From nobody Fri Mar 2 06:24:12 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C16A7124B18 for ; Fri, 2 Mar 2018 06:24:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7BvRIo6IGeYS for ; Fri, 2 Mar 2018 06:24:10 -0800 (PST) Received: from mail-oi0-x231.google.com (mail-oi0-x231.google.com [IPv6:2607:f8b0:4003:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C3DF1201F8 for ; Fri, 2 Mar 2018 06:24:07 -0800 (PST) Received: by mail-oi0-x231.google.com with SMTP id u73so7147133oie.3 for ; Fri, 02 Mar 2018 06:24:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:from:date:message-id:subject:to; bh=E2qkv0b3y83VSVsnpBnYYJDUa05xQEpv4u+Vztgs6Bo=; b=szKBpZSHrdckZNyHVVcV3F8V8TpuZebAkfVoaJpWF+nTj1AU/eyCH5UYC1zeX1BL2q 9p1KBEaJGuAkaKRnNHXK+TnQaBGW/avJ2gAlhKesrUhW5d/AvTRtINgP5BN3pAXgW2SY G7w+YHnu2sosT4y80UvyWqeV+pvDETD44T/CEkqK6lF0MCh+VPk8L9PS4Ory5I7Ki2pz J2jRxQOXxwD3fWC9hCp5NQBUg7d6KtTI9kkerV5lzswxwyiMyaPxRc/9hQ/Bd6TWDulR S8rnjNEuen3CIXLkPuSD78Cyl77qnEOEB9jkxBQVKEbDo7ruqvE6FXvpOmPR/Sc7XS2G 99tw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:from:date:message-id:subject :to; bh=E2qkv0b3y83VSVsnpBnYYJDUa05xQEpv4u+Vztgs6Bo=; b=ccRCYNRJlGSB1qcgxDJ6Vci0lSBvmTYrGitGtweCrsSytxJEl2vaJOhYKE0vFE5jmk NdIO7+0mTD1xPt62pmaHzkrK6soWQBuc8icc/+uc3WtqGSc8c2TjJw7BdxJypjijRdSB 7J/u6inT5gcHg9j/vY7MXpzsPS8b8zFeMPWUX3X0v8F8pKi2jLjPpTuD0rDKt8oKlh3c FQQh9HjUdMqUoXm1+b/HvJji7SwR4YMhxrCbvbWBRnbeiCmPDTXvhccpixsGDVWcrJiX zusOeiWu065m4d8ItqpjtqYwwJj/GzD2G8mh7AQql4A5wCy2KLkORSi7kdrVOW4GvnLU l6ww== X-Gm-Message-State: AElRT7HOJK8/SKgeBQg4Yz7qxDywCPMT086Mopkx6a1HBZahPcjywgpA Obq9h6yNfWYuuk4efzFhzhq4Vj3G28RVvP8jxLI= X-Google-Smtp-Source: AG47ELspIhzR2Vvje8yDlE7wzaqwI3zdPzAIg1T7VIKhrgK9DPsWoMYuraYpzgUY6kWsdssz6N2BFpfp2sZ7K7CLkpw= X-Received: by 10.202.181.87 with SMTP id e84mr3573446oif.271.1520000645969; Fri, 02 Mar 2018 06:24:05 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Fri, 2 Mar 2018 06:24:05 -0800 (PST) From: Phillip Hallam-Baker Date: Fri, 2 Mar 2018 09:24:05 -0500 X-Google-Sender-Auth: oxEfLwdzXsk-pFC96G4M6H_8VIs Message-ID: To: SPASM Content-Type: multipart/alternative; boundary="001a113ce2e48fbcc405666ebadf" Archived-At: Subject: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 14:24:12 -0000 --001a113ce2e48fbcc405666ebadf Content-Type: text/plain; charset="UTF-8" Do we have a PKIX revocation request format? I am asking because of a detail in the Trustico situation in which a file of 23K private keys was emailed to a CA to request revocation. At the point, the circumstances of that situation are not clear. But I can see a scenario in which it is entirely plausible that a CA reseller would have access to large numbers of TLS private keys and that is when they are either hosting or managing the Web sites. The management interfaces that allow Web sites to be wheeled around a data center have become very sophisticated of late with virtualization and much of that infrastructure is 'secret sauce'. What might appear to be a five racks of 100 separate machines is likely visible in the management console as one single entity. --001a113ce2e48fbcc405666ebadf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Do = we have a PKIX revocation request format?

I am asking because of a detail in the Trustico situation = in which a file of 23K private keys was emailed to a CA to request revocati= on.

<= div class=3D"gmail_default" style=3D"font-size:small">At the point, the cir= cumstances of that situation are not clear. But I can see a scenario in whi= ch it is entirely plausible that a CA reseller would have access to large n= umbers of TLS private keys and that is when they are either hosting or mana= ging the Web sites.

The m= anagement interfaces that allow Web sites to be wheeled around a data cente= r have become very sophisticated of late with virtualization and much of th= at infrastructure is 'secret sauce'.

What might appear to be a five racks of 100 separate m= achines is likely visible in the management console as one single entity.
--001a113ce2e48fbcc405666ebadf-- From nobody Fri Mar 2 07:18:13 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61A8E1242F7 for ; Fri, 2 Mar 2018 07:18:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Yiixt2K01Ba for ; Fri, 2 Mar 2018 07:18:10 -0800 (PST) Received: from mail-ot0-x231.google.com (mail-ot0-x231.google.com [IPv6:2607:f8b0:4003:c0f::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7FD6124BAC for ; Fri, 2 Mar 2018 07:18:10 -0800 (PST) Received: by mail-ot0-x231.google.com with SMTP id n74so9011317ota.1 for ; Fri, 02 Mar 2018 07:18:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=8cx9etCoUXTezO4ueeyd36GKGIcmqakdm3R0n4gHzKc=; b=uS3klWmI3eAbxLBXt+5gm7tmPI11DZR8HRtNJhkT4fk+/fQDhhunsAqudiXtOJ//Va BVwcUc6IdDk7TbvJkkX6HvziOsdmgkaPP8St9uITzpguAJVCpp33ACKmJmTXYzpB/HH3 uAGAtIw7rJ48QqYn9SIDhKDwkd7gkABELBsLX8LTidr1+/dHyhhNKwOzOJF/BlxiXOKz bQbbHJooZnBLIiY0SVwHlFO6hDvRxxs9pOiXBr3fuTYEci+/yxbW/TdoFVM3w+UtbOUF GvsXH+ny0p0uBDCoRpn2fZIWDuKhfDR2jxX5gPiWhnXGK0ox3C624cdymNLw95vSA2aU palg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=8cx9etCoUXTezO4ueeyd36GKGIcmqakdm3R0n4gHzKc=; b=KDer6oNdVwAotWhDnra9D+kjMcPs1EhHDs9zloTpqBvrZWzUV70TEcQ0wIXFDp2wB9 Gd0Bpgdl5Yk1GPKYIxqfbCYNvpdNNjzw0ZZ+Kc+ta8oxMKH1kVFX3IXzrnVfYuS0hYgL /KN0FH0G4M93PKCd6nxtD7aHhD0/iaPPwtowTejWzkaLYrzdiRwkNt3slEAYM0ofXtoz wGSQahF5FH6BxnrhqyDnFL1Jisl28S+lximCDnBU/lis8X/ta3eilpGowOwJUq2cW/kJ UurJ08JmLeQ9LHuoCgHi+7tpLmcfyfElFLlmeXiabZyW6KTBflW2NFlv6v8Jvty0OlU8 AUXg== X-Gm-Message-State: AElRT7FbQi0mUGVZ4NXoH8G5Xciyn8H48hVv42AxnAZJ6DlaGUaoyizu 2TetAD/5cKdRu8ChYqUBwOnQ+Nv6RTpLUYxOKMs= X-Google-Smtp-Source: AG47ELuOX95sq19Jw4GVmYuy3N3oa80eXbizrlycr960UrzT+fV2CddDtctdW6bMfzgqTVMBeRnbuaUcMF8HY3BdXjQ= X-Received: by 10.157.37.113 with SMTP id j46mr4126522otd.218.1520003890116; Fri, 02 Mar 2018 07:18:10 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Fri, 2 Mar 2018 07:18:09 -0800 (PST) In-Reply-To: <1153EA1D-5A6C-4EFB-86F5-8DAD45D64909@akamai.com> References: <1153EA1D-5A6C-4EFB-86F5-8DAD45D64909@akamai.com> From: Phillip Hallam-Baker Date: Fri, 2 Mar 2018 10:18:09 -0500 X-Google-Sender-Auth: gt13m_E2fBQbwK8gcXqWG1uzoGA Message-ID: To: "Salz, Rich" Cc: Russ Housley , SPASM Content-Type: multipart/alternative; boundary="001a113d0cf4ed7d5e05666f7bfa" Archived-At: Subject: Re: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 15:18:12 -0000 --001a113d0cf4ed7d5e05666f7bfa Content-Type: text/plain; charset="UTF-8" If there is time, I would like to propose an AOB related to the Trustico incident: Should we add a revocation request message to the PKIX message set. Or do we have one and I have forgotten about it? On Thu, Feb 22, 2018 at 1:19 PM, Salz, Rich wrote: > b) draft-ietf-lamps-pkix-shake (Panos and Quynh) > c) draft-ietf-lamps-cms-shakes (Quynh and Panos) > > Frick and Frack. > Frack and Frick. > > Ha. > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > --001a113d0cf4ed7d5e05666f7bfa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If = there is time, I would like to propose an AOB related to the Trustico incid= ent: Should we add a revocation request message to the PKIX message set.=C2= =A0

<= div class=3D"gmail_default" style=3D"font-size:small">Or do we have one and= I have forgotten about it?

On Thu, Feb 22, 2018 at 1:19 PM, Salz, Rich <rsalz@ak= amai.com> wrote:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 b)=C2=A0 draft-ietf-lamps-pkix-shake (= Panos and Quynh)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 c)=C2=A0 draft-ietf-lamps-cms-shakes (Quynh and= Panos)

Frick and Frack.
Frack and Frick.

Ha.


_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--001a113d0cf4ed7d5e05666f7bfa-- From nobody Fri Mar 2 08:08:15 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 968EA129C6D for ; Fri, 2 Mar 2018 08:08:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ac79Tx28ABBq for ; Fri, 2 Mar 2018 08:08:12 -0800 (PST) Received: from homiemail-a96.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87763126BFD for ; Fri, 2 Mar 2018 08:08:12 -0800 (PST) Received: from homiemail-a96.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a96.g.dreamhost.com (Postfix) with ESMTP id EDFD7C00292B for ; Fri, 2 Mar 2018 08:08:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=25wWUt3wse1sZPMv6c1+6DFqzX8=; b= j+bTf8VETeMorrup08vTXLdyVmJBNK0YRtHQPA2qxcFZNbmFxXBceBP/kxb8Rhg8 VhT6BO68kemL5+V/BbpFmSR+7cOfOC+xQxXFFpjfUSTi97eu3dDUA14aMWz+kqvK xnuX1LvCGe9I2AevuQp/aUi1wfebpb7ZKB6vujqTX3Y= Received: from mail-io0-f176.google.com (mail-io0-f176.google.com [209.85.223.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a96.g.dreamhost.com (Postfix) with ESMTPSA id D8B6AC00292A for ; Fri, 2 Mar 2018 08:08:11 -0800 (PST) Received: by mail-io0-f176.google.com with SMTP id v6so11102594iog.7 for ; Fri, 02 Mar 2018 08:08:11 -0800 (PST) X-Gm-Message-State: APf1xPB5l9H7pSzeXO6aDWIpd/DULWB5CCpgwpCD/XrY17XvekSmtoC/ 7GstK8M79jyzW3LFIzLGwEhHHpwOCsiFBRWii5g= X-Google-Smtp-Source: AG47ELubefNEDN37e+UIb5I6BUWiz1d7IgqjXxNtDqYB1mXO3GjlejcB8xAknE/Omdud61YSCkkWtubob71eRSWXOdA= X-Received: by 10.107.173.12 with SMTP id w12mr6671548ioe.282.1520006891110; Fri, 02 Mar 2018 08:08:11 -0800 (PST) MIME-Version: 1.0 Received: by 10.2.105.214 with HTTP; Fri, 2 Mar 2018 08:08:10 -0800 (PST) In-Reply-To: References: From: Ryan Sleevi Date: Fri, 2 Mar 2018 11:08:10 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Phillip Hallam-Baker Cc: SPASM Content-Type: multipart/alternative; boundary="001a114468f6cd08a20566702e72" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 16:08:15 -0000 --001a114468f6cd08a20566702e72 Content-Type: text/plain; charset="UTF-8" It seems signing a new CSR has been a common practice as proof of possession. There's one segment of users that want to have a time-constrained request (that is, incorporating a challenge/response), while another would prefer that you can generate the 'request to revoke' at the same time you request the cert, so that you can use this token for situations such as loss of private key (but not loss of revocation token) It doesn't seem like there needs to be a bespoke format here, considering that the industry is still working through its use cases, and any signed data is sufficient. Further, it may do harm to try and standardize that. Consider the ROBOT attack ( https://robotattack.org/ ), which presented a signing oracle with TLS private keys. Prematurely constraining revocation requests to a particular format might otherwise preclude reasonable demonstration of private key compromise. So I don't think there's anything for LAMPS to do here - we have ample available technology (running code that already works) and we have not yet ascertained industry needs in any meaningful way (no rough consensus for something new) On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker wrote: > Do we have a PKIX revocation request format? > > I am asking because of a detail in the Trustico situation in which a file > of 23K private keys was emailed to a CA to request revocation. > > At the point, the circumstances of that situation are not clear. But I can > see a scenario in which it is entirely plausible that a CA reseller would > have access to large numbers of TLS private keys and that is when they are > either hosting or managing the Web sites. > > The management interfaces that allow Web sites to be wheeled around a data > center have become very sophisticated of late with virtualization and much > of that infrastructure is 'secret sauce'. > > What might appear to be a five racks of 100 separate machines is likely > visible in the management console as one single entity. > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > > --001a114468f6cd08a20566702e72 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It seems signing a new CSR has been a common practice as p= roof of possession.

There's one segment of users tha= t want to have a time-constrained request (that is, incorporating a challen= ge/response), while another would prefer that you can generate the 'req= uest to revoke' at the same time you request the cert, so that you can = use this token for situations such as loss of private key (but not loss of = revocation token)

It doesn't seem like there n= eeds to be a bespoke format here, considering that the industry is still wo= rking through its use cases, and any signed data is sufficient.
<= br>
Further, it may do harm to try and standardize that. Consider= the ROBOT attack (=C2=A0https://robot= attack.org/ ), which presented a signing oracle with TLS private keys. = Prematurely constraining revocation requests to a particular format might o= therwise preclude reasonable demonstration of private key compromise.
=

So I don't think there's anything for LAMPS to = do here - we have ample available technology (running code that already wor= ks) and we have not yet ascertained industry needs in any meaningful way (n= o rough consensus for something new)
=
On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hall= am-Baker <phill@hallambaker.com> wrote:
Do we have a PKIX revocation request format?

I am asking because of a detail in the T= rustico situation in which a file of 23K private keys was emailed to a CA t= o request revocation.

At = the point, the circumstances of that situation are not clear. But I can see= a scenario in which it is entirely plausible that a CA reseller would have= access to large numbers of TLS private keys and that is when they are eith= er hosting or managing the Web sites.

The management interfaces that allow Web sites to be wheeled a= round a data center have become very sophisticated of late with virtualizat= ion and much of that infrastructure is 'secret sauce'.

What might appear to be a five racks = of 100 separate machines is likely visible in the management console as one= single entity.

