JWtjGt6R1aG8PELzSqYSFom6dImqHrgX
/BGJrE+7Rhilqz++SqL4ivRZeVNbSyPfKmAW7IRrPsDOGehc1Oof7bJUorIHJTqNVD1yfa70a6VD
7WFWoVEspb/S1vkoRR/a9wpyWQ4OpHqUhWqPpLpjEtU85LVTa9PR07JdNA7ySoYPXUgVAk9CYLlJ
syOvNegkJ++zH5NI9XAI1zKH0HYS24BNwEQP/zRaQeIWcLpBt6EmFwBrgVdwPVILT/DmrOq5Chtd
K1tf8in3LrSatHBUIrvpKYVskaseO6fRN06jVk+jhrUcJeeER/80Zs7TsKyNoHpodoHuQukk34D6
OSc11SXaNR0sVAC/CTym9W3PWOtCzylFH5CcLLT7Uvh2UGsL9Lc+tFcL+sNM0P8AO0eQSxha+YQ2
7kDvh51NGL/HUBsRQDf4VWgdN+zYtN6l9SLtuhJo8YxQo7xzgtIlop9chz8bpL5e2+VVLi2rl+Ez
3v9WX4TnGyQa0XsNeFd8Gka6fr/HQitakHDaMPgrJK1j4Hejho9rNpGXtsv7AvxMQL4Gea1KV76E
6lqtB8LnQyhplnznXleh1Q/wWT5E0v/H2ZmAaVFc/b66q6vfF6bn7REREVmGEWGAAQcYYFjEURER
AYdFHAgSNhEREAGRGOKKG6ISUUIMkokSQ4wsIiIa44KKiBsawG1EcAHZEdEoyry3zq9art4nHzf5
nnnm32dOV5+qPnXOv6q7a7obUHI+duoiDyUeDuONKjQPoplH7Z+h6Y/nrwXHgfXA3uxdRcnFXB1v
xnKABbxk3iCbrnesSwvhEH0KrbqSe4azwIe4i5iPvIn7igXI34PT2NsfTKFZDF4ZNrDYmLuRjdE0
Ra6FhTlouguq3eA2Vwa5Cmtj3J1MsJj7nIvA47FwCP3H4L3JXVaZC23inmq+oKmNzXuTGaaUeSaZ
N3aX/mI2XpBgd/E2c6H8xI7geeFAiUxqDLBWTNtmUu94MC2aoDf6VbSwCP1iLB9y3sByN7AFyHzS
P5G994MdOWoW+jKzX0ZG9M+mRgr/cCXOPM2vQN+eGptTy2Q04/FeFvl6Sn4A5spZ+O4+sOZc3nb9
K1f0fkvsMBvXp1H+GXy1Frkve3si10dmXm17Smx+hfxr51UsN6M9dZ3s7j/T8neo8TOwFme6gjIz
kPdhYR/1fuDugaPZSfkVyB+783J3s01W2plE3R3SHrnDoDuJrGdiuYiS31JmLnIFdT3k/ByeI/nI
3mvY25e+e529uVjY6mT033G/ZTfyMBfzIuvLwRT6NQ7phQPIHyLPA7e7mDc3SvtFNo+Av3XxbMc6
y3iUqY9vn6H2hWhqJ3f+Z5A1M+QOHl7d7uTkmcIoicYkJqXkNPx2M3sHUMtSNBtArqr87uCVxP9u
codrPT3U9TVncQPH3oC8H3m/kzlWU+NOWnIInMP1C9Geov1hL8EU8WnW0Z4lgunH2Hsf+q4gV3Z6
kvMJdmhJCm+EY/E21zLeDMck1N6Ulox0lrEwm/bPdvwQTsc/04mTO2AnkfuHpdbC7ynTSd5q4N1s
Ijhnn1xvShn1qci237mXDvYAuf/mt2ZvFbGxDZ+sFjv+HxN+ayg5El4t9hMmbAiDiX6+Sctslro+
gUOWg9dyXlfT/vX4J4MevjUKbIXmd5R5EJ+8JRjUEzSH0WxBkwOWojkZvMpFqfnKynvRfAF+Scne
cq/PxmEZ7ZlOvWVwaRm1W0wxOpjp1P4FZXoL2jIi18O3s8BnpLzliukcKzgabCWoHyRnvwDfMow1
xmU38Qw+Ixg0ocwW5BzBcJEhWgRTTxIhJ3LuF9KGN7F/lXHtpFXGZZnU3oO9q7D5HfJ3+BNWDHz8
sAT9es6ivivP+f5gXM5O5x6+tHADduYiV+DVkwWDUlo7iL0bOarSjWtuvEhaW0bvT0cW/bnU9YNj
S2c/8aTUeBNyZ2z+QK/tpUxLqTF1N3aqqHcqkbMZmzdR17PUvgUk74IFYHN6syPlX0cudFHkZMp8
5OyA91ASj5kbkYl269Xa9L5oOqAhB8OlyFOwORq5Jvgiewdz1CB83g78hPN6gHypj6Y5+BF4LjxQ
huwhZ7BMDvqXgkew8Lyz4zILOZ+jvkGez1E93FggmLoZa/B8arxrj2NpSv4WzR5k2Nh6W/YyIqQY
lcyzWH7QNCOemzFaDaC/mhG9zYj2ZuTdPXI/jRoZJcOByOcg16WuN2n5c+Ae7FfS2rVOdnbA56nr
UkqWknGzwPFJ/JfRO5LX14mFmkNErnGPyOkS0KdeZhE1WpNNPEE2zMRSD2GhnFith/xIwg+CXhL5
FmtOoTxPsYNLktgWDI2LsTKyQ+Tz0Z9LLW1FDmHvcCQeHkW0r5NnKPojs9HiZHwyJehm5ZxgsUR4
IO+0YbbpvSKyzYhZcj8QHCroDaNHuspRwRTxko3YUrkPGcjVwWTReJuklgA+D9z4Atsf6Zs8LbrB
YowcJ0+IOoA8u8m+Ct4EjgfLudO1G3m2PG2Ro7LfZDeiuQeUeddCselfKajrIM8Cn0HTCXmToFcA
vo6mgr39wXw09yJHyPvAaeBi9G8hPwT+HiwGm4LdsVzDaY68LyMdZzodeRsWxrD3DNHY6xopPwys
Rv8x8lbZ67s2bBI5aIe8gb1FYF0sH0afPiLv8GqGXEgtQ5HHU/IQ1jq7FmKtN2VWoeHcVZUriSaX
8rOwuVVQp1yb3bmLxu8PPiOotmPhRfaucL1wZLGcFzgHzaXY/5CjmmIzH/tXg+eAa7BzPmX2gWdg
fxnyJsoUIecm5yVyMfoC5OuxPBM77zrPuF5m7wqu2o6n/Az036J/AW9Mcr3g7LBXg33RnOdk1zuJ
J8XOhxKr3tuCNhIkbg+j/46j6iMP5qiBtK0ndfVEdj5sSZlelJnD+e5254g8DzxAmWFgG2qvlW0i
SMnOSUtE3xI7qwXNbwWD72WvlZsIt6Cp59rmcqRa3tnTFGzv8gW5WNBrgLUGIqttgroOe1si52d/
K/3CdbFGvxBc7DzmEM31YGe3F6wP3guuoORr+KSbi3PXHnAfOBL8mJK1XKShGU/b3gV3u3tH2LnI
ZQFl1oIbOPYDzqsXOAzczzl+TpknsXw3+q3gWMcAyKOInw6UnOasgdr1OD55y7UTvJSjqpHTyJOp
azPxuV2OSpeInCKvw4FgGX13oexNwWlhM5GDPfRjQ87rGlo1gNgYTUlYLnT2AxczruVHphE5gmtc
mx0zcJ9KczdsNjZnk/ULJU4sfzYhnpvAfk2EqRwjgZ3grpux0xk+gdPUp2h6OFakTA3He4J6jOND
9NXgh+Db2Oxe3cKiQm5Nyem09o8u1/DhV9xT7QSy9sCfz/l+jTxc3hIWTAv6ikycv8BVzHDuvb/A
E8yW7v6qXBvaa705XNuKXMlT9e08T69MyXqYlYJ2bxkoJXlepvsn9zSacv+hvuSLyP4HaCYllm9h
fmtlfZegnS3LCLWPJ/uH9UZmvAUyN9BfyN3moDcj+y3SU4b7usECOd/gJqldvtjlrVEniU1WJfWS
t79YrpZ+GQguzZbCIaXSwur5lJHyX4hs6ztfskY0QSgWbK3z5MpIzZb2C6rDgraVs2WmgX6fYIq7
r2Y6K0b6cy+uSNZyWEMDwTngZrCMe02ybmG73GNRB1IbRC+rF+zeXciLwcZSY7gaWUb5A+FgyjPi
h1u5xl9NX6AxT1lsm6x8mE2Zwci84Z3VPoryKviEZ7sL0Qxk7zpk6Zd1tGpd6jPB9DXgTOnr9FDu
DT7IeMoaD/hEVZeAk8CImUY9Ss6E52V914kB0RISseDKVKHI4MoQGVyZOgP9GchdkbtS5nbK3I58
B7JcU9eTdSZ+PXMW+LVgWAkGaHqAbeQo8zZ3SN5BfhM7Mss6YO5CrgJngGXoJ9CGCjz/EEfRKnOm
PaOFsu7F4n2CZjC4SlCOtViAphL5WSV3EX8naO4DpeQiSi6SmLeyYBfe/pcNLyA2LuYei7TkXfr0
m/B1i18JeheY7+x5tZC1NH4LbO4TC1a+A7xLMDQgzwHxRouUb3FecK7EZ/CAoPkN8vfIs8F1gvLu
SKvfBO7mKBnBx8raHotPCZpySkrt9YLDeENmtvXCizl3eb/HFlq+S2q3+sbgheyV1U1biPai4En6
pSe134fnwXAsGKB/An0/arR6/zp5o6Ldm4P+U+RCMEJzK9gIfJE+fZ2YkWzaZa4WlPVIVpbeXCrn
7ueas2XOEzwucwNBPze8QriXO7czzJ9FD84wvZF7I/8G+TfIc5HncuxqGdmpsch8DD5EC58D93Mu
s4ixxrRwP3o5qm/wLrFxvMVl0iqrv5PcHwqKhy/Qr8k8TVZqefcHnQRNR4s7zRhBenlnOBuUSNuZ
KkK+mBi2jKd2hA9I7wTyxbYdRnqnwAwXdpX1rl5B2B6mlVzbRY7skPeTejWpt4e8TdLiHvGq5JTt
x7oyagc7aX8ArhU0l4DNwDsFw+bs3Y2mVFg3dHudfgJ4BWd0qsXZct3k3a9lDcxsPQF5M/ItyGiC
P6P5CM0+5DfAtwR96eWdepm1PMK/Ff/I/e0R8o5FK3dBPgn5dOSTrXyZ+EGt1I+Lz9U9co7qSuYM
gejBA9m6yHUpY/d6LbLCDA+q9sgLRM6uQ74dNGAv8Dbwz9j5DrwEHC4Irx6QqzkrNwZPQBMiD0Au
BVuBvdHLm5N3VddSctV2N/gdKH6u4ClbRfXF4Hz0MlrdQWuHgXdIjRabiwZ8hed9o9l7Ffgkc7xX
qmVN5r3ZQuaoz4HvM2vdYcfHzlkZxRZJ7d4iOcrOV/eCjZnh38AMf7E8xcvK/+VuxQNbjsjov0vQ
2tkrx3JUCjtFiZekVUVyFt5Yh9k89gpOrpanGLmc9XjKb6sWHiuTVZQW3wNfxnJjWpiHzNM05sb1
sblIMGgtFux1rtS+LDtEyboL8Z7OXsPMcBayzFo3U2YzbdtZfcjWewM9dUN11uI5rteyW+zeX1Ky
qbx9xvpcar8/W1M07O2R/UgiqvpXnF2+7JXremv5NIvrqv8iGSfl1fRqycHNaA5kGbNEY+V85J6g
WFhSLTG55IjlH2+be/adPUd52dmMbtuEh+2cxDHq/Viwo6p6SiLKZt9rZOLDyJpc20JmfYn+HMqf
Rl2uJYVEzsuw04vMB4QllGIFpjdHkJXkyuaT4CE0fHfF+kOQOYl7E6e3lXkF9zE4I1X9qMwhme8N
kzmelecxqxRr28Es910zMq6pw4xrGdaCZuGrF4P3GBdE8zX4jvCPekeekqhtrBRtGEgmduXdtIVg
bfee2gRZu0sZRY3KnI/me+RKZFtXtpKS3wcFtGS6bUngVqWqVqCcxVYZp7zjQ3wbXgeTnAL+Ulor
Z5f9hC/SquSbSaL5UolvD1PmD7xdTsnKZ+v/RuR1d/LR9qO9FttPft1E5Ni92akSA1nemp19E+TZ
dDXPprOsXcmy5qR6Pcjahuw3RM4896Sbp+f3u2fraHj3VjUrTKpZzVLNG/urWR1dzfPoatbAHGFd
xBEsHGEd+BHWtBzhufYRVrwc4Zl7Nd8erX4e3IielRtHWG9jI1uQNR72ukj07p3rhbR2ObgHjfv6
Le8Pz7JOIPs0yPqcalbC2MwXC6xXP8Lzfa8Bq9+vNFxZM+NtiB2l99LLo+UJJvMi2uxdCp5HmT8i
fwXejeZUkHXp6hbwQ/bejIwPFSsZPK6/vIdo1QPoB6O5EjwDbEz7f8Hez9F8TC9Qi7cTfAHcxNVc
E/bSO7of8uXsvR6ZNT/eLqzRF14Nt64A+XjqooUeax5UH+SxWPsLJV0tPyC7Lx5t5tsIc8BDgn4F
0UsZ7wLssOLCm8FR9RNcKV5F3wFk9ZTnvib0CjKrBTxW7Hsx6KLxQvBWkNVKHhHi0b+qbYIyU+2E
njjxrgVZ/+Oxhsq7GJwNlnOU61/i2SOKNG3z13BeI8F9ys7zNSumLMpZs5bDd2fxmdTrs75I4z3N
aivfZdPUBOXciQGfdR2aGjX/uaDzwBz27gD3Uy85pV8G7wT3Jv0i1rYi07PSLRZdG5z9edmD9uwc
G2Q5U9aYZVmjlXx5lVU3ij5K3pb4JEhGqxtAl3esZnHvWbSjoIJDhEtZ86bgCsWqNtULdGuunIf5
TwqFz7MjkCs5x/PxnjtfeMn/JehR5nmQeFAu7/4APs5RroWTkGsiP4YMOym3Xg5+81qDrl5W9Hmw
lgenZf+RoPQpLfeKwa4gDOYVsHezvD/SxnwlMV9JzFcS1ZVEvlyjMf76jyU9KDW6LzfAaWo3+B02
WbemYBXlcvNZWuI4gRVKipVOCvZWT4FkaJbVdCwu9DQR65eC+NxfnUSv7P0X8gkgvRkQaQHfiQiu
pwz9rmGt4FfI1BL8ExkveawM9MmdrPtvGnrEP5FWcS4envSJHx+295dgAfb2j2CTvlC/A1lRmSXC
lVszCWNn4eEsPZudC7Im0M7RRT5O0M5NRaY3s4wd7hsbP8CNWdf75L6ixiy8ofDSETgt677q4UY9
RknFyjrvN6Djk++R6RdF9mVhWvWO9LX9rSK/qsisKvi/ipyqIpuqyKYqsqmKbKoim6rguipyqoqc
qiKnqshE7lSAj4D3gw+DQ8BycA04m2NHIFeC24lDmMRjHZrHSlT/IuS/I7sx6A3kfNCNO/SUl+Ic
8aRy+tM4d1hIuR5n7Zz6NXvd2Ec0Kmf5bPz8EUe5aKfXFKOYYuRSr9GPLqMZJT2ixbsd5D+t/OHI
1Os/gZyR/6Wqvov/qNrFl2K/Fsw2ycrVa4FbByh77cxfyswDV/IfZGn0keI5OJFJ5PhuXTrt0Y4x
GImyjNE+OeKfSTvhEMO5B4yzAbOsgMgMiEDvZJAY89xI5zwPb3tkty5Hdrl5CehWUbqxm3z3/0SZ
LZRvhezGXzf6syLRY26gr0OPbzUe01jT/M+a7/5n7VWQujyi2mec8mFLzUzD5+w03KvhAXUSenpf
nws6JqHl6l1kIkpjU7u102S3/hs+YQ1zwFhsmiHjSU3uazJLk/WabPUd5zCL08zi/OeRnU9gHs0o
oxnXNPPYgOwO4A1NRgeMCMHXIKwYVLKXKPJpp8+814OZtYsBeMbbgMzM08f/PuOF7/xPhPisxfX5
X0LfrbWGWzS8quGcACYJ3P8wvg/CSz7Z4ZE7ykWFG3NdnNObXntkF0swp9cFDbnpkyO+K+8iyq3Q
Zg2zz3zSd2zsInwS/idzA7fe1Y0ObWWGoLEQMJcOj5M334Zkq6HXAhgvYK6uXV+XYbMdrYKBA2oP
XI/gsQBG9SYzVtYEh4K54DAwA45g9FyF3BKcCV4M9hW0o3Mlo3Alc8VKRmrBMrAY7IqdA+B2NIzO
do5SyWyzkrmoILMgj3jwmHUoN5OH/y0bXybje7W8efWTgPuTcoXu9+Ru7XQ77sndj6kyf6uuVpIt
Nb2l6bXKjJg8YqTKH/WryePV2ksnX3K52jP2kpGTvdrjR0yd6DVR9VXQ48z++apDn96D81X/AX27
56uJF/a3aOefdn5W0zJobYvN7Yh1trpItbNzg0bsyVGhOsFiC3WaOl11VxWqRI1V+cm+lKpjx5eW
qlh1U+fYa4n2tv2Nk31py9a5qki1sTzew44eHdQ4VZDsq2FngBl7ndpWlalz1S9UR3W5nWvJbFT2
Z1Q91cSOlz3t1UB/3sZ8sRqvrlTTLOdff7RUrE62Vz6x6mTnZ33VADVKyVeAJ6jJdiScYce7H8tp
yyR5aqi87aH3wJ75qmRg//PzZYaIjfp2NDlOdbbzxgvUQMvmvr3qnaim2J74jVzV2TJ5qoFqpmqp
LupMe6Vcri5Ul1ibw9UVdvT9lR3nb0pKNbRXh8erruosOyPpZ+cXY2wLRtg54lXqGnWdmqluHtV2
yiidD7YAS8BuYM9RI8ZP1f3BCnAYOBocN2rUhEl6EjgDvA28F6wEHwVXgdvBA+Dh0eMvuzQIwAis
DdYHm4BFoydeMSFoC5aC3cDuYK8xl00cEZSDg8Ch4Ehw7JjJI0YFE8Hp4I3gbHDeZRMvmxpUgg+D
j4IrwNWXTblifPAs+BK4HtwAbrZNGxFUgbvAbwVNCNYeP/GqCaYALARbgyVg5/FXjBpvysAeYG+w
P1gBDptwyejLzGhwHDgJnAbOsGYmmxvB28C7wHvB+6+QWirBxeBycDX4/CTBdeCb4EbwA3DrZHsC
Zju4BzwIfgtWC4bBFNvvYU0wD6wD1gcLpkwYNSksBNuCXcEeYPmUKcVtwiHgcHAMOB6cDE4HrwVn
grPAORbbhvPABeCD4GJwqcV24UrwafB5cC34+lR7duE74AfgJ+Au8OBVEy8bFR4WTCkwBCNQrsK1
ZZIi1eq/kH6cEf57DOyPsVxT838hu3evyxyqjmW3Npap2lnma29ZrKNlpk6WMbrYXD/d8t4ZlsPO
tFl/tmXHc3525L+TfMumdf6DbXLtoOofE6NjoPBePXXyfyF5KnNMzDkGGsuitSz/1ab1/9u/PNXs
mOi+kuiuEbg/o9wY6vzLnSuVe0xscAz07fjU5D/Y/njH7X/CvGMiM9rkft+/R21HkuaqxX8h/XhH
5X/CY9XmyWh+DGx0DPTtqN30P9geq45f8Ka4dWqDek/eoubV95p4RV4Hr8zr6ZV7Fd5wb6w3yZvu
Xe/d5s3xlnqrvTXeeu8d7wPvE2+Xd9A77Pt+Tb+WX88v8Fv4bf3O/ll+L7+/P8Qf6Y/zJ/vX+Df6
c/wN/nv+Vv8L/4D/rVY6rfN0XZ2vC3WxLtUT9TR9rX5Ur9TP6Pf0Vv2FPqC/tWSQDvKCukF+UBgU
B6VBWdAzKA8qguHB2GBSMF2F8ghBr2Oe4QUVblvjJWZlXs5oJc/wvJxxNkJrqBOj0dG0aFZUGa2I
1kZV0aHcMLdebnFuz9whuRNzZ+YuyF2auyb3vdwDGT9TJyN3/e1PRp5V1LDbicnftk5hkcw9mUWJ
9EFmnysTFyfbbm57wga3rdfbbRtKO+22Uca1K3+i+zv/nuTvVcnfB7AcNe7ZeGjjQwV5BS8VbDll
zilPN1nQZMOp60497Optuq7pZs7Lb/pF02pXQ7Mid+bNhrmcbDY6+fu2ZLso2T6fbKvcttB9G8Fr
npQrujHZ/vh3clxRclxRclzRt27bqnayLU62C5LtYbct/sBt2/RItgvcGZdMTbYzOaegZF7J4pJn
SjbwV4P2Y9tf235e+6Xt17Wvan+wQ7pDfofSDv07jOsws8P8Dks7rO2wpcOhjlHHph3LOg7qOLHj
LR0Xdlzd8Z2O+0rTrpbSzc56aVWyPeC2neon277U43UJ3d9dhibbpFW9rnXb81u7be/FyXazi4Xe
2zm+bu89fVSfOn1a9+nZZ1ifaX3m9Hm0z/N9NvfZ1zfdt2Hfkr69+47ue23f+X1X9t3Q97O+hy/I
uFov2OWslefxd+3ywvKy8kHlE8tnli8oX1G+vnxr+bf9Mv2a9uvab2C/cf1u7De/3/J+a/ttcUf3
X++OHjCUv3MGVA5YPWDDgO0DfhhYa2DhwG4DBw4cN/B6e+1i/XDhvS46Llwu76y320/cdtBEZ2PQ
Ybe9KInLi7ol23HJNtlfcYs7rmK1s1ex3vm5Yrvzx2A/2aaTbWJvcO1k29YdP/isZLvRbYfc+JOv
rBRis4e8bdjO4ftY9ePe48pPdU515kswtYKpcp0ZXBNcI/ddgrnKT5+V7m+JoiJdoU5IX5Oeoeqk
r0vfoE5K35S+SdVP35q+XTVIz0kvUPnp/emDqlVO85yWqk1OcU6xKsnZk7NHtY9eil5WHaJXoldU
ae5xuXVUp9y6uXXtrMIz4+zomOcV+CW6h+WX+nbOcZa9Tulvr11G2mupyfa6Qr40NEfNt1eWi9Vy
ex37rFqr3lSb1Rb1mdqjDqkfvMCLUquUTj2aWpJ6ku3S1Gq2y1JPsV2eetpul1jp72yXpJ5huzT1
D7bLUs+yXZ56zvpiSep5+9dSW/oFtktSa9guTb3IdlnqJbbLUy/b0ktTa+1fy2zpV9guSa1juzT1
KttlqfVsl6des6WXpV63fy23pd9guyT1JtulqbfYLkttYLs89bYtvfz/8chYe6013V4f/iceeYcz
fzT1z8QzGxPPbEo8sznxzLu2nkdT7yX+eT/xyweJXz5M/FKVeOSjxCNbEo98nHhka+KRbXjkk8Qj
nyYe+SzxyOeJR7YnHtmBR75IPLIz8ciuxCO7E4/sSTyy9//jkXlqoXpYLf0fPbIv8cj+xCMHEo98
mXjkYOKRr/DIocQjXycR803imX8lnvk28cx3RMzhxD/fJ/75IfHLkcQv1YlHss4jdpKHR9Ke80ja
dx5Ja/FIOnAeSRvnkXToPJJOOY+k084j6Rr/hUdeUq+rjarKemSXOqgOe75XM13TeSSd4zySjpxH
0rnOI+mM80g6Fo+k85xH0sc5j6RrOY+kj3ceSdd2HkmfIB5J13EeSZ/oPJKu6yImfZLzTLqe80z6
ZImYdH3nn3SDxD8NE/80SvxyqpxpOj/xS+PELwWJX05J/NLE+eW/9sieox5pmnikWeKRwsQjzROP
tEg80hKPFCUeaZV4pHXikdMSjxQnHmmDR9omHmmXeKQk8Uj7xCMdEo90xCOliUc6JR7pnHikSxIx
XRPPnE7EdEs8c0bimbLEM2c6z8hIIO2WccC7h2+pTLQDQdqOCXJ3qNj6q7vqqyqif1qmPzvdL7gn
2phIc6NNSP2tbnMizY3etdI5lHsvkeZG7yNJuQ8SaS5fCmhir/NKuWc0SA23rD5VXatuiz48WlPV
0Zo+OlrTlqM1fXy0pq1Ha9p2tKZPfqwp2m2lc9NnW92eRJob7UU6x+r2JdKxWvTp0RZ9drRFnx9t
0fajLdpxtEVfHG3RzqMt2nW0RfuPtujA0RZ9ebRFB4+2yOa+11qeotr5vayZOMU/hTf/23E+t4Sx
fqr9PWivQevbdpfZuB6qJtqIflA9ajlO3lwcqkjX4ntWg5VvOiWac9H8Ao2d/eUOs1LnZN957Kv4
SeleaIYcLX0xpQ1vgq1rr6KacMwh6vky9yK7twvHfE09BzlmKEf/5BipwT8krbLHDJHS0h7/oJT0
v3U1S03+N9I6/yusXCQtEQ/4X8q7YUwn08X6Qtb3bP3xaZv9PZdvHO/y5JnTxp/otLfZ/jxttc//
ROt5djblPfKzY5fKGilv/s+Ovd/+LPrxCXaiDbyZ/Nxl9RN/ZlP+c3rQz2wO8WSNb/ef2exhfwb9
+Nz7qM1ifsqsvt7PbLb+8bnWUZuhV18lb8b50aaNhoOezAOrfmqTJ6ZVSvpi7U9tyjedkyfeiU21
QslzuwU/s7nQ/sjbCm/7mc3b+JErlMk/syn/FTfkZzaHWY6Vb8j91GYv+yPr60t+ZrOEH3lDasOj
ehvnYW++5/OdrGDRNXWkaoa3hLfy/v3/+4UoL+dPoKyk9zLvIUvrvLgnXybR4a3hLX5WLGkmvtZS
TVmFqCOyqqby40Px13KN5+/x97pj8vw8L09zTCArRnIeznlYeXlyO8PnbGV9XVHS1p6crXCmfJnu
R52046H/pP2Z95PvMMp17I+Rcl7y3Ui5gis+qvv31qyNvDHH2HepOye9M2yghV28sFEo9418b7na
pHfpRrpQt9StdVvdQd+oZ+qb9W16lr5L363v1ffp3+uF+kH9sP6r/pteopfpx/QT+in9D/2Cflmv
12/qt/Vm/b7+SG/Tn1tbe/RefUAfNIVx1pxuzjBnmrNNd9PDnGd6mb6mvxlkhphhZqS51FxurjBT
zNXm1+Zac7250cw0t5jbzCwz29xl5ph7zL1mnplv7jcLzEJTaRaZxeZRs9ysNE+ap83fzXPmRfOK
ec1sMO+YjeY986H52HxqvjB7zAFzyHxrvjfZUIepMCeMw+PC48MTw3phQ3ve+WHjsCBsEjYNC8MW
YVHYOiwO24Xtw9KwS3hGeGZ4djg0HB5eEk7JWZGzMmdV5EdhVDPKRLWiOlG9qFF0StQ0KoxaREVR
m6h91CnqGpVF50TnRX2i8mhgVBENjYZHo6Pxma2ZzzJfZPZk9mUOZg5lvskczlTHfhzEYZyOa8aZ
uFZcJy6Mi+LiuCQujbvGf4n/Fi+LH4+fjP8ePxe/GL8Svxa/Eb+Vd1nexLxJeVPzpuddY3vubZ3W
MlVspBvZCG6mmynf9lxL27etdCsV6Da6jTK6vW6vQn2DvkGl9E36JpW2PXqzqqFv1beqmvp2fbvK
0XfqOy3H363vVrl6ro2KjO3p+1Rse/v3Kk8/oB9Qx+k/6T+pWvrP+s/qeNv7f1W1bQT8TZ1go2CJ
qmMjYZk60UbDY6qujYgn1Ek2Kp5S9Wxk/EOdbKPjBVXfRsjLqoF+Vb+qGuo39BuqkY2Wt1W+3qQ3
qcY2at5XBTZyPlKn2OjZZkeUz/Xn6lS9U+9UTfVuvVs1s9G0VxXq/Xq/aq6/1F+qFqbQFKqWpsgU
qSLT1XRVrUw30021NmWmTJ1mzjJnqWIbcd1VGxt1PVRb09P0VO1s9PVSJTYC+6r2Ngr7qw42Egep
jjYah6hSG5HDVCcblSNVZzPGjFFdzDh7JdrVTDQT1elmspmsuplpZpo6w1xjrlFlNmKvVWfaqL1e