_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm


--001a114468f6cd08a20566702e72-- From nobody Fri Mar 2 12:03:36 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64DA1126C22 for ; Fri, 2 Mar 2018 12:03:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SsJFMtJbqjdo for ; Fri, 2 Mar 2018 12:03:32 -0800 (PST) Received: from mail-lf0-x233.google.com (mail-lf0-x233.google.com [IPv6:2a00:1450:4010:c07::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EE66124217 for ; Fri, 2 Mar 2018 12:03:32 -0800 (PST) Received: by mail-lf0-x233.google.com with SMTP id o145so14961197lff.0 for ; Fri, 02 Mar 2018 12:03:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=JW8wOFncmb1v9g1FhlgFflCubeC7zlyHLe+Y0u+1hRU=; b=ne0OLVfi0ci5nYXA6pZthagMQvKvNEL0o+lmMGzlHG3rMVGAeu73/h+0DDTxwLrz8g K4uRXdorhezDB2Ij2b8gQtimxnUzhVQ3tfLkvlQyLsO14eof1lQIYxzCOgQqJaIsyEOc 4CHwHUacuECtl7msDaz/wnphHy5CCeYmNShLd+XWs/qGoqGh7WOOjHqZu98QQ/5xXfXN qwAcEC9OkhdIKZOK4uwPMfTZ94az3LmeIiM4oPmnbVvjem0q/v3xZt49WFYVhvBm6adA xcTBUPXI2LSnf06N/Q1Rfapla3batWjPwSgWurSUnF+M8SmNX6rtL3A74C5Ae1r03lVY Qbbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JW8wOFncmb1v9g1FhlgFflCubeC7zlyHLe+Y0u+1hRU=; b=WAu4U7cboI2CmdJDkdUSAAn3gmNBX+xaikveErZXAGXJFA+9sTHsmyZjbZyWTmsNK4 SUnpLLdOKhoViV2eFGq1xm4S/2yXj9CtComzwfANNicejepw7BsAAhl7xePF1SdI1K2k 8I26iueowITC6P4x33E47E3cW9Fx86FMoujgEg+PFdhseYB1ge4UAq/U43Mb7ADMW6L5 MXy88jYf44V7D534SeXInVHawNrKNmyV4oxKRfH4FN15WarHPNd2DlgNdDWW8++61/QL 9y8nsyjyCPP03L9HNueTtP22YUzj6+DB4yYQANE6Q3lLF0JLuBOfREDUM2j8ib2yrQGr ys9w== X-Gm-Message-State: AElRT7GRVBR7tAcc6jwsqiqu3iupavFuvm+db3UwWqTPssxk8Xavo982 uRPA3dAC1Pxn4+AQVagIwJDJrsMnyMJOd9ZfmGOClmP5 X-Google-Smtp-Source: AG47ELsh8RRS3nnjquGzXVsLjaz8PYqsmM5aPvxDw8HvQHicgBf0GNG04SQnMMz0kijtfzeHZ2S67iCR8ZKvvhmQh2M= X-Received: by 10.25.153.200 with SMTP id b191mr4546904lfe.73.1520021010606; Fri, 02 Mar 2018 12:03:30 -0800 (PST) MIME-Version: 1.0 Received: by 10.25.26.79 with HTTP; Fri, 2 Mar 2018 12:03:29 -0800 (PST) In-Reply-To: References: From: Peter Bowen Date: Fri, 2 Mar 2018 12:03:29 -0800 Message-ID: To: Ryan Sleevi Cc: Phillip Hallam-Baker , SPASM Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 20:03:34 -0000 On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi wrote: > It seems signing a new CSR has been a common practice as proof of > possession. > > There's one segment of users that want to have a time-constrained request > (that is, incorporating a challenge/response), while another would prefer > that you can generate the 'request to revoke' at the same time you request > the cert, so that you can use this token for situations such as loss of > private key (but not loss of revocation token) > > It doesn't seem like there needs to be a bespoke format here, considering > that the industry is still working through its use cases, and any signed > data is sufficient. > > Further, it may do harm to try and standardize that. Consider the ROBOT > attack ( https://robotattack.org/ ), which presented a signing oracle with > TLS private keys. Prematurely constraining revocation requests to a > particular format might otherwise preclude reasonable demonstration of > private key compromise. > > So I don't think there's anything for LAMPS to do here - we have ample > available technology (running code that already works) and we have not yet > ascertained industry needs in any meaningful way (no rough consensus for > something new) There is also a documented (albeit not in RFCs) format for a generic signed public key with challenge: https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge PublicKeyAndChallenge, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } The challenge is an arbitrary length IA5STRING, so it could easily include nonce or other challenge data to prove key control. Thanks, Peter From nobody Fri Mar 2 12:17:07 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2914126C25 for ; Fri, 2 Mar 2018 12:17:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BeYjH_YKiDJ6 for ; Fri, 2 Mar 2018 12:17:05 -0800 (PST) Received: from mail-ot0-x232.google.com (mail-ot0-x232.google.com [IPv6:2607:f8b0:4003:c0f::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8CC7124217 for ; Fri, 2 Mar 2018 12:17:04 -0800 (PST) Received: by mail-ot0-x232.google.com with SMTP id g97so9813133otg.13 for ; Fri, 02 Mar 2018 12:17:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=mzFTtGVRVpELyzeBmvBGoDX+v1AGEIh3A6wZhepaRDg=; b=hZAj0BGvTBuuEfKW2U3JsnNH/6yMQEip4iOKyQDcpq6+S5Ems9SwL0fzJzW3P9plzD 3wWqxOfWTVFHI1lAYrR0r6czbexxGbhsM4LcJbjnEii1YcLu57ayuGw1nGbaEk9oMpky dLI8ZSaQNNOfSIe+yFDdFZhc3M0Nu+ydAx13vUx/+fIZ2CPkx2KqfUDxriWIplsNuhp/ z7r7otd3tANc4LmkjnDexWorDM16UJM6l4XVQrpj7FT8f7UbeZn6Ir/BXeh4JJ9L7Gu4 i2Gv1bE6sZkDRZiofVbvHc+chOgPx4rfxTcNWE79IQb9JxjUiw8UY3EPvi8REnjR7yKP LKgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=mzFTtGVRVpELyzeBmvBGoDX+v1AGEIh3A6wZhepaRDg=; b=ScT/XwnnJnB4VoaZiV/xa1SIi7IYYsfuRz/BR99DAytknOHlmZRjZ9lGo32kGitZ44 IONPS7ReULgmGkfdNczPBIKDMjtG+/CRW3WnAhRe5OUrcnoAt6nYWbWk9dy02o2C2P40 zXYQkSLkyvpOVrxjFslBYC64r/hpxvV2+d3AwvSCu/1v/db7ut1HMCoHrL3SPQho+9p8 ZqqTblUcCF3OQcyTEd3VDviBfxjVAKJQDvC+cRb+i/A0Y6H0vwpIb+/MyV8GPtEFRQ7Y krQc1zJ2VUU4BEzmGs0Al5d9+eNzG87ZMX8vTl9xL9aXSoXeiuQkWNkSnKGN4lgF9eR/ m92Q== X-Gm-Message-State: AElRT7HvzsVXiY4lMAVtZ1PDdvqz7S2QbHXt5qudUusRGwikI6/jjB9n dmh3VsWVq6VSCmkozhbYE26Q3oS7+fzkogD9oV8= X-Google-Smtp-Source: AG47ELsTzrn0R55MNpoHGdl1CXK40BwqH4HrtacTWwwdBjgUtfQLMp98t7P+E3V+sxVY7d/4FVHIhIDUHbmKlFelqQA= X-Received: by 10.157.65.140 with SMTP id p12mr4660301ote.167.1520021823957; Fri, 02 Mar 2018 12:17:03 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Fri, 2 Mar 2018 12:17:03 -0800 (PST) In-Reply-To: References: From: Phillip Hallam-Baker Date: Fri, 2 Mar 2018 15:17:03 -0500 X-Google-Sender-Auth: 57t0OQ0j8UzfSk0HOmKYgBPN7J8 Message-ID: To: Peter Bowen Cc: Ryan Sleevi , SPASM Content-Type: multipart/alternative; boundary="94eb2c1c1ce2de3115056673a8e8" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 20:17:07 -0000 --94eb2c1c1ce2de3115056673a8e8 Content-Type: text/plain; charset="UTF-8" If it is a signing key, just sign a CRL for the certificate. Now that is not quite the same as revoking the key but certs are the only things PKIX makes status assertions about. Do we have to support self-revocation of certs with only encryption only keys? Probably not. Since a very common reason for having to revoke a cert is that the private key is lost entirely any revocation format cannot be the only way to request revocation. So I don't see the relevance of the robot attack. Standards are all about taking choices that don't matter except that a choice is made. If we choose to recognize CRL suicide notes as the one mechanism that must be supported, that is one mechanism that can be added to PKI toolkits that don't already have it. And yes, there is at least one widely used toolkit that allows certificates and CRLs to be parsed but not generated. On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen wrote: > On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi wrote: > > It seems signing a new CSR has been a common practice as proof of > > possession. > > > > There's one segment of users that want to have a time-constrained request > > (that is, incorporating a challenge/response), while another would prefer > > that you can generate the 'request to revoke' at the same time you > request > > the cert, so that you can use this token for situations such as loss of > > private key (but not loss of revocation token) > > > > It doesn't seem like there needs to be a bespoke format here, considering > > that the industry is still working through its use cases, and any signed > > data is sufficient. > > > > Further, it may do harm to try and standardize that. Consider the ROBOT > > attack ( https://robotattack.org/ ), which presented a signing oracle > with > > TLS private keys. Prematurely constraining revocation requests to a > > particular format might otherwise preclude reasonable demonstration of > > private key compromise. > > > > So I don't think there's anything for LAMPS to do here - we have ample > > available technology (running code that already works) and we have not > yet > > ascertained industry needs in any meaningful way (no rough consensus for > > something new) > > There is also a documented (albeit not in RFCs) format for a generic > signed public key with challenge: > https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element > > PublicKeyAndChallenge ::= SEQUENCE { > spki SubjectPublicKeyInfo, > challenge IA5STRING > } > > SignedPublicKeyAndChallenge ::= SEQUENCE { > publicKeyAndChallenge PublicKeyAndChallenge, > signatureAlgorithm AlgorithmIdentifier, > signature BIT STRING > } > > The challenge is an arbitrary length IA5STRING, so it could easily > include nonce or other challenge data to prove key control. > > Thanks, > Peter > --94eb2c1c1ce2de3115056673a8e8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If = it is a signing key, just sign a CRL for the certificate. Now that is not q= uite the same as revoking the key but certs are the only things PKIX makes = status assertions about.

= Do we have to support self-revocation of certs with only encryption only ke= ys? Probably not.

Since a= very common reason for having to revoke a cert is that the private key is = lost entirely any revocation format cannot be the only way to request revoc= ation. So I don't see the relevance of the robot attack.


Standards are all about taking choices that don&#= 39;t matter except that a choice is made. If we choose to recognize CRL sui= cide notes as the one mechanism that must be supported, that is one mechani= sm that can be added to PKI toolkits that don't already have it. And ye= s, there is at least one widely used toolkit that allows certificates and C= RLs to be parsed but not generated.



On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen <= ;pzbowen@gmail.com> wrote:
On = Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:
> It seems signing a new CSR has been a common practice as proof of
> possession.
>
> There's one segment of users that want to have a time-constrained = request
> (that is, incorporating a challenge/response), while another would pre= fer
> that you can generate the 'request to revoke' at the same time= you request
> the cert, so that you can use this token for situations such as loss o= f
> private key (but not loss of revocation token)
>
> It doesn't seem like there needs to be a bespoke format here, cons= idering
> that the industry is still working through its use cases, and any sign= ed
> data is sufficient.
>
> Further, it may do harm to try and standardize that. Consider the ROBO= T
> attack ( https://robotattack.org/ ), which presented a signing orac= le with
> TLS private keys. Prematurely constraining revocation requests to a > particular format might otherwise preclude reasonable demonstration of=
> private key compromise.
>
> So I don't think there's anything for LAMPS to do here - we ha= ve ample
> available technology (running code that already works) and we have not= yet
> ascertained industry needs in any meaningful way (no rough consensus f= or
> something new)

There is also a documented (albeit not in RFCs) format for a generic=
signed public key with challenge:
https://www.w3.org/TR/html51/sec-= forms.html#the-keygen-element

PublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 spki SubjectPublicKeyInfo,
=C2=A0 challenge IA5STRING
}

SignedPublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 publicKeyAndChallenge PublicKeyAndChallenge,
=C2=A0 signatureAlgorithm AlgorithmIdentifier,
=C2=A0 signature BIT STRING
}

The challenge is an arbitrary length IA5STRING, so it could easily
include nonce or other challenge data to prove key control.

Thanks,
Peter

--94eb2c1c1ce2de3115056673a8e8-- From nobody Fri Mar 2 12:26:27 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24E5912EAAE for ; Fri, 2 Mar 2018 12:26:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.01 X-Spam-Level: X-Spam-Status: No, score=-7.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=eff.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RWMO_oIKMzqo for ; Fri, 2 Mar 2018 12:26:12 -0800 (PST) Received: from mail2.eff.org (mail2.eff.org [173.239.79.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D96A127369 for ; Fri, 2 Mar 2018 12:26:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=eff.org; s=mail2; h=Content-Type:In-Reply-To:MIME-Version:Date:Message-ID:From: References:Cc:To:Subject:Sender:Reply-To:Content-Transfer-Encoding:Content-ID :Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To: Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe :List-Post:List-Owner:List-Archive; bh=CdBAUHvfutn7jmoog9/vmjPHQCjgUSAj/uiBlLIvIM0=; b=UPPCRENGOpWsynotALYeIp/P/k vSvJ6fzzHkbBiGhWYOXe4Z7rEMYelk2CFOAbutX9hD684DMrdMK9GEwC9YH9vCQn13VvZorIF6VFz Skbldrq48+DDDuPv2HB7oRX2zzeIvapwPN/icDbKS71/grSwHf7jWVlJ903HtR0k1Ycw=; Received: ; Fri, 02 Mar 2018 12:26:10 -0800 To: Phillip Hallam-Baker , Peter Bowen Cc: Ryan Sleevi , SPASM References: From: Jacob Hoffman-Andrews Message-ID: <9d5be6a2-167b-ba03-ca0f-d076132c1519@eff.org> Date: Fri, 2 Mar 2018 12:26:10 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------78BF77FF9933A3A3943D0C73" Content-Language: en-US Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 20:26:17 -0000 This is a multi-part message in MIME format. --------------78BF77FF9933A3A3943D0C73 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit ACME already specifies how to revoke by proving control of the private key, or by proving control of the affected domains. If a CA wants to provide standards-based revocation services, they don't need to implement all of ACME, just enough to sign up for an account and do the revocation request. On 03/02/2018 12:17 PM, Phillip Hallam-Baker wrote: > If it is a signing key, just sign a CRL for the certificate. Now that > is not quite the same as revoking the key but certs are the only > things PKIX makes status assertions about. > > Do we have to support self-revocation of certs with only encryption > only keys? Probably not. > > Since a very common reason for having to revoke a cert is that the > private key is lost entirely any revocation format cannot be the only > way to request revocation. So I don't see the relevance of the robot > attack. > > > Standards are all about taking choices that don't matter except that a > choice is made. If we choose to recognize CRL suicide notes as the one > mechanism that must be supported, that is one mechanism that can be > added to PKI toolkits that don't already have it. And yes, there is at > least one widely used toolkit that allows certificates and CRLs to be > parsed but not generated. > > > > On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen > wrote: > > On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi > wrote: > > It seems signing a new CSR has been a common practice as proof of > > possession. > > > > There's one segment of users that want to have a > time-constrained request > > (that is, incorporating a challenge/response), while another > would prefer > > that you can generate the 'request to revoke' at the same time > you request > > the cert, so that you can use this token for situations such as > loss of > > private key (but not loss of revocation token) > > > > It doesn't seem like there needs to be a bespoke format here, > considering > > that the industry is still working through its use cases, and > any signed > > data is sufficient. > > > > Further, it may do harm to try and standardize that. Consider > the ROBOT > > attack ( https://robotattack.org/ ), which presented a signing > oracle with > > TLS private keys. Prematurely constraining revocation requests to a > > particular format might otherwise preclude reasonable > demonstration of > > private key compromise. > > > > So I don't think there's anything for LAMPS to do here - we have > ample > > available technology (running code that already works) and we > have not yet > > ascertained industry needs in any meaningful way (no rough > consensus for > > something new) > > There is also a documented (albeit not in RFCs) format for a generic > signed public key with challenge: > https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element > > > PublicKeyAndChallenge ::= SEQUENCE { >   spki SubjectPublicKeyInfo, >   challenge IA5STRING > } > > SignedPublicKeyAndChallenge ::= SEQUENCE { >   publicKeyAndChallenge PublicKeyAndChallenge, >   signatureAlgorithm AlgorithmIdentifier, >   signature BIT STRING > } > > The challenge is an arbitrary length IA5STRING, so it could easily > include nonce or other challenge data to prove key control. > > Thanks, > Peter > > > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --------------78BF77FF9933A3A3943D0C73 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit ACME already specifies how to revoke by proving control of the private key, or by proving control of the affected domains. If a CA wants to provide standards-based revocation services, they don't need to implement all of ACME, just enough to sign up for an account and do the revocation request.

On 03/02/2018 12:17 PM, Phillip Hallam-Baker wrote:
If it is a signing key, just sign a CRL for the certificate. Now that is not quite the same as revoking the key but certs are the only things PKIX makes status assertions about.

Do we have to support self-revocation of certs with only encryption only keys? Probably not.

Since a very common reason for having to revoke a cert is that the private key is lost entirely any revocation format cannot be the only way to request revocation. So I don't see the relevance of the robot attack.


Standards are all about taking choices that don't matter except that a choice is made. If we choose to recognize CRL suicide notes as the one mechanism that must be supported, that is one mechanism that can be added to PKI toolkits that don't already have it. And yes, there is at least one widely used toolkit that allows certificates and CRLs to be parsed but not generated.



On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen <pzbowen@gmail.com> wrote:
On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:
> It seems signing a new CSR has been a common practice as proof of
> possession.
>
> There's one segment of users that want to have a time-constrained request
> (that is, incorporating a challenge/response), while another would prefer
> that you can generate the 'request to revoke' at the same time you request
> the cert, so that you can use this token for situations such as loss of
> private key (but not loss of revocation token)
>
> It doesn't seem like there needs to be a bespoke format here, considering
> that the industry is still working through its use cases, and any signed
> data is sufficient.
>
> Further, it may do harm to try and standardize that. Consider the ROBOT
> attack ( https://robotattack.org/ ), which presented a signing oracle with
> TLS private keys. Prematurely constraining revocation requests to a
> particular format might otherwise preclude reasonable demonstration of
> private key compromise.
>
> So I don't think there's anything for LAMPS to do here - we have ample
> available technology (running code that already works) and we have not yet
> ascertained industry needs in any meaningful way (no rough consensus for
> something new)

There is also a documented (albeit not in RFCs) format for a generic
signed public key with challenge:
https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element

PublicKeyAndChallenge ::= SEQUENCE {
  spki SubjectPublicKeyInfo,
  challenge IA5STRING
}

SignedPublicKeyAndChallenge ::= SEQUENCE {
  publicKeyAndChallenge PublicKeyAndChallenge,
  signatureAlgorithm AlgorithmIdentifier,
  signature BIT STRING
}

The challenge is an arbitrary length IA5STRING, so it could easily
include nonce or other challenge data to prove key control.

Thanks,
Peter



_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--------------78BF77FF9933A3A3943D0C73-- From nobody Fri Mar 2 13:19:36 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 320CB124239 for ; Fri, 2 Mar 2018 13:19:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1_2tjIEWCKFi for ; Fri, 2 Mar 2018 13:19:33 -0800 (PST) Received: from homiemail-a102.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC69C12025C for ; Fri, 2 Mar 2018 13:19:33 -0800 (PST) Received: from homiemail-a102.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a102.g.dreamhost.com (Postfix) with ESMTP id 501A5201702CB for ; Fri, 2 Mar 2018 13:19:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=fDiFUxmT5cp5o0BPIbd7ztVyHgE=; b= dhxKnbaqQH+I8knUaxzosYm+6IUaemGEKltNYWlRc96pPJZEZ0Gm6gCYxLdoIzUg y3IIw7AfVVoAt0bf0TTe6pUybtxphSWmB7DWBBRTl4gLZDfIP4A+XkAzKcQog2Z6 Bwh6jEgUCoqEcLgWxW/Q08c95cTNjn3jsPu6Hx/VFpo= Received: from mail-io0-f176.google.com (mail-io0-f176.google.com [209.85.223.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a102.g.dreamhost.com (Postfix) with ESMTPSA id 277A9201702C9 for ; Fri, 2 Mar 2018 13:19:33 -0800 (PST) Received: by mail-io0-f176.google.com with SMTP id b34so12019867ioj.6 for ; Fri, 02 Mar 2018 13:19:33 -0800 (PST) X-Gm-Message-State: APf1xPCxM6BLvNEeAxn7IqThksJ/csc9Xp1hHoj69jD41GpCvbZEAS+9 sAGvVbBZ9G8vIZclrq8XrFMOhBu3D8/oRwVcZJI= X-Google-Smtp-Source: AG47ELv8p3AGAETHaVqVrOTjgzQR/pWIJGzOxATRDbkvzHcSYy37vMvqS3a62pBhkNFYy3FjZCenc0r83oJz2ZcvQRQ= X-Received: by 10.107.70.14 with SMTP id t14mr8082159ioa.281.1520025572438; Fri, 02 Mar 2018 13:19:32 -0800 (PST) MIME-Version: 1.0 Received: by 10.2.105.214 with HTTP; Fri, 2 Mar 2018 13:19:31 -0800 (PST) In-Reply-To: References: From: Ryan Sleevi Date: Fri, 2 Mar 2018 16:19:31 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Phillip Hallam-Baker Cc: Peter Bowen , Ryan Sleevi , SPASM Content-Type: multipart/alternative; boundary="089e082861004b79d305667488ea" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 21:19:35 -0000 --089e082861004b79d305667488ea Content-Type: text/plain; charset="UTF-8" On Fri, Mar 2, 2018 at 3:17 PM, Phillip Hallam-Baker wrote: > If it is a signing key, just sign a CRL for the certificate. Now that is > not quite the same as revoking the key but certs are the only things PKIX > makes status assertions about. > > Do we have to support self-revocation of certs with only encryption only > keys? Probably not. > > Since a very common reason for having to revoke a cert is that the private > key is lost entirely any revocation format cannot be the only way to > request revocation. So I don't see the relevance of the robot attack. > Because it's a demonstration of compromise. Any attempt to define how that demonstration of compromise is proved (which I think is *bad* standardization) is to make it more difficult to report or demonstrate compromise. > > > Standards are all about taking choices that don't matter except that a > choice is made. If we choose to recognize CRL suicide notes as the one > mechanism that must be supported, that is one mechanism that can be added > to PKI toolkits that don't already have it. And yes, there is at least one > widely used toolkit that allows certificates and CRLs to be parsed but not > generated. > > > > On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen wrote: > >> On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi wrote: >> > It seems signing a new CSR has been a common practice as proof of >> > possession. >> > >> > There's one segment of users that want to have a time-constrained >> request >> > (that is, incorporating a challenge/response), while another would >> prefer >> > that you can generate the 'request to revoke' at the same time you >> request >> > the cert, so that you can use this token for situations such as loss of >> > private key (but not loss of revocation token) >> > >> > It doesn't seem like there needs to be a bespoke format here, >> considering >> > that the industry is still working through its use cases, and any signed >> > data is sufficient. >> > >> > Further, it may do harm to try and standardize that. Consider the ROBOT >> > attack ( https://robotattack.org/ ), which presented a signing oracle >> with >> > TLS private keys. Prematurely constraining revocation requests to a >> > particular format might otherwise preclude reasonable demonstration of >> > private key compromise. >> > >> > So I don't think there's anything for LAMPS to do here - we have ample >> > available technology (running code that already works) and we have not >> yet >> > ascertained industry needs in any meaningful way (no rough consensus for >> > something new) >> >> There is also a documented (albeit not in RFCs) format for a generic >> signed public key with challenge: >> https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element >> >> PublicKeyAndChallenge ::= SEQUENCE { >> spki SubjectPublicKeyInfo, >> challenge IA5STRING >> } >> >> SignedPublicKeyAndChallenge ::= SEQUENCE { >> publicKeyAndChallenge PublicKeyAndChallenge, >> signatureAlgorithm AlgorithmIdentifier, >> signature BIT STRING >> } >> >> The challenge is an arbitrary length IA5STRING, so it could easily >> include nonce or other challenge data to prove key control. >> >> Thanks, >> Peter >> > > --089e082861004b79d305667488ea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, Mar 2, 2018 at 3:17 PM, Phillip Hallam-Baker = <phill@hallam= baker.com> wrote:
If it is a signing key, just sign a= CRL for the certificate. Now that is not quite the same as revoking the ke= y but certs are the only things PKIX makes status assertions about.

Do we= have to support self-revocation of certs with only encryption only keys? P= robably not.

Since a very common reason for having to revoke a cert is th= at the private key is lost entirely any revocation format cannot be the onl= y way to request revocation. So I don't see the relevance of the robot = attack.

Because it's a demo= nstration of compromise. Any attempt to define how that demonstration of co= mpromise is proved (which I think is *bad* standardization) is to make it m= ore difficult to report or demonstrate compromise.
=C2=A0


Standards are all about taking choices that don't matter excep= t that a choice is made. If we choose to recognize CRL suicide notes as the= one mechanism that must be supported, that is one mechanism that can be ad= ded to PKI toolkits that don't already have it. And yes, there is at le= ast one widely used toolkit that allows certificates and CRLs to be parsed = but not generated.



On Fri, Mar 2, = 2018 at 3:03 PM, Peter Bowen <pzbowen@gmail.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sl= eevi <ryan-iet= f@sleevi.com> wrote:
> It seems signing a new CSR has been a common practice as proof of
> possession.
>
> There's one segment of users that want to have a time-constrained = request
> (that is, incorporating a challenge/response), while another would pre= fer
> that you can generate the 'request to revoke' at the same time= you request
> the cert, so that you can use this token for situations such as loss o= f
> private key (but not loss of revocation token)
>
> It doesn't seem like there needs to be a bespoke format here, cons= idering
> that the industry is still working through its use cases, and any sign= ed
> data is sufficient.
>
> Further, it may do harm to try and standardize that. Consider the ROBO= T
> attack ( https://robotattack.org/ ), which presented a signing orac= le with
> TLS private keys. Prematurely constraining revocation requests to a > particular format might otherwise preclude reasonable demonstration of=
> private key compromise.
>
> So I don't think there's anything for LAMPS to do here - we ha= ve ample
> available technology (running code that already works) and we have not= yet
> ascertained industry needs in any meaningful way (no rough consensus f= or
> something new)

There is also a documented (albeit not in RFCs) format for a generic=
signed public key with challenge:
https://www.w3.org/TR/html51/sec-= forms.html#the-keygen-element

PublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 spki SubjectPublicKeyInfo,
=C2=A0 challenge IA5STRING
}

SignedPublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 publicKeyAndChallenge PublicKeyAndChallenge,
=C2=A0 signatureAlgorithm AlgorithmIdentifier,
=C2=A0 signature BIT STRING
}

The challenge is an arbitrary length IA5STRING, so it could easily
include nonce or other challenge data to prove key control.

Thanks,
Peter


--089e082861004b79d305667488ea-- From nobody Fri Mar 2 13:46:03 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D289512025C for ; Fri, 2 Mar 2018 13:46:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dBoARPEv_Z6X for ; Fri, 2 Mar 2018 13:46:00 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBDA01200E5 for ; Fri, 2 Mar 2018 13:45:59 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7354FBE51; Fri, 2 Mar 2018 21:45:57 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PTvVrEQDO5BF; Fri, 2 Mar 2018 21:45:56 +0000 (GMT) Received: from [10.200.0.239] (unknown [193.180.218.196]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 0701BBE3E; Fri, 2 Mar 2018 21:45:55 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1520027156; bh=gMWhJGXuR9KiLBlI38VyLzOO1E9W98s5Deum7mc0AGg=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=ImfXzXiH/LMcIQuYpvC/BtTuOTPNWIGVGwYatfDFtrwoEfmWFtnyAjUUNUZ+no2lb N13VAOBgVgA5TCkrAJGGitKMJAc3vjvwPwFBVjfecZJjE9SPE3Ni31xnTlPXEy08C9 6toVMSGMmW3+OzMFgtqNTCxBHLnjuAfNCdq9D+D4= To: Ryan Sleevi , Phillip Hallam-Baker Cc: SPASM , Peter Bowen References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Message-ID: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> Date: Fri, 2 Mar 2018 21:45:55 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Wj1w32VDzomsj80p8Dzp1tpBghYIYiR4I" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 21:46:02 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Wj1w32VDzomsj80p8Dzp1tpBghYIYiR4I Content-Type: multipart/mixed; boundary="DNSUIE8VBOxTQQD2Pp4FT0czJTjd2n955"; protected-headers="v1" From: Stephen Farrell To: Ryan Sleevi , Phillip Hallam-Baker Cc: SPASM , Peter Bowen Message-ID: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> Subject: Re: [lamps] Revocation Request Format? References: In-Reply-To: --DNSUIE8VBOxTQQD2Pp4FT0czJTjd2n955 Content-Type: multipart/mixed; boundary="------------6A8488D4FE2E4C830D89E164" Content-Language: en-GB This is a multi-part message in MIME format. --------------6A8488D4FE2E4C830D89E164 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 02/03/18 21:19, Ryan Sleevi wrote: > Because it's a demonstration of compromise. Any attempt to define how t= hat > demonstration of compromise is proved (which I think is *bad* > standardization) is to make it more difficult to report or demonstrate > compromise. I don't understand the "any" in the above. Can you clarify? Ta, S. --------------6A8488D4FE2E4C830D89E164 Content-Type: application/pgp-keys; name="0x7B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x7B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------6A8488D4FE2E4C830D89E164-- --DNSUIE8VBOxTQQD2Pp4FT0czJTjd2n955-- --Wj1w32VDzomsj80p8Dzp1tpBghYIYiR4I Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJamcYTAAoJEFqy+vF7FyvqijUP/0ZBKp1iZ4mPYgXXk7BGBKA2 yxX1M5JcZvmqpXIO8m0rF85NLxYUwYChkZXSNA8dY7afwzvukTQcBrktm0MYQqE5 LCZxJkCFKZ5IHtOUSgcvfNMZkpy9gxIwxq7hPRXoEO0QPCIL2+wGCB+d0iuuZZPe H4hssWUtNjwPk7BGm9nP9m6VKRNPIzuuQaI0ED/xC80Ap+pz3/GtS9MyL+hHfVxd jNYY9UqafgmxZYGWSerMuZw3SfScRHbY8Ls9aE7mT56MAHzIPAoc7D5Bvtg+2jMq JCiGBT0aLO6LZYafVKY2RCv0XgfKWtcb+TKuvCbudhv+uItGhNXRCCYDNoCInxfQ jg8PZRRiYyAWrWuoDMKmF2o7/EAcJV6mpRR2/P4mN8kPlAJYi8S+9reswcsc5tdO 52lY7qMpIz22gd8kBY61Y22j67JwviUdW7zsnH/PdJy4vMlWKm59UQ5NYeGsQZlg ybt8A0va4PhezyLI8/r8yIQzAAJgVapBiuD9UeAmyFOrlPsWo8+44w8iO9/ByhM+ CjtvioKPQkOQsj9eY0yIGMMzrsfZFz2KwW2shmQg1CUirg+inljhAFheggem0C9k JuCiSh3SN4IWDTepJTFzY1UiXqvTM9qNeNvgWTJi/7be7c9zoCfs9wbRXUZaYdxR YQC8cwTBHyCHw+frZDtl =zxdB -----END PGP SIGNATURE----- --Wj1w32VDzomsj80p8Dzp1tpBghYIYiR4I-- From nobody Fri Mar 2 14:08:25 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7413F124239 for ; Fri, 2 Mar 2018 14:08:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fe0Z8-WSdYV6 for ; Fri, 2 Mar 2018 14:08:21 -0800 (PST) Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF99812D7F1 for ; Fri, 2 Mar 2018 14:08:20 -0800 (PST) Received: by mail-oi0-x234.google.com with SMTP id b8so8117670oib.11 for ; Fri, 02 Mar 2018 14:08:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=dBZ35PjgvpBA/AlwYd2AynAuvdKWsWrf9yN/wz247lg=; b=uKVVr7kPmXpXo/h04ciqctOAhPbQjNy3QotNKTSEZ42q0zG6rP7O0wSx2qY6Wr+4oY mQ1gL9VSi9dF2BiNbanIqdjdlsw/CBrdYeQ/hC32UW9flggpVxn2ypR//JweBOTg6bnx mBG/UOMMTw5miyiydhquWdYYFzNPet3kKQts+BtUBWitnQMstJzwswXh2XYrPVq2bRSr 039Gb54hgCfB1jCFkScmLzDbgKv4gPAcDzb26HRfQ0GhdypYsHRH2uK83uF9XENwf/EU 69kKLkBwrWm4oxGA0Vjh655/vEnYglACATjfV7YtZiy/7mb7bsFOLbu30Scr+R33MnN0 ayjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=dBZ35PjgvpBA/AlwYd2AynAuvdKWsWrf9yN/wz247lg=; b=NUvEdZ6IMVFwV61sfLDyXGUvsVjXHmTgQeKqD2YOfRt96nV00zJwdRP4dsdGQGsUa3 jWNogs1QKenZkLOxtJJrD8V0Il5CMkZmF9NmdEBuWQ5albj0DVY8FEQfLDnm/zAqJlf9 ir8cmhhNP8FmxDlxHobDw+20z+Tx8Z3Or2Swhmlzhj+Jw7TML2XvknaCBo25QztsuHB8 MLhKkG1cDV8snR7nyLfeYG7r+56f4Q554Cfb/+0cV+NOFRgppAWV+td4vPUzG2wYi+JQ ERtU14Zn57neL4AryhQZ+SN3iVHIFshYrkyJqX185X6123/DcjgLLShWPmpmRS3L/IVU Roug== X-Gm-Message-State: APf1xPAsCBKI0zOiGEsLv77RCxaoGC0S3wcqxDLycbCgzMEPg+mtwGih YDP/My/J1WtwGs+VxYB1qY6zNj0/1pF2/tYeY6o= X-Google-Smtp-Source: AG47ELue/XOMsb5k8R6tW5j4Dr/+6RwPfqfHbsQQGINtVjzbbDsgS4l1Yybipih9uhUs572kTzgre/RvfHrRQH/fMxc= X-Received: by 10.202.206.71 with SMTP id e68mr4865318oig.34.1520028500042; Fri, 02 Mar 2018 14:08:20 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Fri, 2 Mar 2018 14:08:19 -0800 (PST) In-Reply-To: <9d5be6a2-167b-ba03-ca0f-d076132c1519@eff.org> References: <9d5be6a2-167b-ba03-ca0f-d076132c1519@eff.org> From: Phillip Hallam-Baker Date: Fri, 2 Mar 2018 17:08:19 -0500 X-Google-Sender-Auth: MLkK0Sfo7HkogPfFZDgtnCN95ng Message-ID: To: Jacob Hoffman-Andrews Cc: Peter Bowen , Ryan Sleevi , SPASM Content-Type: multipart/alternative; boundary="001a113cdb04cb2b5d0566753696" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 22:08:25 -0000 --001a113cdb04cb2b5d0566753696 Content-Type: text/plain; charset="UTF-8" Hmmm... Well ACME is intended to be a comprehensive certificate lifecycle protocol. I guess it might depend on whether that part needed JSON or just ASN.1... Might be all we would need to do is to add a page or two calling out standalone use as a specific use case and declare victory. On Fri, Mar 2, 2018 at 3:26 PM, Jacob Hoffman-Andrews wrote: > ACME already specifies how to revoke by proving control of the private > key, or by proving control of the affected domains. If a CA wants to > provide standards-based revocation services, they don't need to implement > all of ACME, just enough to sign up for an account and do the revocation > request. > > > On 03/02/2018 12:17 PM, Phillip Hallam-Baker wrote: > > If it is a signing key, just sign a CRL for the certificate. Now that is > not quite the same as revoking the key but certs are the only things PKIX > makes status assertions about. > > Do we have to support self-revocation of certs with only encryption only > keys? Probably not. > > Since a very common reason for having to revoke a cert is that the private > key is lost entirely any revocation format cannot be the only way to > request revocation. So I don't see the relevance of the robot attack. > > > Standards are all about taking choices that don't matter except that a > choice is made. If we choose to recognize CRL suicide notes as the one > mechanism that must be supported, that is one mechanism that can be added > to PKI toolkits that don't already have it. And yes, there is at least one > widely used toolkit that allows certificates and CRLs to be parsed but not > generated. > > > > On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen wrote: > >> On Fri, Mar 2, 2018 at 8:08 AM, Ryan Sleevi wrote: >> > It seems signing a new CSR has been a common practice as proof of >> > possession. >> > >> > There's one segment of users that want to have a time-constrained >> request >> > (that is, incorporating a challenge/response), while another would >> prefer >> > that you can generate the 'request to revoke' at the same time you >> request >> > the cert, so that you can use this token for situations such as loss of >> > private key (but not loss of revocation token) >> > >> > It doesn't seem like there needs to be a bespoke format here, >> considering >> > that the industry is still working through its use cases, and any signed >> > data is sufficient. >> > >> > Further, it may do harm to try and standardize that. Consider the ROBOT >> > attack ( https://robotattack.org/ ), which presented a signing oracle >> with >> > TLS private keys. Prematurely constraining revocation requests to a >> > particular format might otherwise preclude reasonable demonstration of >> > private key compromise. >> > >> > So I don't think there's anything for LAMPS to do here - we have ample >> > available technology (running code that already works) and we have not >> yet >> > ascertained industry needs in any meaningful way (no rough consensus for >> > something new) >> >> There is also a documented (albeit not in RFCs) format for a generic >> signed public key with challenge: >> https://www.w3.org/TR/html51/sec-forms.html#the-keygen-element >> >> PublicKeyAndChallenge ::= SEQUENCE { >> spki SubjectPublicKeyInfo, >> challenge IA5STRING >> } >> >> SignedPublicKeyAndChallenge ::= SEQUENCE { >> publicKeyAndChallenge PublicKeyAndChallenge, >> signatureAlgorithm AlgorithmIdentifier, >> signature BIT STRING >> } >> >> The challenge is an arbitrary length IA5STRING, so it could easily >> include nonce or other challenge data to prove key control. >> >> Thanks, >> Peter >> > > > > _______________________________________________ > Spasm mailing listSpasm@ietf.orghttps://www.ietf.org/mailman/listinfo/spasm > > > --001a113cdb04cb2b5d0566753696 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hmm= m...=C2=A0

=
Well ACME is i= ntended to be a comprehensive certificate lifecycle protocol. I guess it mi= ght depend on whether that part needed JSON or just ASN.1...