nWUj90Z1to3emaq7jeBb1Dk2im9TPWwkz1Ln2mierXraiL5LnWejeo7qZSP7HnW+je57VW8b4fNU
Hxvl81VfG+n3qwtstC9Q5TbiF6p+NuorVX8b+YvUABv9i9VAmwGPqgttFixXg2wmrFQXmVVmlaqQ
jFCDbU48p35h8+JFNdTmxivqYpsfr6lh5i3zlvqledu8rYabf5p/qhHmXfOuGmlz5kM1yubNx2q0
zZ1P1SVmh9mhxpjdZre61Ow3+9VY85X5Sl1m/mX+pcbZnPpeXW6yJqvG29zSaoLNr5SaaHMsR11h
8yxWk2yuHaeutPl2vJpsc+5ENSU8KTxJTQ0bhA3UVTb/CtQ0m31N1DU2A5uqX9ssLFQzbCa2UL+x
2VikrrUZ2VpdZ7OyWF0ftg3bqhvCkrBE3WgztFTdFHYOO6uZYbewm7o5LAvL1C3hWeFZ6labtUPV
bTZzh6vbw9HhaDUrnBxOVnfkPJbzmJqd83jO4+rOnCdynlB32Yz21d02q0M1x2Z2TfVbm90ZdY/N
8Fpqrs3yOupem+n11H1Rw6ihmhcVRAXqdzbrm6r5NvML1e9t9rdQ91sGKFJ/iIqjYrUgKolK1ANR
aVSqFlpG6Kr+aFmhTFVG3aPu6k9Rz6inejDqHfVWD1mWKFeLLFMMVH+2bFGhHraMMVT9xbLGcLXY
Msdo9ddofDRePZL5OPOx+lvm08yn6tHMjswOtSSzO7NbLc3szexVyzJfZr5UyzNfZb5Sj2W+znyt
VmS+y3ynHs8cyRxRK2Mv9tQTsY61WhWb2Kgn41ScUqvjGnEN9VScG+eqp+Pj4uPU3+MT4hPUM3Gz
uJn6R9wybqmejU+LT1PPxe3idur5uGPcUb0Qd4m7qDXxw/HD6sX4kfgR9VK8NF6qXo5XxCvU2nhV
vEq9Ej8dP63Wxc/Gz6pX4zXxGrU+XhuvVa/F6+P16vXY/qg34jfjN9WbeWPzxqq38ibkTVAb8q7I
u0K9nTclb4p6J+/qvKvVP/N+lfcrew3me03VHN1YN9fFukR/pe/Qv9W/03/Qf9QP6b/ox/WT+u/6
OUag1/UGvVG/pz/UW/Wneocdf/aY5vor09y01HeY3qbcDDQVZqgZbkabsWa8mWSmmulmhnnQPGwe
MUvNCptHT5mW5lmzxqw1682beqPdbjYfmI/MNvO52WX2mYPmG3PYVId+GIY1w1y9w/QOT9AF4cnh
+LCDGWilYeHI8FKzLWd1FETpKIryotpR3ah+lB81iVpH7aKOUZfojOjs6Nzo/OiCqH80KBoSDYtG
RmOiiZlPMtszuzIHMt9mfohVHMV5ce24btwibh23jTvEneNu8V/jJfFj8RPxU/E/4hfil+NX8y7P
m5w3zY4HdzMSKEYCjzHAZwzQjAEBXG9g+RB+T8Hvafi9BvxeE37PgccjeDwXHs/A4zE8ngePHweP
14LHj4fHa8PjJ8DjdeDxE+HxuvD4SfB4PXj8ZBi8PgzeAAZvCIM3gp3zYefGsHMB7HwK7NwEdj4V
dm4KOzeDnQth5+awcwvYuSXsXAQ7t4I3W8Obp8GbxfBmG3izLbzZDt4sgTfbw5sd4c1SeLMTvNkZ
3uwCb3aFN0+HN7vBm2fAm2Xw5pnw5lnw5tnwZnd48xx4swe8eS682RPePA/e7AVvng9v9oY3+8Cb
feHNC+DNcsuYjVQ/GLA/3DcA7hsI310I3w2C7y6C7yrguMFw3BA47hdw3FA47mI4bhgc90s4bjgc
NwKOGwmjjYLRRsNol8BoY2C0S2G0sTDaZTDaOBjtchhtPIw2AUabCKNdAaNNgtGuhNH+D3vnHR9V
0e7xmTm7m2w2MxtIDAihF5G69CIiTYiIdBERkEAIPQkhhN4iIiBEQEoAxdB7L1JCkQ5SQ0lAehMQ
pQooxfvMbzebPV59r/et/7w5n/1ldr7nzJ4yzzP1nBMHj9YbHi0eHq0PfFkC/Fdf+K9+8F/94acG
wE8NhJ8aBD81GH5qCPzUUPipYfBTw+GnEuGnPoKfGgE/9TH81Ej4qU/gp0bBT42GnxoDP/Up/NRY
eKVx8EdJ8Eef+figMkb5v+mDvjWOGMeNdPJBF+CDKMd7fFDxv+yDNliLW7dYv7Hutu63HjKO0/+T
1tMeH3TT+qP1nvVn6y/W5zZus9rsXh9UgHxQd/igAvBBUeSDvv5DH1QusFJgtcAagbUD6wU2CGz0
Ox90SV1TN9Ud9Vg9Vb85HU6nM9iZw/mqs5SzrLOis6rzdedC51LnSuda5wZnqnO7c5dzX1C3oF5B
ff7rg/7rg/7rg/51PojlYgG6d8Ldh+F85Hxsy2fccj7Du7J0bwU6VcjidJ+GgT4NC+X/y2Rxt4xb
zA/Xzt/W1dYVz1utxiTLz+LYLnaYZbDL7DZ7xBkP4CG8KHexABbKwlhBVoyVZhVYNaafdNrQ+JlS
TzQek44wfiEdZTwlTbKNYsL6uq0f6Rs2aptaa9kGkdZxvsyEuu/MTfrwT1J8hBSfIMVfkeIzpDga
KfZHigOR4mCkmAsphiFFziy2IXpthIZ6Q8O8oeHeUKI39JE3NMIb+hgh9DgGPtDhwIeZzPmDN3Tb
s5Yf+faLjFmfW18wQV5YUApWm43ZyBsHMH/yolF0pVKdW/BOMt075I+0szsO0rUYp7c2bmWFbfpe
en2HkWndIGvWullhn3Wrob+qMNYOotQs3nQtnjU1UcZQygsU7/6P7YVOi+l7hXRff1G6GkiDfsXi
/T2L99csjkP07YGRRP4UKaod7pTc/yln6Z4x3YfA0BvAacsL6BnTM8qKMxd99BO29D097jidD0JZ
QU9PVgMc0RXoHOgiPdbs7t81shvZqXyob7zN7Nby1gpMWatYX2NBtjdtb7MQWyNbc5bb1tL2Hitg
e9/2ASvkWOhYwYo6ngYyVlq+J9uxCs6CzqKsuvMN5xuslvOo8ySr7TzrvMXCgyxBFvZe0MCggawV
9svfkyersYasGX30/bvtPfvsr/ur6Tjy0tFUok91z76/jf39CnoOvfEGwhegSTjXt3Al/v3H40d7
qmfjVmLhrBHTc2naeI7Gz2OHYR5LdB9Lwz85lmfeI/rPHYuTtaS916P+sfRJoPAglkihMWw8had4
eqvda+q301bBlaxJx1SOrmUrCrVnURTu4TnWd3BMm6EXcWSVjLtZx+w4CPIt9IH3yDnuANS6Bnrp
P3IuQnAWEtgQNoI+YyisRy6HsJlsLlvsCa2k2PW0j6mesxLiyQsNWBP6tKSwPpsNPCm5Q4MoNtFz
fhr9g+dnuI8V/CfPVTBddSrpWT86K/3ofI3BufqCzfb5tpDFeUZA3Ft4yyb66LzTjkXiPGV9SyDu
Pk+NcWwTTMf5+7M0zudcLPPxcm6Pd81zDv8TZ0ePsHDM6HR/C/IcVROMmBSAxnpYafpfF4teo6kn
Nid589KexR1Pft8xyzFbv+3WMZcJZ7jTPSKSOcYhaBu7rrs4nzmfOH9x/up86nzu1G84t6KuwlA/
EVSLo9+gWty7zEq1o23kszDmyZAnWXacYT1nKbMUaYbxm820MNVa6Xsh9PymYMwTRs1JRbE77C67
p7aqbSpSbVffqE7/a53W6gPVRrVV7dSHqr2KUB0opf9vOqVZiBwpP1GfqrFqnBqjZqgJaqqapqar
JPWZGq+S1edqopqkJqsptHYQ+auSyEk6L31LdTHBLtFiY09o8eOKK+bPg3gQs/PsPDsL4Ev5Uubg
K/lKFshX89VM8k18E1P8IX/InPw3/hsLEkoolk2UFeXoHAnyfaXkCPmxHCAHykFysBwih8phcrhM
lB+p+WqeWqAWqYVqsdqsvlQz1VfqC7VWbVRz1FK1TK1Uq9UatU59rZaoFDVLzVbL1Vy1Qq1SG9Qm
larWU/oF2Mu4Wy2MhWEkrCTOgs4xeiTPglxjJZ/bmI6qBS129h4t1AqgxcG6smiqhWykJTuOPxjH
n4PdoiUnzsLL3OAGy6VfTcly44yE4YzkwRnJy/Pz/CwfL8gLsvx8Kp/KCuAcFcQ5KoRzVJiv41+z
IjhTxfg+vo+9yk/wE6w4v8qvshJ+AX4Beq95OJsl+8gE2U/2lf1lH1aEakevyATMMnbPuS/Nymjq
Ox9e9s+aD6+6qx6qtxqsPlJdVGfVlb53Uz1YJMXFqXjVh47vIDukBrMj7Bg7yjqz5SpRDVcfkSea
QOt3YyvYJtoqnrbuQ1sQYxepbn6Vfc9ush/YI/YLe8qec38VTUuMiuE21Z+WAWoAl9zJs6khtAxT
w3gO/jLPzfPwfLyA+oSWUWoUf4W/yseonqonT+bTVQItfWnpp/rx2Xwun88X8sV05pbTeVvN1/L1
fKMaqobyLXwb/4bv5Lv5XjWClo9pGUnLaDWaH+PHVayK5Rn8DD/HL/BL/IqfttS3yKtov1IMcwr1
/QOCyuQqyAttKS90YB1ZPtaJvHMB1oX1ZoVYHzaUlWHDaanGUtgsOptL2TL2OpVkK9kbyB012R52
gNViabTUYydoqY+cEs6u0PIWu0ZLA3aDlreRdxpSi+Y25brHtDRiv9LSmD2jpQl7wX5jTbmg3NSc
+3E/9h6380DWCjmrDXJWW8pZoawdz8lzso48F8/FInkYD2OdeF6el0Uhx3WmHFeUdeHFeDHWkxfn
xVk0/5R/ymL4FMqDsXwan8bi+Aw+i/Xmc/gcNoDP4/PYQL6AL2CD+CK+iA3mS/gSNoQv48vYUL6C
r2DD+Cq+ig3HvMtEyrPr2Ef8a8q5IyjnprKP+Va+lY3i2/l2Nprv4DvYGL6L72Kf8j2c2oyUr4+y
cTyNp7EpyN1T+SmezpL5aX6aTeff8e/YDH6en2df8Iv8IvuSX+aX2UxYwFd+/n7+dN7d80pGwcc2
dPs7GSE7yI4yUnaSUbKz7CK7ym6/94m4f0Hft5GDLNZ9N0WYXoe27Za5zp+lI7vLeO863WUP2VNG
yxgZK3vJONlbxv/l3/oL6Xj3J5KVUVVVNfWaqq5eVzXUG6qmqqVqqzqqrnpT1VP1Vbh6SzVQb6uG
6h3VSDVWTVRT1Uw1Vy3Uu6qlek+1UiVUSVVKlVZllEuVVeVUeVVBVVSVVGVVRb2PGSqtxSf0Y6PF
aPIagvJmQRWgpFIqtwpTeVVBVUgVVkWUQwUqpwpS2VR2FaxC1EsqVOVQOVUuWi+PyqfyqwLqVVVc
FVWvqGKKWtTMwkvz8pRykAhmNvGSKMECxFgxlmxJ8ACWqLbI0XKM/FSOleNkkvxMjpcT5ET5uZwk
J8spcqpMltPkdDlDfiG/lDPlVzJFzpKz5RK5WC6Vy+UyuUKulKvlKrlGrpXr5Tr5tdwgN8rNcpNM
lVvlFrldbpPfyB1ykZwj58u5SlD68+Q9ZZML5U65QKbJu3Kv3CcPyt1yj/xWHpXH5EV5WV6RV+V1
eUv+IH+UP8kH8mf5q3yqLMoqz8ldcr88IA/Jw/KIPC5PyhPylEyXGfK0PCO/k+flBXlJXpPfyxvy
prwt78hH8rF8In+Rz+RzMls/5a/s8oX8TVGDV96XZ+ksNaZyRj9rRXscTqXMcMopo2mpAP9SEZ6l
MjxLFXaSlqrwJtXgTV6DN6kOb/I6vEkNeJM34E1qwpvUgjepDW9SByXUmyih6sGn1OcBdC3CeSB5
lrfgWRrAs7yNMqshD+Eh7B0eSl6mEbxMY3iZJvAyTeFlmsHLNEe51oIX5oXZu7woeZyW8DjvweO0
gsd5H6Vea3icD8jjzCAv9iX/krzYV/wr8mKzyAd9CB/UHj4oAj6oA3xQR/igSPigTvBBUfBBneGD
usAHdYUP6obSsztPJU/UA56oJzxRNDxRDDxRLDxRL5SwcfwAP0C+7yA/yOL5YX6Y9eFHyUMlwEP1
hYfqx9PJQ/WHhxoADzUQHmoQPNRgeKgh8FBD4aGGyVHknYZ7LPhvWeA/at1uCy6p7+cWo8QoWHA4
K0C2ms3Hdt02GUA2rO1aW7HZhl+GFYf52jFm9JXgpajaeo8/pvAvwqnnHXF/NvzvtNzlHovdSNa5
Aza5mKx4CyxzKVnxErLjVWTJ2o7XkR2nkiVvJwve9jurPeuxW7fVHvwP2K3u+WnksdvCZHkcM3Rz
69oR1fSXUu2oMNtESzGqC5ygWtlFWqpQ/egyWe9VWqpRPel7st6btFSn+tIPlMYjWmpQLfIXst6n
tNRiz2mpTeW/ILu1cKqTcBu3kfX6cztZr4M7yG4ll2S3Tu4ku83Gs5HdBvNgstuX+Etktzl4DrLb
l/nLZLe5eW6y2zw8D9ltPp6P7LYAL0B2W4gXIrstwouQ3b7CXyG7fZW/SnY7ho8hu53Cp5DdJvNk
stvpfDrZ7Rf8C7LbmXwm2W0KTyG7nc1nk93O5XPJbufz+WS3C/lCstvFfDHZra7jRlJtbTnZra7p
RqGm25lqbmvJbtfz9WS3G/lGstvNfDPZ7Ra+hex2G99GdvsN/4bsdiffSXa7m+8mu93L95Ld7uf7
yW6/5d+S3R7ih8huj/AjZLfH+DGy2+P8ONntKX6K7DaDZ5DdnuFnyG7P8XNktxf4BbLbS/wS2e0V
foUN8aM/NlTWl/Ux9y87+jY5s4jvybKW6jqGSGH6CWJZ8Ya46SXuFqbuicAz61hzT0x1yiOjWJIp
rhjFxVMb3jcuBC2fFE+cTnM1xTjEODGZbHqqmMrsYpqYxgLs79vfZw57O3s7FmjvaO/IpL2bPZop
ey97LxbseOh4yEIcjxyP2EuOJ44nLBRpTUGvu96eYXuO7QW2N7C9BdvbsX0Atte9wdweD+2gW8Ui
1aBaiUFHb+D9y3SkBp2D+bTcpt+4z/T7D7Pikwwl9FOz9XOpL3rjLSKBlkciFc8d0u9+yyT6SSv6
jWFc3PLGCREujurn19HnlM+am+ij+9IZtRmz1g0Tcym+C4VuiTCftfUzXZvQHqWJDHE+a31+W8Tj
eUiG2CS2iz0+W7SmT16KT6Fja+2zxSZRG8+fMsjLJumwdwt9B5U+C6V94vR7gjJ0zYqP9YnV82d3
UAp1RQP+wie+Bmb1GuTFy4kqPr9ZD++an4i5wVmxLhGEWbuCv+Aun/icnK4BjyRPfZ3f5ilZhL3g
5/E0DIPKuDSe4bPNASrn9Jxe/ewL7/Ujy1yIucf66ZT5feLHk+3Pxsxezv2z4qluPoLrp9jqq3c3
63qzkWwk78F1r5V+4nKGD+nBm/F6XPdc6/vEtnqJlTUjv1SFl+R6Xql+OvVcn60qUc0kjOvnKOp7
D0f5bKVb9I+4wF7pZwZHe5jbjijvixliBpOWyZbJTNn62Powp389/3osiGyiL8uGvO9C3i8L2ynn
/NH5IyvvvO98wDB73W3t9gg9qkJ5YwuluEMcYHnFIfIGr9j62vqy2g67w87qODY6trO6zp+c99BT
LUQy/XKmJQaIWd5t89C2p1hRypmXmUtcpXRes8Xb4tkbSK0mUquF1GojtQZeT8TFPGgyeu9+Rngm
dKO7ZUT2rIkeeQrN9FqUpoW81iJtUbTmItLiGFcJZfoaWxw7aF+nIbTTG9qFkH5mdJIYD2/lwjY5
qXxzb6M9YeZWWeFdnrDPljpH0Z5UomsTzwaQpx3JxrKJLNnTH6zvAUtlO9g+dphKzDNUXl7HHS1P
KPdaqI4aRHVQuvZUpyzNK/BqvCbln4aUi1rxdjySd+OxPIEP4ol8FE/ik6ikSqGSaKkYR/s/TiSR
JonPSD+jfRFivJhAOkFMJJ0oPif9nM6KEJPI4woxWV8pMYX8riDvm4wrOE2fB7qOQsygHCQskykH
CVsfykHCvx55VUH5qDVpa/sHpB/Y25C2sbclbQtv287+IemH9vak7XUuskeQZxX2DuSFtS+OJI20
dyLtZI8ijbJ3Ju1sJ49m72LvStrVTq1Q8tfdSbvbe5D2sPck7UkeXNij7TGkMfZY0li6+oJ8ehxp
nL03aW/y5cIeb6d9tvexJ5AmUK4X9r6UQwTl/UekjyjXC8cTyvWC8v59Up33hfMBcpLd5+7LnLCt
d5m7//ifZWG5WOaIYqDjMZ3VsVrFTeTVlYyr5eRLspNfqMfb8wF0hZdT3f0yfyZChUs0EJFiCF2l
1eKguE4OKZdRwWhkdDESjS+M9cZR45bFYslrqWJpZulhGWlJsWyynLD8ZPW3FrRWt7a0xlrHWOda
t1ozrPdtgbaitpq21mSHSbaFth22s7ZHfkF+xf3q+rXz6+c30W+p3x6/i36/+of4l/YP9+/gP8h/
iv9K/wP+V/1f2HPay9kb0pUbZp9uX2s/bL8RIALCAioFNAnoFjAiYGbAhoC0gNsOmyO/o5qjhSPa
Mcox25HqOOW4GxgQWDiwRmCrwLjAsYHzA7cHngl8KJUsJmvLNjKB6taLqfZ6Xj6hOntJahW0VwPU
JDrz/kyxEJ3D/ccin9+E3vCSJJAkkCQT+QzkM5DPTGQ8yHiQ8SYyAWQCyAQTmQgyEWSiiXwO8jnI
5yYyCWQSyCQTmQwyGWSyiUwBmQIyxUSmgkwFmWoiySDJIMkmMg1kGsg0E5kBMgNkhomkgKSApJjI
LJBZILNMZDbIbJDZJjIHZA7IHBOZCzIXZK6JzAOZBzLPROaDzAeZbyILQBaALDCRhSALQRaayCKQ
RSCLTGQxyGKQxSayBGQJyBITWQqyFGSpiSwDWQayzESWgywHWW4iK0BWgKwwkZUgK0FWmsgqkFUg
q0xkNchqkNUmsgZkDcgaE1kLshZkrYmsA1kHss5E1oOsB1lvIl+DfA3ytYlsANkAssFENoJsBNlo
IptANoFsMpHNIJtBNptIKkgqSKqJbAHZArLFRHaA7ADZYSI7QXaC7DSRXSC7QHaZyG6Q3SC7TWQP
yB6QPSayF2QvyF4T2QeyD2SfiewH2Q+y30QOgBwAOWAih0AOgRwykcMgh0EOm8gRkCMgR0zkKMhR
kKMmcgzkGMgxE0kDSQNJM5HjIMdBjpvICZATICdM5CTISZCTJnIK5BTIKRNJB0kHSTeRDJAMkAwT
OQ1yGuS0iZwBOQNyxkS+A/kO5DsTOQtyFuSsiZwDOQdyzkTOg5wHOW8iF0AugFwwkYsgF0Eumsgl
kEsgl0zkMshlkMsmcgXkCsgVE7kKchXkqolcA7kGcs1EroNcB7luIt+DfA/yvS+xoDy1oDy1mMpT
XYP1H6tV3IRmkb4gfUH6+hLUd8dqFTehXqLrwP5jtYqb0CzSGqQ1SGsT+QDkA5APTKQNSBuQNibS
FqQtSFsTaQfSDqSdiXwI8iHIhybSHqQ9SHsTiQCJAIkwkQ4gHUA6mEhHkI4gHU0kEiQSJNJEOoF0
AulkIlEgUSBRJtIZpDNIZxPpAtIFpIuJdAXpCtLVRLqBdAPpZiLdQbqDdDeRHiA9QHqYSE+QniA9
TSQaJBok2kRiQGJAYkwkFiQWJNZEeoH0AullInEgcSBxJtIbpDdIbxOJB4kHiTcRWIkdVmI3WYlu
RxFJAEkwEdiPHfZjN9kPtaN0y8auCTSLoER3oER3mEp0B0p0B0p0h6lEd6BEd6BEd5hKdAdKdAdK
dIepRHegRHegRHeYSnTHVpCtIFtNZBvINpBtJrIdZDvIdhN5CPIQ5KGJPAJ5BPLIRJ6APAF54kt0
q9R/rFZxE5pFfgL5CeQnE7kDcgfkjoncBbkLctdE7oHcA7lnIvdB7oPcN5EHIA9AHoAIFuTbJkZ/
kUKfT0n0F1VEK7kJWslN0dvTDG3l5mgrt0DPT2/0/MSj3TwI7ebBaDcPoXbzA6bfEDIb86KLU+u5
BgtnzVgbFsVi2QA2giWxZPRTo/cDIfSAIIReEITQE4IQekMQQo8IQugVQQg9IwihdwQh9JAghF4S
9Pn8zAT6oizungTc2z2OGHP8TPEO7H0g0+9ZCGXlWHXWiLVncZ691U+BWM/24Znp19ld9isP5KE8
Py/Ow/Erut6V7O4dQE0rGWXmDE+MrmEl4+pnxhxFzB2fmGOIuYsYnWIaUtSh497QCW/opDd0yueX
0/HL17xpZHjXOu0NnfGGvvOGzvqkcQ5pXPemcd671gVv6CJC7vwVirpGMtVWDfEl/T9A/2d6U7uM
o7qXeZy615py3UJqZfmJ5dRuChQrqb0jxRpqpzjFemoRZGMcY4QBmI2g09B15y9RT57pidmPmAOI
0T2YG8Ul07jIFc/V1/2Q6G90f6OrrHuJhKgialKc+zluLT1xhUVJ0jhPr31mrBKhdDxtaAnzjeeP
+Av6nbpYLCZylusr305EmmL38MOUTogIF41M8cv5embhz/gz4RKVTGQS/4JZ9bgtvyxCf/fr/fgw
2v8gU1wkp3KOr+bPTLGNOIX0iBi/boqvxGt4n7hx2ETCeGHSmegNzYq1cUU6ii/2jSU7eEKp1+Bx
PMkUn8EuUnxR3lo/u8MnXj+d0aLH8Hlt91uUvEQ/LcjCHrKHvBhvYCJj2SRmZWf0QtsVNzH9xCEr
24rlPg8xsRZMP0X/hSmuJgvHXt8yxRYna88cR8iMC2V5SffwQE+szmVLRcY/qZ/cO+IFP8vhZwU8
rEEeNoE8lPaqBeFVC6EHsrCnb12Ppbt9lvZWGAcj36MVs2BFmncU4J80rkB1CgPnQ1tjQfd7i+jz
Hn4NM3LFek8PrA5PMPeUouU9Dq3syeCLdWr8IL9BZ1z7w4KiDdJrhfi1GO055R7l8sbOxGgVld78
oWcMyx0/Uug3l+pRuZI+sbGiLsakyOYE84lvpdfiA+jzwie2trYsTjVenszTfOKLa6vmDfEc/azY
EP0eMF6JQt343Kx49ozrd2PmZfqdelmx1/lBjEMJXp0n+MQf5vodQ3eJxfvEbkCK5J0pl4f7xKdg
hG4HrV3PJ3YMLGsphS7qUTBvfBzXfodKQ57TJ7YN3lY2hOkn0tz2ia/L9XtL9XMzb/nElsY7z5pQ
aIRn5MsdHwoL0+N/qZ5YoUtuPXoiJtL1NTAW7Id8hKcn6v7Ev2NsVzC7mC3mUKrz0FO4SCyi31kn
1jGr+FpsoFLkCJWf/iKNSsYAcZLKwkBxgcok6SnRvaPS2JMAlDuLKecxsULotyuuQW/ZDqHHg06R
5VrFWSoB8URKKqmzRq9gSxiH0u+O8vTzu0eNSedDjzP3E2X0mcl8Ts/7/6TRce1lxpGNMTEJo8w6
FYFUDKRiQSpWpGJDKg6kEohU9FNqKpFPpRKaFcWscgvFcrddok5Yz3kfYyQW9xgK/b8PbsBbMPIT
9emK9SU/4X7Ej37PjIV8+iRa3M9Cbe2JP0/xtfkgWvaZ4vdQKVCcr/eUGpmxKyk2hKfw6abY6fT/
BR/Ph5hiR9D/G3wAjzbFRtP/NLLBZqZYnUtTeQte2xRbm/7P53U9pUpmbEn6P56X5tVMsVTWswE8
p6eUaf1vqSe7c/tsT27nyO0G5dSVlOePUH60IZ/7IZ/bxRnKfQFUivwEO/knzcHwzqTQfnwXdAd0
J/L4NOhn0CQo1cyZfi7qSYfTGeNQ7M+ec1qYOdU+tV8dUN+qg+qQOqyOqKPqmEpTx9UJdVKdYn/2
fKUhzIn7xFye+23cd161xt1H7vtQhDqt9kH3Qw9Av4UehB6CHoYegR6FHoOmQY9DT0BPQv+hfQrq
LH6B/gp9Cn0GfQ59Af1Nq77DlJRDBTQA6oAGarWNhH7yp/vkHT135mEWY45xxYC/wj0x5bzlcE5n
fuZvnGOG8ZVxwUiiz63fx3juOtJ3rZX2bhdKa/l51nrm2crnu882E7GNhbxtcX0PlDMvcxoXjbvM
cByktb+l8APjFoV+NNZQ+JKHV/o/uGl7+rW/ub0vZ5l3XSVhv3RLpRxr48zHQv5kr4bro/NJ373m
H+3fX1jTsyfDcYb+9z5V8F6zAiyY2CXPtvq+1GW4htd8vj3wbKlrVu4ZXlZnAWess5czztmbue8v
gjWqdJWhzjj1/Ow/vnPor9yXo9tKe1jmHC89UyPGW6P0z6zlMX3PUF600fQeWTBW4m5t7/aEMmvL
WW2yzDa8O40oamnn/RNrEmKaI0OXdNB20I7QbtDu0B7QntBoaC+t5OEyMFsg4++cV5ZA5/J391ab
7l6j+qxDt7MnQadppT1Nx56mY0/Tsafp2NN07Gk69jQde5qOPU3HnqZjT9P/8ZLeUgmzD3LyvLww
lbguat9VpxI5nNp/LajEbs+j9DwnajcO0TOhqJSdomdK8YXU/lzLN/Ht1D7FzCt+nl/lt/hdat8+
E0L4U/s3ROQS+UVR99wvUUPPDRNNREtqEXcQXUS0iBcDxDAxUoylOmAytfznUl1rJbXkU6mc3CcO
ixNUZl0U18VtcV88ES8MC3mwICPUCDMKGsWM0kYFo5pR06hnNDSaGa2Mdkak0c2INRKMQUaiMYo8
0yRjupFizDeWGquNDcZWY5dxwDhqnDLOGpeNG8ZPxkPjVwuz2CyBluyWnJa8lsKW4haX9yolQT+D
jodOgE6Efu5zJSdDp0CnQpOzrrCYAU2BzoLOhs6BzoXOg86HLoAuhC6CLoYugS6FLoMuh66AroSu
gq6GroGuha6Drod+Dd0A3QjdBN0MTYVuge6A7oTugu6G7oHuhe6D7ocegB6CHoYegR6FHoOmQY9D