Might be all we would need to do is to = add a page or two calling out standalone use as a specific use case and dec= lare victory.
<= br>
=C2=A0

On Fri, Ma= r 2, 2018 at 3:26 PM, Jacob Hoffman-Andrews <jsha@eff.org> wrot= e:
=20 =20 =20
ACME already specifies how to revoke by proving control of the private key, or by proving control of the affected domains. If a CA wants to provide standards-based revocation services, they don't need to implement all of ACME, just enough to sign up for an account and do the revocation request.


On 03/02/2018 12:17= PM, Phillip Hallam-Baker wrote:
If it is a signing key, just sign a CRL for the certificate. Now that is not quite the same as revoking the key but certs are the only things PKIX makes status assertions about.

Do we have t= o support self-revocation of certs with only encryption only keys? Probably not.

Since a very common reason for having to revoke a cert is that the private key is lost entirely any revocation format cannot be the only way to request revocation. So I don't see the relevance of th= e robot attack.


Standards ar= e all about taking choices that don't matter except that a choice is made. If we choose to recognize CRL suicide notes as the one mechanism that must be supported, that is one mechanism that can be added to PKI toolkits that don't alread= y have it. And yes, there is at least one widely used toolkit that allows certificates and CRLs to be parsed but not generated.



On Fri, Mar 2, 2018 at 3:03 PM, Peter Bowen <pzbowen@gmail.com> wrote:
On Fri, Mar 2, 2018 at 8:08 = AM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:
> It seems signing a new CSR has been a common practice as proof of
> possession.
>
> There's one segment of users that want to have a time-constrained request
> (that is, incorporating a challenge/response), while another would prefer
> that you can generate the 'request to revoke' at= the same time you request
> the cert, so that you can use this token for situations such as loss of
> private key (but not loss of revocation token)
>
> It doesn't seem like there needs to be a bespoke format here, considering
> that the industry is still working through its use cases, and any signed
> data is sufficient.
>
> Further, it may do harm to try and standardize that. Consider the ROBOT
> attack ( https://robotattack.org/ ), which presented a signing oracle with
> TLS private keys. Prematurely constraining revocation requests to a
> particular format might otherwise preclude reasonable demonstration of
> private key compromise.
>
> So I don't think there's anything for LAMPS to d= o here - we have ample
> available technology (running code that already works) and we have not yet
> ascertained industry needs in any meaningful way (no rough consensus for
> something new)

There is also a documented (albeit not in RFCs) format for a generic
signed public key with challenge:
https://www.w3.org/TR/html= 51/sec-forms.html#the-keygen-element

PublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 spki SubjectPublicKeyInfo,
=C2=A0 challenge IA5STRING
}

SignedPublicKeyAndChallenge ::=3D SEQUENCE {
=C2=A0 publicKeyAndChallenge PublicKeyAndChallenge,
=C2=A0 signatureAlgorithm AlgorithmIdentifier,
=C2=A0 signature BIT STRING
}

The challenge is an arbitrary length IA5STRING, so it could easily
include nonce or other challenge data to prove key control.

Thanks,
Peter



______________________________=
_________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/spasm


--001a113cdb04cb2b5d0566753696-- From nobody Fri Mar 2 14:33:41 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CBA412D7F1 for ; Fri, 2 Mar 2018 14:33:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4udaHRLGJwj4 for ; Fri, 2 Mar 2018 14:33:37 -0800 (PST) Received: from homiemail-a96.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6D9D1250B8 for ; Fri, 2 Mar 2018 14:33:37 -0800 (PST) Received: from homiemail-a96.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a96.g.dreamhost.com (Postfix) with ESMTP id A3EC4C00292B for ; Fri, 2 Mar 2018 14:33:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=IdvcSzIUhXTXU6AyhVL2Wp64Fx0=; b= oxR1cWXqxVjFXgmYRnDvMq43MDb+VvlpE1vv7Lsnm+RdnKpF7o1UF5FTmBrldy0U AR7oLRMAmlx8bUz4OmjC5bCY0YgVCt4+txMnbEhTrx/r91ygNypCEjduFYypT1EG QR60xC/E7y1zw1R9Df8KONF0bRn6h7Dt/0SJdKDJYhU= Received: from mail-it0-f41.google.com (mail-it0-f41.google.com [209.85.214.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a96.g.dreamhost.com (Postfix) with ESMTPSA id 44CEAC00292A for ; Fri, 2 Mar 2018 14:33:37 -0800 (PST) Received: by mail-it0-f41.google.com with SMTP id e64so3638147ita.5 for ; Fri, 02 Mar 2018 14:33:37 -0800 (PST) X-Gm-Message-State: AElRT7HADOZZ/VnXuPl5piSQYfiMD3rgWwyjBO5hbl8h8OX2zCS/SjrU mv+WUpwOatb/VlU2JqxraBhZmXDoLehq/p1Eh9M= X-Google-Smtp-Source: AG47ELtGJnfhtey7ZmBfwCq3uzRFzWNaEqrcRHFPy0JE8oWhUdYRvveXDbqABbaccmgl0/R/3m95SOV5ZeXh/Hel2YM= X-Received: by 10.36.170.6 with SMTP id b6mr4552925itf.148.1520030016659; Fri, 02 Mar 2018 14:33:36 -0800 (PST) MIME-Version: 1.0 Received: by 10.2.105.214 with HTTP; Fri, 2 Mar 2018 14:33:36 -0800 (PST) In-Reply-To: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> From: Ryan Sleevi Date: Fri, 2 Mar 2018 17:33:36 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Stephen Farrell Cc: Ryan Sleevi , Phillip Hallam-Baker , SPASM , Peter Bowen Content-Type: multipart/alternative; boundary="f403045fae2830e7c00566759132" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 22:33:39 -0000 --f403045fae2830e7c00566759132 Content-Type: text/plain; charset="UTF-8" On Fri, Mar 2, 2018 at 4:45 PM, Stephen Farrell wrote: > > > On 02/03/18 21:19, Ryan Sleevi wrote: > > Because it's a demonstration of compromise. Any attempt to define how > that > > demonstration of compromise is proved (which I think is *bad* > > standardization) is to make it more difficult to report or demonstrate > > compromise. > > I don't understand the "any" in the above. > > Can you clarify? > So, there's two scenarios for key compromise that we're considering in the CA space 1) I have the private key (Heartbleed, Trustico, rooted servers, etc) 2) I have a signing oracle (Bleichenbacher, ROBOT, etc) a) Note: The signing oracle may be somewhat constrained in message formatting, but still provides an oracle sufficient to count as compromise b) Note: The signing oracle may be temporary in nature, so I'd be particularly concerned with systems that require nonces or timestamps, as they would incentivize disclosure to the CA first, rather than to the 'presumed legitimate' keyholder. Further, we have at least several actors to consider demonstration of compromise to: I) The CA/issuer II) Those that oversee the trust anchor management that includes the CA III) The public Because 2) exists, and the constraints re: 2 a), we need ecosystem flexibility for how we demonstrate proof. That is, it will be somewhere along a spectrum, based on what I, II, III find an acceptable demonstration. I might want to require a challenge, but II does not, for example. Thus, because the ecosystem has flexibility, 1) can easily adapt to whatever is needed - because they have the key, they are technically capable of producing any signed message necessary for I, II, III - of which we already have plenty of ways of expressing, whether it be raw signatures, CSRs, SPKACs, whatever your heart desires. There's no need to invent a new format, because we have infinitely flexible formats already available, and because the policy for I, II, and III will be inherently variable anyways. Further, I am deeply concerned for situations in which 1) - or any standardized version of expressing that - is seen as the only form of compromise or the only acceptable form of demonstrating that. This isn't hypothetical - this is a problem that, in acting in the role of a browser trust store maintainer (II), I've had to chase down a number of CAs (I), because they only want to revoke for 1) (... if even that). That's a policy matter, for sure, but it's a policy matter that I fear is or would be amplified. So I think attempts at 1) are somewhere along the line of https://xkcd.com/927/ , where we already have a number of methods. But let's go further, and imagine that let's say we wanted to have an interoperable definition for proof-of-key-compromise, so that you don't see what we see today - where CA Foo revokes a certificate as compromised, and the Subscriber then goes to CA Bar and requests a new certificate - with the same key. It might seem appealing to suggest that an interoperable proof of compromise would facilitate that information sharing, perhaps via some shared transparent ledger. And I totally get that appeal, but that's only addressing 1), and not 2), so we're not really addressing 'compromise' in the broad sense, just 'compromise' in the narrow sense - and we're just adding more work for those who do have the key to adopt whatever the new hotness is, creating ecosystem adoption issues. That's why I think an effort to standardize there is bad, not good, because it counterintuitively fragments the ecosystem, without addressing the general issue, which is in my view is moreso a matter of policy, because of the inherent constraints of 2). --f403045fae2830e7c00566759132 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, Mar 2, 2018 at 4:45 PM, Stephen Farrell <<= a href=3D"mailto:stephen.farrell@cs.tcd.ie" target=3D"_blank">stephen.farre= ll@cs.tcd.ie> wrote:


On 02/03/18 21:19, Ryan Sleevi wrote:
> Because it's a demonstration of compromise. Any attempt to define = how that
> demonstration of compromise is proved (which I think is *bad*
> standardization) is to make it more difficult to report or demonstrate=
> compromise.

I don't understand the "any" in the above.

Can you clarify?

So, there's two sc= enarios for key compromise that we're considering in the CA space
=
1) I have the private key (Heartbleed, Trustico, rooted servers, etc)<= /div>
2) I have a signing oracle (Bleichenbacher, ROBOT, etc)
=C2=A0 a) Note: The signing oracle may be somewhat constrained in message = formatting, but still provides an oracle sufficient to count as compromise<= /div>
=C2=A0 b) Note: The signing oracle may be temporary in nature, so= I'd be particularly concerned with systems that require nonces or time= stamps, as they would incentivize disclosure to the CA first, rather than t= o the 'presumed legitimate' keyholder.

Fur= ther, we have at least several actors to consider demonstration of compromi= se to:
I) The CA/issuer
II) Those that oversee the trus= t anchor management that includes the CA
III) The public

Because 2) exists, and the constraints re: 2 a), we need e= cosystem flexibility for how we demonstrate proof. That is, it will be some= where along a spectrum, based on what I, II, III find an acceptable demonst= ration. I might want to require a challenge, but II does not, for example.<= /div>

Thus, because the ecosystem has flexibility, 1) ca= n easily adapt to whatever is needed - because they have the key, they are = technically capable of producing any signed message necessary for I, II, II= I - of which we already have plenty of ways of expressing, whether it be ra= w signatures, CSRs, SPKACs, whatever your heart desires. There's no nee= d to invent a new format, because we have infinitely flexible formats alrea= dy available, and because the policy for I, II, and III will be inherently = variable anyways.

Further, I am deeply concerned f= or situations in which 1) - or any standardized version of expressing that = - is seen as the only form of compromise or the only acceptable form of dem= onstrating that. This isn't hypothetical - this is a problem that, in a= cting in the role of a browser trust store maintainer (II), I've had to= chase down a number of CAs (I), because they only want to revoke for 1) (.= .. if even that). That's a policy matter, for sure, but it's a poli= cy matter that I fear is or would be amplified.

So= I think attempts at 1) are somewhere along the line of=C2=A0https://xkcd.com/927/ , where we already have a num= ber of methods.

But let's go further, and imag= ine that let's say we wanted to have an interoperable definition for pr= oof-of-key-compromise, so that you don't see what we see today - where = CA Foo revokes a certificate as compromised, and the Subscriber then goes t= o CA Bar and requests a new certificate - with the same key. It might seem = appealing to suggest that an interoperable proof of compromise would facili= tate that information sharing, perhaps via some shared transparent ledger. = And I totally get that appeal, but that's only addressing 1), and not 2= ), so we're not really addressing 'compromise' in the broad sen= se, just 'compromise' in the narrow sense - and we're just addi= ng more work for those who do have the key to adopt whatever the new hotnes= s is, creating ecosystem adoption issues.

That'= ;s why I think an effort to standardize there is bad, not good, because it = counterintuitively fragments the ecosystem, without addressing the general = issue, which is in my view is moreso a matter of policy, because of the inh= erent constraints of 2).

--f403045fae2830e7c00566759132-- From nobody Fri Mar 2 15:57:12 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0ECA124B0A for ; Fri, 2 Mar 2018 15:57:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DJQZgmzI9sBE for ; Fri, 2 Mar 2018 15:57:07 -0800 (PST) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E8311242EA for ; Fri, 2 Mar 2018 15:57:07 -0800 (PST) Received: from [216.82.249.212] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-12.bemta-12.messagelabs.com id 86/8C-09148-2D4E99A5; Fri, 02 Mar 2018 23:57:06 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA2WTfUhTbxTH99x7t93U2W1anoZGrf6olUurH4y iVzAkCIqKYEl1pzd3aZu2O2NCZE2SNCNXznRW68VerSzRqFaQlkXai1pZWWFzRtrwlz+0X1li 3bs7e6F/Dp/nfM85zzkP5yFxZbFcRTJ2G2O10Ca1LIx4rD2RGN/SVaZPqHXM1Tn7ypFuf8dhp DvSlroIT26u/IQlV1QMYsm5Xi+xAtdLWYshw75RarzkPi3PdO1F9tuDq3Yg/05UgMJIgvqIwc vGfEw4KCkXBo2FLaFDB4JhVxtegEaRMioB2m7ewwSOptZA1ZkHQcYpFRy48x0JHEXNBG/nBVy MSYBdz2ukBYjkeS5U9ugFN0FNAYd3gBBYQaWA2/NaJrCSKkHQcCdJ4FHUSmhtLwyWR9Q4+Nx4 PnRVDLR3eYIMVDT4WppkIo+FHv+wVIxPgcP99SH/RMj9fyjEcdDq2ROcGKgaDOpKj4cKaaHW2 YtEXg61gX6ZGJSPQW11LyEKGiipHAwFbYYHl0/JRTZBmdNPiAndGOx7czMkxEL7t7dyURiQwp OrdzFxzjQoPjfS32ME/n6iCGncv43n5nNwyoOg6Po1zB18pzFwv6yLEIP08O+Xp1KRNVDh+C4 XeTqcOhbARZ4GA0WviL/986D0a51M5ElQvMcXyv0HAg3/oaMo/ByayjHWrYw1fvYcrcHKphtt Zpo1xScmztKaGY6j0xkTbeC0qRnmasRvYo5Egq6ipmPr6tF4ElOPVbzzlemVkYaMtGwjzRk3W LNMDFePYklSDYpwfmOVY6xMOmPfxJr4dR6RgYxQRytYPy8ruEzazLHpotSIksiag+/zcHLI18 Pbmk7B3graF92BPFxJWDIsjCpGUS4kU0KyMcvys/TIZ2lFcaooBZJIJMqITMZqZm1/6h9QDIn UUYo6oUoEa7H97OAD3xzGNyfvLRWas9G/JNUOtDi8aEr5l0Ld/NRlWYEZToezaum4KyXNJ9d+ Ks95+ix/9cSq1oa+QyuwPPaip8NlyN7WN9Olcbxb2lxdGqmPoHd2N3UeiPVu16XZcyZdOk7tz l0y+q3e9OLIw76zvpM6Y0XPhAlJprTsZZFxN3SXF65v1iVNHq4qOB82FJbifrTl+gI1wRnpRA 1u5egf9s6NricEAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-8.tower-219.messagelabs.com!1520035025!183874591!1 X-Originating-IP: [207.46.163.49] X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 22747 invoked from network); 2 Mar 2018 23:57:05 -0000 Received: from mail-cys01nam02lp0049.outbound.protection.outlook.com (HELO NAM02-CY1-obe.outbound.protection.outlook.com) (207.46.163.49) by server-8.tower-219.messagelabs.com with AES256-SHA256 encrypted SMTP; 2 Mar 2018 23:57:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=rexNqhry3sHgYF4DnSvpiepqngC4Gc7Na70a7UbLIQY=; b=eVWnjn06amW6XlUx7vMB5HEQ9kK64tQgkfJvDd349ZWUjn+kPTBp+sK5saf3YDT1VRlZXwgk2xe1js4bYXywcPoX9HcszzvIUprIbD2NlgdwDg5//kQ8qYpzoWqWXQpqYyvkFxw/XMDFCfyRoAhXwqGlbx8PxHlpeJ+2DZwBaA8= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1630.namprd14.prod.outlook.com (10.171.146.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Fri, 2 Mar 2018 23:57:02 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0548.014; Fri, 2 Mar 2018 23:57:02 +0000 From: Tim Hollebeek To: Ryan Sleevi , Phillip Hallam-Baker CC: SPASM Thread-Topic: [lamps] Revocation Request Format? Thread-Index: AQHTsjInSyN45zGu70muhef4KLLyqaO9HOwAgACCEUA= Date: Fri, 2 Mar 2018 23:57:02 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [12.130.122.8] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1630; 7:BsB9H8uSLvAgm5FWArvxqgJsLsyOG4sbAz1J8NIojZ62e19XNVcjiwM31dDM/UvoiolacubLQiNZX6UuockmjcvXVcSBDkNrGW3OEfpsESgJr+c+lP/U/RBlraXZPnonZl/54XvzPg4YKCuaTyb0aYcZsrexOAAGovESC2bDxjYImfMsskIi/7vZvzx9eleSceeylQIoluKCGbfwzdXizH+a2k+pdAotSu1pci3eyWsZDWxhcExmH4yRq/wci5hM x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: fe656451-6a3b-43f1-3941-08d580994b2c x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603307)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1630; x-ms-traffictypediagnostic: MWHPR14MB1630: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(192374486261705)(100405760836317)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040501)(2401047)(5005006)(8121501046)(3002001)(3231220)(944501244)(52105095)(10201501046)(93006095)(93001095)(6041288)(2016111802025)(20161123558120)(20161123562045)(20161123564045)(20161123560045)(6043046)(6072148)(201708071742011); SRVR:MWHPR14MB1630; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1630; x-forefront-prvs: 05991796DF x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(39860400002)(366004)(346002)(39380400002)(376002)(189003)(199004)(7736002)(74316002)(5660300001)(5250100002)(33656002)(55016002)(105586002)(6306002)(99936001)(54896002)(106356001)(53936002)(478600001)(14454004)(966005)(236005)(9686003)(68736007)(606006)(3660700001)(110136005)(6436002)(6246003)(3280700002)(81156014)(59450400001)(6506007)(53546011)(316002)(2906002)(81166006)(66066001)(2900100001)(3846002)(6116002)(790700001)(8936002)(97736004)(25786009)(99286004)(4326008)(2950100002)(86362001)(229853002)(76176011)(8676002)(102836004)(26005)(186003)(7696005); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1630; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 44ZhhVQ7UpndTGT8vT9jnAJqqg5S7go0txZLILZdQYwy6V59MrJ/lLbuVG+EzwR2697vMlsOSa9SvkG7mVL4OvsTYy7P2/4ofmjNHnp7m0yrdF2dqnLKw04jJk17ElGVagwCsqk8sdymVkB8DFPtFRNX+JLegXDIGYt2btTgOrY= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_039E_01D3B247.749E7440" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: fe656451-6a3b-43f1-3941-08d580994b2c X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2018 23:57:02.0771 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1630 Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Mar 2018 23:57:10 -0000 ------=_NextPart_000_039E_01D3B247.749E7440 Content-Type: multipart/alternative; boundary="----=_NextPart_001_039F_01D3B247.749E7440" ------=_NextPart_001_039F_01D3B247.749E7440 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable One thing I would consider doing if I found myself in this situation is = to take a fresh, signed OCSP response along with some text like REVOKE = THIS CERTIFICATE and sign it with the private key for the certificate in = question. =20 Haven=E2=80=99t done a full security analysis of the pros/cons but I = thought I=E2=80=99d throw it out there. It has some nice information = about exactly which certificate and exactly when I made the request, and = that it was made by someone with access to the private key. =20 It seems like a better idea than abusing a CSR for an unintended = purpose. Abusing signed messages for purposes they weren=E2=80=99t = designed for usually ends badly. =20 -Tim =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Ryan Sleevi Sent: Friday, March 2, 2018 9:08 AM To: Phillip Hallam-Baker Cc: SPASM Subject: Re: [lamps] Revocation Request Format? =20 It seems signing a new CSR has been a common practice as proof of = possession. =20 There's one segment of users that want to have a time-constrained = request (that is, incorporating a challenge/response), while another = would prefer that you can generate the 'request to revoke' at the same = time you request the cert, so that you can use this token for situations = such as loss of private key (but not loss of revocation token) =20 It doesn't seem like there needs to be a bespoke format here, = considering that the industry is still working through its use cases, = and any signed data is sufficient. =20 Further, it may do harm to try and standardize that. Consider the ROBOT = attack ( https://robotattack.org/ ), which presented a signing oracle = with TLS private keys. Prematurely constraining revocation requests to a = particular format might otherwise preclude reasonable demonstration of = private key compromise. =20 So I don't think there's anything for LAMPS to do here - we have ample = available technology (running code that already works) and we have not = yet ascertained industry needs in any meaningful way (no rough consensus = for something new) =20 On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker = > wrote: Do we have a PKIX revocation request format? =20 I am asking because of a detail in the Trustico situation in which a = file of 23K private keys was emailed to a CA to request revocation. =20 At the point, the circumstances of that situation are not clear. But I = can see a scenario in which it is entirely plausible that a CA reseller = would have access to large numbers of TLS private keys and that is when = they are either hosting or managing the Web sites. =20 The management interfaces that allow Web sites to be wheeled around a = data center have become very sophisticated of late with virtualization = and much of that infrastructure is 'secret sauce'. =20 What might appear to be a five racks of 100 separate machines is likely = visible in the management console as one single entity. _______________________________________________ Spasm mailing list Spasm@ietf.org =20 https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_001_039F_01D3B247.749E7440 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

One thing = I would consider doing if I found myself in this situation is to take a = fresh, signed OCSP response along with some text like REVOKE THIS = CERTIFICATE and sign it with the private key for the certificate in = question.

 

Haven=E2=80=99t done a full security analysis of the = pros/cons but I thought I=E2=80=99d throw it out there.=C2=A0 It has = some nice information about exactly which certificate and exactly when I = made the request, and that it was made by someone with access to the = private key.

 

It seems like a better idea than abusing a CSR for an = unintended purpose.=C2=A0 Abusing signed messages for purposes they = weren=E2=80=99t designed for usually ends badly.

 

-Tim

 

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Ryan = Sleevi
Sent: Friday, March 2, 2018 9:08 AM
To: = Phillip Hallam-Baker <phill@hallambaker.com>
Cc: SPASM = <SPASM@ietf.org>
Subject: Re: [lamps] Revocation Request = Format?

 

It = seems signing a new CSR has been a common practice as proof of = possession.

 

There's one segment of users that want to have a = time-constrained request (that is, incorporating a challenge/response), = while another would prefer that you can generate the 'request to revoke' = at the same time you request the cert, so that you can use this token = for situations such as loss of private key (but not loss of revocation = token)

 

It doesn't seem like there needs to be a bespoke = format here, considering that the industry is still working through its = use cases, and any signed data is = sufficient.

 

Further, it may do harm to try and standardize that. = Consider the ROBOT attack ( https://robotattack.org/ ), which = presented a signing oracle with TLS private keys. Prematurely = constraining revocation requests to a particular format might otherwise = preclude reasonable demonstration of private key = compromise.

 

So I don't think there's anything for LAMPS to do here = - we have ample available technology (running code that already works) = and we have not yet ascertained industry needs in any meaningful way (no = rough consensus for something new)

 

On Fri, = Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker <phill@hallambaker.com> = wrote:

Do we have a PKIX = revocation request format?

 

I am asking because = of a detail in the Trustico situation in which a file of 23K private = keys was emailed to a CA to request = revocation.

 

At the point, the = circumstances of that situation are not clear. But I can see a scenario = in which it is entirely plausible that a CA reseller would have access = to large numbers of TLS private keys and that is when they are either = hosting or managing the Web sites.

 

The management = interfaces that allow Web sites to be wheeled around a data center have = become very sophisticated of late with virtualization and much of that = infrastructure is 'secret sauce'.

 

What might appear to = be a five racks of 100 separate machines is likely visible in the = management console as one single = entity.


______________________________________= _________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

 

------=_NextPart_001_039F_01D3B247.749E7440-- ------=_NextPart_000_039E_01D3B247.749E7440 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzAyMjM1NjQ5WjAvBgkqhkiG9w0BCQQxIgQg2vCLh8xzaDdG5o0JLILKhy3+OL1m j0GF9UVox4frcPIwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAHVnB3GiThmyNyTr0V+UTswq6v6x/1NJKdwaUgX0a/kejrZ8ZbqEFH6lXyl0iaWF1lU0F1Yu Ogt27Ywa14f6wh716f7pRExCv3PHBFkVTcDRqu1m9gfMiP09YfIlRtsW255p5fXIsgkmZahWhUwG 8+4gm87IOB0ZmILO1APXffSeUQA1smWxKE9V0cYbI6wknDtxMMz+OEpqRWs1o1v0YTeE9WmaXVDt 88weflR3cdhJV4BZAljRdZHP0JiAW2KwYeUdbrmvkeQUD+S9KvNSbt4NPFtJmXPphT2aFb4Xhu79 kWOTiy4sl5ehjUd6iOmM+LzbcS27IW/MP9pW+r8+JIwAAAAAAAA= ------=_NextPart_000_039E_01D3B247.749E7440-- From nobody Fri Mar 2 16:46:02 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1E40126FB3 for ; Fri, 2 Mar 2018 16:46:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id byQgM3EH14Ga for ; Fri, 2 Mar 2018 16:45:58 -0800 (PST) Received: from homiemail-a33.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 324A4126C26 for ; Fri, 2 Mar 2018 16:45:58 -0800 (PST) Received: from homiemail-a33.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a33.g.dreamhost.com (Postfix) with ESMTP id B3847A004F1F for ; Fri, 2 Mar 2018 16:45:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=49pymlKBHrDPfvemqLHnkxwA27M=; b= DgAZKb6ldHeoZGC31fMG9TCyPGVdmGP5TATWXFbzbqfjDJ7t9eEko9ysSvPgndFc vEcBwZeYky1utgTUajjpOsbjxiPZw1MwOkhsx9DeVxjZSrr8astpY9LMHBh9yI7c Vwx22j9LoU29ULOn7/Tr8ZgRsNST+HoCQbVGcuJrUPc= Received: from mail-io0-f175.google.com (mail-io0-f175.google.com [209.85.223.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a33.g.dreamhost.com (Postfix) with ESMTPSA id 7162FA004F1B for ; Fri, 2 Mar 2018 16:45:57 -0800 (PST) Received: by mail-io0-f175.google.com with SMTP id m22so12398623iob.12 for ; Fri, 02 Mar 2018 16:45:57 -0800 (PST) X-Gm-Message-State: AElRT7GTO9tUJ+X2MgPzjIUjjwnIgHGoBX74ZrmTDkH9kmPbFs7WOV0D n4jbElhJ6uNWSuJ7gTMOehV7yahoVW4SpYiCXEA= X-Google-Smtp-Source: AG47ELvjLM9Zl+y0/ccMG97D9rI/kcVTGuh+isxffq9Z2tMic5ZiDZWFcqtmdlJYBeltVSmLRfrtU3MYcgUEQqrz+Z4= X-Received: by 10.107.58.86 with SMTP id h83mr8821768ioa.284.1520037956859; Fri, 02 Mar 2018 16:45:56 -0800 (PST) MIME-Version: 1.0 Received: by 10.2.105.214 with HTTP; Fri, 2 Mar 2018 16:45:55 -0800 (PST) In-Reply-To: References: From: Ryan Sleevi Date: Fri, 2 Mar 2018 19:45:55 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Tim Hollebeek Cc: Ryan Sleevi , Phillip Hallam-Baker , SPASM Content-Type: multipart/alternative; boundary="001a114ac88476bf150566776a95" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 00:46:01 -0000 --001a114ac88476bf150566776a95 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Mar 2, 2018 at 6:57 PM, Tim Hollebeek wrote: > One thing I would consider doing if I found myself in this situation is t= o > take a fresh, signed OCSP response along with some text like REVOKE THIS > CERTIFICATE and sign it with the private key for the certificate in > question. > > > > Haven=E2=80=99t done a full security analysis of the pros/cons but I thou= ght I=E2=80=99d > throw it out there. It has some nice information about exactly which > certificate and exactly when I made the request, and that it was made by > someone with access to the private key. > Right, and I'm actually arguing against those properties as being reasonable, for reasons I expand on bleow. > It seems like a better idea than abusing a CSR for an unintended purpose. > Abusing signed messages for purposes they weren=E2=80=99t designed for us= ually ends > badly. > The key is compromised. It's already ended badly. The format won't change that if it is compromise, and since only the key holder can produce signed messages in the first place, if they're signing a message that says their key is compromised, well, then we know the just self-compromised :) Perhaps the distinction is whether it's a Subscriber-initiated request or a Third-Party initiated request. For a Subscriber initiated request, there's no inherent requirement to require they demonstrate the private key. It's fundamentally a question about certificate lifecycle management, and one could just as easily imagine a 'revoke this cert' button in the subscriber's certificate management portal. Formats here don't help the subscriber, because the revocation is part of the lifecycle management, and that overall process is where you want to see the alignment. For a CA that supports ACME for lifecycle management, ACME addresses this. However, for a CA that doesn't use ACME, or a Subscriber who doesn't use ACME, the ACME lifecycle management is more onerous and detrimental, and out of sync with the rest of the lifecycle management. For a third-party initiated request - that is, security researcher or the like - I don't think more formats is necessarily beneficial. The burden lies on the CA, not the reporter, regarding the investigation and handling of this. Properties such as "Was this freshly done" are actively detrimental, rather than beneficial - if it was compromised in the past, then that's reasonable grounds for revocation. As for aligning how to identify the certificate, that benefits the CA, sure, but it doesn't benefit the reporter. If anything, it adds more burden on the reporter to now try and shape their proof in a way the CA will accept. >From a policy point of view, the policies on what an acceptable form of proof is will vary based on the PKI. For the Web PKI, *any* proof of a signed message, I would argue, is sufficient proof, so there's no need to introduce formats for reporting, because any signed message is sufficient, and, at a minimum, CAs are required to be monitoring that 24/7 with real people and responding within 24 hours. So, at best, we're talking optimizing the speed at which a CA responds by offering additional methods for providing demonstration, but they aren't replacement methods nor will they be sufficient methods. Nor are they necessarily optimizations - while it may enable the CA to respond more quickly, it doesn't guarantee they will - that's a question of policy for that particular PKI, and at least in the Web PKI, CAs have the flexibility for 24 hours for investigation, 24 hours for revocation, and 24 hours for publication, and the incentive structure is very much aligned for CAs to take advantage of that full time precisely because it serves as a risk management method for them. > > > -Tim > > > > *From:* Spasm [mailto:spasm-bounces@ietf.org] *On Behalf Of *Ryan Sleevi > *Sent:* Friday, March 2, 2018 9:08 AM > *To:* Phillip Hallam-Baker > *Cc:* SPASM > *Subject:* Re: [lamps] Revocation Request Format? > > > > It seems signing a new CSR has been a common practice as proof of > possession. > > > > There's one segment of users that want to have a time-constrained request > (that is, incorporating a challenge/response), while another would prefer > that you can generate the 'request to revoke' at the same time you reques= t > the cert, so that you can use this token for situations such as loss of > private key (but not loss of revocation token) > > > > It doesn't seem like there needs to be a bespoke format here, considering > that the industry is still working through its use cases, and any signed > data is sufficient. > > > > Further, it may do harm to try and standardize that. Consider the ROBOT > attack ( https://robotattack.org/ ), which presented a signing oracle > with TLS private keys. Prematurely constraining revocation requests to a > particular format might otherwise preclude reasonable demonstration of > private key compromise. > > > > So I don't think there's anything for LAMPS to do here - we have ample > available technology (running code that already works) and we have not ye= t > ascertained industry needs in any meaningful way (no rough consensus for > something new) > > > > On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker < > phill@hallambaker.com> wrote: > > Do we have a PKIX revocation request format? > > > > I am asking because of a detail in the Trustico situation in which a file > of 23K private keys was emailed to a CA to request revocation. > > > > At the point, the circumstances of that situation are not clear. But I ca= n > see a scenario in which it is entirely plausible that a CA reseller would > have access to large numbers of TLS private keys and that is when they ar= e > either hosting or managing the Web sites. > > > > The management interfaces that allow Web sites to be wheeled around a dat= a > center have become very sophisticated of late with virtualization and muc= h > of that infrastructure is 'secret sauce'. > > > > What might appear to be a five racks of 100 separate machines is likely > visible in the management console as one single entity. > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > > > --001a114ac88476bf150566776a95 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, Mar 2, 2018 at 6:57 PM, Tim Hollebeek <tim.hollebeek@= digicert.com> wrote:

One thing I would consider doing= if I found myself in this situation is to take a fresh, signed OCSP respon= se along with some text like REVOKE THIS CERTIFICATE and sign it with the p= rivate key for the certificate in question.

=C2=A0

Haven=E2=80=99t don= e a full security analysis of the pros/cons but I thought I=E2=80=99d throw= it out there.=C2=A0 It has some nice information about exactly which certi= ficate and exactly when I made the request, and that it was made by someone= with access to the private key.


Right, and I'm actually arguing against those properties as being= reasonable, for reasons I expand on bleow.
=C2=A0

It s= eems like a better idea than abusing a CSR for an unintended purpose.=C2=A0= Abusing signed messages for purposes they weren=E2=80=99t designed for usu= ally ends badly.


The key is= compromised. It's already ended badly. The format won't change tha= t if it is compromise, and since only the key holder can produce signed mes= sages in the first place, if they're signing a message that says their = key is compromised, well, then we know the just self-compromised :)

Perhaps the distinction is whether it's a Subscriber-= initiated request or a Third-Party initiated request.