T0BPQk9B06EZ0NPQM9DvoGeh56DnoRegF6GXoJehV6BXodeg16Hfa7Xgetn6QPtq9a/nY4utoR9A
20Db+tjoh9D20AhoBx/bjYR2gkZBO0O7QLv+BfuOgcZm2bo9DtobGg/FntsToNh/qi1qxdV04Go6
cDUduJoOXE3HVug26PbfexGq0aXr2VHQn6B3oHeh96D3oQ+0/htqt+4WEcdbxQLxPgdG7a27Rm5L
Z0sXS1d858z9p/sWRGSP6M6ecJ7e7rB+F06ehhHx0SXrx3XqXrJO/7geJWvF9YwuGd6pQxyFIjr8
Tej5De7eE8Zy6fcihrh/Mtc2V2KuzTZ78ZHhIx9L7idSEnMtpaiFgvOyDpfdZi2hDJHLylwRtoAS
Nm7hiZUFt6Q0dzV1lfSJCZudd1gYFWN6acw6sN4shqqEnVg8fWroxVXAJzFLyObC+8sWHZtDFrIM
u9lvaPi81HH9aqUkvpToSrTsdCUaS1IMwYUI1m+n67Wm9JjuiYvzNcIO93JJ795yK+1XX+ym8a7F
FizebV422JVNf/EPDngvoneXrtGd42Oiywa5lI70C/Zr1imyZ0x0ZNm8rjAdExD80jtdO8bF9I6J
is9fJyYuNiYuIr4rbVHAlU9zIzhnFm/RtWenUs3jI3rG5m9Sp5Yrbw5ZtqKrfDlX2cok5VvT10qu
St6vruFr/iV7Jl0OzR3BlncaN2lW9hVXEffXvNF1usZ26RSXv27zN/O/2bxRtdpV3qxTqryrVoVS
lctWqFC2iKuQ+4jC/vCImneKS+jasZMrkRf0PcPcyoxE7mQUHyASOWe3JmxZPep5SEyBSsWMqPLV
ovyffvD23CUpxSo0qFPOf/vIa/tfP1kkdWCNDp+cGnzHGd98zr0JHUfFD71R+JDRZPe9Ayx04Lyq
K21h1esO+eWHXauHp+YotOl5pyovfzz0QMqrzx9V2+4o0+XhxQqNBsfk2B49bfGvQyOKHCsamxY/
+EJE7zaHWxSv2tQob3/SZFm/vaP915/4uPgb6Rn5mt6686xLu3XffO/Xpdy4MnFNXxhl6zfdnfZD
nN+K/JOfnOn2pG/nq+2nxzZc8ua3Q/xXXBt+4r0j1Q4G9/my6KGU2V2bpFYbNenCyhZVzo+uemhk
uXnjnUO2/XhwUpH5tUZGFN17rvKQNvJGjgOV6QDWN1r7JHehHwS1V/icRG6nM2J15aFTmkdZQi0h
T54X+sQ6aVjLQ+Xn1drR46B/pX2rZyMP5SlkyekKHRZSqMKT083qxQb8WPNpwtM1JVburLjG6Wqh
V8hnecf1tuutlPopb46s0yU+PrZamTId43qU7pl5nUp3jOlZJrZ7Vx1bJjYuJrJPx/jeZbyXUV9F
XETKlaVpFVcrmz8ZptXqx7mloauBKzzzu0uMrO75gb59+/7RD3SK+xspx7uC9f4WsQS6AjKTNPx/
Z5CGziWlLGsPvOp4/1npWykrGjbqYnky8cdXd0Qd7B67/5MbWz951vbhucbzcsX0m7qsu7VK01px
X1a9miv3zp69nsWuP35w/fhWlmJvnMp756M1ITkDJzsez8sWnLzn45btfiq/NrDyumG3fs7e5XTp
gSP9414LGXji9NHQxtvLOPKVOnAt99HlN0es/MzRtveG0OE1C7UqeSti8YstQ4+Pax37rP+hqCmd
Oq6zZk+4XPy1Ej8mLp1++5VaC6aqQqFf1drXqGfzbDUtB9tPO5N8u8TyqU8vDv5506fsYZEcQzsM
2Nz0vW/u3j30Re6I3ssmjy2RUHDhktgqa3mxwVG1m5//6qHfoNYulWi8/2jEyI0vFemw0pF25N53
U94kN3ab3NiJLDfGA0r2X57ef+B8PU2dvv3ejfX/lziLQq4CbqPP5csjO+Vv3rVzNKXq48gquSqU
rVyhXIWKbkdW1fvVNfyjf4cj86xu/Mnq/6djmvgsptLmS8bGYqfqHZsdsWlevacdQ2uU/qV+2t7b
P+6dtqpo0z5bzhx02kKyze3x8sztH77TYvTVd5pkjDs0K2Je3+DpYQt+lPGPF7Tsf6PY4+ZpqwZ0
vPjzpKlf3z5d/0mP1x8UGbUmNWC3ZUHSoI/DE8Ii6i1+edeADp9+s6Pi4qetYnZ3dHz+lmt47oEX
hg5qvLZ+zw/7ha1Y/3hKcLM7G4+9U/Va7/PhjaqHLJ4qqx78tOmlNsdeu5vU+Zar/aJ3Wn9ZZ8t3
hTZtd6a/HfTlF+/cbTp7xOKrXyx4/dScOwE5wxf+uqrRvGT19ra7IQ/YvpXhpz54USV9dLZS1k11
ROOCbEqRZYMrRo/osiR/zirFXoTNDlo1L9Mxtacz0uaPDNXw8VajXwSUvVX00PWeeydM2Dhp7Oyc
EZUruJpqnM1C/mJuPVfd31+f8q6y+qs1uHj5shWrVizhquCqXLV8RVepspWiIkpV6FjJVapDpQ5R
papGlutQtmOkq2LVKhVMDvDbbDcOpK0NbcX3Vy5dPjR0Y8PpAflcLd0OsLGLXGAKucCRb/6/HCDl
ZcrJlIk/dFUpVb5sKSp9XXCBrX1cYCMXOUEfF1jjr7nAP0k7/o/83fyFzSdceI2/iGhra/1D1N3A
jMenRxxnTVXQsbnHchT7fmz5KiUy6uwxPu3zQ/mJDxdd7vxcfDcvT6P/qc4+w5rK0gAAJ3QCRmro
HWkSchMEdASlhmqoBoEoBqVLMdSICkRBcAAV6SAmdBWkqiggNlY6CAgMRXrviFKVDTgqM+Pu7P7Y
x2d/Jd+5uSd5zvnOm++cq6VzXEB/qN8YNn/x2nwYey0pL2M9647th/iT1QGvKs8nO8+IkJ4vNET5
G9p96Ngl2GHO0R5nNqdUwRdFVr9JgWTCYSkv0N5MU91LnZn6yhYc7EdpiwNg67qf1502nungBg9z
EBXT5khV79T5GGe5qyDJVvQad5rjU4NTaW02DIb4FehzTXQREWvETmHRFfp1WVderjUC3SOW7KTT
0+zHjXX0I2X54evND5nNbffF9MNePZ70Uhq3nBuYgr3kfc1QfLAJf3nwoXZ4THooQKIvp3qX8cU7
CF5Rin+7WkP+mTnbbT0gzNFS4TcX5U+D+WC01IFH8gE8f2hk/jYvSDiw94sLkt9dMPPwoOJAnShn
B+dTeG97UQ0fbycPgrM3cRszANiviEShkAcUUVTMUL+HqK3wZzr7d4IVEaxwfMDpSqGkk6Kimom+
5mcOCbR71NctTLp+joex9ff94n2J/xGCjJrefPdCEyPxlgDqVrKEhNfeF9VfmnfKPWIYmVlBNDyb
rMvY9WlP3y2fsKa7XtqBHcHd7ysWlTNqcDo9+Xlq/TJO8fzZmQQv7AJPzPAnpRgCud3XVthP51LI
flizlw39E0ezyMwiZ0QXH8vnaG/ZQV+ERS8XYLXSEmn3qa7GFo00eSzNOawONBFk2WTEX6tg1Mgo
tesNlP0MITgMliQjR496ZNhhfGqsBW63oKM2lssE+oimpL6xiZAyHz9312AR3aSiuj+1xA+XyZMa
Wcd+Dav6PJfZlrb1q2AnqCNiDezekoETDN6kowdoqS879PqhJFtYCe2mo6NmYCjAwcD8+9aEG0xH
v90xtfz91kaz1cunN0hMq9TV2IGEkwdzkB5ZquWdcIDv24e4aOhYhSEgc5APdTujBdL4g2XQXNJJ
dax0/Mgezg25AYh5rNVwBmDyxTJ9QBfQIWuRNUIP/+eWfbtMoKb2FkHbilnsUEwPoKK8Q7H9/00h
t7VgtL70+le/aMAgqwOHAqXQ+VMe6oWoBy5TUIR7jv7ylK3PjNFBeIdWHsvnugk4Ml2i/rxJQpDY
8Vw1hNGTtBxsypBnWWnJCvGBPmH50KRGYO0AK49zXWaKKHyNxeQVtgE+ZNBS7jmWsyuNNhPbX3rV
0HIxVjNl4f3c7FCoyD7VUmzSvLlEiFwGSfDmYAyj0OIgZiWCUjvOmXkDUy3Qco0QK3fWLZl/RXDe
vN2xXnwTJ9SQFlEhXUQ8hdVOM21YnUg/hu1NptHRRtgudd1vI6HcNzJiOYennMfupMk/rd7LBrWP
Suz+kLbGIcVsvz9m4ZyIQdmbAex4s38cL65GCWbbe1NIPwr+NG+ftuAsGzc/6Hivko1YY8Jr5tkQ
aISxG5QTo3ZeVi+F8Ob9mdrn057pltGWF2IiyQJ6tNbLTemOEO9M5Rk4gqd6lKDCseRRqOpIWjUr
ilSE2QtDr/ayvTu95NGIbmvlmSC+oitpXZfvE7mamgtZ55RWzxteHbgTiC5jPKlrf1IdU6A5jZkp
9iV2QvYxuwkGIUUGoRa9I5T1EV22vNMJmyYwhfOV9GLnBmM1pJ1f3rwWWxPZmSx2fxcuZT7tfqjT
JVYXeJmvK0goLm8RFvARdknycViTS44uEpHUM3RWrQN00U73TWNYTSnvGpQQ+TxdLZ9G3WXTOTlu
kC2HrUTFhKn9pRpAYmCk+j331W+Y075tvwV/ht+ACrW2oIqtpAgc2PIbuR0qAlvhz9vu/53etyln
Cvu69aLlzrsq8A1UDA5VJZpKmOQ19vJiJHfPvsl+Y5TnDYiyTzG+tYjl1o8R0Iy+n4ADpLpAruMB
FdPhjLuXoXQJ8+H1InWKklduLS45CspvBIyFCU2OYdIpzyXMayPXdJqYm0/kNxdo0qWtZp256dgh
04M2LwhtHpFBK0jnhhofNWMdppVfd7l+HXC/8t4KuLV2sT2+eFws/uJKC+d7pkfmbmYlOtdv64EM
dB3YpWUdcuKHWxmCDdJWL2ez63Ixk25fnjnq/xmcJGTCFAJiA9Azj95JoMtewS1u5wv7ayD96pP7
Dl66ScHTPBDaVbixnFwEbhQ3tNhcpX/5QpTlq973qCOS/e/0/uFG+A96s+3Um9oCAoITvuAbfB0I
jvwxv5RTGfj/eXqS2Ih5MIoBOTPPyOvYEiOngv3/jfr/0dadOtZs8Vdf4mi1lXsnSvL8uhuJpkfA
hQreZ23cWDnvNT4NuFaq0MaRFuFmV2pJU4cR5TRJ7D2nPmhZln8sSXBACByaW+a/+Gvz9EHw7ODT
axD66ki9wXlz7l7je9HDY5Eub4Oej8YsMiBCaCduyEmKe65/3Bj2T1TYtcw46FnOi7kV5QohxJZS
DqQ4wqtMoZN2uMOwhF9FDw8y8qNW65EGvki1vQSW6klPtc0QCGffCwg+ar6jlGcK82tgldLeE+mV
U+UXWDQD2swJYrNAbZm/Pc4GzAPhgrZ0cSV8UH3scKwYjhhbDQmtN8WO3/KMOZN7wKjtI7HyLu85
O9m5tGTZfQx+/HY1asJuIqR5ltfyZU1axSOr0xceDGXkeCuVYqrOSnBI+bKomkWctUZrcZUXFxcc
cay+rbkZRBQLSuUGHMY1OU7wV6eKizVrTeydKFvSq5dv60QFGUnJ6UnaWk9i57LeJd6q/cWjIlja
m4F91lesMpn0XNriYaGLWjjFF1/iTuHMqryrO8/h8ekq6kzR5z7T6giJGoeKW0JXOE7TqMHzra6V
DouNPCioPVXib0HfpqFgkhtTkOl/r5gc58P/W/QVTh9xBCqHyZ1sE7Gnkjx3uVasfUrYuCZpVr9/
GWzvEc5yodq5etR9Mju+ESm7Ca2ywXUeEaB0riFSDyschbnWcKZ/QpLoqEuYLpsGDAaoy+3n1cs/
Pjb5fohMDn61Va79nr/MtEjWnSfU1B/wPWJBQoGdV7m3isGvN9IhqSgdeZLYJYDv9vYQtULCSps/
PS40agdO77iFFYkFLMhyQTKgIyBn0CkQAeSxfcjtAPIGiYIsQESQJzVypLbjqe+cQESKVJDkv1ys
FkRPD0cC3tOJiPjTnwodCQzCaMqXs+BvkBDsz84cPaxsOtyj+iCp2D5wmmeYol/RdYf+Nwev9+lZ
4Nl+Ecv3qTivx8ormWPxapXvVnnXXyg5VRAfOXmxvZVp6eaTumh0pU8htZwpXy6OTWrIKGjdvqKx
vKifneALRZ6FjkoI+jFTfFhkRkkLN7DhV1RmgtWZ26zHFy9okVT8vJLj0NgS710MlxgmUh4Y+h5Y
hRi5mzwUHdWeIbsNrPsqd931C5Y5Khsljo+mPOHueq3Rfmi3avJT5ThW8YNuBjAmGdqsSKfFt5Xi
EzK+i8e6+hez1vYsMCSNehV17rFmh9XtQfSY6w91/eY2TJztut14bx6tWZ2u5RlAIdHIACQaye9z
xIAk0XBTm9i3szLqp1UBP34isSMnjwO8O1OS5fuTFTD1y79doUfu/nLohgRQKOAAoGT9l4xcv1zv
lJ5dK/AsF32vSTZ5Lx05S+lPXm/lyshczeh9n6fRF/MiHZYZKeRwCdMGrWY5In5uQcY/wdiLKKgc
E13SZd5wsNXRgBvcU+XCzKCPkjxhgjccyYqvbDGBQO/V4VzWBPAkVx3tF7V8QSVQf/H8kvpDYdCM
nId2YipemuPtPVzkgrYC215FRWs3seSRf+yfMUOzZBZeKG4V1Hpd0hut+XHC8QJfkKEci//GCVJz
i9+h47GMYiemrVqO1zG3+ghHI5S07Cwf9tz/lI0fYkqEJNXhhUuhT5pxHXoNxMT0sBfXLz4bY5DO
JUs382xAqlCEtnfuGl0UrY2Bz5NeOr8ENgW22oalNw0y5o4VTN5xc+B1UCSPza1kitmD/gmPhtO4
DQplbmRzdHJlYW0NCmVuZG9iag0KMzA0IDAgb2JqDQpbIDBbIDc1MF0gIDNbIDI3OF0gIDExWyAz
MzMgMzMzIDM4OV0gIDE1WyAyNzggMzMzIDI3OCAyNzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYg
NTU2IDU1NiA1NTYgNTU2IDI3OF0gIDM0WyA1NTZdICAzNlsgNjY3IDY2NyA3MjIgNzIyIDY2NyA2
MTFdICA0M1sgNzIyIDI3OCA1MDAgNjY3IDU1NiA4MzMgNzIyIDc3OCA2NjddICA1M1sgNzIyIDY2
NyA2MTEgNzIyXSAgNThbIDk0NF0gIDYwWyA2NjddICA2OFsgNTU2IDU1NiA1MDAgNTU2IDU1NiAy
NzggNTU2IDU1NiAyMjIgMjIyIDUwMCAyMjIgODMzIDU1NiA1NTYgNTU2IDU1NiAzMzMgNTAwIDI3
OCA1NTYgNTAwIDcyMiA1MDAgNTAwXSAgMTc3WyA1NTZdICAxNzlbIDMzMyAzMzNdICAxODJbIDIy
Ml0gXSANCmVuZG9iag0KMzA1IDAgb2JqDQpbIDI3OCAwIDAgMCAwIDAgMCAwIDMzMyAzMzMgMzg5
IDAgMjc4IDMzMyAyNzggMjc4IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1
NiAyNzggMCAwIDAgMCA1NTYgMCA2NjcgNjY3IDcyMiA3MjIgNjY3IDYxMSAwIDcyMiAyNzggNTAw
IDY2NyA1NTYgODMzIDcyMiA3NzggNjY3IDAgNzIyIDY2NyA2MTEgNzIyIDAgOTQ0IDAgNjY3IDAg
MCAwIDAgMCAwIDAgNTU2IDU1NiA1MDAgNTU2IDU1NiAyNzggNTU2IDU1NiAyMjIgMjIyIDUwMCAy
MjIgODMzIDU1NiA1NTYgNTU2IDU1NiAzMzMgNTAwIDI3OCA1NTYgNTAwIDcyMiAwIDUwMF0gDQpl
bmRvYmoNCjMwNiAwIG9iag0KWyAyNzggMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw
IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDcyMiA3MjIgMCAwIDAgMCAwIDAgMCAwIDAg
MCAwIDcyMiAwIDAgMCAwIDY2NyAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDU1NiAwIDU1NiA2
MTEgNTU2IDAgNjExIDAgMjc4IDAgNTU2IDI3OCAwIDYxMSA2MTEgNjExIDAgMzg5IDU1NiAzMzMg
NjExIDAgNzc4IDU1NiAwIDUwMF0gDQplbmRvYmoNCjMwNyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRl
RGVjb2RlL0xlbmd0aCAyMjU+Pg0Kc3RyZWFtDQp4nF2QTWrEMAyF9z6FljOLwZlZtJsQGDIUsugP
TXsAx1ZSQyMbxVnk9pXdMIUKbJDf+8SzdNvdOvIJ9BsH22OC0ZNjXMLKFmHAyZM6V+C8TXtXbjub
qLTA/bYknDsag6pr0O8iLok3OFxdGPCo9Cs7ZE8THD7bXvp+jfEbZ6QElWoacDjKoGcTX8yMoAt2
6pzoPm0nYf4cH1tEuJT+/BvGBodLNBbZ0ISqrqQaqJ+kGoXk/uk7NYz2y3B2P16zu3poi3t/z1z+
3j2UXZklT9lBCZIjeML7mmKImcrnBxbub1kNCmVuZHN0cmVhbQ0KZW5kb2JqDQozMDggMCBvYmoN
Cjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTMwNTIvTGVuZ3RoMSAyODEwMD4+DQpzdHJl
YW0NCnic1HwJfFNV2vdz7s3WfV8gLLctLYUuSfcWChTaslUQKEurKE2T2yY2TWKSbi4MoAIWHJkR
dWBUEEEFBQO4AO6MC+46LiOi4oK7dXBGZFxo3uece9Mm0DLN6zfz+95zOf+zP+dZzz1JW4AAQCyC
AoSq2lkzprz111iABVYAbd0FC2tnKjjuUxx8F2d9fmGtLj/v1U/PAJB7sb14cdWcutaX2hYDKJ/C
/JGx1eC49Of7wgBSNDjnImO7W9ij27kTYHwyjk9ocjS3PvPDRA9AqglpLms2uByaNAjF/eqQXnyz
taspoTGiE0C3EEDlNptaO9f0di0CCNsKkGA2iwbTUfL8l0g7G+cX047YuNBibCM9GGNudXeW/qBA
/jlscu9a7UZDXq/+UYCiIzjnuVZDp4MXFD1YX4sTBJuhVVxUv+xVgJINAMPvcdhdbu9EQFoLSum4
wyk6Lnx+7DKAjGcA+IVAdaXE2uLym5dFlZ/SaFFMTDt239RLy6enfWUG6J0Xelydh81wNp8mLNV5
vfNQjvUA3tdCj/eN+FI36/kELgGJJAfRoIMyXPqtYplEQz2KbMDdNYpXFcgxn+grwcQL4ZStQdKc
WkGAipPCSacqi2yHPHUe8azoG1UAsIZKbmsmw+yQTNg4KLn/z5LmU9j939pL/Yf/3l7/r5Pyp/8d
7+qU/7Myf0IIAXJ2pJ0nnWdqEFTOnR7k4mATFZKKGg7/0njx/FB7eyEENIihEOI9A2EQivVwCMN6
BIQjRjKMggjEaIhEjIEo768QC9GIcRCDGA+xiAkQh5gI8d5fIAkSEJMZDoNExOGQhKiFZO/PMAKG
IY6E4YijQIs4GkZ4fwIBRiKmMEyFUYhpMBpxDAjef0E6pCBmQCriWEhDzIQxiOMg3XsaxjPMggzE
bBiLmAOZiLkwzvsjno/jEfWQhZgH2Yj5kOM9BQUMCyEXsQh0iMWgRyyBPO8PUAr5iGVQgDgBChEn
QhFiORR7/wmTGE6GEsQpUIpYAWXef8BUmIA4DSYiVkI5YhVMQqyGyd7vYTrDGTAFcSZUIM6CqYiz
YZr3JNRAJeIFUIU4B6YjzmV4IeLfYR7MQJwPMxEXwCzEWpjt/Q4WQg3iIrgAcTHMQVwCcxHrEHug
Hi5EvAjmIV4M8xGXwgLES6DW+y1cCgsRl8EixAZYjGhg2AhLvN+AEeoQTVCPKMJFiE1wsfdraIal
iGa4BNEClyJeBssQWxC/Ais0ILaCAdEGjYh2MCI6wOT9Ei4HEdEJTYguaEZ0M2wDs/cLaAcLYgdc
htgJLYhdYPV+DldAK+KVYEO8CuyIVzNcDg7vZ/A7uBxxBTgRV4ILcRW4Ea+BNu8JuBbaEa+DDsTV
DNdAJ+Ja6PJ+CtfDFYjdcCXiOrgKcT1c7f0EboDliL+H3yHeCCsQNzD8A6z0fgx/hFWIN8E1iBvh
OsSbGd4Cq70fwa2wBvFPsBZxE8PNcD3in6Hbexxug3WIt8N6xDvgBsQt8Hvvh7AVbkS8EzYgbmN4
F/wBcTv80fsB7ICbEO+GjYj3wM2I98ItiDvhVu/7sAv+hHgfw/thE+JuuA1xD+IxeABuR/TAHYh7
YQviPtjqfQ/2w52ID8I2xIfgLsSHYTviI7DDexQOMDwIdyMegnsQH4V7ER+Dnd534XHYhfgE3If4
JNyP+BTs9v4NnoY9iIcZ/gUeQHwGPIjPwl7vO/Ac7EN8HvYjHoEHEV+AhxBfhIe9b8NLDF+GRxBf
gQOIr8JBxNfgkPcteB0eRXwDHkP8KzyO+CY84X0T3oInEd9m+A48hYhcIL4Lh71/haPwF8T34BnE
Y/Ac4vsMP4DnvW/Ah3AE8TjDj+AFxI/hRcRP4CXv6/ApvIx4Al5B/AxeRfwcXvO+Bl/A64hfwhuI
XzH8Gv6K+A286X0VvoW3EHvgbcTv4B3Ev8PfEE/Cu95X4Hs4ivgPeA/xnwx/gGOIp+B978vwI3yA
eBo+RPwXHEf8CT7yvgQ/w8eIv8AniL/Cp4hnGPbCCe+L4IXPEAFPXIATYREqPNrDIob+WggffCg0
uBeM5rcsDiKFR6rwxRUeOfQV51FHWHB7h/yWxUGkiCg1ajAiaugrzqOO85h4oBRouSAXB5GiYtBT
EYe+4jxTg/AGmgItF0S4BJmiYzWowejYoa84z9QgvIGmQMsFqaAgUkxcCGowNm7oK84zNTq4vQMt
F6SCgkhxiaGowfjEoa9IGHwoCG+gKdByQYRLkCkhOQzVn5g89BVJgw/FB7d3dEArCFcKMiVrw1H9
w7RDX3GeqecRf6AUaPbz+MdvTNrR6KkwYvTQV4wafGh4cHsHmj0IVwoyjUyJwo+bo1KGvkIYfCgI
b6Ap8BAIUkFBJCE9GjWYkj70FWMGHzqPiQdKgZYbGdziIFJKRgwMg9SMoa84jzqC8HiahgW0/nMy
po+PgxGQMX7oK8YNPpQW3N4jAlpBhEuQabw+ASMsSz/0FbrBhzKD2zvQ7EGES5AptygJ1a8rGvqK
gsGHsoPbOzWgdR7/+I0pv2wYZEBh2dBXlA4+dB4TD5QCLZcT3OIgUvFkLWqwdPLQV5QPPnQeEw+U
Al1bH9ziINKEaSPRxcqnDX1FxeBDJcHtnRXQKgxucRCpck4q5EP1nKGvmD340JTg9s4PaJ3HP35j
qlmcgRE2Z/HQV9QOPjQjuL0DI7syuMVBpNpl42EyLF429BVLBx+6MLi9Aw+B8/jHb0xLLblQDcss
Q1/RNPjQkuD2rg5oLQhucRDJ5MyHGmh2Dn2FffChILyBppqAVn1wi4NLnPyDunjgaUHwAwBRgf8P
8c/9UR5tKwb/2fs5ST9wt0/KKxiuHTq9/0ZSsFdIOGhQQ4qTqSfnnDSdtJ50er0AJ1P6W1Gf4vNF
dGR04tlaqigpLSksyM/T63JzsrPGj8scm5E+Ji01RRg9auQI7fBhyUmJCfFxsTHRUZER4WGhIRq1
SqngOQLZ1WnTGwRPRoNHkZE2c2YObacZsMPg19HgEbBreuAcj9DApgmBMytwZtNZMyukmRV9M0m0
UA7lOdlCdZrgeaUqTThALppfh/UbqtLqBU8Pq89hdUUGa0RgIyUFVwjVyeYqwUMahGrP9HZzd3VD
FdLbGxZamVYphuZkw97QMKyGYc0zPc2xl0yfTFiFm149YS8HmgjkyjM7raraMyutirLg4dOrDSbP
vPl11VXalJT6nGwPqTSmNXogbZonKotNgUq2jUdV6VGzbQQLFQfWCXuzn+pefyAaGhuywk1pJsPS
Og9vqKd7xGR5ZqRVeWZccSI5J/sAuXthnSek8gCBhXUHYbZ3xd5ZK6qq6ulusZV1a9j0JJyedMUJ
Ld9dnWwRaLO7e43g2Tq/zn80hWJ9PRLNya5ZUJeCXKdVrxeoGAvqmARIlCTrkEnaR8WUBBbTqmlP
w2WCJyRtWpq5+7IGNNbwbg8s6ErZN3x2xUHvRzC7WuheWJeW4pmiTas3VI3YGw/dC7r2z6oQZgWO
5GTvjY6RNL03MkquhEf4V8S+MVZj02kNufapmlCO0mahi3gEo4Cc1KV5uPRSCmIpdBtLcRqmeoIa
taD+GrqjJ1BDKNOj04TuU4COkNbzbWCPQe5RpUefAlql7tLncjjuq3uysjzjx1NPUVeiaZGzyaxd
lJPd7qlJc0QLnhpUGcyrw0X1E3So8pQUauV1ByqgERueFfPrpLYAjdp9UKHLqvdwDXTkKd9IwiI6
ssI30re8IQ3d+UEWyAkeTUbfv6joxLhq8wQPSTzPsCiNY/hUC3sVyvTueXUZhu512oyG7vX1aJrp
GIrd3dPThOndDd2GA94VjWlCdFr33pqabkd1g0+kA96n1mk9FevrzQSV6imQtOGJq6zjtVy9VOO0
fH0OVITD9OnISmyMpmKmcIAr3jczH4trWEHul4r7pGKnVNwrFfdIxV1ScadUbJGKWVIxUypmSMU0
qaiQislSUS4VZVKhkgqFVPBSQSouxPJ9zMcwv4f5Hcx/wfww5ocwP4B5N+b7Md+L+R7MWzDfgfl2