<= div>For a Subscriber initiated request, there's no inherent requirement= to require they demonstrate the private key. It's fundamentally a ques= tion about certificate lifecycle management, and one could just as easily i= magine a 'revoke this cert' button in the subscriber's certific= ate management portal. Formats here don't help the subscriber, because = the revocation is part of the lifecycle management, and that overall proces= s is where you want to see the alignment. For a CA that supports ACME for l= ifecycle management, ACME addresses this. However, for a CA that doesn'= t use ACME, or a Subscriber who doesn't use ACME, the ACME lifecycle ma= nagement is more onerous and detrimental, and out of sync with the rest of = the lifecycle management.

For a third-party initia= ted request - that is, security researcher or the like - I don't think = more formats is necessarily beneficial. The burden lies on the CA, not the = reporter, regarding the investigation and handling of this. Properties such= as "Was this freshly done" are actively detrimental, rather than= beneficial - if it was compromised in the past, then that's reasonable= grounds for revocation. As for aligning how to identify the certificate, t= hat benefits the CA, sure, but it doesn't benefit the reporter. If anyt= hing, it adds more burden on the reporter to now try and shape their proof = in a way the CA will accept.

From a policy point o= f view, the policies on what an acceptable form of proof is will vary based= on the PKI. For the Web PKI, *any* proof of a signed message, I would argu= e, is sufficient proof, so there's no need to introduce formats for rep= orting, because any signed message is sufficient, and, at a minimum, CAs ar= e required to be monitoring that 24/7 with real people and responding withi= n 24 hours. So, at best, we're talking optimizing the speed at which a = CA responds by offering additional methods for providing demonstration, but= they aren't replacement methods nor will they be sufficient methods. N= or are they necessarily optimizations - while it may enable the CA to respo= nd more quickly, it doesn't guarantee they will - that's a question= of policy for that particular PKI, and at least in the Web PKI, CAs have t= he flexibility for 24 hours for investigation, 24 hours for revocation, and= 24 hours for publication, and the incentive structure is very much aligned= for CAs to take advantage of that full time precisely because it serves as= a risk management method for them.

=C2=A0

=C2=A0

-Tim

=C2=A0<= u>

From: Spasm [m= ailto:spasm-bou= nces@ietf.org] On Behalf Of Ryan Sleevi
Sent: Fri= day, March 2, 2018 9:08 AM
To: Phillip Hallam-Baker <phill@hallambaker.com>
Cc: SPASM <SPASM@ietf.org>
Subject: Re: [lamps] Revocation Re= quest Format?

=C2=A0

It seems= signing a new CSR has been a common practice as proof of possession.

=C2=A0

=

There's one segment of users that want to have a= time-constrained request (that is, incorporating a challenge/response), wh= ile another would prefer that you can generate the 'request to revoke&#= 39; at the same time you request the cert, so that you can use this token f= or situations such as loss of private key (but not loss of revocation token= )

=C2=A0

It doesn't seem like there needs to= be a bespoke format here, considering that the industry is still working t= hrough its use cases, and any signed data is sufficient.

<= /div>

=C2=A0

Further, it may do harm to try and standardize that. Consid= er the ROBOT attack (=C2=A0https://robotattack.org/ ), which presented a signing oracle wit= h TLS private keys. Prematurely constraining revocation requests to a parti= cular format might otherwise preclude reasonable demonstration of private k= ey compromise.

= =C2=A0

So I don't think the= re's anything for LAMPS to do here - we have ample available technology= (running code that already works) and we have not yet ascertained industry= needs in any meaningful way (no rough consensus for something new)<= u>

=C2=A0

<= div>

On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-B= aker <phill@h= allambaker.com> wrote:

Do we have a PKIX revocation request format?

=C2=A0

I am asking because of a detail in the Trustico sit= uation in which a file of 23K private keys was emailed to a CA to request r= evocation.

=C2=A0

At the point, the circums= tances of that situation are not clear. But I can see a scenario in which i= t is entirely plausible that a CA reseller would have access to large numbe= rs of TLS private keys and that is when they are either hosting or managing= the Web sites.

<= span style=3D"font-size:12.0pt">=C2=A0

<= p class=3D"MsoNormal">The management inter= faces that allow Web sites to be wheeled around a data center have become v= ery sophisticated of late with virtualization and much of that infrastructu= re is 'secret sauce'.

=C2=A0=

What= might appear to be a five racks of 100 separate machines is likely visible= in the management console as one single entity.


_______= ________________________________________
Spasm mailing list
Spasm@ietf.org
https:= //www.ietf.org/mailman/listinfo/spasm

=C2=A0


--001a114ac88476bf150566776a95-- From nobody Fri Mar 2 20:17:36 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C68C12EAE0 for ; Fri, 2 Mar 2018 20:17:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bKevAZJpZ8kJ for ; Fri, 2 Mar 2018 20:17:33 -0800 (PST) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43BE812EABD for ; Fri, 2 Mar 2018 20:17:33 -0800 (PST) Received: from [216.82.242.46] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-8.bemta-8.messagelabs.com id EA/B7-31372-CD12A9A5; Sat, 03 Mar 2018 04:17:32 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WTfUxTVxjGd+5He6nUXC8I76pkszEaa6jFxNj oEhf9Q1ziosnQrDPqRa9tY79yb9Uas6xqJAP8qKYJ0InV2BHUoVMRQULEJviJX0TRUBBBUAGb ThGnZhne3lP8uH+c/M55nve8z7k5hyG5MrWOEXxeQXTxDr1KQ902Hs3OjU0JWUyBU1nm/f/8g cyjjwco84HuSmQ+1L7ueyq/IdSlzr9zYoTIj0TeEfk7GxupZZSFtrsK3b61tK3h7GHSs7PAd+ thOeFHb5aVoDSGYhMEdCSMJUjDcGyQgHA8SOBJN4KBhj100qViTdDedIVIciZbAKeqWxUm2fl wpyWicAY7Cxp7a0jsMcGuB7U05h8h3ldP425T4dH2LlWStewqOFJ2H+FmzwnYcbJU2SiNXQ5v a+sUE2Kz4N/rf6WaZUNHX1hhYDOh5+4NFeaJMPDkfxr7V0HlcDS1roeTLzpT/hxoC5cqzYBtV 8Pdo80pkxHO7Y8jzEthdyxAYVMxAV0HR0ksGKAjUqzGvBEOJH6nMP8Ao637SFwgH8H/5gKNhc nwtPSQCgtPaTjWWaXk4Nj1EDw+lu82glePfg4gQ+iz44XkGpINI6iI3iBDyo+aANcq+ihsskC srpvEbIDIjlE15m/gfPxgan0GvA7EUv6ZUHVkKLU+H8rfX1JhngLB0p5U7RwYanmJDqNxx9F0 SRA3C2LubGOhaLfavE7e7sjNM5mNTkGSeKvg4Asl4zq38wySr+RX8leP3v23MIq+Zgj9RG1/T 4WFG1/oXr/Vxku2NeImhyBF0WSG0YO26tuQhZsgClbBt8HukO/1mAxMuj5TuzQpayUP75TsVi xdRwuY2rJnRSRT2zsgj83K+PD5UBHJUS63S9Bla/3JMjZZZtvk+rjp2HtpQzm6DC2SY3LpHkF 02r1f6oMom0H6DO138rPi0u0u78feg3IsQo6ljpcnY3n5T5LOjzzLo5qay21LNCvOzLj2uDm8 yNpYcqtoyYhQ6Ru+VzF3cNovosab01vz7Oa27W+5F1RwemJBdUm9d8u+6qGsYl3TJHf1vL+bP P2Lft17of/qlpjpwVm6M2/2iGdxQfrqV69P90US5pX+4amtf9p7DYO7/dxP0D8+rc15M2C4GP qtpU5PSTY+z0CKEv8BQBKPHCoEAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-13.tower-96.messagelabs.com!1520050650!84114086!1 X-Originating-IP: [207.46.163.23] X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 24379 invoked from network); 3 Mar 2018 04:17:31 -0000 Received: from mail-dm3nam03lp0023.outbound.protection.outlook.com (HELO NAM03-DM3-obe.outbound.protection.outlook.com) (207.46.163.23) by server-13.tower-96.messagelabs.com with AES256-SHA256 encrypted SMTP; 3 Mar 2018 04:17:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=4xVNemtB9LmYOQ+M8srLTlitt7CtFvb1JPuVW+jKvrc=; b=So9yGexc4XQnuuXaX1Dkl9+R/MUFgm/ZL65KRZuM7N1JWIP/lYpYWn/mycCwJgiRRIrUoHfBQnkdqlwgxrVUrOYB6Wz2FGJS6ckH+xmFrRUHl/OdLND7fQiLdYSVrRuvkVXbM/SAQC6Ee4u2D+9bRn/8c4e8p0HUscGlClSuNjM= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1741.namprd14.prod.outlook.com (10.171.147.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Sat, 3 Mar 2018 04:17:29 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0548.014; Sat, 3 Mar 2018 04:17:28 +0000 From: Tim Hollebeek To: Ryan Sleevi , Phillip Hallam-Baker CC: SPASM , Peter Bowen Thread-Topic: [lamps] Revocation Request Format? Thread-Index: AQHTsjInSyN45zGu70muhef4KLLyqaO9HOwAgABBwICAAAPKgIAAEXSAgABwX9A= Date: Sat, 3 Mar 2018 04:17:28 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1741; 6:AEdwiG9q4tRUuhnzEO5UB8FxUssNKDipQ3jqujlRkLIu+U/DeG6clJI2NI0T1qUEzHfw0U4zdCWHbB9093JM6RtCMN4q/yhfrNyFWaZKZouYhZVftsd+hpGEZ85vOngo9fOE3P5AzpdwccXm9JxwIX8PCaeTr+RDrWCFJJrtFa7/6tuAzjabL9989mHLdOH7r155SRteyxbMuQme2vQTw66lZkvLph/oSda9RNF1BLiEibCqkNhlKxyXB2VMrv7lwRNfBjsr/jqC3mXOjbS47kxVh08VKMQXkriZDBSUWs490ELdhfmxlqrCMS5L4T7bUQXWt/KEktvnodMqpmz9F7w2y0g79nwlBa/EgBSA4P5P9TysF0G+OYt0G3jZZE5F; 5:YfJy3qFzjKOlHQpmg88+NfSTWW96py7DbOb9mbnXMIZjVCxKCr7e9b9sOvffFw+S9WSRTGUvuadTp97McZHFvYgpONwxbD0+73j22InjkTgi96JJu0avUl9/mMs004cZsWXmDowuzKT0Wg+3AGfi8uYhKsHWU6AYo8skAg9ucLo=; 24:ao05ZP4pYUwDcwTQyqGq7vXou7bfvml26fKE0yNPRiKd4lKQ3ZLBBqtxOtXNKGENYUvUL5TmRY5uZgmDfq2vwoOjhJl6QPGKBgCgXewx6BU=; 7:BaNF6TIqVsJLWqBD8257nKLkvbkrJtGqcHPMEdgLcyK5dKHMDgfqze7FLK7gI4ifpluaVd+SR/3g8vFA/0mQcwqqUS2u8jze8RnfefmYH4i4NMSeI0ZJ+pZy7GYcGGznCTgOopOMxAfB51I3SFKe9oFPMTmGhGVCXGFBZIiUgkWoETpcAghEvH9uzUvmhfRl2GEdvlVRU2P+aReHkCQq4C4ueL46AuXo+j6l0WXU6m6rXvRrYBSpvJCw3/hUr9Ev x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: eb34aee5-1d5b-4fa5-bd0d-08d580bdad6b x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(5600026)(4604075)(3008032)(2017052603307)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1741; x-ms-traffictypediagnostic: MWHPR14MB1741: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231220)(944501244)(52105095)(10201501046)(3002001)(6041288)(20161123558120)(20161123560045)(20161123562045)(20161123564045)(2016111802025)(6072148)(6043046)(201708071742011); SRVR:MWHPR14MB1741; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1741; x-forefront-prvs: 0600F93FE1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(376002)(39860400002)(396003)(39380400002)(189003)(199004)(110136005)(478600001)(229853002)(54906003)(3660700001)(186003)(102836004)(5660300001)(8936002)(74316002)(33656002)(6506007)(81166006)(8676002)(81156014)(7736002)(97736004)(26005)(5250100002)(790700001)(3846002)(6116002)(105586002)(9686003)(54896002)(6306002)(55016002)(6436002)(6246003)(53936002)(93886005)(2900100001)(25786009)(2950100002)(316002)(39060400002)(106356001)(2906002)(3280700002)(4326008)(7696005)(68736007)(14454004)(66066001)(86362001)(99936001)(99286004)(76176011); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1741; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: B3aUO4DTx+HhLuIqMdDbErNvWs1kHg0FRE7mPZyp2IaAojK/n7m9jk85F5PaAvyGV1rSWHZUwiTA4IMqr4xhiV6Ba80g0pnVz4nVg43wslnDn5RUjN7zCno7LjotUNZl2t06TRQoWdXDIYyTrhx+Rdl6Zl8j7K3T577KWlXmmX8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_040A_01D3B26B.DCD7EEA0" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: eb34aee5-1d5b-4fa5-bd0d-08d580bdad6b X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2018 04:17:28.8392 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1741 Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 04:17:35 -0000 ------=_NextPart_000_040A_01D3B26B.DCD7EEA0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_040B_01D3B26B.DCD7EEA0" ------=_NextPart_001_040B_01D3B26B.DCD7EEA0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Right. If there is an assertion that public key X is bound to Ryan Sleevi, and I, as an individual who is provably not Ryan Sleevi [1], can successfully sign anything as Ryan Sleevi, revocation is required. We need to make sure that any revocation rules and policies that exist respect that principle. -Tim [1] How many people can actually prove that? Other than Ryan? Because it's a demonstration of compromise. Any attempt to define how that demonstration of compromise is proved (which I think is *bad* standardization) is to make it more difficult to report or demonstrate compromise. ------=_NextPart_001_040B_01D3B26B.DCD7EEA0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Right.=C2=A0 If there is an assertion that public key = X is bound to Ryan Sleevi, and I, as an individual who is provably not = Ryan Sleevi [1], can successfully sign anything as Ryan Sleevi, = revocation is required.

 

We need to = make sure that any revocation rules and policies that exist respect that = principle.=C2=A0

 

-Tim

 

[1] How many = people can actually prove that?=C2=A0 Other than Ryan?

 

Because it's a = demonstration of compromise. Any attempt to define how that = demonstration of compromise is proved (which I think is *bad* = standardization) is to make it more difficult to report or demonstrate = compromise.

------=_NextPart_001_040B_01D3B26B.DCD7EEA0-- ------=_NextPart_000_040A_01D3B26B.DCD7EEA0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzAzMDQxNzI2WjAvBgkqhkiG9w0BCQQxIgQgAng5CxkYLxIeVSzch/nKX8MX+U+g cTDPP3hqNJeQws4wgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAE7+OIUe5IbAFHFbC+y36w67wsWuK89IpalzmW4xuv5RxNpZh21jaO2E6cvvOw8yBq2Uo5Ma WbhPyAyWszW2hHUB5ew/zedFmYjfdeAXK0X+ZMF2jGfOAGby5/3Itz8aVtHHHesAB06LUr9/QhmY AN79mk51kB1T7cD5E6KuxIascTrFspHrWaZOggjwHG/+xSNEUiFwYFgE+8DQhXjanc2BoiKLPm+9 jpFdurmCNgYuE9LbmmyTW14jFAW+xxttKSk4KgaM5RoPE4LxBZq101EgaE8FDnv5LmPzl6rSOueu ZgiT/QAr/wkN/MVzPV3xKTyeY4qMS/ZeKqBVdXCL5fwAAAAAAAA= ------=_NextPart_000_040A_01D3B26B.DCD7EEA0-- From nobody Fri Mar 2 20:28:12 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8353312EAEA for ; Fri, 2 Mar 2018 20:28:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AKleuRZF9-BG for ; Fri, 2 Mar 2018 20:28:07 -0800 (PST) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69BFE12EABD for ; Fri, 2 Mar 2018 20:28:07 -0800 (PST) Received: from [216.82.251.38] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-16.bemta-12.messagelabs.com id B0/93-11158-6542A9A5; Sat, 03 Mar 2018 04:28:06 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA2WTf0wTZxjH+95drydy7igwHokkWnTZqiAQ3Wr 8Zy4xNiRGt6AmHZk74GyrbSF31XRmEYSMqJDhD4q2CGiGRtSajJTgZE2kG1MQfyFWQIlUwQnM 3zME1NVe3+o0/vPk87zf7/O8z3N5jyHVJ1XJjOCwC6KNt2joGKpvthfS1sx1GzKOVWXp9jyuR brQ0Cil23u7DunqA/m6/b6A6kul3lNxndb/5h5U6a+ceE7oGxsnCX1ZWxu1WmlQmm15hY7vla aJzktE0ekm5LhW/zNZgva50C4Uw1DcIwJaT9VScqLmqgloGQkinNxGsGPAq9qFpjE0lwEB3zl C5gQuB6butSKZSW4j9A2URjzx3EJou+MhsScDfrrhVWI2QKjvcYQpbi5cdG+nZGa5XOjo76Jl VnNDJISat8k8jfsaukdvRjyI+xgmuk4S+K4kGBhuiDBwCRC8eoHGnAijd/9TYn8u1D3zR881c OqfW1F/CvQ0VEQWA85LQFX/nxQW0qFlzwOEeSVcfXqExqadBBx0+lVY0MLD4cEobwKXcyLaqR KBt6qFwsl9Aio916NtZ8G9ivpoKycNZzznEV60AKqP+6PCZQTdrU5qN9K631nQHdZIrgFB2VA v4Y58qTjodA1T2GSAR2fKCcxaaCwNqTDPh6OHx0nMn8G/u29SH54vhQNT7TTmOVBdEYzWLobx jifoEJp+HH0qCeIWQUzLXJyeJ5qNJruVN1vSMjOz0q2CJPFGwcLnSen5hdZmFH6hxQoFOo1e1 GT70UyG0CSyI0GXQT0jr7DgBxMvmdaLmy2C5EezGEYD7I+pboM6ThSMgmOD2RJ+5m9kYGI1Ce xlWWalIt4qmY1Y6kLLmd89wXKS6d3/dzh674yG49lI7Ls/Xk6qKVuhTUhOYn1yMScXmzbb3rZ +8xP1oJTkeBYpFAp1bJEgWs329/UxlMQgTTx7Te4Sa7bZ304wFh6OCA+nenBAHs7O/y8ll6At jQPU3fLEjm+Nk7Sx44/snvW9m7aafdqDn/wSjFm1qN3V3/3rRzUvvYEZXxTXiXbQBJtyDdYls 7/rzJ2XeqPgG2dtaMXh5RNz2Ell6ciCmi71i0VLFpTFO4Ix09cGSpp6l738PKu98sJG36Du0l 8r12W9+upsfvaY0Z7TOaUgDhWnaCjJxGdqSVHiXwP54lYGPwQAAA== X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-15.tower-163.messagelabs.com!1520051285!153683944!1 X-Originating-IP: [216.32.180.24] X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 97512 invoked from network); 3 Mar 2018 04:28:05 -0000 Received: from mail-sn1nam02lp0024.outbound.protection.outlook.com (HELO NAM02-SN1-obe.outbound.protection.outlook.com) (216.32.180.24) by server-15.tower-163.messagelabs.com with AES256-SHA256 encrypted SMTP; 3 Mar 2018 04:28:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+bGrAffgVDnc4bE5+0Eiq/H/kfy/LcrG4fQk06lbdxQ=; b=P63p1ekVe1HnR6YC8ZJn6IpWWGFDVHppTdwj9yKMHa3aABL0Nnxt2BFHcngjShgDkVi4sh3/u1cNbSjD+amxTHSLePSipe5uNJiTXV2rtbsRFxXVKeShCKVgnLSHwIfEp7W/KkEKuTaLVqDkSWZvJN3at4d6lR2I9vM5L34H5w0= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1261.namprd14.prod.outlook.com (10.173.102.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Sat, 3 Mar 2018 04:28:03 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0548.014; Sat, 3 Mar 2018 04:28:03 +0000 From: Tim Hollebeek To: Ryan Sleevi , Stephen Farrell CC: SPASM , Phillip Hallam-Baker , Peter Bowen Thread-Topic: [lamps] Revocation Request Format? Thread-Index: AQHTsjInSyN45zGu70muhef4KLLyqaO9HOwAgABBwICAAAPKgIAAEXSAgAAHYICAAA1TAIAAYL7g Date: Sat, 3 Mar 2018 04:28:03 +0000 Message-ID: References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1261; 7:ySvwi17ycAdBeuPZRnwh3SprswPzcdw2IWd7Yf9p9mRHO5/pxFWZyvNBX+1w0ePPrcFGENBdTLgwri6QSe/V1LUa9lS0IJM7un+901FHmOXjUiFIG4urIDLqIKNs7SfFed27NpucUPqnLzQ8SjxrvapWQF0qWpTu9IuBa4RCbM4EVRm5jABOgxTFgpUByjKoM25MrUrR+B9iJdhe1k0QEHcTduPzTIUi3osAkgz9id/8jG9C6iqaclntZ2MwYMRT x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 16288334-4e0a-43b2-7494-08d580bf27bf x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(5600026)(4604075)(3008032)(2017052603307)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1261; x-ms-traffictypediagnostic: MWHPR14MB1261: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(32856632585715)(192374486261705)(85827821059158)(144208319314845)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040501)(2401047)(5005006)(8121501046)(3231220)(944501244)(52105095)(10201501046)(3002001)(93006095)(93001095)(6041288)(2016111802025)(20161123558120)(20161123562045)(20161123560045)(20161123564045)(6043046)(6072148)(201708071742011); SRVR:MWHPR14MB1261; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1261; x-forefront-prvs: 0600F93FE1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(346002)(366004)(376002)(39860400002)(39380400002)(199004)(189003)(6436002)(966005)(106356001)(606006)(229853002)(99936001)(5660300001)(478600001)(93886005)(7736002)(3660700001)(33656002)(74316002)(99286004)(59450400001)(53546011)(68736007)(6506007)(81166006)(81156014)(3280700002)(8936002)(8676002)(76176011)(4326008)(25786009)(186003)(102836004)(26005)(105586002)(39060400002)(7696005)(6306002)(9686003)(236005)(54896002)(2906002)(14454004)(55016002)(2950100002)(97736004)(6246003)(5250100002)(86362001)(2900100001)(790700001)(54906003)(53936002)(3846002)(6116002)(110136005)(66066001)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1261; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: LdIpnFDjzwb3uirQcZhsH9f7FTV54D2fBf+XRvrqtmczBrwYXtKni9Fm6BWEmj51XLWyGvJx83YYUZJ2NF0uGQvX2DubU42n80ANzCAebmsGxCxFICUf5uRa4r1Snp669C72Z7CY/MgCwIHKS/n7l08nz8gdUh4K3jmVmhFz4rA= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_041F_01D3B26D.572FB4C0" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 16288334-4e0a-43b2-7494-08d580bf27bf X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2018 04:28:03.5666 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1261 Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 04:28:10 -0000 ------=_NextPart_000_041F_01D3B26D.572FB4C0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0420_01D3B26D.572FB4C0" ------=_NextPart_001_0420_01D3B26D.572FB4C0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I agree with Ryan. =20 Some standardized methods of proof of compromise would be useful for = typical compromise scenarios (I hope Ryan agrees with that), but you = can=E2=80=99t produce an exhaustive list of what=E2=80=99s acceptable. =20 We=E2=80=99re not going to be able to standardize =E2=80=9CI have a = quantum computer in my back pocket, here=E2=80=99s how I demonstrate = that=E2=80=9D or =E2=80=9Cif I wiggle my fingers at the public key like = so, the private key appears in an thought bubble above its = head=E2=80=9D. =20 Security failures happen when assumptions and abstract models break = down. If you can demonstrate that you can violate those assumptions, = people have to be prepared to deal with the consequences. =20 -Tim =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Ryan Sleevi Sent: Friday, March 2, 2018 3:34 PM To: Stephen Farrell Cc: Ryan Sleevi ; SPASM ; Phillip = Hallam-Baker ; Peter Bowen Subject: Re: [lamps] Revocation Request Format? =20 =20 =20 On Fri, Mar 2, 2018 at 4:45 PM, Stephen Farrell = > wrote: On 02/03/18 21:19, Ryan Sleevi wrote: > Because it's a demonstration of compromise. Any attempt to define how = that > demonstration of compromise is proved (which I think is *bad* > standardization) is to make it more difficult to report or demonstrate > compromise. I don't understand the "any" in the above. Can you clarify? =20 So, there's two scenarios for key compromise that we're considering in = the CA space 1) I have the private key (Heartbleed, Trustico, rooted servers, etc) 2) I have a signing oracle (Bleichenbacher, ROBOT, etc) a) Note: The signing oracle may be somewhat constrained in message = formatting, but still provides an oracle sufficient to count as = compromise b) Note: The signing oracle may be temporary in nature, so I'd be = particularly concerned with systems that require nonces or timestamps, = as they would incentivize disclosure to the CA first, rather than to the = 'presumed legitimate' keyholder. =20 Further, we have at least several actors to consider demonstration of = compromise to: I) The CA/issuer II) Those that oversee the trust anchor management that includes the CA III) The public =20 Because 2) exists, and the constraints re: 2 a), we need ecosystem = flexibility for how we demonstrate proof. That is, it will be somewhere = along a spectrum, based on what I, II, III find an acceptable = demonstration. I might want to require a challenge, but II does not, for = example. =20 Thus, because the ecosystem has flexibility, 1) can easily adapt to = whatever is needed - because they have the key, they are technically = capable of producing any signed message necessary for I, II, III - of = which we already have plenty of ways of expressing, whether it be raw = signatures, CSRs, SPKACs, whatever your heart desires. There's no need = to invent a new format, because we have infinitely flexible formats = already available, and because the policy for I, II, and III will be = inherently variable anyways. =20 Further, I am deeply concerned for situations in which 1) - or any = standardized version of expressing that - is seen as the only form of = compromise or the only acceptable form of demonstrating that. This isn't = hypothetical - this is a problem that, in acting in the role of a = browser trust store maintainer (II), I've had to chase down a number of = CAs (I), because they only want to revoke for 1) (... if even that). = That's a policy matter, for sure, but it's a policy matter that I fear = is or would be amplified. =20 So I think attempts at 1) are somewhere along the line of = https://xkcd.com/927/ , where we already have a number of methods. =20 But let's go further, and imagine that let's say we wanted to have an = interoperable definition for proof-of-key-compromise, so that you don't = see what we see today - where CA Foo revokes a certificate as = compromised, and the Subscriber then goes to CA Bar and requests a new = certificate - with the same key. It might seem appealing to suggest that = an interoperable proof of compromise would facilitate that information = sharing, perhaps via some shared transparent ledger. And I totally get = that appeal, but that's only addressing 1), and not 2), so we're not = really addressing 'compromise' in the broad sense, just 'compromise' in = the narrow sense - and we're just adding more work for those who do have = the key to adopt whatever the new hotness is, creating ecosystem = adoption issues. =20 That's why I think an effort to standardize there is bad, not good, = because it counterintuitively fragments the ecosystem, without = addressing the general issue, which is in my view is moreso a matter of = policy, because of the inherent constraints of 2). =20 ------=_NextPart_001_0420_01D3B26D.572FB4C0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

I agree = with Ryan.

 

Some standardized methods of proof of compromise would = be useful for typical compromise scenarios (I hope Ryan agrees with = that), but you can=E2=80=99t produce an exhaustive list of = what=E2=80=99s acceptable.

 

We=E2=80=99re not going to be able to standardize = =E2=80=9CI have a quantum computer in my back pocket, here=E2=80=99s how = I demonstrate that=E2=80=9D or =E2=80=9Cif I wiggle my fingers at the = public key like so, the private key appears in an thought bubble above = its head=E2=80=9D.

 

Security = failures happen when assumptions and abstract models break down.=C2=A0 = If you can demonstrate that you can violate those assumptions, people = have to be prepared to deal with the consequences.

 

-Tim

 

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Ryan = Sleevi
Sent: Friday, March 2, 2018 3:34 PM
To: = Stephen Farrell <stephen.farrell@cs.tcd.ie>
Cc: Ryan = Sleevi <ryan-ietf@sleevi.com>; SPASM <SPASM@ietf.org>; = Phillip Hallam-Baker <phill@hallambaker.com>; Peter Bowen = <pzbowen@gmail.com>
Subject: Re: [lamps] Revocation = Request Format?

 

 

 

On Fri, = Mar 2, 2018 at 4:45 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> = wrote:



On 02/03/18 21:19, Ryan = Sleevi wrote:
> Because it's a = demonstration of compromise. Any attempt to define how = that
> demonstration of compromise is = proved (which I think is *bad*
> = standardization) is to make it more difficult to report or = demonstrate
> = compromise.

I don't understand the "any" in the = above.

Can you clarify?

 

So, there's two scenarios for key compromise that = we're considering in the CA space

1) I have the private key (Heartbleed, Trustico, = rooted servers, etc)

2) I = have a signing oracle (Bleichenbacher, ROBOT, = etc)

  a) Note: The = signing oracle may be somewhat constrained in message formatting, but = still provides an oracle sufficient to count as = compromise

  b) Note: = The signing oracle may be temporary in nature, so I'd be particularly = concerned with systems that require nonces or timestamps, as they would = incentivize disclosure to the CA first, rather than to the 'presumed = legitimate' keyholder.

 

Further, we have at least several actors to consider = demonstration of compromise to:

I) The CA/issuer

II) Those that oversee the trust anchor management = that includes the CA

III) = The public

 

Because 2) exists, and the constraints re: 2 a), we = need ecosystem flexibility for how we demonstrate proof. That is, it = will be somewhere along a spectrum, based on what I, II, III find an = acceptable demonstration. I might want to require a challenge, but II = does not, for example.

 

Thus, because the ecosystem has flexibility, 1) can = easily adapt to whatever is needed - because they have the key, they are = technically capable of producing any signed message necessary for I, II, = III - of which we already have plenty of ways of expressing, whether it = be raw signatures, CSRs, SPKACs, whatever your heart desires. There's no = need to invent a new format, because we have infinitely flexible formats = already available, and because the policy for I, II, and III will be = inherently variable anyways.

 

Further, I am deeply concerned for situations in which = 1) - or any standardized version of expressing that - is seen as the = only form of compromise or the only acceptable form of demonstrating = that. This isn't hypothetical - this is a problem that, in acting in the = role of a browser trust store maintainer (II), I've had to chase down a = number of CAs (I), because they only want to revoke for 1) (... if even = that). That's a policy matter, for sure, but it's a policy matter that I = fear is or would be amplified.

 

So I think attempts at 1) are somewhere along the line = of https://xkcd.com/927/ , = where we already have a number of methods.

 

But let's go further, and imagine that let's say we = wanted to have an interoperable definition for proof-of-key-compromise, = so that you don't see what we see today - where CA Foo revokes a = certificate as compromised, and the Subscriber then goes to CA Bar and = requests a new certificate - with the same key. It might seem appealing = to suggest that an interoperable proof of compromise would facilitate = that information sharing, perhaps via some shared transparent ledger. = And I totally get that appeal, but that's only addressing 1), and not = 2), so we're not really addressing 'compromise' in the broad sense, just = 'compromise' in the narrow sense - and we're just adding more work for = those who do have the key to adopt whatever the new hotness is, creating = ecosystem adoption issues.

 

That's why I think an effort to standardize there is = bad, not good, because it counterintuitively fragments the ecosystem, = without addressing the general issue, which is in my view is moreso a = matter of policy, because of the inherent constraints of = 2).

 