zOsxX4PZiHkZo/mARHq3VOySirulYodUbJeKO6SiSiqmSsUkqSiVCrVUKKWCkwqoqMDyKOa3MR/B
/Dzm5zA/i/kRzA9i3o95D+atmP+IuQuzaWZ+fEh8SMmGA6S9YpZ6w53qDTepN9yg3mBXb7CqNzSp
N4jqDUvVGy5Sb6hXb6hTj9GkagTNKM0IzXBNsiZRE6+J1URrIjXhmlCNRqPSKDScBl9Anji+hqup
nUZqPE8ZoaZR8PxYm3aAhM6/yKNMm0Y8sTVQs3Basqc0y8OtZafZAeLdS8jvr9PSg+wgEOK97gat
XNbXQ2LWuSk5oFUzr+sxGE1KQI1YsF89+hk17a3F3g2sdwPt3cB6k8m+eZBfY1jXMBIGINyfyHlH
A2ZWW6i48+r2amBafeVSqdzPhYWiPA3alPppidGOyUy4iSnJy7WHFPSXM8MwnsPxBRGBmQ7lTM2Z
SocUwIYi6btDHkpePjFFe4jcKw9FY3cMqvK/fcn4t+mNQUfy8DGSOm4ldxHW/gyNiJsxmzBvgo2w
kdsvzcHP9EbwYG02fKE8gh/1nKy/AK5CrIJ/oeJWs55yaMTxRpz9LJaTccyIJWE0NpL1rLwarkXa
33P7ucPcYTY6BenOpjOkh9uvPIL9lN41sAc+JE/hnCvhJhw7CG/QVUh5I+yG0yQTn3XkM9LDzcNe
QvdHOi04eyPy+wQchX+SeDKZdJPHcE4st5LxIu22Auc8i88bjAp95hArsRMnuR5pnuB4rgip2rm1
3FbOwx3m6xWTlUdUsaoStZX+5hje6XiIQQkptbn4IbMRn8v7qErP64Qj88lCYia3kK3Iw7OkB58f
uBxuCmqdPjfzDYpwxZfKFuU2fI6oFqlv16iQthJUMBwESIdClKoa95iPPJvgMrzq0udKfK5CXa6C
LbAV7oSdsBcOwdN0TzgGH8Jp1E4UPlSuElJGluBTj4+TLCfXoj7W+T03kNvIfnII+XuJvM2NRqml
x4rSS1xew23mHuRe4l7mjnMnuK+573ngQ/hlfCPv4nfwu/jX+NcUMxVbFXcq3le8ryRKD9NUrCpe
dYlqHT7r1SHqFvW16j+ob1c/HJoLSShXNso1Gz+5GaELJbkKL+/dzGp78XkQHsLnCHxN5cDHK0tC
nzJSRaaTRfjUk4vwBtBKXKSzT6Lt5G5yL3kQZXkbn3fJMfIx+YZ8x57TnIpL5LL65JvH1XJLuBbu
Fm4Tdxt3H3rkfu4x7l3uQ5TxBHcKZQzjY/kEfhRfzU/HZyF/Md/JX8Pv5g/zx/getFu4YpJismKR
4hKU/TnFCcWXaElOySvTlUXKCfiYlTblcuU65R3o0T3KHlU400qsKk41UbVGtUW1X3VUdUadoE5U
p+KTq85T16qt6nb1LvUJ9Rea+0OmhlhCnKHZsAs//zxyVvQ+RH+Xh7tEpYPh5Bh6w+V8FM4SaOxx
4WpriIXbT7lT15JMtNQHcJoPgRrFc7CEvxisykY+TP0t3EtcipXkPn463A871O3kMb6B7+F3KNNV
EyV9cpv5XeoudYP6C+T0B/4mpVmdS6Yq15F7uSkY0U4yH34kp+BS3NnNjYfn4HpYS9rxhbNRcz+J
wFh7lhtN1im38fsUW/lq5XIyDi2oVR7hr4MiSMDPRpmQir6uxM+O9MMgR3+nml+B0c/jCyKtIkr9
FlG8Re7Cz1JeUHr5g+QzAF1vT3QPTPkOMU9fEJMSk54Sk7KChzMrOOgF5ZGfS1cojtBfzJ7tPab+
QdmDlMOQ/nBIg4mwvSJTodKEhMXGJw9PSQvjImMSJvJlSdpCPl8pjEnPyFFlQf6qcFJmjjzAFe3L
yuIOkOsqsoHzW6QYlZGgiybhY9ILJ6qKQdBmukflxES7i5VJbt2Now5whfuKixUHiYC89pTpzpzp
KYvuKWM5JjYJs1RKg9jZw3qTythYUlmePomQxDjMSekZY0lxQX6CmmAlMYEhfuRjzaT04qLCjLRU
dWAxm8xWLvs24efb+dZb0wlJ+/MvMTFhmYSflCKcScnlp0Zpz6jiYiP48vDIX6LKSElVROTIGeUJ
iUkzpoRH5BSkk18USTN6f/7lK0XLvD1/OVD56zRFRih35bDIM6Vhem55yvAzAomJjtRyXVnCr5/M
XFo+MjwsrSwjLi61eFxY2Fiq940Amo1owyR8Q0yAGbAQlsK2isjSyUWkflFx6QR+bmHyItTuI7XA
DRs5WVl/gCvZr9WtnoU30Aph7urxlatDtbWhK8bDkmEjC4smLEElXzyWjMlP5uZHXox3yYr4/LjO
yM6KMZ1jb5w/XV3TWTE/ny8+SFIgR9eTVIYq1fX0sH+Srtm/pDIdTGFmiD7zYw+dh/ovk+2h0+Xp
iXpsxtixGUWFqHH6wVqtViXEJyUm8dQESURF2wlJSYlqVVoqziqh+leWEGyhMRIL8pn+cQmh67CN
w2mp6fkUE+J5zw018W2vf9O1+MpLlioI54yPm6G4bOTw7jW/XFiakLiY49WbN+9abLuPTDKTys38
m1c6cgp/1uZNGzdvY33RHDL3M0tFxbW9UzKImJen55sX55QXXNz8p/mO2lqbRpeUGDazMDSs9zT3
tKLkzIwUjUaoDRmWt3bFyiWVS1qem1qoylt65tV8jQKSRzsWdM8uWPTrtzdOy8vMfLVl5jc6TBix
u73HNJswWjIhC3IxcguhBK03CW6vyNGOG5+tV+hiITxSOzYrNy+/oDAsPamouLRsYrlKRcJKJkxS
CquS0lfFxibpaLyMUoWN1OnpvOKS0rIJYUU548ZnTSyfpMrmwyJD+EPkQrxI5leEjb0xMndktjsn
J7LoILcIQnTMdJjP/HCCmU2KCORPGqFWi0nq70ejJShi4iEtFYqi04uKSyTjUWuU0LiJp8YZi2ZJ
SCQlcXEFPEkiyiQlUafHqXl+bBxvJU29L7x/rPcF0pQ/e7XhmoNFT3WNmxQSlds6/eYPyrbVrZrK
xWX+WF6QTGaO6/2S1Gh63yN1yb0PFOhnv6u7R2Fe+8feLe/3vkiKsfv2tcPDE5pv2JK7Q1Cmjy0/
pF97dyS5IKX3MVLVe4ykj+59T6XT9n437uPeQzFkRO/VMcRNT7zdsFF1gp14o+GyhxSxCYkK9dRQ
cgcGkhYxAjVF6xGcsiIE4vloFUZX6CFSBqPIxH3K2OipYVhPJhMhgYhIREmRM9KjBx39Bzx6MEsh
QJWIhyZVYp6+pCglgSSkFKWgK0NBPqC/p2Cz2OfFu1Ulv04+s44c7CTDDh8mwzrJgTPr7jx83eqn
N27cyE3v3njlpidIbO93T2y6cmO3+YFrn3zy2gfwVoTSKOcqC+mJ+zjysR5CQEV+odzgvzx9nLwX
tdhucvGpU2Rp7/ZTp3p3cCdOkYt7d9AquZhpBVRtTCshMLEiVIO3rVWwSqHE43h2RYRqhQJVwt/I
3agIAfpRU7NNoWPH7JmYMpjCajT28/TpMSlx6piSlBi1cs4vh4nxWSX/rFEx6ZfDjVj5+cyz9E2a
IT+fkMf/Ew/X9b96PvpPPrziPM+E/3sPuxGlk8N936DSH0dJdYIeVCzXOVArv5TrPGiVH8p1hd8c
JYQrf5LrKohRKeW6GlaofN/QaiBedYtcD1Xej7tJ9TDIV+2S6xFkjup9+o24gt7nwzXjWF1N/0JN
U8Tq9FdnTZpquU4gVrNXrnMQGZ8g13kojidyXeE3RwnJ8SVyXQWp8RfKdTWB+MvlugYyE3z10LA6
zU65HgamhE1yPYLbnHCG1UMpn8m3snoY5TN5B6uH+/VHU97kehzWY5MfYvV4vzlatvZ5Vh/p1z+G
rf0brWsS+/vD5X13Cvl6fbEwx2J02l32JrdQaXc67E6D22K35QpTrVZhgaXZ7HYJC0SX6GwXTbkL
zaKwxGJrNmF2CU12Gw52iE5RMIkuS7NNNAmNXUKN0+ISZtqtraJLMNhMQqXZ4LRifZqlWbTaOwSL
TcgrK9OzMazk5QoRoRGhlLQfQbvT0myxGazWLvbHjybhgjajxWQQZhntNle2MNXptHdgSWnUug1O
l+C2C0Z7q8Mqtoo2t+BGavIKt9jpZpSFJkOrBekhi3TYhWR9fDtduSgk2yhbcIp2Z7PBZrmCNugG
TtEqGlzIg8R5vmBw+SmtTx/ZjKzb7BR9kjic9naLSRQMAqqg1W6z2NtcyECfslyiW7A3CRYqE+7i
cKKebW6kxSihOLiGSWW3iZQeznUgr3bUC+tuc4tOwdXlcoutkqrpMlFSAZvd7DQ4zBYjTm9DCyL/
uKDJYBRdfTpHVRswSyw02Z3CvMpsgbLqtjuzhRaxq9FucJpoF1JACZ0GY0sjmiWbimQSTE5LO3ab
LK4W0e2mEwwO5NzgcklNh5PtmY2678wWRLcxN5tqr0NE58Kyf9smi5VqzWpC+ZCe3djGhMCNDRar
hI32ThE7Oiw2E7O90WpxyNxR2TsMqIdGA2UkV5hlEwwmk4V6crafx1psRmsbql/euMPiNguNdgSU
S5qNqqLE+rWLlrI0oQptRhTH1WY0M/6dFslMdrtV0rwZwUV9x0B3EpqtVAUykw7a4zJaXC47Fa5R
pOprtLc24rBZNLYIsmR+imm1o1H8mbK0GpqR7z4GRAPaWmKPbWvFcEEToTe0NiJPlJjbabfam5n1
5WmizWhxGq3oeTZUr9PA5qEXWkUj3YZ6jKGVehgVhonFrOe0NxqYfzusuAPOxujAaMJYxqlsGtbb
MOrNPseaZ7dIfizRMCETUhOlanKKl7fRGG1qs7FtqVn8PLXfSVHfdjrmsySNcQMaDSMqgGeHbzfZ
CO4BTimU1Y5zm1BnBnZ2UMJG5KepzUo3NxkkVpBch0hPPca6yUJXUGZNFqcoc0sHXO4uKxV2Orpu
u8FpEd1dkqytDoPRTS3U2Ga1im7JECLqpkU+rexOesww115CNUNZ7GcO6xK9vsOhWbS3im6nxShI
tqNaubwNGaf2sFu7mtl5iEdgs7QbYw4PxNx+DSwQm9usBucEYU7tBHbkL8aNqO6KcvX6vmk58jS/
aEFjW5ibGdDDmi1UEGSMuqXYanC2oCw44tdsGvhdQlVNbbIITxWRnddu6dWgQwJ2toHR3mZDIalK
+0ks7HLYmV90md1uxwSdrqOjI7fVN5yLMapzO9tQ9Q5Rx6ys6/Dxrqu3t+Gh0UXPPdzbIrkBtQu6
d6vF7ZZeVZSr6kUXTGVHEG3giW1qQwMixx3ojma/tZa+48NEHRGPPIfVIFmdnXIoA3quDQ8fwbe5
3YanfaZlnCC2NtJV/bRsvtkDssSms3MEzUxt7wsTeXumT5nWRMZBpgV3wdcAVbmTvuTwiLRZ7Qb/
TVn0yAey0Kd5e5sbTzp8J7VbjCKdYxatjrMkAhvYwUn/pBKsUAtuLG1gQnQi7gQBr2N6fIqxNgcs
YMR+O7gwN+FcASrZagdDA/ZYsGbDj7wCTEV6ViwXYF8zmHHMxVoiliLObkc04cyFOCbiyBKcZ8OZ
Jrmks5sYNWllB1tFZ5oYDUrVxmgI0AhdiDU4bmFzZ+I6K8okspYkEeXVzOSyyv3TGA0R23akLrB9
BfywXoaP3m+d1JPHpIqgfzeF2cf1wBzaGSfNjKKB6YHyR+utMscXQBvq0sI0LcAsrFM6LshmmnMy
LXfIbR8fknWcbC83jgtsVStqn0pEKduYTdwyb4F7uLGvk437eKY1ypFF5k/Som+1S+b2bH3T/XNl
S/ZLRPmkslPJmxnHFriib8QngZNpW8S2S9aDv87z2UzXIJ52rn9k+3FLS0r9bJs4GJV2pgWR0Rdk
L2hls6i/tuFMSQPnehbl080s2sS49dlJksXB0CVrXuKrnyfJOtI+/bayM9o+/iS6Dlmvdtlf+me3
Mbs5GSddmN3M0v5e7dtNDPCCftrNLDIdOItyL1Fvk2NQ0r+0A/UFI5PmXD93yrqTSn8tNDGLCzAP
o4vaw6dVN+unPS24pgt9yy6fKb5ZEg+SDZ1s7xacJUVLdp+VTMwqNJra5dkmFuMtzC7uPgoGpkOB
SeiSreYbdbD1PjmzZb/vZDU6z4gSZ/f5XgfTpLWvPZC0TSxmfL5mZX7jlD3SRP8kHaXrt4QksYGt
8a9TnXQyjWezfS3Mov1xb8Q5FuQ+UHc+u3cw/qhMjawmaSSXnSY2Ns/EdOU7k7MHOWNpje7UJnt/
oMQdjIKZnQ52uSbZy5+2QdaXxNlAvivFlIVpzshmGmXruNgpZfbTv1Om7IsmO9Oxv8+b5Zqr79wx
9MlEPd7a5wWBmnT0zXGxk9HFYs5nuUbZ8tmytK2I0moaA9Q/hbNsNrDHtDKa4nk0ZWE+0Czr+1wN
iOxdaj5Le/3SWuW3ixRF0tnQyniz+nHmZmcffbs1+8V+IDWRWcKCM43Mo03sPSV5r5Ot8NGTzkIr
04RPGt8ZY2D2lmLAZ5l+a/XHHuWnkfX7zm8H8zxX3/klvTukd5P0XhblN56PmtTfJr/rzeecWPNw
1BJwHvvzYZI14T/qlCOZlpcjZbGPgzamHZ+0vmgZ+Ewd6CSV/Nvet+7smPS9xw1ypJnkN+9genac
I1tgJLiHeJeS7GqX6TbJfmbwu3f4ODbK+qG6sPZJbvK76/W/aaitfHe9fq2bWNQ3yW8RSbMm5nHi
Wbr1raCe2yXf0qhlp8unbjvjxcLOua4Au1LvMzBqvhhqZPxa2Vz/iBBlv2k5625Fd/DdZvpP7SV9
PuPT4kCac8kW7Ofv3JtDM7sbtbI+J/MaISDufL5C/c8g3yqyZYvTu0mz3/1QugU2B8jWrzmDfEMb
yAcWsAhrY+ejEyYAvWnVstJ3y18sS+TzuyKkREfOpZZzFrWB3y1SZFv8TjODfIY1s1G37Bcmv9NS
ZKejk5239r41A482QTCfS3xe7YuTRfJdRfS7X7vB/1ODTubA7ieBkZ0/NtmSPi8diIuFaDkHO399
50UXiw431icgbR3GDH1y2S08cHWu/B7VsX3aZK+np6zOL5Z18r3BX+86qGccSjcNGinSXUuS2xJw
GvjiRTq9W5k2fPoI/DxQTf8bIPxs0n8L8o1Id2wTe4u5+3TcIZ+O5kH2tQxw+zD1nYjSLc/BfMs/
1vvvcoJ8S3HLEUttIJwjOZ0h3e0zcd045o2t7E1vGpQv2zm0h66lfur99xEpmn1xf/bbJFD6fv8M
5Guinw6oJJIs0qcBn5c7+z7JSbdIG3tTGgaVtP/dE3hDFgbweTu7zUl3OulzUjuTRuyjY2ZvLce/
sdFc6P+2QfRrGdidxv/7B+nG65vxMY7b2AoDO2dNQL+3kP5GAsBbSv+/xAGTgv3FwAggGpxN/1qA
/RSLsJ8rYdZWQd+flWvL9au0paqQ8atnrj4dQdTc1lXacdiVzhGSF6YPUSmzInluuBL0BlVolooo
yKoSjii21urn67P9ekZsG7ViBJSz50L0Bhc7w0Wmhcn00af4EVPEL9rV9chnt24i92U+ot/V9Ofr
U688qtm6KuG4fhX/DOacrTxHOC56xpPDbj5+w4LplaePtc6MyNuuj+hjlSiRqZXrGJP8IoUqjrto
al6CPo42NHHhS0T69Z5NqDQ4xLx4fSztVseFVbU5Gw22dovVKuZFITXsDY1TLTQbOtxi3ki9lnaE
xcVLHUKl6HSzb8vpF1Z5o/Uj6TAflygPL7S04i6GVvaFeOVU/aikCH1BXr6+UM/SRUkRebRZkF9Q
VFZUdpG+1o/ZRbV5SfoEaf/IxaLTUmtptmULs2zG3Lws/Thpo1TfANuKftMo7VUrOunXWy666SqS
6q8VogR+FYkC7A/lVhECO1/ct/3lV4QHQq++/v41bScfnPv98aejnmw2PH6XacR7j/70YsF91+qv
r1u+/ljLB8V3RD35xred/+i4e7m9/MmbHog4ZP7BuvHFxxfk3Ddz0qmH375kmZbb8rOuZdT203dt
vnv4Ee7j312w4NPIhm8rRiw/GPHhlOcfPL7m8WVXXJaXy29aGXfvDOHVPFfEkpxXOgsLbo7dFHvw
Q7Nu1+efHu5eP/4v61LWND1+Td0Se9uT5bsy1lzyYnRC+ZZrv174dKjtmd5nZ39wUB1za+pVxyaP
fWNU57db8l74/vPUYcee2T+jcvPwZVtHbThx6anvrvr+6vsayY2n5oR9+Hrq4ntvfmXP2vY93x2K
+OeJOUe3/mLeuid+4v41Tz/K8ej4d608pl/5rr5QpUGPVSrVhCgy9Rn6Mb62nqxOlr+UtRtdjtx2
+hU36p1+Kct8Z2QcIV6FRq/CgiOgn0r7Rism6Ev1xVsLt+av1svLjU5rwGqd5Cv+rlI5NRdnMU8d
ma4I14f6uOA1+kjaGUX3on+Ho0IOsR2jQM/cPkyf5PNvPi58Ye1UdLTSnLycooKzooJfuRJmt/z0
dd3hqhF513dtyrrlyVX3k3dGXPCKp7vOdlwz7q5Lj7x4U9wXigURf58xVgelnhMv3DR381upjQmn
p5SkXOjIW/H9utI1+7/88lbofW3RLXPH/HXn2LlX7HnEMPWf41/94oWjl37waNZ1kx+6/aGjHy/x
PvHgs8tPvRZ+x8lbe7PenLhAqy0de3rKbIxhr34V94UcxxFfZZ18691xa5PzlSGXbm5fe3Yc/0ci
49xw1Jf6h+OSIW6q0+dIm2b8u01r2Q9f/21I7puXOfODN81XXJtc1dR2yfJnDmwxZngnVd52VUxp
dPoi19G2sZYzcw8KS98M/WmrdnzPosUphndHHTvxWEHL83//4K4S8ffam8Ifrh219KqmomXK7ure
9rnHa1dsWyncvmft0m2a05/pf/outeSCaaGvHn9u9DPvLPpq5ZSHFtyVvYtc8Y9tu24o6t3y+SWX
KbdMavn0yVue6n254aeKL9Rbq75ZOd+2Y/w/Hu6Ozuy58X3V1tXzNl85WxOhH/li9B0tp7+q26PY
WbFpX+aXNybeX/5prb3mf6o383Aouz6ODzN2krGvjW1aUPfYRiU7pZIlO8k2spR9VzJT2RKhsRYz
o8GEJFnKkimEKNmKRGWXyFpSvDOoPE/1Pu/1Xtf7Ptfz11znPnPfc859fr/P+X7POdOucK3Ew1G4
OEm6Yt9I0LtTwYs8w/CCwqnUo2Vq0tjyoBvLHUZ5231DNSZ2ixBceYYtKiScX4DCNDdHhLmtp2QT
gH70X6Yk6/eUpKUodbm1ZJQGdgDbcHCcRLjY75LR18dHxsFuNf14VtOP+oh/k4H0Nf9RBsr/OQOp
oxwR6NlzxIgGZvU6qBED1H69y59UFQ96WNXSUj+36cXKol6NnD3AUTfvK9iR0Hf8Koyz6LR2tUHL
uZEw3nM5WxNPcOosNZWnqIOb0w2t6C6ezfWYFTQQlNg543LppNjHiiYe7HtW3xrngO53qfYRZJ/L
n6J8g8XzslJCkos+xm330tvpJ3hAvedDCRvMuCsAl4xxcPnK9DT6g18FU3r3IocJPM1OtjqY9lZI
eDXh4UUx6cBnCv6VCT7Wi3eHD3MzizcPtnXI79RV41Zmtw2WqCc6TSU99XynMjLHFtr77HSWv5cL
+ar+fkBBtIhQKGCvLNUde2MHQ8gLvmLrkLfXiB7LylEFAAYCpSDg8xoC2EFk0EVl5UiOZyoLDhP9
ahvfGIRCAM9vuc3CKabp4Rnkvbppuc1hO/WIAvJPG3E7ESKA0NqXuX+5RYcQBbasDRPfj3ojDw9f
mLqfr7OHt4tvEBUPu5EAAgEAyHU8yFJPHCLWi39Di/5yKqetInsO7505IrgtMznQBhgnkC5JHv+0
jD2cVbZ8jQBTOW1ISCfE2cq6PdNwDJrM92807pl5dzVcKC7zvFNxnVuwvXiXsHIfO03CaFLtfRmn
tDRneGrrHun7rCXmcLLOCLOKUpI0advu3AndcxoD59kr0k6a2OVjTuNtZQIOj6XecdybZiCEYJTg
yiSNxEvxDe9LceCyNadDZQojjSI+5kxdoa0XbL9vol0cFXZ/z4TxlSM3v+YEn/I9UsjXnMS0TRRk
dtnWBVlxCMqgbLpitXTdiZkxuw1tajZVuteGBx0A6VmovhmGXb7VcrYrR8DbWrmp8gNjlhhQTH+h
sRgWwHmhf50buQCaCKAJ1LykgaDTAHRy2GarVs8pF+8MccNQrtt6sSuP8d7///HD/EWMr1IBO8pS
c2k2mU/hfTmNxIsAjllrW9nMDJbHKnTxkXGNe4ZFZz6YJUqX4PY32E99ed68d68lSdHYZVnilGpj
840+utOvEJf2ZW72dK1YhurzudR8adUc4LCE6Y/bhxTe4G+QQkrKVKPw0GhJdoesj8ZCi6KNXdyz
RvnumrIMXzG8n4ZOnGQzXKiaNnpUNVILfIEhmCKFsdsF9DqFaYnTYa/Bd6zmil41mE2idB8ZGZfe
AW+Drlzu+sAYF1qeXJeHlB4MHswNGPDHgVpdVcltitGv1aG5Cq6Cri8V3nQIQQZztSENlnJK7npC
bPZlzISY9k5jVZ0WIZNsz5fQPRGJfpk5bTgKFR5SxEHhujBwZUnVrwEJ53H01NLinbbe+2YShP8u
JACKFL0gj0DKyyPkqQKegnhZxW9IQGf/UTJwAhxrdoPZzM7HmSIFfCm/s3l1CqGYDQYjlOMpD3fH
by1j/l3LftdNWcqP/tRNcUB0rRsCG2scUavig6pGDFZNAexnkrBRScK4SpKHzbBLlf0rKgaTwQ86
JCQX/J+IrrTsMD3SdLUMc1shSAZUm8vY6dBYRlwYI5O7imKSCAyf2UsxRmnvMPVVm+tyaybdzsce
Faww+OxIE0Xm6cA4g9QCteahSkeWHAxff953dwhZ1O/AIL7XS01+/5zbTZ35rT4iYo81+EUMS43S
2rNaOev5Vb3oT81gRbWOa7yvaUx1hJWT5b8QtIZDbgvvKs/um8P3p4uyL5sj1E2UQgvNRwYnLIIk
8z7u2MWhqhSoonE2x3kwVMyZd/hgQm2gltF+vP75qMT0mhMh40xL4eAzC6leylI5TinN/TJvpWgF
2OUPoOaVoYXTEULCcCOPZkrsgbMwNDso7wP+Kx0O/mfgBUrPtG7AuSl8oQWDQZBViyq8CcID4ZL8
JHXoWIO3ccHQAm4HL88SefEoGuD/fgsXLYRVhBl0FORHseuaIHWAZVX4rPoOHYD9u8CiA8CUjw15
uYoxh4HXs3Tlt8ZZWOSfYRAqUfbanYw5i3aohp3gz0oH1J+WzGw91z5QZ3o0t4T/SfPwNG7RtPTA
lf0SQ6QtvcEdCzzB0JezlwUnGI8VX7h8N8a8QqgZ2469IjcX37cSmW5zSNdgN3wPTNAY+eWMNXfi
w16h2A92RspDDO+dpoIm4p6YOaCwfLq44H5UWT/85nIDtLSe0Fx//KLnbNPLPIw7Qy+K/27uQvgD
Jo2UaXi+S3ARWSrnltMWYmEEo1syZ/ktxVQRuixOpayafEDlnuhzILvJHipUaHZpaDqY456NMity
OpGcEHkEYkln/ehpF6n7zZn4wK1Ld9yJcfRy5kU2OzjYAQydHAVlgmsYY7bTyXhM/Y8nCPXTCsU/
BRk/2LdbXk5ekeqWkBRtRCkqUIuA7/+kH+v14N/U/6UkakEnKd20JsyQ+/ta87CXupSvbbn48Fj4
zmMfirzn8/IjXUt6isRCWBoaiIfibcQ4xxbnxa+VzLn735yavK78qLbGwlo1r9hHDp5tj7YLwtvP
uUdiW91fPcpsu27I4W93zzMahU/iico5hm7Vchp6aZqh1vSl119ipxYAGuo6E4Ll6DQXzhrVZ2mM
7CV0HU092eTQlOqalmBzWI9jdFe7lZXNcaMsHxlixXltthh+bv/HjD1p2Z7co3oTLl+P3XaLe7/d
EKl0sV5Hl/uKQcqtOefrz/uYvE74ZgTECF9wSx4fOa7d/HrYi+2ZAygxBJESy3KHs6q4dXK6X3SS
ZGs3idTc93BNEmFoEihvJPYn7/IDBpPdbiS/oy36k4JH+OlFsq7mPb3y9TfkI1GvikPQeACdEfZL
iuB9r/8d/PtZLBxaM35agAaghlPBKYfv2WD8/niyztPNhXp11/qJOJ9d1ASgxj8l9mVXDaH+Bieq
CagDqt+dKG243G9P7K0+F+X98wN9f+UJlbqnsErp1ilcx4zdXfppG0aKl9of6BXsyjtrzNYjW/rJ
dZhtSVQgQIXoHHwHGxptPaNZey4ddSbSwPA0hmv+nM9zQrV1E63nE/hJ3kojLmJUTdkgvhnvdy3e
a59gjSnItOTTeXiPjdxSl2SwTVpP9tLcjLpAvolOwYHeeCVOcybd6VlExJZKSKwVFAUeYzFsxbNG
p1Z1k3NbGbklRUtKzaKEnlmFKxCbvt6ImCAhVcs03QZg09qVoTfHpk1u4w9UoqqPync3jtI7QOgD
3Q1WDlSkj2taRrwsYA6bt6iTHhw6a3VwSDZoUuxCAqtMsYFV/QM1c/O8tpaBXeSWiVOZyCAEBvKY
gs1HtDQ0ALrkHwPHPwD+xzI2Dj0KcH2fULfRIBjAdKvL89Rpdn3omcAI1o0r55Sm/yixIDYBG2u5
AfEfN0IQlLyVx952CTs7q49PedqoJoVWryzNrgG8N9zCinAE7HFKYYq/3IzT+b7x8ZtNTjw8TOL3
p1G/H1j9s5qEYGhAgNKetpcWl/cZuETHm8EK7bq7xkDtdlzXxMktaqZ9NoH2xg+eaY75muUwL2+6
P2Zx4ip7RPUnL/MX9ddFcnvF7M7BHsUWkTjObzlguXCu+dD1Umm4ZVq8hHSFx+e6V3jcDTBXlhfH
vA6seYv6kD1Rp3NihSmwjTfidN3M6PvIpdA6pyKthYzD0ilZ0SljA3wBH+9WvE9NKy4c17shpO9e
CFO99dwwjv2+JJ9MgUflaOQNg4SR/JgpzD2+40FjyeF3EDWhpdqoRY0aEj2jVb6OyS534z7+odDC
zgxkw02AZJuY4vV1LGYZRUOIeWImsdLhOhheJnXmiaJhqWvj8x6+Nw/r4vEYiizC0Cz9GDF6BIZm
gnJplBreJ/4ni5q/WEplpWdcawAthTI4C4BvY+yx/NjaoaGE3vcaOgQ7db6nTPCysnKyCNndlhT+
bgg9KGTzUAERd5CTcY/j9cBSa8838r8IAS/Hzzy8n2eHhsCchSozWk8DZQaqiaKW42+XRg215Yhu
pacf9Kacv/NpG7cu6f2YrMFcuVqG7iFMGDSr6GI78RDriZi4MT571UHs7GCV2fhzLK8CfnfVIlIE
3zM6c9wC92KcnHEVyuYo71cUECtd3BPXMecaNYoanSJ55FsS2RKd4Z3ZA0V5K5j+fcJ1zfpVvaIx
gv5wI967lpysGhYJkuV+ywIL+Wbs/ku2Y/HvGs9y2PAT6nm7oz8ovyHqavsM0pIeyzjnFeqKsjqU
Pm2IbblwNXXHBI2W/cGUDr/bbzuUYmPTTOAT9fxg6xeNDZfpz46VzFW21iZfLFiS5CTFpqmm/wum
UbO6DQplbmRzdHJlYW0NCmVuZG9iag0KMzA5IDAgb2JqDQpbIDBbIDUwMF0gIDEyMlsgNzQ3XSBd
IA0KZW5kb2JqDQozMTAgMCBvYmoNCjw8L1R5cGUvTWV0YWRhdGEvU3VidHlwZS9YTUwvTGVuZ3Ro
IDMwNjY+Pg0Kc3RyZWFtDQo8P3hwYWNrZXQgYmVnaW49Iu+7vyIgaWQ9Ilc1TTBNcENlaGlIenJl
U3pOVGN6a2M5ZCI/Pjx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9
IjMuMS03MDEiPgo8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIv
MjItcmRmLXN5bnRheC1ucyMiPgo8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiAgeG1sbnM6
cGRmPSJodHRwOi8vbnMuYWRvYmUuY29tL3BkZi8xLjMvIj4KPHBkZjpQcm9kdWNlcj5NaWNyb3Nv
ZnTCriBQb3dlclBvaW50wq4gMjAxNjwvcGRmOlByb2R1Y2VyPjwvcmRmOkRlc2NyaXB0aW9uPgo8
cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9k
Yy9lbGVtZW50cy8xLjEvIj4KPGRjOmNyZWF0b3I+PHJkZjpTZXE+PHJkZjpsaT48L3JkZjpsaT48
L3JkZjpTZXE+PC9kYzpjcmVhdG9yPjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRlc2NyaXB0aW9u
IHJkZjphYm91dD0iIiAgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIj4K
PHhtcDpDcmVhdG9yVG9vbD5NaWNyb3NvZnTCriBQb3dlclBvaW50wq4gMjAxNjwveG1wOkNyZWF0
b3JUb29sPjx4bXA6Q3JlYXRlRGF0ZT4yMDE3LTAzLTI5VDAwOjAwOjU2LTA1OjAwPC94bXA6Q3Jl
YXRlRGF0ZT48eG1wOk1vZGlmeURhdGU+MjAxNy0wMy0yOVQwMDowMDo1Ni0wNTowMDwveG1wOk1v
ZGlmeURhdGU+PC9yZGY6RGVzY3JpcHRpb24+CjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIi
ICB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyI+Cjx4bXBNTTpE
b2N1bWVudElEPnV1aWQ6OTA2MjI0QTAtNTM0RC00OThELTlDNTMtMEY4MTk0QTExOUUzPC94bXBN
TTpEb2N1bWVudElEPjx4bXBNTTpJbnN0YW5jZUlEPnV1aWQ6OTA2MjI0QTAtNTM0RC00OThELTlD
NTMtMEY4MTk0QTExOUUzPC94bXBNTTpJbnN0YW5jZUlEPjwvcmRmOkRlc2NyaXB0aW9uPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAKPC9yZGY6UkRGPjwveDp4bXBtZXRhPjw/eHBhY2tldCBlbmQ9
InciPz4NCmVuZHN0cmVhbQ0KZW5kb2JqDQozMTEgMCBvYmoNCjw8L0Rpc3BsYXlEb2NUaXRsZSB0
cnVlPj4NCmVuZG9iag0KMzEyIDAgb2JqDQo8PC9UeXBlL1hSZWYvU2l6ZSAzMTIvV1sgMSA0IDJd
IC9Sb290IDEgMCBSL0luZm8gMzIgMCBSL0lEWzxBMDI0NjI5MDRENTM4RDQ5OUM1MzBGODE5NEEx
MTlFMz48QTAyNDYyOTA0RDUzOEQ0OTlDNTMwRjgxOTRBMTE5RTM+XSAvRmlsdGVyL0ZsYXRlRGVj
b2RlL0xlbmd0aCA2NjY+Pg0Kc3RyZWFtDQp4nDXVd1hPURzH8d+vsmeEhvaQQkUalJWMSCoZkb0K
KVu2yMweoRKJZI+Qkb2jZIWMjFLZM0TuPe/u/eO8nvvcc7+f5/OcP45KJT1lZWpp1VapZJKhVKBh
KNAKhUTIEejEC3RTBHreAn17gUG4wCRQYKoJxQKzCIgRmHtAtMAiUmCpBmNIE1gxxapEYO0lsAsT
2HsKHKIELkkC11yBW4bUQ2pkoyqBX/Ab/kA10AJNKP+vVJrinq68qUEDKkFFqABVoQpUhq5QE2pA
dfgLXaCzlOeboOTVAW2oBbWhtbwzW9nZEAygLuhAPagPDUAX9EAfzMAUDMEIjMEEbKAxmIMFWIIV
NAJrcIQWYAtNoCk0AzuwBwdoDq3AFVqCEziDC7SHduAG7tAG2kIn8IQO4AEdYQt0h27gBf9gM2yS
DsdPSzmcXuAP3tADfKAn+IIfjJCnOCtThsMwGAoB0Bv6QF/oB4HQHwZAEAyEQTAYhsBEmAAjYRSM
hmAIgTEwFsZBKIyHMAiHaLlfiNJvGkyFSTAZpsBsmAXTIQJmwExYDItgDsyFeTAfImEBLIQoWA7L
YAkshdWwClbASoiRi8UpxTbCBlgDa2EdrIcXsBXiIRbKIA6ewzM5KEsJSoZdkADbYDskwg5Igp1w
Xhrmr6kMOwdnYTekwB7YC/tgPxyAg3AIDsMROAqpcAyOwwlIg5NwCk7DGUiHK3AZLsBFuAS35WJO
SrFbkAFX4RpchxtwE+5CNmRCFtyBp3JCsJLwEB7APbgPufAEcuARPIaf8ApeQp5AXZ7wA77LsbFK
bBEUwmt4A/lQAG/hI3yAYngH7+EbfIVP8Bm+yOmZ4qIN8JFR5wcJCvIFhY6CIntBsfimYZQKeQJb
O5XqP7Mv1K8NCmVuZHN0cmVhbQ0KZW5kb2JqDQp4cmVmDQowIDMxMw0KMDAwMDAwMDAzMyA2NTUz
NSBmDQowMDAwMDAwMDE3IDAwMDAwIG4NCjAwMDAwMDAxNjggMDAwMDAgbg0KMDAwMDAwMDI1MiAw
MDAwMCBuDQowMDAwMDAwNTQxIDAwMDAwIG4NCjAwMDAwMDExMzQgMDAwMDAgbg0KMDAwMDAwMTE4
NyAwMDAwMCBuDQowMDAwMDAxMjQwIDAwMDAwIG4NCjAwMDAwMDUyNzggMDAwMDAgbg0KMDAwMDAw
NjMxNCAwMDAwMCBuDQowMDAwMDA2NDc3IDAwMDAwIG4NCjAwMDAwMDY3MDQgMDAwMDAgbg0KMDAw
MDAwNzAyNSAwMDAwMCBuDQowMDAwMDA4MjgyIDAwMDAwIG4NCjAwMDAwMDg0NTEgMDAwMDAgbg0K
MDAwMDAwODY4MyAwMDAwMCBuDQowMDAwMDA4ODI2IDAwMDAwIG4NCjAwMDAwMDg4NTYgMDAwMDAg
bg0KMDAwMDAwOTAyNyAwMDAwMCBuDQowMDAwMDA5MTAxIDAwMDAwIG4NCjAwMDAwMDkzNDcgMDAw
MDAgbg0KMDAwMDAwOTQ3MyAwMDAwMCBuDQowMDAwMDA5NTAzIDAwMDAwIG4NCjAwMDAwMDk2NTcg
MDAwMDAgbg0KMDAwMDAwOTczMSAwMDAwMCBuDQowMDAwMDA5OTc2IDAwMDAwIG4NCjAwMDAwMTAz
MTQgMDAwMDAgbg0KMDAwMDAxMjE0NCAwMDAwMCBuDQowMDAwMDEyMzU3IDAwMDAwIG4NCjAwMDAw
MTI2NzggMDAwMDAgbg0KMDAwMDAxNDUwMSAwMDAwMCBuDQowMDAwMDE0ODEyIDAwMDAwIG4NCjAw
MDAwMTU1NjQgMDAwMDAgbg0KMDAwMDAwMDAzNCA2NTUzNSBmDQowMDAwMDAwMDM1IDY1NTM1IGYN
CjAwMDAwMDAwMzYgNjU1MzUgZg0KMDAwMDAwMDAzNyA2NTUzNSBmDQowMDAwMDAwMDM4IDY1NTM1
IGYNCjAwMDAwMDAwMzkgNjU1MzUgZg0KMDAwMDAwMDA0MCA2NTUzNSBmDQowMDAwMDAwMDQxIDY1
NTM1IGYNCjAwMDAwMDAwNDIgNjU1MzUgZg0KMDAwMDAwMDA0MyA2NTUzNSBmDQowMDAwMDAwMDQ0
IDY1NTM1IGYNCjAwMDAwMDAwNDUgNjU1MzUgZg0KMDAwMDAwMDA0NiA2NTUzNSBmDQowMDAwMDAw
MDQ3IDY1NTM1IGYNCjAwMDAwMDAwNDggNjU1MzUgZg0KMDAwMDAwMDA0OSA2NTUzNSBmDQowMDAw
MDAwMDUwIDY1NTM1IGYNCjAwMDAwMDAwNTEgNjU1MzUgZg0KMDAwMDAwMDA1MiA2NTUzNSBmDQow
MDAwMDAwMDUzIDY1NTM1IGYNCjAwMDAwMDAwNTQgNjU1MzUgZg0KMDAwMDAwMDA1NSA2NTUzNSBm
DQowMDAwMDAwMDU2IDY1NTM1IGYNCjAwMDAwMDAwNTcgNjU1MzUgZg0KMDAwMDAwMDA1OSA2NTUz
NSBmDQowMDAwMDIwODk2IDAwMDAwIG4NCjAwMDAwMDAwNjAgNjU1MzUgZg0KMDAwMDAwMDA2MSA2
NTUzNSBmDQowMDAwMDAwMDYyIDY1NTM1IGYNCjAwMDAwMDAwNjMgNjU1MzUgZg0KMDAwMDAwMDA2
NSA2NTUzNSBmDQowMDAwMDIwOTQ2IDAwMDAwIG4NCjAwMDAwMDAwNjYgNjU1MzUgZg0KMDAwMDAw
MDA2NyA2NTUzNSBmDQowMDAwMDAwMDY4IDY1NTM1IGYNCjAwMDAwMDAwNjkgNjU1MzUgZg0KMDAw
MDAwMDA3MCA2NTUzNSBmDQowMDAwMDAwMDcxIDY1NTM1IGYNCjAwMDAwMDAwNzIgNjU1MzUgZg0K
MDAwMDAwMDA3MyA2NTUzNSBmDQowMDAwMDAwMDc0IDY1NTM1IGYNCjAwMDAwMDAwNzUgNjU1MzUg
Zg0KMDAwMDAwMDA3NiA2NTUzNSBmDQowMDAwMDAwMDc3IDY1NTM1IGYNCjAwMDAwMDAwNzggNjU1
MzUgZg0KMDAwMDAwMDA3OSA2NTUzNSBmDQowMDAwMDAwMDgwIDY1NTM1IGYNCjAwMDAwMDAwODEg
NjU1MzUgZg0KMDAwMDAwMDA4MiA2NTUzNSBmDQowMDAwMDAwMDgzIDY1NTM1IGYNCjAwMDAwMDAw
ODQgNjU1MzUgZg0KMDAwMDAwMDA4NSA2NTUzNSBmDQowMDAwMDAwMDg2IDY1NTM1IGYNCjAwMDAw
MDAwODcgNjU1MzUgZg0KMDAwMDAwMDA4OCA2NTUzNSBmDQowMDAwMDAwMDg5IDY1NTM1IGYNCjAw
MDAwMDAwOTAgNjU1MzUgZg0KMDAwMDAwMDA5MSA2NTUzNSBmDQowMDAwMDAwMDkyIDY1NTM1IGYN
CjAwMDAwMDAwOTMgNjU1MzUgZg0KMDAwMDAwMDA5NCA2NTUzNSBmDQowMDAwMDAwMDk1IDY1NTM1
IGYNCjAwMDAwMDAwOTYgNjU1MzUgZg0KMDAwMDAwMDA5NyA2NTUzNSBmDQowMDAwMDAwMDk4IDY1
NTM1IGYNCjAwMDAwMDAwOTkgNjU1MzUgZg0KMDAwMDAwMDEwMCA2NTUzNSBmDQowMDAwMDAwMTAx
IDY1NTM1IGYNCjAwMDAwMDAxMDIgNjU1MzUgZg0KMDAwMDAwMDEwMyA2NTUzNSBmDQowMDAwMDAw
MTA0IDY1NTM1IGYNCjAwMDAwMDAxMDUgNjU1MzUgZg0KMDAwMDAwMDEwNiA2NTUzNSBmDQowMDAw
MDAwMTA3IDY1NTM1IGYNCjAwMDAwMDAxMDggNjU1MzUgZg0KMDAwMDAwMDEwOSA2NTUzNSBmDQow
MDAwMDAwMTEwIDY1NTM1IGYNCjAwMDAwMDAxMTEgNjU1MzUgZg0KMDAwMDAwMDExMiA2NTUzNSBm
DQowMDAwMDAwMTEzIDY1NTM1IGYNCjAwMDAwMDAxMTQgNjU1MzUgZg0KMDAwMDAwMDExNSA2NTUz
NSBmDQowMDAwMDAwMTE2IDY1NTM1IGYNCjAwMDAwMDAxMTcgNjU1MzUgZg0KMDAwMDAwMDExOCA2
NTUzNSBmDQowMDAwMDAwMTE5IDY1NTM1IGYNCjAwMDAwMDAxMjAgNjU1MzUgZg0KMDAwMDAwMDEy
MSA2NTUzNSBmDQowMDAwMDAwMTIyIDY1NTM1IGYNCjAwMDAwMDAxMjQgNjU1MzUgZg0KMDAwMDAy
MDk5NiAwMDAwMCBuDQowMDAwMDAwMTI1IDY1NTM1IGYNCjAwMDAwMDAxMjYgNjU1MzUgZg0KMDAw
MDAwMDEyNyA2NTUzNSBmDQowMDAwMDAwMTI4IDY1NTM1IGYNCjAwMDAwMDAxMjkgNjU1MzUgZg0K
MDAwMDAwMDEzMCA2NTUzNSBmDQowMDAwMDAwMTMxIDY1NTM1IGYNCjAwMDAwMDAxMzIgNjU1MzUg
Zg0KMDAwMDAwMDEzNCA2NTUzNSBmDQowMDAwMDIxMDQ3IDAwMDAwIG4NCjAwMDAwMDAxMzUgNjU1
MzUgZg0KMDAwMDAwMDEzNiA2NTUzNSBmDQowMDAwMDAwMTM3IDY1NTM1IGYNCjAwMDAwMDAxMzgg
NjU1MzUgZg0KMDAwMDAwMDEzOSA2NTUzNSBmDQowMDAwMDAwMTQwIDY1NTM1IGYNCjAwMDAwMDAx
NDEgNjU1MzUgZg0KMDAwMDAwMDE0MiA2NTUzNSBmDQowMDAwMDAwMTQzIDY1NTM1IGYNCjAwMDAw
MDAxNDQgNjU1MzUgZg0KMDAwMDAwMDE0NSA2NTUzNSBmDQowMDAwMDAwMTQ2IDY1NTM1IGYNCjAw
MDAwMDAxNDcgNjU1MzUgZg0KMDAwMDAwMDE0OCA2NTUzNSBmDQowMDAwMDAwMTQ5IDY1NTM1IGYN
CjAwMDAwMDAxNTAgNjU1MzUgZg0KMDAwMDAwMDE1MSA2NTUzNSBmDQowMDAwMDAwMTUyIDY1NTM1
IGYNCjAwMDAwMDAxNTMgNjU1MzUgZg0KMDAwMDAwMDE1NCA2NTUzNSBmDQowMDAwMDAwMTU1IDY1
NTM1IGYNCjAwMDAwMDAxNTYgNjU1MzUgZg0KMDAwMDAwMDE1NyA2NTUzNSBmDQowMDAwMDAwMTU4
IDY1NTM1IGYNCjAwMDAwMDAxNTkgNjU1MzUgZg0KMDAwMDAwMDE2MCA2NTUzNSBmDQowMDAwMDAw
MTYxIDY1NTM1IGYNCjAwMDAwMDAxNjIgNjU1MzUgZg0KMDAwMDAwMDE2MyA2NTUzNSBmDQowMDAw
MDAwMTY0IDY1NTM1IGYNCjAwMDAwMDAxNjYgNjU1MzUgZg0KMDAwMDAyMTA5OCAwMDAwMCBuDQow
MDAwMDAwMTY3IDY1NTM1IGYNCjAwMDAwMDAxNjggNjU1MzUgZg0KMDAwMDAwMDE2OSA2NTUzNSBm
DQowMDAwMDAwMTcwIDY1NTM1IGYNCjAwMDAwMDAxNzEgNjU1MzUgZg0KMDAwMDAwMDE3MiA2NTUz
NSBmDQowMDAwMDAwMTczIDY1NTM1IGYNCjAwMDAwMDAxNzQgNjU1MzUgZg0KMDAwMDAwMDE3NSA2
NTUzNSBmDQowMDAwMDAwMTc2IDY1NTM1IGYNCjAwMDAwMDAxNzcgNjU1MzUgZg0KMDAwMDAwMDE3
OCA2NTUzNSBmDQowMDAwMDAwMTc5IDY1NTM1IGYNCjAwMDAwMDAxODAgNjU1MzUgZg0KMDAwMDAw
MDE4MSA2NTUzNSBmDQowMDAwMDAwMTgyIDY1NTM1IGYNCjAwMDAwMDAxODMgNjU1MzUgZg0KMDAw
MDAwMDE4NCA2NTUzNSBmDQowMDAwMDAwMTg1IDY1NTM1IGYNCjAwMDAwMDAxODYgNjU1MzUgZg0K
MDAwMDAwMDE4NyA2NTUzNSBmDQowMDAwMDAwMTg4IDY1NTM1IGYNCjAwMDAwMDAxODkgNjU1MzUg
Zg0KMDAwMDAwMDE5MCA2NTUzNSBmDQowMDAwMDAwMTkxIDY1NTM1IGYNCjAwMDAwMDAxOTIgNjU1
MzUgZg0KMDAwMDAwMDE5MyA2NTUzNSBmDQowMDAwMDAwMTk0IDY1NTM1IGYNCjAwMDAwMDAxOTUg
NjU1MzUgZg0KMDAwMDAwMDE5NyA2NTUzNSBmDQowMDAwMDIxMTQ5IDAwMDAwIG4NCjAwMDAwMDAx
OTggNjU1MzUgZg0KMDAwMDAwMDE5OSA2NTUzNSBmDQowMDAwMDAwMjAwIDY1NTM1IGYNCjAwMDAw
MDAyMDEgNjU1MzUgZg0KMDAwMDAwMDIwMiA2NTUzNSBmDQowMDAwMDAwMjAzIDY1NTM1IGYNCjAw
MDAwMDAyMDQgNjU1MzUgZg0KMDAwMDAwMDIwNSA2NTUzNSBmDQowMDAwMDAwMjA2IDY1NTM1IGYN
CjAwMDAwMDAyMDcgNjU1MzUgZg0KMDAwMDAwMDIwOCA2NTUzNSBmDQowMDAwMDAwMjA5IDY1NTM1
IGYNCjAwMDAwMDAyMTAgNjU1MzUgZg0KMDAwMDAwMDIxMiA2NTUzNSBmDQowMDAwMDIxMjAwIDAw
MDAwIG4NCjAwMDAwMDAyMTMgNjU1MzUgZg0KMDAwMDAwMDIxNCA2NTUzNSBmDQowMDAwMDAwMjE1
IDY1NTM1IGYNCjAwMDAwMDAyMTYgNjU1MzUgZg0KMDAwMDAwMDIxNyA2NTUzNSBmDQowMDAwMDAw
MjE4IDY1NTM1IGYNCjAwMDAwMDAyMTkgNjU1MzUgZg0KMDAwMDAwMDIyMCA2NTUzNSBmDQowMDAw
MDAwMjIxIDY1NTM1IGYNCjAwMDAwMDAyMjMgNjU1MzUgZg0KMDAwMDAyMTI1MSAwMDAwMCBuDQow
MDAwMDAwMjI0IDY1NTM1IGYNCjAwMDAwMDAyMjUgNjU1MzUgZg0KMDAwMDAwMDIyNiA2NTUzNSBm
DQowMDAwMDAwMjI3IDY1NTM1IGYNCjAwMDAwMDAyMjggNjU1MzUgZg0KMDAwMDAwMDIyOSA2NTUz
NSBmDQowMDAwMDAwMjMwIDY1NTM1IGYNCjAwMDAwMDAyMzEgNjU1MzUgZg0KMDAwMDAwMDIzMiA2
NTUzNSBmDQowMDAwMDAwMjMzIDY1NTM1IGYNCjAwMDAwMDAyMzQgNjU1MzUgZg0KMDAwMDAwMDIz
NSA2NTUzNSBmDQowMDAwMDAwMjM2IDY1NTM1IGYNCjAwMDAwMDAyMzcgNjU1MzUgZg0KMDAwMDAw
MDIzOCA2NTUzNSBmDQowMDAwMDAwMjM5IDY1NTM1IGYNCjAwMDAwMDAyNDAgNjU1MzUgZg0KMDAw
MDAwMDI0MSA2NTUzNSBmDQowMDAwMDAwMjQyIDY1NTM1IGYNCjAwMDAwMDAyNDMgNjU1MzUgZg0K
MDAwMDAwMDI0NCA2NTUzNSBmDQowMDAwMDAwMjQ1IDY1NTM1IGYNCjAwMDAwMDAyNDYgNjU1MzUg
Zg0KMDAwMDAwMDI0NyA2NTUzNSBmDQowMDAwMDAwMjQ4IDY1NTM1IGYNCjAwMDAwMDAyNDkgNjU1
MzUgZg0KMDAwMDAwMDI1MCA2NTUzNSBmDQowMDAwMDAwMjUxIDY1NTM1IGYNCjAwMDAwMDAyNTIg
NjU1MzUgZg0KMDAwMDAwMDI1NCA2NTUzNSBmDQowMDAwMDIxMzAyIDAwMDAwIG4NCjAwMDAwMDAy
NTUgNjU1MzUgZg0KMDAwMDAwMDI1NiA2NTUzNSBmDQowMDAwMDAwMjU3IDY1NTM1IGYNCjAwMDAw
MDAyNTggNjU1MzUgZg0KMDAwMDAwMDI1OSA2NTUzNSBmDQowMDAwMDAwMjYwIDY1NTM1IGYNCjAw
MDAwMDAyNjEgNjU1MzUgZg0KMDAwMDAwMDI2MiA2NTUzNSBmDQowMDAwMDAwMjYzIDY1NTM1IGYN
CjAwMDAwMDAyNjQgNjU1MzUgZg0KMDAwMDAwMDI2NSA2NTUzNSBmDQowMDAwMDAwMjY2IDY1NTM1
IGYNCjAwMDAwMDAyNjggNjU1MzUgZg0KMDAwMDAyMTM1MyAwMDAwMCBuDQowMDAwMDAwMjY5IDY1
NTM1IGYNCjAwMDAwMDAyNzAgNjU1MzUgZg0KMDAwMDAwMDI3MSA2NTUzNSBmDQowMDAwMDAwMjcy
IDY1NTM1IGYNCjAwMDAwMDAyNzMgNjU1MzUgZg0KMDAwMDAwMDI3NCA2NTUzNSBmDQowMDAwMDAw
Mjc1IDY1NTM1IGYNCjAwMDAwMDAyNzYgNjU1MzUgZg0KMDAwMDAwMDI3NyA2NTUzNSBmDQowMDAw
MDAwMjc4IDY1NTM1IGYNCjAwMDAwMDAyNzkgNjU1MzUgZg0KMDAwMDAwMDI4MCA2NTUzNSBmDQow
MDAwMDAwMjgxIDY1NTM1IGYNCjAwMDAwMDAyODIgNjU1MzUgZg0KMDAwMDAwMDI4MyA2NTUzNSBm
DQowMDAwMDAwMjg1IDY1NTM1IGYNCjAwMDAwMjE0MDQgMDAwMDAgbg0KMDAwMDAwMDI4NiA2NTUz
NSBmDQowMDAwMDAwMjg3IDY1NTM1IGYNCjAwMDAwMDAyODggNjU1MzUgZg0KMDAwMDAwMDI4OSA2
NTUzNSBmDQowMDAwMDAwMjkwIDY1NTM1IGYNCjAwMDAwMDAyOTEgNjU1MzUgZg0KMDAwMDAwMDI5
MiA2NTUzNSBmDQowMDAwMDAwMjkzIDY1NTM1IGYNCjAwMDAwMDAyOTQgNjU1MzUgZg0KMDAwMDAw
MDI5NSA2NTUzNSBmDQowMDAwMDAwMjk2IDY1NTM1IGYNCjAwMDAwMDAyOTcgNjU1MzUgZg0KMDAw
MDAwMDI5OCA2NTUzNSBmDQowMDAwMDAwMjk5IDY1NTM1IGYNCjAwMDAwMDAzMDAgNjU1MzUgZg0K
MDAwMDAwMDMwMSA2NTUzNSBmDQowMDAwMDAwMDAwIDY1NTM1IGYNCjAwMDAwMjE0NTUgMDAwMDAg
bg0KMDAwMDAyMTgzOSAwMDAwMCBuDQowMDAwMTI0NTA5IDAwMDAwIG4NCjAwMDAxMjQ5MDIgMDAw
MDAgbg0KMDAwMDEyNTIzNiAwMDAwMCBuDQowMDAwMTI1NDg4IDAwMDAwIG4NCjAwMDAxMjU3ODkg
MDAwMDAgbg0KMDAwMDEzODkzMyAwMDAwMCBuDQowMDAwMTM4OTc3IDAwMDAwIG4NCjAwMDAxNDIx
MjcgMDAwMDAgbg0KMDAwMDE0MjE3MyAwMDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDMxMy9Sb290
IDEgMCBSL0luZm8gMzIgMCBSL0lEWzxBMDI0NjI5MDRENTM4RDQ5OUM1MzBGODE5NEExMTlFMz48
QTAyNDYyOTA0RDUzOEQ0OTlDNTMwRjgxOTRBMTE5RTM+XSA+Pg0Kc3RhcnR4cmVmDQoxNDMwNDIN
CiUlRU9GDQp4cmVmDQowIDANCnRyYWlsZXINCjw8L1NpemUgMzEzL1Jvb3QgMSAwIFIvSW5mbyAz
MiAwIFIvSURbPEEwMjQ2MjkwNEQ1MzhENDk5QzUzMEY4MTk0QTExOUUzPjxBMDI0NjI5MDRENTM4
RDQ5OUM1MzBGODE5NEExMTlFMz5dIC9QcmV2IDE0MzA0Mi9YUmVmU3RtIDE0MjE3Mz4+DQpzdGFy
dHhyZWYNCjE0OTQ2Mg0KJSVFT0Y=

--_004_CY4PR21MB05045AD34CD4194ECD77F562F5350CY4PR21MB0504namp_--


From nobody Thu Mar 30 10:52:52 2017
Return-Path: <scott@paragonie.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFA271299EE for <jose@ietfa.amsl.com>; Thu, 30 Mar 2017 10:52:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level: 
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paragonie-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1lzL1IS4geHV for <jose@ietfa.amsl.com>; Thu, 30 Mar 2017 10:52:48 -0700 (PDT)
Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12948129639 for <jose@ietf.org>; Thu, 30 Mar 2017 10:52:48 -0700 (PDT)
Received: by mail-oi0-x234.google.com with SMTP id r203so38583046oib.3 for <jose@ietf.org>; Thu, 30 Mar 2017 10:52:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragonie-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=TbdPj+yF13zq6y7EPW18dS0S+TTMLTwAytFPWM1ycnE=; b=X4YTa7X7cqbH1xVO8nRL/YvpV6Yabz6o5bMKBKE7MDXaNSslz1k/P1HsKfM1/oPSWO x1MtLb5m6pDjnhfscI1Kl1WhNK8JfjXSYRNSa4ZoaTr9MieKIPhY7RGagc8Q+f2DILxD rm6SF9Yi2YIjFv8eyHx8aF7p7RkQgIF21HexeB41RJXbh06cyS7r2PdaFSY6ZAxyybnN zWuLeRzjqI+1r3Iyulo4p43IwDtvDPRCiliyZPY74/S0DFLKjo/oSHcyoHkF1cRZ/m5B I/eKWYD0l0lRG9Mx3SWqrHzo22bwTuGh0dPn+TG8zI0NHJLVdgmcI37dK8MNMWxihpQa +f0A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=TbdPj+yF13zq6y7EPW18dS0S+TTMLTwAytFPWM1ycnE=; b=iWY93rLfSWnZ0wK7+0jx0VUKRmr1D20hpPk5X3pfc3bl6bZiflwWucoKi691Etj32B TjBSGpo8sCrqVmmYUvaEA4FfD0/f+HBygwr/8PrcdE3kBIgylKR/X5LvXuFWlkbb3eAQ 0fHi33i/jKZ+9BTFGYQduEQvQAqvJ+blRv7raToNCJ6Vy9UUg53YQxcmyUkNOC0oJ8u6 sR0LaFsUO8FSZ8m+TSyVNbq5I/HbulpXPxBdzCWFab8p5BQ4nRWWbKy2avMBGupMOCsy uR0y4GhiYYkf97oHk0WqKeXs2dcGMtdqN3pUgfGyqDW6+Oz5b6AfqvNmS8vQDTHWvN8f nCRQ==
X-Gm-Message-State: AFeK/H3zp7LRs4Yx8DY357RlhTq4GCv7gbelj2ledeAUWkFdKlDTasTXMCUunVPc9lTHyPciYh92tBlcZCI+zg==
X-Received: by 10.157.38.229 with SMTP id i34mr574751otd.97.1490896367249; Thu, 30 Mar 2017 10:52:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.46.198 with HTTP; Thu, 30 Mar 2017 10:52:46 -0700 (PDT)
In-Reply-To: <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu> <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com> <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com>
From: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Date: Thu, 30 Mar 2017 13:52:46 -0400
Message-ID: <CAKws9z1_H0+YXa-DLPEKKnTdZYQU7U4bvB9iRcDoGiLhcas+wA@mail.gmail.com>
To: Nathaniel McCallum <npmccallum@redhat.com>
Cc: Justin Richer <jricher@mit.edu>, jose@ietf.org
Content-Type: multipart/alternative; boundary=001a11393f365e006e054bf65cb0
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/nc7qsxrRZLfhcBVOwQDiIBtKaEY>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 17:52:52 -0000

--001a11393f365e006e054bf65cb0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 29, 2017 at 3:29 PM, Nathaniel McCallum <npmccallum@redhat.com>
wrote:

> On Wed, Mar 29, 2017 at 2:36 PM, Paragon Initiative Enterprises
> Security Team <security@paragonie.com> wrote:
> > On Wed, Mar 29, 2017 at 2:22 PM, Justin Richer <jricher@mit.edu> wrote:
> >>
> >> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=
=80=9Calg: HS256=E2=80=9D or the
> like,
> >> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D=
 with =E2=80=9Cmode: sa=E2=80=9D?
> >> There have been some reasonable arguments for removing the algorithm
> >> selection from the JOSE package, but this proposal doesn=E2=80=99t do =
that.
> Instead,
> >> it simply defines *new* headers for algorithm selection. Ergo, unless
> I=E2=80=99m
> >> missing a key point here, this is just kicking things down the road a
> little
> >> bit.
> >>
> >>  =E2=80=94 Justin
> >>
> >> On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Security
> Team
> >> <security@paragonie.com> wrote:
> >>
> >> Hello,
> >>
> >> We've outlined some suggestions to make a JOSE replacement/upgrade mor=
e
> >> secure. Our suggestions are outlined at
> >> https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27c
> 03,
> >> but I have mirrored them below.
> >>
> >> Changes to JOSE that will prevent insecurity
> >>
> >> Deletions
> >>
> >> JWS and JWE
> >>
> >> Drop the alg header
> >>
> >> Neither JOSE users nor JOSE library designers should be required to
> >> understand cryptography primitives. At a lower level, this can lead to
> badly
> >> implemented primitives. On a higher level, this can lead to reasoning =
by
> >> lego.
> >>
> >> For all the reasons outlined here and here, the alg header (and
> algorithm
> >> agility in its entirety) should be considered harmful.
> >>
> >> JWE
> >>
> >> Drop the enc header
> >>
> >> For the same reason we're dropping the alg header, we should drop the
> enc
> >> header.
> >>
> >> Consider dropping the zip header
> >>
> >> As we've seen with CRIME and BREACH, as well as this error oracle atta=
ck
> >> against iMessage, compression can introduce side-channels that totally
> >> undermine confidentiality.
> >>
> >> This one is less of a hard-and-fast requirement to make JOSE secure,
> but I
> >> still strongly recommend it.
> >>
> >> Additions
> >>
> >> JWS and JWE
> >>
> >> New header: ver (version)
> >>
> >> Instead of letting library developers and users mix-and-match
> cryptography
> >> algorithms, the only choice they should be given is, "Which version ar=
e
> we
> >> using?" Versions can look like this:
> >>
> >> Version 1:
> >>
> >> HMAC-SHA256 for shared-key authentication
> >> AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key
> >> encryption
> >> RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for
> >> public-key encryption, min. key size: 2048-bit
> >> RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital
> signatures,
> >> min. key size: 2048-bit
> >>
> >> Version 2:
> >>
> >> HMAC-SHA256 for shared-key authentication
> >> AES-256-GCM for shared-key encryption
> >> ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key encrypti=
on
> >>
> >> Libraries must verify that the point is on the curve
> >>
> >> ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministic
> >> ECDSA), for public-key digital signatures
> >>
> >> Version 3:
> >>
> >> HMAC-SHA512-256 for shared-key authentication
> >>
> >> As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not
> >> HMAC-SHA-512/256.
> >>
> >> Xsalsa20poly1305 for shared-key encryption
> >> X25519 + Xsalsa20poly1305 for public-key encryption
> >> Ed25519 for public-key digital signatures
> >>
> >> Libraries that support version 3 SHOULD NOT support version 1.
> >>
> >> New header: mode
> >>
> >> Only four options (case-insensitive):
> >>
> >> se =3D Shared-key Encryption
> >> sa =3D Shared-key Authentication
> >> pe =3D Public-key Encryption
> >> ps =3D Public-key digital Signatures
> >>
> >>
> >> Kind regards,
> >>
> >> Security Team
> >> Paragon Initiative Enterprises
> >> _______________________________________________
> >> jose mailing list
> >> jose@ietf.org
> >> https://www.ietf.org/mailman/listinfo/jose
> >>
> >>
> >
> > Hi,
> >
> >> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=
=80=9Calg: HS256=E2=80=9D or the
> like,
> >> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=9D=
 with =E2=80=9Cmode: sa=E2=80=9D?
> >
> >
> > There are more problems than the RS256/HS256 critical vulnerability fro=
m
> > 2015, but nonetheless, you raise a good point:
> >
> > The mode should be decided out-of-band, not supplied by the attacker.
> >
> > Therefore, the mode header must be made optional (i.e. it's purely
> > informational) and implementations should be encouraged to only operate
> in
> > one mode at a time (i.e. not decided by the message they receive).
> >
> >> There have been some reasonable arguments for removing the algorithm
> >> selection from the JOSE package, but this proposal doesn=E2=80=99t do =
that.
> Instead,
> >> it simply defines *new* headers for algorithm selection. Ergo, unless
> I=E2=80=99m
> >> missing a key point here, this is just kicking things down the road a
> little
> >> bit.
> >
> >
> > The previous standard allowed people to choose which hash function,
> which of
> > the NIST P-curves, etc. to use. The new proposal only allows for one
> > cipher/algorithm per use-case. These algorithm decisions should be made
> by
> > experts and given as non-tweakable, hard-coded configuration options.
> There
> > is no "a little of column A, a little of column B", you either use
> version 2
> > or version 3.
> =E2=80=8B=E2=80=8B
>
> But the attacker still gets to choose what version to lie about.
> Implementers will still have to verify that the expected algorithm (as
> defined implicitly by the version) matches the inputs. Failure to
> check inputs has been the cause of all the major vulnerabilities. This
> plan adds precisely no additional security but comes with great cost
> for implementers.
>
> The bottom line is that implementers of JOSE need to know what they're
> doing. The expectation that someone can write a JOSE library without
> understanding cryptographic primitives is unrealistic.
>

=E2=80=8BNathaniel,

=E2=80=8B
> =E2=80=8BBut the attacker still gets to choose what version to lie about.

Implementers will still have to verify that the expected algorithm (as

defined implicitly by the version) matches the inputs.
> =E2=80=8B=E2=80=8B
> =E2=80=8B=E2=80=8B
> Failure to
> check inputs has been the cause of all the major vulnerabilities.
> =E2=80=8B=E2=80=8B
> This
> plan adds precisely no additional security but comes with great cost

for implementers.=E2=80=8B
> =E2=80=8B


=E2=80=8BI'd like to unpack your claims here.

=E2=80=8B
> =E2=80=8B
> =E2=80=8B
> =E2=80=8BBut the attacker still gets to choose what version to lie about.

Implementers will still have to verify that the expected algorithm (as

defined implicitly by the version) matches the inputs.


=E2=80=8BLet's look at version 3 of the original email:

   - HMAC-SHA-512-256: 32 byte signature
   - Ed25519: 64 byte signature (RFC 8032 for reference)=E2=80=8B
   - XSalsa20Poly1305: [ciphertext] + [16 byte authentication tag]
   - X25519 + XSalsa20Poly1305: [32 byte ephemeral X25519 public key] +
   [Ciphertext] + [16 byte authentication tag]

The respective libsodium functions here would be: crypto_auth(),
crypto_sign(), crypto_secretbox(), and crypto_box_seal() if you'd like a
reference implementation.

The analogous =E2=80=8Battacks on RS256/HS256 confusion do not apply: If yo=
u
attempt to crypto_auth_verify(signature, message, pk) instead of
crypto_sign_verify_detached(signature, message, pk), it will fail in
constant time (i.e. the signature is not long enough).

In fact, in *all* cases the preferred underlying library will fail closed
without leaking useful timing information. Can the same be said of the JOSE
standards?

=E2=80=8B
> Failure to check inputs has been the cause of all the major
> vulnerabilities.
>

=E2=80=8BNo, a badly-written standard that maximizes the joinery between di=
fferent
cryptography protocols, encourages users to mix-and-match primitives, and
has weird key encapsulation schemes (n.b. AES-GCM does not belong in the
same category as public-key cryptography), while placing all the blame on
libraries and users, and furthermore has not been designed with the
assistance of a professional cryptographer, has been the root cause of all
the major vulnerabilities.

As an industry, we've grown past the point to where we can just blame users
for mistakes enabled by our error-prone cryptographic designs. Has the IETF
lagged behind here?

=E2=80=8B
> =E2=80=8B
> This
> =E2=80=8B
> plan adds precisely no additional security =E2=80=8B


=E2=80=8BThat's an interesting claim, and easily debunked:

By getting rid of RSA PKCS1v1.5 encryption and signing, we eliminate any
chance of Daniel Bleichenbacher's 1998 or 2006 attacks against RSA +
PKCS1v1.5 padding, which increases the security of implementations by a
nonzero amount.

If anyoune would like to argue that PKCS1v1.5 is just fine (insert dog
drinking coffee in a house fire here), be sure to CC some of the TLSWG and
CFRG members; they could use a laugh.

Security Team
Paragon Initiative Enterprises <https://paragonie.com/security>=E2=80=8B

--001a11393f365e006e054bf65cb0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:monospac=
e,monospace"><br></div><div class=3D"gmail_extra">
<br><div class=3D"gmail_quote">On Wed, Mar 29, 2017 at 3:29 PM, Nathaniel M=
cCallum <span dir=3D"ltr">&lt;<a href=3D"mailto:npmccallum@redhat.com" targ=
et=3D"_blank">npmccallum@redhat.com</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">On Wed, Mar 29, 2017 at 2:36 PM, Parago=
n Initiative Enterprises<br>
<div><div class=3D"gmail-h5">Security Team &lt;<a href=3D"mailto:security@p=
aragonie.com">security@paragonie.com</a>&gt; wrote:<br>
&gt; On Wed, Mar 29, 2017 at 2:22 PM, Justin Richer &lt;<a href=3D"mailto:j=
richer@mit.edu">jricher@mit.edu</a>&gt; wrote:<br>
&gt;&gt;<br>
&gt;&gt; If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =
=E2=80=9Calg: HS256=E2=80=9D or the like,<br>
&gt;&gt; how is that any different from substituting =E2=80=9Cmode: ps=E2=
=80=9D with =E2=80=9Cmode: sa=E2=80=9D?<br>
&gt;&gt; There have been some reasonable arguments for removing the algorit=
hm<br>
&gt;&gt; selection from the JOSE package, but this proposal doesn=E2=80=99t=
 do that. Instead,<br>
&gt;&gt; it simply defines *new* headers for algorithm selection. Ergo, unl=
ess I=E2=80=99m<br>
&gt;&gt; missing a key point here, this is just kicking things down the roa=
d a little<br>
&gt;&gt; bit.<br>
&gt;&gt;<br>
&gt;&gt;=C2=A0 =E2=80=94 Justin<br>
&gt;&gt;<br>
&gt;&gt; On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Secur=
ity Team<br>
&gt;&gt; &lt;<a href=3D"mailto:security@paragonie.com">security@paragonie.c=
om</a>&gt; wrote:<br>
&gt;&gt;<br>
&gt;&gt; Hello,<br>
&gt;&gt;<br>
&gt;&gt; We&#39;ve outlined some suggestions to make a JOSE replacement/upg=
rade more<br>
&gt;&gt; secure. Our suggestions are outlined at<br>
&gt;&gt; <a href=3D"https://gist.github.com/paragonie-scott/c88290347c2589b=
0cd38d8bb6ac27c03" rel=3D"noreferrer" target=3D"_blank">https://gist.github=
.com/<wbr>paragonie-scott/<wbr>c88290347c2589b0cd38d8bb6ac27c<wbr>03</a>,<b=
r>
&gt;&gt; but I have mirrored them below.<br>
&gt;&gt;<br>
&gt;&gt; Changes to JOSE that will prevent insecurity<br>
&gt;&gt;<br>
&gt;&gt; Deletions<br>
&gt;&gt;<br>
&gt;&gt; JWS and JWE<br>
&gt;&gt;<br>
&gt;&gt; Drop the alg header<br>
&gt;&gt;<br>
&gt;&gt; Neither JOSE users nor JOSE library designers should be required t=
o<br>
&gt;&gt; understand cryptography primitives. At a lower level, this can lea=
d to badly<br>
&gt;&gt; implemented primitives. On a higher level, this can lead to reason=
ing by<br>
&gt;&gt; lego.<br>
&gt;&gt;<br>
&gt;&gt; For all the reasons outlined here and here, the alg header (and al=
gorithm<br>
&gt;&gt; agility in its entirety) should be considered harmful.<br>
&gt;&gt;<br>
&gt;&gt; JWE<br>
&gt;&gt;<br>
&gt;&gt; Drop the enc header<br>
&gt;&gt;<br>
&gt;&gt; For the same reason we&#39;re dropping the alg header, we should d=
rop the enc<br>
&gt;&gt; header.<br>
&gt;&gt;<br>
&gt;&gt; Consider dropping the zip header<br>
&gt;&gt;<br>
&gt;&gt; As we&#39;ve seen with CRIME and BREACH, as well as this error ora=
cle attack<br>
&gt;&gt; against iMessage, compression can introduce side-channels that tot=
ally<br>
&gt;&gt; undermine confidentiality.<br>
&gt;&gt;<br>
&gt;&gt; This one is less of a hard-and-fast requirement to make JOSE secur=
e, but I<br>
&gt;&gt; still strongly recommend it.<br>
&gt;&gt;<br>
&gt;&gt; Additions<br>
&gt;&gt;<br>
&gt;&gt; JWS and JWE<br>
&gt;&gt;<br>
&gt;&gt; New header: ver (version)<br>
&gt;&gt;<br>
&gt;&gt; Instead of letting library developers and users mix-and-match cryp=
tography<br>
&gt;&gt; algorithms, the only choice they should be given is, &quot;Which v=
ersion are we<br>
&gt;&gt; using?&quot; Versions can look like this:<br>
&gt;&gt;<br>
&gt;&gt; Version 1:<br>
&gt;&gt;<br>
&gt;&gt; HMAC-SHA256 for shared-key authentication<br>
&gt;&gt; AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key<=
br>
&gt;&gt; encryption<br>
&gt;&gt; RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM f=
or<br>
&gt;&gt; public-key encryption, min. key size: 2048-bit<br>
&gt;&gt; RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital s=
ignatures,<br>
&gt;&gt; min. key size: 2048-bit<br>
&gt;&gt;<br>
&gt;&gt; Version 2:<br>
&gt;&gt;<br>
&gt;&gt; HMAC-SHA256 for shared-key authentication<br>
&gt;&gt; AES-256-GCM for shared-key encryption<br>
&gt;&gt; ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key encr=
yption<br>
&gt;&gt;<br>
&gt;&gt; Libraries must verify that the point is on the curve<br>
&gt;&gt;<br>
&gt;&gt; ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (determini=
stic<br>
&gt;&gt; ECDSA), for public-key digital signatures<br>
&gt;&gt;<br>
&gt;&gt; Version 3:<br>
&gt;&gt;<br>
&gt;&gt; HMAC-SHA512-256 for shared-key authentication<br>
&gt;&gt;<br>
&gt;&gt; As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not<br>
&gt;&gt; HMAC-SHA-512/256.<br>
&gt;&gt;<br>
&gt;&gt; Xsalsa20poly1305 for shared-key encryption<br>
&gt;&gt; X25519 + Xsalsa20poly1305 for public-key encryption<br>
&gt;&gt; Ed25519 for public-key digital signatures<br>
&gt;&gt;<br>
&gt;&gt; Libraries that support version 3 SHOULD NOT support version 1.<br>
&gt;&gt;<br>
&gt;&gt; New header: mode<br>
&gt;&gt;<br>
&gt;&gt; Only four options (case-insensitive):<br>
&gt;&gt;<br>
&gt;&gt; se =3D Shared-key Encryption<br>
&gt;&gt; sa =3D Shared-key Authentication<br>
&gt;&gt; pe =3D Public-key Encryption<br>
&gt;&gt; ps =3D Public-key digital Signatures<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; Kind regards,<br>
&gt;&gt;<br>
&gt;&gt; Security Team<br>
&gt;&gt; Paragon Initiative Enterprises<br>
&gt;&gt; ______________________________<wbr>_________________<br>
&gt;&gt; jose mailing list<br>
&gt;&gt; <a href=3D"mailto:jose@ietf.org">jose@ietf.org</a><br>
&gt;&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/jose" rel=3D"nore=
ferrer" target=3D"_blank">https://www.ietf.org/mailman/<wbr>listinfo/jose</=
a><br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;<br>
&gt; Hi,<br>
&gt;<br>
&gt;&gt; If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =
=E2=80=9Calg: HS256=E2=80=9D or the like,<br>
&gt;&gt; how is that any different from substituting =E2=80=9Cmode: ps=E2=
=80=9D with =E2=80=9Cmode: sa=E2=80=9D?<br>
&gt;<br>
&gt;<br>
&gt; There are more problems than the RS256/HS256 critical vulnerability fr=
om<br>
&gt; 2015, but nonetheless, you raise a good point:<br>
&gt;<br>
&gt; The mode should be decided out-of-band, not supplied by the attacker.<=
br>
&gt;<br>
&gt; Therefore, the mode header must be made optional (i.e. it&#39;s purely=
<br>
&gt; informational) and implementations should be encouraged to only operat=
e in<br>
&gt; one mode at a time (i.e. not decided by the message they receive).<br>
&gt;<br>
&gt;&gt; There have been some reasonable arguments for removing the algorit=
hm<br>
&gt;&gt; selection from the JOSE package, but this proposal doesn=E2=80=99t=
 do that. Instead,<br>
&gt;&gt; it simply defines *new* headers for algorithm selection. Ergo, unl=
ess I=E2=80=99m<br>
&gt;&gt; missing a key point here, this is just kicking things down the roa=
d a little<br>
&gt;&gt; bit.<br>
&gt;<br>
&gt;<br>
&gt; The previous standard allowed people to choose which hash function, wh=
ich of<br>
&gt; the NIST P-curves, etc. to use. The new proposal only allows for one<b=
r>
&gt; cipher/algorithm per use-case. These algorithm decisions should be mad=
e by<br>
&gt; experts and given as non-tweakable, hard-coded configuration options. =
There<br>
&gt; is no &quot;a little of column A, a little of column B&quot;, you eith=
er use version 2<br>
&gt; or version 3.<br>
<div class=3D"gmail_default" style=3D"font-family:monospace,monospace;displ=
ay:inline">=E2=80=8B=E2=80=8B</div><br>
</div></div>But the attacker still gets to choose what version to lie about=
.<br>
Implementers will still have to verify that the expected algorithm (as<br>
defined implicitly by the version) matches the inputs. Failure to<br>
check inputs has been the cause of all the major vulnerabilities. This<br>
plan adds precisely no additional security but comes with great cost<br>
for implementers.<br>
<br>
The bottom line is that implementers of JOSE need to know what they&#39;re<=
br>
doing. The expectation that someone can write a JOSE library without<br>
understanding cryptographic primitives is unrealistic.<br>
</blockquote></div><br></div><div class=3D"gmail_extra"><div class=3D"gmail=
_default" style=3D"font-family:monospace,monospace">=E2=80=8BNathaniel,</di=
v><div class=3D"gmail_default" style=3D"font-family:monospace,monospace"><b=
r></div><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex" class=3D"gmail_quote"><div class=3D"gma=
il_default" style=3D"font-family:monospace,monospace;display:inline">=E2=80=
=8B</div><span style=3D"font-family:monospace,monospace">=E2=80=8B</span>Bu=
t the attacker still gets to choose what version to lie about.=C2=A0</block=
quote><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r=
gb(204,204,204);padding-left:1ex" class=3D"gmail_quote">Implementers will s=
till have to verify that the expected algorithm (as</blockquote><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">defined implicitly by the version) m=
atches the inputs. <div class=3D"gmail_default" style=3D"font-family:monosp=
ace,monospace;display:inline">=E2=80=8B=E2=80=8B</div><div class=3D"gmail_d=
efault" style=3D"font-family:monospace,monospace;display:inline">=E2=80=8B=
=E2=80=8B</div>Failure to<br>check inputs has been the cause of all the maj=
or vulnerabilities. <div class=3D"gmail_default" style=3D"font-family:monos=
pace,monospace;display:inline">=E2=80=8B=E2=80=8B</div>This<br>plan adds pr=
ecisely no additional security but comes with great cost</blockquote><block=
quote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex" class=3D"gmail_quote"><div class=3D"gmail_default" st=
yle=3D"font-family:monospace,monospace;display:inline"><span style=3D"font-=
family:arial,sans-serif">for implementers.</span>=E2=80=8B</div>=E2=80=8B</=
blockquote><br></div><div class=3D"gmail_extra"><div class=3D"gmail_default=
" style=3D"font-family:monospace,monospace">=E2=80=8BI&#39;d like to unpack=
 your claims here.</div><div class=3D"gmail_default" style=3D"font-family:m=
onospace,monospace"><br></div><blockquote style=3D"margin:0px 0px 0px 0.8ex=
;border-left:1px solid rgb(204,204,204);padding-left:1ex" class=3D"gmail_qu=
ote">=E2=80=8B<div class=3D"gmail_default" style=3D"font-family:monospace,m=
onospace;display:inline">=E2=80=8B</div><div class=3D"gmail_default" style=
=3D"font-family:monospace,monospace;display:inline">=E2=80=8B</div><span st=
yle=3D"font-family:monospace,monospace">=E2=80=8B</span>But the attacker st=
ill gets to choose what version to lie about.=C2=A0</blockquote><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">Implementers will still have to veri=
fy that the expected algorithm (as</blockquote><blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex">defined implicitly by the version) matches the inputs=
.</blockquote><div><br></div><div class=3D"gmail_default" style=3D"font-fam=
ily:monospace,monospace">=E2=80=8BLet&#39;s look at version 3 of the origin=
al email:</div><div class=3D"gmail_default" style=3D"font-family:monospace,=
monospace"><ul><li>HMAC-SHA-512-256: 32 byte signature</li><li>Ed25519: 64 =
byte signature (RFC 8032 for reference)=E2=80=8B<br></li><li>XSalsa20Poly13=
05: [ciphertext] + [16 byte authentication tag]</li><li>X25519 + XSalsa20Po=
ly1305: [32 byte ephemeral X25519 public key] + [Ciphertext] + [16 byte aut=
hentication tag]</li></ul><div>The respective libsodium functions here woul=
d be: crypto_auth(), crypto_sign(), crypto_secretbox(), and crypto_box_seal=
() if you&#39;d like a reference implementation.</div><div><br></div><div>T=
he analogous =E2=80=8Battacks on RS256/HS256 confusion do not apply: If you=
 attempt to crypto_auth_verify(signature, message, pk) instead of crypto_si=
gn_verify_detached(signature, message, pk), it will fail in constant time (=
i.e. the signature is not long enough).</div><div><br></div><div>In fact, i=
n <i>all</i>=C2=A0cases the preferred underlying library will fail closed w=
ithout leaking useful timing information. Can the same be said of the JOSE =
standards?</div><div><br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex"><div class=3D"gmail_default" style=3D"display:inline">=E2=80=8B</div>=
<span style=3D"font-family:arial,sans-serif">Failure to=C2=A0</span><span s=
tyle=3D"font-family:arial,sans-serif">check inputs has been the cause of al=
l the major vulnerabilities.</span><br></blockquote></div></div><div class=
=3D"gmail_extra"><br></div><div class=3D"gmail_extra"><div class=3D"gmail_d=
efault" style=3D"font-family:monospace,monospace">=E2=80=8BNo, a badly-writ=
ten standard that maximizes the joinery between different cryptography prot=
ocols, encourages users to mix-and-match primitives, and has weird key enca=
psulation schemes (n.b. AES-GCM does not belong in the same category as pub=
lic-key cryptography), while placing all the blame on libraries and users, =
and furthermore has not been designed with the assistance of a professional=
 cryptographer, has been the root cause of all the major vulnerabilities.</=
div><div class=3D"gmail_default" style=3D"font-family:monospace,monospace">=
<br></div><div class=3D"gmail_default" style=3D"font-family:monospace,monos=
pace">As an industry, we&#39;ve grown past the point to where we can just b=
lame users for mistakes enabled by our error-prone cryptographic designs. H=
as the IETF lagged behind here?</div><div class=3D"gmail_default" style=3D"=
font-family:monospace,monospace"><br></div><blockquote style=3D"margin:0px =
0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" clas=
s=3D"gmail_quote"><div class=3D"gmail_default" style=3D"font-family:monospa=
ce,monospace;display:inline">=E2=80=8B</div><div class=3D"gmail_default" st=
yle=3D"font-family:monospace,monospace;display:inline">=E2=80=8B</div>This<=
div class=3D"gmail_default" style=3D"font-family:monospace,monospace;displa=
y:inline">=E2=80=8B=C2=A0</div>plan adds precisely no additional security=
=C2=A0<span style=3D"font-family:monospace,monospace">=E2=80=8B</span></blo=
ckquote><div><br></div><div class=3D"gmail_default" style=3D"font-family:mo=
nospace,monospace">=E2=80=8BThat&#39;s an interesting claim, and easily deb=
unked:</div><div class=3D"gmail_default" style=3D"font-family:monospace,mon=
ospace"><br></div><div class=3D"gmail_default" style=3D"font-family:monospa=
ce,monospace">By getting rid of RSA PKCS1v1.5 encryption and signing, we el=
iminate any chance of Daniel Bleichenbacher&#39;s 1998 or 2006 attacks agai=
nst RSA + PKCS1v1.5 padding, which increases the security of implementation=
s by a nonzero amount.</div><div class=3D"gmail_default" style=3D"font-fami=
ly:monospace,monospace"><br></div><div class=3D"gmail_default" style=3D"fon=
t-family:monospace,monospace">If anyoune would like to argue that PKCS1v1.5=
 is just fine (insert dog drinking coffee in a house fire here), be sure to=
 CC some of the TLSWG and CFRG members; they could use a laugh.</div></div>=
<div class=3D"gmail_extra"><br clear=3D"all"><div><div class=3D"gmail_signa=
ture"><div dir=3D"ltr">Security Team</div></div></div><div class=3D"gmail_d=
efault" style=3D"font-family:monospace,monospace"><a href=3D"https://parago=
nie.com/security" target=3D"_blank" style=3D"font-family:arial,sans-serif">=
Paragon Initiative Enterprises</a>=E2=80=8B</div><br></div></div>

--001a11393f365e006e054bf65cb0--


From nobody Fri Mar 31 08:46:13 2017
Return-Path: <nmccallu@redhat.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 568461294E1 for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 08:46:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.195
X-Spam-Level: 
X-Spam-Status: No, score=-4.195 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 258D44p8_r0T for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 08:46:09 -0700 (PDT)
Received: from mail-io0-f174.google.com (mail-io0-f174.google.com [209.85.223.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCF281294DF for <jose@ietf.org>; Fri, 31 Mar 2017 08:46:08 -0700 (PDT)
Received: by mail-io0-f174.google.com with SMTP id z13so42209939iof.2 for <jose@ietf.org>; Fri, 31 Mar 2017 08:46:08 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=lMbkzUGukFDQxfkYtJdHs322Rd8DxWg75IC9SiEpgG8=; b=eiSLTYbArJtiZbgiGqDBkJ7RT+wnXpCOtbGnj/FhHGEOYurnWTWaNqFYHuvWe+gf1C iIqZRK56ZUp4wlsD+YaMxo3IrxOoDyRZmFoMWp3VcvhzgW9r8zMT/CB1f8HebsQiuHId wE6lpQwSfNG5I9coZBnaYnodbdj4tnRQ0UcPaZZ5csunv6EEq+bbzH8jXVxCP9u+p2Ee OJw0ZiOHJVbE+eEqt/G2JNVVdZ0SL8k+/Ly8dolns/7/NT/eNP28olZRkalByw+wCqAs 3jkYceXxBfSp4IAypHGk5iNlgr/IaeuFjKSj6jQDttFk9tyDkQQIg3yg0b5evSHJ2nSk A2ig==
X-Gm-Message-State: AFeK/H0NH6gWQ/W/OHLzmJ9YdTgP8nlnu5yhJzQOyEniiuQ+pMkTfXdhtEZGFNxrETbpmW1bYgbNkhc9cIN8u73x
X-Received: by 10.107.205.197 with SMTP id d188mr3684186iog.206.1490975167998;  Fri, 31 Mar 2017 08:46:07 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.164.82 with HTTP; Fri, 31 Mar 2017 08:46:07 -0700 (PDT)
In-Reply-To: <CAKws9z1_H0+YXa-DLPEKKnTdZYQU7U4bvB9iRcDoGiLhcas+wA@mail.gmail.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu> <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com> <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com> <CAKws9z1_H0+YXa-DLPEKKnTdZYQU7U4bvB9iRcDoGiLhcas+wA@mail.gmail.com>
From: Nathaniel McCallum <npmccallum@redhat.com>
Date: Fri, 31 Mar 2017 11:46:07 -0400
Message-ID: <CAOASepNaSLmey8fO0zzH77tfbQpyGadgQPSUjDcxT7LJYezjrA@mail.gmail.com>
To: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Cc: Justin Richer <jricher@mit.edu>, jose@ietf.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/xhyLkI5ryYNevo-T8EFcFXz7M80>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 15:46:12 -0000

On Thu, Mar 30, 2017 at 1:52 PM, Paragon Initiative Enterprises
Security Team <security@paragonie.com> wrote:
>
>
> On Wed, Mar 29, 2017 at 3:29 PM, Nathaniel McCallum <npmccallum@redhat.co=
m>
> wrote:
>>
>> On Wed, Mar 29, 2017 at 2:36 PM, Paragon Initiative Enterprises
>> Security Team <security@paragonie.com> wrote:
>> > On Wed, Mar 29, 2017 at 2:22 PM, Justin Richer <jricher@mit.edu> wrote=
:
>> >>
>> >> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=
=80=9Calg: HS256=E2=80=9D or the
>> >> like,
>> >> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=
=9D with =E2=80=9Cmode: sa=E2=80=9D?
>> >> There have been some reasonable arguments for removing the algorithm
>> >> selection from the JOSE package, but this proposal doesn=E2=80=99t do=
 that.
>> >> Instead,
>> >> it simply defines *new* headers for algorithm selection. Ergo, unless
>> >> I=E2=80=99m
>> >> missing a key point here, this is just kicking things down the road a
>> >> little
>> >> bit.
>> >>
>> >>  =E2=80=94 Justin
>> >>
>> >> On Mar 29, 2017, at 11:19 AM, Paragon Initiative Enterprises Security
>> >> Team
>> >> <security@paragonie.com> wrote:
>> >>
>> >> Hello,
>> >>
>> >> We've outlined some suggestions to make a JOSE replacement/upgrade mo=
re
>> >> secure. Our suggestions are outlined at
>> >>
>> >> https://gist.github.com/paragonie-scott/c88290347c2589b0cd38d8bb6ac27=
c03,
>> >> but I have mirrored them below.
>> >>
>> >> Changes to JOSE that will prevent insecurity
>> >>
>> >> Deletions
>> >>
>> >> JWS and JWE
>> >>
>> >> Drop the alg header
>> >>
>> >> Neither JOSE users nor JOSE library designers should be required to
>> >> understand cryptography primitives. At a lower level, this can lead t=
o
>> >> badly
>> >> implemented primitives. On a higher level, this can lead to reasoning
>> >> by
>> >> lego.
>> >>
>> >> For all the reasons outlined here and here, the alg header (and
>> >> algorithm
>> >> agility in its entirety) should be considered harmful.
>> >>
>> >> JWE
>> >>
>> >> Drop the enc header
>> >>
>> >> For the same reason we're dropping the alg header, we should drop the
>> >> enc
>> >> header.
>> >>
>> >> Consider dropping the zip header
>> >>
>> >> As we've seen with CRIME and BREACH, as well as this error oracle
>> >> attack
>> >> against iMessage, compression can introduce side-channels that totall=
y
>> >> undermine confidentiality.
>> >>
>> >> This one is less of a hard-and-fast requirement to make JOSE secure,
>> >> but I
>> >> still strongly recommend it.
>> >>
>> >> Additions
>> >>
>> >> JWS and JWE
>> >>
>> >> New header: ver (version)
>> >>
>> >> Instead of letting library developers and users mix-and-match
>> >> cryptography
>> >> algorithms, the only choice they should be given is, "Which version a=
re
>> >> we
>> >> using?" Versions can look like this:
>> >>
>> >> Version 1:
>> >>
>> >> HMAC-SHA256 for shared-key authentication
>> >> AES-128-CBC + HMAC-SHA256 in Encrypt-then-MAC mode for shared-key
>> >> encryption
>> >> RSA-OAEP with MGF1-SHA256 and e=3D65537 + AES-128-CBC in KEM+DEM for
>> >> public-key encryption, min. key size: 2048-bit
>> >> RSASSA-PSS with MGF1-SHA256 and e=3D65537 for public-key digital
>> >> signatures,
>> >> min. key size: 2048-bit
>> >>
>> >> Version 2:
>> >>
>> >> HMAC-SHA256 for shared-key authentication
>> >> AES-256-GCM for shared-key encryption
>> >> ECDH over secp256r1 (NIST P-256) + AES-256-GCM for public-key
>> >> encryption
>> >>
>> >> Libraries must verify that the point is on the curve
>> >>
>> >> ECDSA over secp256r1 (NIST P-256), adhering to RFC 6979 (deterministi=
c
>> >> ECDSA), for public-key digital signatures
>> >>
>> >> Version 3:
>> >>
>> >> HMAC-SHA512-256 for shared-key authentication
>> >>
>> >> As per NaCl, this is HMAC-SHA-512 truncated to 256 bits, not
>> >> HMAC-SHA-512/256.
>> >>
>> >> Xsalsa20poly1305 for shared-key encryption
>> >> X25519 + Xsalsa20poly1305 for public-key encryption
>> >> Ed25519 for public-key digital signatures
>> >>
>> >> Libraries that support version 3 SHOULD NOT support version 1.
>> >>
>> >> New header: mode
>> >>
>> >> Only four options (case-insensitive):
>> >>
>> >> se =3D Shared-key Encryption
>> >> sa =3D Shared-key Authentication
>> >> pe =3D Public-key Encryption
>> >> ps =3D Public-key digital Signatures
>> >>
>> >>
>> >> Kind regards,
>> >>
>> >> Security Team
>> >> Paragon Initiative Enterprises
>> >> _______________________________________________
>> >> jose mailing list
>> >> jose@ietf.org
>> >> https://www.ietf.org/mailman/listinfo/jose
>> >>
>> >>
>> >
>> > Hi,
>> >
>> >> If the problem is substituting =E2=80=9Calg: RS256=E2=80=9D with =E2=
=80=9Calg: HS256=E2=80=9D or the
>> >> like,
>> >> how is that any different from substituting =E2=80=9Cmode: ps=E2=80=
=9D with =E2=80=9Cmode: sa=E2=80=9D?
>> >
>> >
>> > There are more problems than the RS256/HS256 critical vulnerability fr=
om
>> > 2015, but nonetheless, you raise a good point:
>> >
>> > The mode should be decided out-of-band, not supplied by the attacker.
>> >
>> > Therefore, the mode header must be made optional (i.e. it's purely
>> > informational) and implementations should be encouraged to only operat=
e
>> > in
>> > one mode at a time (i.e. not decided by the message they receive).
>> >
>> >> There have been some reasonable arguments for removing the algorithm
>> >> selection from the JOSE package, but this proposal doesn=E2=80=99t do=
 that.
>> >> Instead,
>> >> it simply defines *new* headers for algorithm selection. Ergo, unless
>> >> I=E2=80=99m
>> >> missing a key point here, this is just kicking things down the road a
>> >> little
>> >> bit.
>> >
>> >
>> > The previous standard allowed people to choose which hash function,
>> > which of
>> > the NIST P-curves, etc. to use. The new proposal only allows for one
>> > cipher/algorithm per use-case. These algorithm decisions should be mad=
e
>> > by
>> > experts and given as non-tweakable, hard-coded configuration options.
>> > There
>> > is no "a little of column A, a little of column B", you either use
>> > version 2
>> > or version 3.
>>
>> But the attacker still gets to choose what version to lie about.
>> Implementers will still have to verify that the expected algorithm (as
>> defined implicitly by the version) matches the inputs. Failure to
>> check inputs has been the cause of all the major vulnerabilities. This
>> plan adds precisely no additional security but comes with great cost
>> for implementers.
>>
>> The bottom line is that implementers of JOSE need to know what they're
>> doing. The expectation that someone can write a JOSE library without
>> understanding cryptographic primitives is unrealistic.
>
>
> Nathaniel,
>
>> But the attacker still gets to choose what version to lie about.
>>
>> Implementers will still have to verify that the expected algorithm (as
>>
>> defined implicitly by the version) matches the inputs.
>> Failure to
>> check inputs has been the cause of all the major vulnerabilities.
>> This
>> plan adds precisely no additional security but comes with great cost
>>
>> for implementers.
>
>
> I'd like to unpack your claims here.
>
>> But the attacker still gets to choose what version to lie about.
>>
>> Implementers will still have to verify that the expected algorithm (as
>>
>> defined implicitly by the version) matches the inputs.
>
>
> Let's look at version 3 of the original email:
>
> HMAC-SHA-512-256: 32 byte signature
> Ed25519: 64 byte signature (RFC 8032 for reference)
> XSalsa20Poly1305: [ciphertext] + [16 byte authentication tag]
> X25519 + XSalsa20Poly1305: [32 byte ephemeral X25519 public key] +
> [Ciphertext] + [16 byte authentication tag]
>
> The respective libsodium functions here would be: crypto_auth(),
> crypto_sign(), crypto_secretbox(), and crypto_box_seal() if you'd like a
> reference implementation.
>
> The analogous attacks on RS256/HS256 confusion do not apply: If you attem=
pt
> to crypto_auth_verify(signature, message, pk) instead of
> crypto_sign_verify_detached(signature, message, pk), it will fail in
> constant time (i.e. the signature is not long enough).
>
> In fact, in all cases the preferred underlying library will fail closed
> without leaking useful timing information. Can the same be said of the JO=
SE
> standards?

It can, yes, be said of the many implementations of the JOSE standards
that were not affected by RS256/HS256 confusion.

>> Failure to check inputs has been the cause of all the major
>> vulnerabilities.
>
>
> No, a badly-written standard that maximizes the joinery between different
> cryptography protocols, encourages users to mix-and-match primitives, and
> has weird key encapsulation schemes (n.b. AES-GCM does not belong in the
> same category as public-key cryptography), while placing all the blame on
> libraries and users, and furthermore has not been designed with the
> assistance of a professional cryptographer, has been the root cause of al=
l
> the major vulnerabilities.
>
> As an industry, we've grown past the point to where we can just blame use=
rs
> for mistakes enabled by our error-prone cryptographic designs. Has the IE=
TF
> lagged behind here?

Implementations that check the requested algorithm against the key
type and allowed key algorithms are not vulnerable. Hence, the root
cause is a failure to verify inputs.

Yes, it would be nice if the standard was less fragile in this area.
But you're asking for a major change to an existing standard after it
is published and many interoperable implementations exist. You have to
realize this is a (very) hard sell.

>> This
>>
>> plan adds precisely no additional security

(versus other plans with lower costs)

> That's an interesting claim, and easily debunked:
>
> By getting rid of RSA PKCS1v1.5 encryption and signing, we eliminate any
> chance of Daniel Bleichenbacher's 1998 or 2006 attacks against RSA +
> PKCS1v1.5 padding, which increases the security of implementations by a
> nonzero amount.
>
> If anyoune would like to argue that PKCS1v1.5 is just fine (insert dog
> drinking coffee in a house fire here), be sure to CC some of the TLSWG an=
d
> CFRG members; they could use a laugh.

Make a proposal to retire or downgrade RSA PKCS1v1.5 encryption and
signing. I'll support it.

Make the same proposal to retire zip. I'll support it.

These are both very achievable proposals that will significantly
reduce our attack surface.


From nobody Fri Mar 31 08:49:15 2017
Return-Path: <scott@paragonie.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 642E2124281 for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 08:49:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=paragonie-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AByG883Vq_PB for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 08:49:12 -0700 (PDT)
Received: from mail-oi0-x22c.google.com (mail-oi0-x22c.google.com [IPv6:2607:f8b0:4003:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32EAB1294DF for <jose@ietf.org>; Fri, 31 Mar 2017 08:49:12 -0700 (PDT)
Received: by mail-oi0-x22c.google.com with SMTP id o67so65044649oib.1 for <jose@ietf.org>; Fri, 31 Mar 2017 08:49:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragonie-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=JZ/Njz8rMxiJlpSZ3jjfgJhyBXVYIoCh6sL45YYTOYA=; b=nfDl6ROoOOFCfo3v3DHOHWjULHbLtCZ/DY/6VpdRgUu/e46pYWiOGZ7gCzzLPH7nHF QUhGJU23TFF1sm42k39FKQPY+ynEwzEGi0Q1OC4WxOf4amS6bCB1ORkXVLxTYlM7w8+6 OoeLcV2qPzF6Aubd3ZZW5Edo5F2BpXbAhgc+/I3lPfpd8MixBxoQfbKGTd6M/QiyqXPg xfxCWYeobbIpk7VLvbD4C3cHqkZokdUypRJZbXNe7D/cquV1iDMVsNzQfTDhM7kmBODU ltkY4PpuOGwNvzf8EcB8rvI3jB/gSPM+kw5N3lbavybryD5Ym+/2Js/5/RRn9cL1ep0S WoFA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JZ/Njz8rMxiJlpSZ3jjfgJhyBXVYIoCh6sL45YYTOYA=; b=Rw4UBfJvJZGI+WO7s/1F/Sd+JQLEWsamZDyUSm5C2LXFhjl1fB9RPUswMMmJxEwG5y JeyVXdbUcLllAj3VcvHOVYpHm5lgWeCj44PnwWrwJM2gEgOQabxWTNpPI4ahESCvagSL lt4oriJG0z4lWZz4UNjQFOsDJYEAQ6D1viEcmJ7GR9oW8zQONtHlTmaQ5tOUByPvCEkG Xk7Dh/XZjteHn8tQ0QVAe8P9jXPONe4+A4rx0/pZvnUwPtij/6lkXFk7EzWJJrwlsu04 s5tu1jtf2Cbb+clDqaH/EFWGIbjhv43XH21kQT1K7g8iQQFglzgxy8BrIFmxOhMglusM 0fng==
X-Gm-Message-State: AFeK/H3fWbrUerscpOuUFGDHAePj1f/kpiZIq8sH7yJE1iFuSJQsK4nRyhodidOLhFVorzGHhe0BbzasYDHrPw==
X-Received: by 10.202.196.71 with SMTP id u68mr2101836oif.210.1490975351456; Fri, 31 Mar 2017 08:49:11 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.46.198 with HTTP; Fri, 31 Mar 2017 08:49:11 -0700 (PDT)
In-Reply-To: <CAOASepNaSLmey8fO0zzH77tfbQpyGadgQPSUjDcxT7LJYezjrA@mail.gmail.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu> <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com> <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com> <CAKws9z1_H0+YXa-DLPEKKnTdZYQU7U4bvB9iRcDoGiLhcas+wA@mail.gmail.com> <CAOASepNaSLmey8fO0zzH77tfbQpyGadgQPSUjDcxT7LJYezjrA@mail.gmail.com>
From: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Date: Fri, 31 Mar 2017 11:49:11 -0400
Message-ID: <CAKws9z3KTNNk-GkgCHeH65dg=cOCuVQexKUdbjbPqYMFm+GB2w@mail.gmail.com>
To: Nathaniel McCallum <npmccallum@redhat.com>
Cc: Justin Richer <jricher@mit.edu>, jose@ietf.org
Content-Type: multipart/alternative; boundary=001a11351c86315be0054c08c0bb
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/7eAiYVBb5nwBsvCfJfLuvZ55oWg>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 15:49:14 -0000

--001a11351c86315be0054c08c0bb
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 31, 2017 at 11:46 AM, Nathaniel McCallum <npmccallum@redhat.com=
>
wrote:

> On Thu, Mar 30, 2017 at 1:52 PM, Paragon Initiative Enterprises
> Security Team <security@paragonie.com> wrote:
>

=E2=80=8B(SNIP)
=E2=80=8B

>
>
Yes, it would be nice if the standard was less fragile in this area.
> But you're asking for a major change to an existing standard after it
> is published and many interoperable implementations exist. You have to
> realize this is a (very) hard sell.
>

=E2=80=8BThe alternative is to tell people don't use JOSE, it's a bad stand=
ard
<https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-tha=
t-everyone-should-avoid>
and design a superior alternative to recommend instead. One that has
actually been vetted by cryptography experts.=E2=80=8B

=E2=80=8BGiven only those two options, which would you rather see?

Security Team
Paragon Initiative Enterprises <https://paragonie.com/security>=E2=80=8B

--001a11351c86315be0054c08c0bb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:monospac=
e,monospace"><br></div><div class=3D"gmail_extra"><div class=3D"gmail_quote=
">On Fri, Mar 31, 2017 at 11:46 AM, Nathaniel McCallum <span dir=3D"ltr">&l=
t;<a href=3D"mailto:npmccallum@redhat.com" target=3D"_blank">npmccallum@red=
hat.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D=
"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-le=
ft:1ex">On Thu, Mar 30, 2017 at 1:52 PM, Paragon Initiative Enterprises<br>
<div><div class=3D"gmail-h5">Security Team &lt;<a href=3D"mailto:security@p=
aragonie.com">security@paragonie.com</a>&gt; wrote:</div></div></blockquote=
><div><br></div><div class=3D"gmail_default" style=3D"font-family:monospace=
,monospace">=E2=80=8B(SNIP)</div><div class=3D"gmail_default" style=3D"font=
-family:monospace,monospace">=E2=80=8B</div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)=
;padding-left:1ex"><div><div class=3D"gmail-h5">=C2=A0</div></div></blockqu=
ote><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">
Yes, it would be nice if the standard was less fragile in this area.<br>
But you&#39;re asking for a major change to an existing standard after it<b=
r>
is published and many interoperable implementations exist. You have to<br>
realize this is a (very) hard sell.<br></blockquote><div><br></div><div><di=
v class=3D"gmail_default" style=3D"font-family:monospace,monospace">=E2=80=
=8BThe alternative is to tell people <a href=3D"https://paragonie.com/blog/=
2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid">don=
&#39;t use JOSE, it&#39;s a bad standard</a> and design a superior alternat=
ive to recommend instead. One that has actually been vetted by cryptography=
 experts.=E2=80=8B</div><div class=3D"gmail_default" style=3D"font-family:m=
onospace,monospace"><br></div><div class=3D"gmail_default" style=3D"font-fa=
mily:monospace,monospace">=E2=80=8BGiven only those two options, which woul=
d you rather see?</div></div></div></div><div class=3D"gmail_extra"><br cle=
ar=3D"all"><div><div class=3D"gmail_signature"><div dir=3D"ltr">Security Te=
am</div></div></div><div class=3D"gmail_default" style=3D"font-family:monos=
pace,monospace"><a href=3D"https://paragonie.com/security" target=3D"_blank=
" style=3D"font-family:arial,sans-serif">Paragon Initiative Enterprises</a>=
=E2=80=8B</div><br></div></div>

--001a11351c86315be0054c08c0bb--


From nobody Fri Mar 31 09:03:45 2017
Return-Path: <nmccallu@redhat.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B65112968B for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 09:03:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.195
X-Spam-Level: 
X-Spam-Status: No, score=-4.195 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vaF2mg7w36ia for <jose@ietfa.amsl.com>; Fri, 31 Mar 2017 09:03:41 -0700 (PDT)
Received: from mail-io0-f170.google.com (mail-io0-f170.google.com [209.85.223.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CD211242EA for <jose@ietf.org>; Fri, 31 Mar 2017 09:03:41 -0700 (PDT)
Received: by mail-io0-f170.google.com with SMTP id z13so42541705iof.2 for <jose@ietf.org>; Fri, 31 Mar 2017 09:03:41 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wwE+zscv2cdPum4qXPYVmOjp7ug4NHdQ3SIcNQuVPmE=; b=fXkNduOKZJYUXrbc6XC8yf+aSKSjD7GJp2fQpUI6nrJuSHsuRgfslvZs7EeNYZ3Ile iOmTHbkJZp1vq4LvTCN5+nJELkPeQ8EzV3FQzRyE53Tvf50DuQLCc8AzECphL+DyJAa0 FKvdFYY/oMK7aWQas5A9NQrScF48VYUWfiqXAQM58RyL+zGAOh8PxM+siHkLJoAAVNWW BEBrf3XUGW5Q46KP+tn84ba9u2y5S4wyQKdmxT8Iue3JydpKAh68ZUcUwef+17Ahh8B3 YqGZhV+dXNQBNI1h4gn97GoN95RjFF0PqkG1MzYlNGAa3C72e9QOx4BUEKhiw/xphrz2 sNUg==
X-Gm-Message-State: AFeK/H1CwAE85yqbUg/F7gObUVLrM8KVHQzDo93535BDTF6Wdetc+Y4SUN1u7d6tIVoFnh/chRem9yCbkA9FhLS1
X-Received: by 10.107.136.41 with SMTP id k41mr4288785iod.160.1490976220044; Fri, 31 Mar 2017 09:03:40 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.164.82 with HTTP; Fri, 31 Mar 2017 09:03:39 -0700 (PDT)
In-Reply-To: <CAKws9z3KTNNk-GkgCHeH65dg=cOCuVQexKUdbjbPqYMFm+GB2w@mail.gmail.com>
References: <CAKws9z0UxAFynhW1jf34VARyV82VHVEwhg4E4rcyMMtSGeHj4w@mail.gmail.com> <FCF428D5-9FF5-460D-8C54-D148177A38F9@mit.edu> <CAKws9z1jhYfE4fJBSn9Yp+ETKRgsiH6ZsW5J76AfytWSAY-85w@mail.gmail.com> <CAOASepN8Q5aZEfkc6buoTpBo_Xpoavxt1e5qruX6Cg24K3Ec2g@mail.gmail.com> <CAKws9z1_H0+YXa-DLPEKKnTdZYQU7U4bvB9iRcDoGiLhcas+wA@mail.gmail.com> <CAOASepNaSLmey8fO0zzH77tfbQpyGadgQPSUjDcxT7LJYezjrA@mail.gmail.com> <CAKws9z3KTNNk-GkgCHeH65dg=cOCuVQexKUdbjbPqYMFm+GB2w@mail.gmail.com>
From: Nathaniel McCallum <npmccallum@redhat.com>
Date: Fri, 31 Mar 2017 12:03:39 -0400
Message-ID: <CAOASepPO7dnC5smQ4+Z4p6Z9iVG3y8X7D9M+y1kfECN48gzDRQ@mail.gmail.com>
To: Paragon Initiative Enterprises Security Team <security@paragonie.com>
Cc: Justin Richer <jricher@mit.edu>, jose@ietf.org
Content-Type: text/plain; charset=UTF-8
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/u2aIL0af-1q1ze_VgHxFFpqI8f8>
Subject: Re: [jose] Towards a More Secure JOSE Standard
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 16:03:43 -0000

These are both applicable here:
    http://rationalwiki.org/wiki/False_dilemma
    https://xkcd.com/927/

It is very reasonable to tell people to ensure that their crypto
library is written by a security professional who understands
cryptography and ensures that inputs are validated.

Is is also sensible to write a follow-up RFC detailing security
considerations for implementers. Once done, you can tell people to
only use JOSE implementations that have performed conformity audits
against the new RFC.

Further, you can make sensible proposals to downgrade the IANA
recommendation level of algorithms subject to various attacks. This
can be done without a new RFC.

These approaches will have a far broader impact on the cryptography
ecosystem than proposing a new standard.

On Fri, Mar 31, 2017 at 11:49 AM, Paragon Initiative Enterprises
Security Team <security@paragonie.com> wrote:
>
> On Fri, Mar 31, 2017 at 11:46 AM, Nathaniel McCallum <npmccallum@redhat.com>
> wrote:
>>
>> On Thu, Mar 30, 2017 at 1:52 PM, Paragon Initiative Enterprises
>> Security Team <security@paragonie.com> wrote:
>
>
> (SNIP)
>>
>>
>>
>> Yes, it would be nice if the standard was less fragile in this area.
>> But you're asking for a major change to an existing standard after it
>> is published and many interoperable implementations exist. You have to
>> realize this is a (very) hard sell.
>
>
> The alternative is to tell people don't use JOSE, it's a bad standard and
> design a superior alternative to recommend instead. One that has actually
> been vetted by cryptography experts.
>
> Given only those two options, which would you rather see?
>
> Security Team
> Paragon Initiative Enterprises
>