------=_NextPart_001_0420_01D3B26D.572FB4C0-- ------=_NextPart_000_041F_01D3B26D.572FB4C0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzAzMDQyODAwWjAvBgkqhkiG9w0BCQQxIgQg5gDWDcTa81vGYnDb7ii5JhzvO6Ts +pKnqv0o7u7dJfMwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBADWcL+e22AXei79AOBxP01GXOqNBwL4+CWvS2HXrrgX06mEniLObgapSmN8l/NaYZzzXUYPk xo3EFanmI/l5AxwCElkPzrXw2On90VquNzqA0kCnTnCV2jyGBdrfNqElCN4522nqhUb1RFhqT+Gf x9kAGC4KDmM3rTGsDWM9RDAYiovvfT0Q3askXrakrlDKZvnMX/L6LLzWkyEUS1SPmQEznwJuErzB YPJlKgIJ6LXd56JC16pDIcnJZXUFmT7CLeecUz6UaadD1UdthLMIN/xtj5E9VqQYV78nt3RqsFtr 5T3aqlrt7vUuihdFfLbvneitSHuSjIYDM2yt4MoomrwAAAAAAAA= ------=_NextPart_000_041F_01D3B26D.572FB4C0-- From nobody Fri Mar 2 22:29:42 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C15D512EABD for ; Fri, 2 Mar 2018 22:29:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kY1pGC2AeNIt for ; Fri, 2 Mar 2018 22:29:38 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 613C2126C19 for ; Fri, 2 Mar 2018 22:29:37 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 8FBF2BE79; Sat, 3 Mar 2018 06:29:34 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jjZiKHa9AfJs; Sat, 3 Mar 2018 06:29:33 +0000 (GMT) Received: from [172.18.242.162] (w193-11-200-249.eduroam.sunet.se [193.11.200.249]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 13AC0BE5F; Sat, 3 Mar 2018 06:29:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1520058573; bh=v+X+O+eg3+SKtzV+LDYT0Q0HfJKU0hhf3hucFCOyk3I=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=bsYiqzXwDWgNSsJoK9qvrNyRSWGTMusTO3dd8p3S99ioQIV8H8yCdnD0HtckIuFhh gZBmSxsx6f2CtKVRX/ldBXHXJu0EQmBsfWq5iuSF+x29W59SjSjEg6pahtyKCyL/g6 oIh1ZcR4942nXxgPO4C0D6PunmakJNG4DvO6kWvs= To: Ryan Sleevi Cc: SPASM , Phillip Hallam-Baker , Peter Bowen References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Message-ID: <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> Date: Sat, 3 Mar 2018 06:29:30 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Y5wF5rlHnJKRpEegdH7fJOIYfExEP0gWJ" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 06:29:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Y5wF5rlHnJKRpEegdH7fJOIYfExEP0gWJ Content-Type: multipart/mixed; boundary="F1fZwU2vjWYJdSdtAyiH1rrwYWlqehdRV"; protected-headers="v1" From: Stephen Farrell To: Ryan Sleevi Cc: SPASM , Phillip Hallam-Baker , Peter Bowen Message-ID: <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> Subject: Re: [lamps] Revocation Request Format? References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> In-Reply-To: --F1fZwU2vjWYJdSdtAyiH1rrwYWlqehdRV Content-Type: multipart/mixed; boundary="------------5E4EA6688629EB5E7D2981E6" Content-Language: en-GB This is a multi-part message in MIME format. --------------5E4EA6688629EB5E7D2981E6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 02/03/18 22:33, Ryan Sleevi wrote: > That's why I think an effort to standardize there is bad, not good, bec= ause > it counterintuitively fragments the ecosystem, without addressing the > general issue, which is in my view is moreso a matter of policy, becaus= e of > the inherent constraints of 2). FWIW, I don't agree with your conclusion that *any* standardisation of revocation signals would be counter-productive, but I also don't think we ought do any such standardisation unless there are a bunch of CAs and writers of private key handling s/w who do in fact want to use the same new format for revocation signalling. I don't see a whole bunch of CAs and others wanting that right now. So in the short term, I think we agree as to what to (not) do:-) Cheers, S. --------------5E4EA6688629EB5E7D2981E6 Content-Type: application/pgp-keys; name="0x7B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x7B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------5E4EA6688629EB5E7D2981E6-- --F1fZwU2vjWYJdSdtAyiH1rrwYWlqehdRV-- --Y5wF5rlHnJKRpEegdH7fJOIYfExEP0gWJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJamkDKAAoJEFqy+vF7FyvqK3AP/1pP28X74AZ8uIORXi3TLQ1d tI9pDj7Pf/ea290DxrKTog+wtR5VDHqhAmEGHaUclLmXYHWTRJiSg3fZ2FNjBoFR t8e4hB+VYG9A2dJ7j6FRbotBipHzTlOhudrMj0ZwcFkdftjTWQwiY2ZlTmeC2nY4 H7vng8ypokoqaRd3ioJB6z+zupYQmQD4sWJM9zxFceM8e+RXmiIXiizrv4viqDPu wxk8zmv55OdhBNNmAH3meklSCWWFfsGW7Xo+1dtTik0lvCMx5mjs3XjNx62Ptsmn 0rxQJrEtJDCZRV1ZueJQrczRmv4ntwB4OeKUgqx6ZTEGDBAqpkbLw8yWlwXxkkMy TchjoqJpJxgSv7sa477OB2EOA+uN1qjzhsBsf71zgJYKKb4AEiXSwBeztVP26QPz uZWz4Hrw14adGNC0hAUYSJ/FlVf3dKDK6hRJ3MpFUP8vk4G+48SGxvUwp7jfTYKQ C3jQrPDC6866SchqQWXRtU6homkwlHoG90w+gqlS+cwHd0GSeuBPbQmqTXnLpJvQ GxK9NQT1P/Ka3zkHq/10V+GtS0+ecyOUy/QbWjc/T2Ew5QCQ62FTulEpUP1wZlr/ eZrcG3t5Of9tepi22gi5FYDo0o924zByfBwjpK2xYnS1KE7gE6iWZBJjumj7hEFU mkf3Cpb+T4PNZFqgGgJ/ =Bpcy -----END PGP SIGNATURE----- --Y5wF5rlHnJKRpEegdH7fJOIYfExEP0gWJ-- From nobody Sat Mar 3 09:08:04 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 726F2126BF3 for ; Sat, 3 Mar 2018 09:08:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z56zqdLd81fd for ; Sat, 3 Mar 2018 09:08:01 -0800 (PST) Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A10C1204DA for ; Sat, 3 Mar 2018 09:08:01 -0800 (PST) Received: by mail-oi0-x22a.google.com with SMTP id c12so9255169oic.7 for ; Sat, 03 Mar 2018 09:08:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=+jdqJjhiVDXjO6CuJlCDxwlt40c7nFGc65NLlWQSAGk=; b=Yt0bVb1zCb0UwwBIdKbl8Gecblv9rltWhi40WCzJj7OlSxMz0xnik95XLhPF+oYj7S ePG2m/fWO22bXnKmncHUSR4K8Xg6H3L0/acCci/fyOVzBtwHNKq/w9JDV37P0vq/Dp+w CLgSDFqXXjxCe0TIHRpbeB7CiBDbdhUYjvukOn4SDhrpjalfbwC8SoHKdBXu/Oz20g1s BdPk9FKbWnm8V7ATAEtym75e7JPELrF1R131STV1jKvEIc0WyirhMzTtoXXEUZZeWyAy bu41mq7yEY4ZaSMUSUD5x3M1ubNJqJHL0aTSy1oXVDFojeEaCBEycU2t+iP9zVm79r/a i4Bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=+jdqJjhiVDXjO6CuJlCDxwlt40c7nFGc65NLlWQSAGk=; b=Ku8ZuJNwg9E73q/LH47LOgUNmL6tWmmWZKixtYMzuJOzFuCbcuP0VAEEKDVwm9TQkT fVu+XEd8KloaAB7+depoqEXcIrnUs4kV71+0YnhMa0cgHHj4qv/+92ijaSlcEfcPQwfd xqdIov4PGCJLI5NvtWo34icreMW+VTXKSErD0KO9xLjluk46EKsYt9YBCMADyBE/0RD1 oP5pIjkUyShEKFYxfBxwY32n2Ah9rEy8G+SzB59oNjQFrRvTwtWjZPYH0wMt6MBpaLJc cSuidlExyv5fvdAb/ym091iNHNSBbHieWbolZDaqwXTZ4+D77odTGLt/TIxjdP35Kcq3 deDA== X-Gm-Message-State: AElRT7Fa4zFcg+yRLp7DPDeY2gohuOHXck0EKph5p5YoVYB/eYZlG1Wv j1mRzV80QmkKzegnh9EKf6FHdNXrlnqpSQH2bwY= X-Google-Smtp-Source: AG47ELutb+ZTfkk8NkWPNEN1mug5mzsPmD55FgriszG2yRWSwXsOMh7juXuxpaAwo+roWVzM+2Q8k1MIR0bem53iCH0= X-Received: by 10.202.168.199 with SMTP id r190mr6484940oie.180.1520096880463; Sat, 03 Mar 2018 09:08:00 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Sat, 3 Mar 2018 09:07:59 -0800 (PST) In-Reply-To: <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> From: Phillip Hallam-Baker Date: Sat, 3 Mar 2018 12:07:59 -0500 X-Google-Sender-Auth: 4sQbZOeWWJjTdTZU-XF1GfJrQxI Message-ID: To: Stephen Farrell Cc: Ryan Sleevi , SPASM , Peter Bowen Content-Type: multipart/alternative; boundary="001a113cd4b695938d0566852206" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 17:08:03 -0000 --001a113cd4b695938d0566852206 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Mar 3, 2018 at 1:29 AM, Stephen Farrell wrote: > > > On 02/03/18 22:33, Ryan Sleevi wrote: > > That's why I think an effort to standardize there is bad, not good, > because > > it counterintuitively fragments the ecosystem, without addressing the > > general issue, which is in my view is moreso a matter of policy, becaus= e > of > > the inherent constraints of 2). > > FWIW, I don't agree with your conclusion that *any* standardisation > of revocation signals would be counter-productive, but I also don't > think we ought do any such standardisation unless there are a bunch > of CAs and writers of private key handling s/w who do in fact want > to use the same new format for revocation signalling. I don't see a > whole bunch of CAs and others wanting that right now. > > So in the short term, I think we agree as to what to (not) do:-) > =E2=80=8BAt this point, the incident that motivated this proposal happened = 4 days ago. So it would probably be a mistake to bang out a draft and promote it to RFC.=E2=80=8B =E2=80=8BWhat I was most interested to know is if we had done the work alre= ady and the answer appears to be not in PKIX=E2=80=8B but possibly in ACME. It migh= t just be that all we need to do is to add a few paragraphs to ACME and maybe get an IANA content type for whatever the standalone message blob is. I do think we will need to standardize because we are almost certain to want to pop these blobs in our CT logs at some point and it is in any case the right thing to do. One code path is always better than five code paths offering the same functionality. --001a113cd4b695938d0566852206 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Sat, Ma= r 3, 2018 at 1:29 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

On 02/03/18 22:33, Ryan Sleevi wrote:
> That's why I think an effort to standardize there is bad, not good= , because
> it counterintuitively fragments the ecosystem, without addressing the<= br> > general issue, which is in my view is moreso a matter of policy, becau= se of
> the inherent constraints of 2).

FWIW, I don't agree with your conclusion that *any* standardisat= ion
of revocation signals would be counter-productive, but I also don't
think we ought do any such standardisation unless there are a bunch
of CAs and writers of private key handling s/w who do in fact want
to use the same new format for revocation signalling. I don't see a
whole bunch of CAs and others wanting that right now.

So in the short term, I think we agree as to what to (not) do:-)

=E2=80=8BAt this point, the incident that motivated this proposal hap= pened 4 days ago. So it would probably be a mistake to bang out a draft and= promote it to RFC.=E2=80=8B

=E2=80=8BWhat I was most interested to know is= if we had done the work already and the answer appears to be not in PKIX= =E2=80=8B but possibly in ACME. It might just be that all we need to do is = to add a few paragraphs to ACME and maybe get an IANA content type for what= ever the standalone message blob is.=C2=A0


I do think we will need to standardize because we are almost certai= n to want to pop these blobs in our CT logs at some point and it is in any = case the right thing to do. One code path is always better than five code p= aths offering the same functionality.

--001a113cd4b695938d0566852206-- From nobody Sat Mar 3 10:34:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BA9D1204DA for ; Sat, 3 Mar 2018 10:34:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SodtCDoAVAKZ for ; Sat, 3 Mar 2018 10:34:17 -0800 (PST) Received: from homiemail-a102.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2822D126D05 for ; Sat, 3 Mar 2018 10:34:13 -0800 (PST) Received: from homiemail-a102.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a102.g.dreamhost.com (Postfix) with ESMTP id BA3CD20047604 for ; Sat, 3 Mar 2018 10:34:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :references:in-reply-to:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=1R7iWHD8M7+oYb85sOQjCUGlQ+o=; b= HKMBh1v4O2MHYbhQAeCN5TDj2iF5Myp3/rZAbFwrY226Ew/f5x9LVBVXnos/Xdf9 k2WDcLl7JEOplK831ABPDeyjq+3w+e4O/k9r/kuW4ioQk3I5OGNcBW39kMvs5IDk t3Jr20BN4RgV/1MseP/Ohnwekg21VjJ4wDKZehu60jE= Received: from mail-io0-f169.google.com (mail-io0-f169.google.com [209.85.223.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a102.g.dreamhost.com (Postfix) with ESMTPSA id 5E51F201702C2 for ; Sat, 3 Mar 2018 10:34:12 -0800 (PST) Received: by mail-io0-f169.google.com with SMTP id u84so13882123iod.9 for ; Sat, 03 Mar 2018 10:34:12 -0800 (PST) X-Gm-Message-State: AElRT7F/8+XfF7zybewtpAFO4Ua2xFXvFObjHdVay6/B87oJA139+bnM repa+DKSbJU/qJYUciUX8Xg00rEjBzcUWsW8FWY= X-Google-Smtp-Source: AG47ELsdZeoY79zY6/SrUtNrhRkpD4uo83vj6qcYBabZjJmR3ejYebNB+3usFFZiFUKrt20zmVusZ40V6F1pn8vemsE= X-Received: by 10.107.44.68 with SMTP id s65mr11934749ios.159.1520102051724; Sat, 03 Mar 2018 10:34:11 -0800 (PST) MIME-Version: 1.0 References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> In-Reply-To: From: Ryan Sleevi Date: Sat, 03 Mar 2018 18:34:00 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Phillip Hallam-Baker Cc: Peter Bowen , Ryan Sleevi , SPASM , Stephen Farrell Content-Type: multipart/alternative; boundary="001a1139818cd0c3d205668656bb" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2018 18:34:20 -0000 --001a1139818cd0c3d205668656bb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Mar 3, 2018 at 12:07 PM Phillip Hallam-Baker wrote: > On Sat, Mar 3, 2018 at 1:29 AM, Stephen Farrell > wrote: > >> >> >> On 02/03/18 22:33, Ryan Sleevi wrote: >> > That's why I think an effort to standardize there is bad, not good, >> because >> > it counterintuitively fragments the ecosystem, without addressing the >> > general issue, which is in my view is moreso a matter of policy, >> because of >> > the inherent constraints of 2). >> >> FWIW, I don't agree with your conclusion that *any* standardisation >> of revocation signals would be counter-productive, but I also don't >> think we ought do any such standardisation unless there are a bunch >> of CAs and writers of private key handling s/w who do in fact want >> to use the same new format for revocation signalling. I don't see a >> whole bunch of CAs and others wanting that right now. >> >> So in the short term, I think we agree as to what to (not) do:-) >> > > =E2=80=8BAt this point, the incident that motivated this proposal happene= d 4 days > ago. So it would probably be a mistake to bang out a draft and promote it > to RFC.=E2=80=8B > > =E2=80=8BWhat I was most interested to know is if we had done the work al= ready and > the answer appears to be not in PKIX=E2=80=8B but possibly in ACME. It mi= ght just > be that all we need to do is to add a few paragraphs to ACME and maybe ge= t > an IANA content type for whatever the standalone message blob is. > > > I do think we will need to standardize because we are almost certain to > want to pop these blobs in our CT logs at some point and it is in any cas= e > the right thing to do. One code path is always better than five code path= s > offering the same functionality. > It might be good to start with a Use Cases document first, to figure out who the participants/constituents would be. This would align with Stephen= =E2=80=99s remark re: what writers of private key handling s/w should use. Considering such solutions naturally preclude solving (some of) the =E2=80=9Ccompromise= =E2=80=9D scenarios that must be dealt with today, the merits of those use cases could be independently evaluated before trying to shape such work. I view the transparency aspect as similarly orthogonal - such transparency is more beneficial for demonstrating the private key holder authorized a revocation. In today=E2=80=99s Web PKI, that is a real problem with CAs unilaterally revoking for specious reasons (=E2=80=9Cmalware=E2=80=9D, =E2= =80=9Ccustomer stopped paying monthly fee=E2=80=9D, =E2=80=9Cwe added a new domain name to the cus= tomer account=E2=80=9D) or Resellers, often misguided, requesting revocation per the terms of their contract with the CA without regard to whether or not the Certificate recipient desires it. > --001a1139818cd0c3d205668656bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Sat, Mar = 3, 2018 at 1:29 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> = wrote:


On 02/03/18 22:33, Ryan Sleevi wrote:
> That's why I think an effort to standardize there is bad, not good= , because
> it counterintuitively fragments the ecosystem, without addressing the<= br> > general issue, which is in my view is moreso a matter of policy, becau= se of
> the inherent constraints of 2).

FWIW, I don't agree with your conclusion that *any* standardisat= ion
of revocation signals would be counter-productive, but I also don't
think we ought do any such standardisation unless there are a bunch
of CAs and writers of private key handling s/w who do in fact want
to use the same new format for revocation signalling. I don't see a
whole bunch of CAs and others wanting that right now.

So in the short term, I think we agree as to what to (not) do:-)

=E2=80=8BAt this point, the incident that motivated this proposal h= appened 4 days ago. So it would probably be a mistake to bang out a draft a= nd promote it to RFC.=E2=80=8B

=E2=80=8BWhat I was most interested to know = is if we had done the work already and the answer appears to be not in PKIX= =E2=80=8B but possibly in ACME. It might just be that all we need to do is = to add a few paragraphs to ACME and maybe get an IANA content type for what= ever the standalone message blob is.=C2=A0


I do think we will need to standardize because we are almost certai= n to want to pop these blobs in our CT logs at some point and it is in any = case the right thing to do. One code path is always better than five code p= aths offering the same functionality.

It might be good to star= t with a Use Cases document first, to figure out who the participants/const= ituents would be. This would align with Stephen=E2=80=99s remark re: what w= riters of private key handling s/w should use. Considering such solutions n= aturally preclude solving (some of) the =E2=80=9Ccompromise=E2=80=9D scenar= ios that must be dealt with today, the merits of those use cases could be i= ndependently evaluated before trying to shape such work.

I view the transparency aspect as similarl= y orthogonal - such transparency is more beneficial for demonstrating the p= rivate key holder authorized a revocation. In today=E2=80=99s Web PKI, that= is a real problem with CAs unilaterally revoking for specious reasons (=E2= =80=9Cmalware=E2=80=9D, =E2=80=9Ccustomer stopped paying monthly fee=E2=80= =9D, =E2=80=9Cwe added a new domain name to the customer account=E2=80=9D) = or Resellers, often misguided, requesting revocation per the terms of their= contract with the CA without regard to whether or not the Certificate reci= pient desires it.
--001a1139818cd0c3d205668656bb-- From nobody Sat Mar 3 19:24:15 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D66F12426E for ; Sat, 3 Mar 2018 19:24:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7roVBy0v8FTx for ; Sat, 3 Mar 2018 19:24:12 -0800 (PST) Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EB9D1200C1 for ; Sat, 3 Mar 2018 19:24:12 -0800 (PST) Received: by mail-ot0-x22e.google.com with SMTP id g97so12110708otg.13 for ; Sat, 03 Mar 2018 19:24:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=oIg4iIRtByYJlWR0Znvyp8/yCRVpFR6MNt8igNCW0kc=; b=ghWPEge+pCXSVDxB0IiK4Ca+y3AcbUmrfN1oVBz/CleGFbKsR9KrY/LdT8OsXNRDyP DmBL5vL2BNOQsvy6+PRi81OwVigCKya6TjoNuPZRI8POQSQ2tcB2IihaE/Ym3ueuradp lYRBfr0BB+ZfGSdL/e572rcvaVApWYUX+7kkeW2g8CBPQTUK4XkqR/kzZB0tK0TwQw/p lMDpHXSMxmUEpjrNuLBH1SnR9A2wga9v8jtaG4PJDRsYYDedUlr3jTeXiAPR2TzB8n94 H2vuVeuFSrwNbLFwMq1FesKpJlgXmXGFHJgJ0nAFow+jeQrs26Ha42fz/0DJDCFJdlm0 gEcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=oIg4iIRtByYJlWR0Znvyp8/yCRVpFR6MNt8igNCW0kc=; b=KhnEscoknhNNTJB5o+2GSb27pZGDZ6JpdHR58LLY1Kwd41VupbHrnUuq1slM6qSh76 nwAueSk7q68439Lr5PQ4+I2P7gPJyuXXITf54XKcmV+H4HUAA6dSY14rB6mMPzu8JiO+ FJVHlXWwbSkDNyn9YFHfpoAUx5YUHuEc4MrTXYe/AvHhcsAPNwmkYbILz/1CLqqDNZQP pFcB9xj5lSbJAz9718i8oRhfnJQHMd8qpUH8lkaB9KsL9sUoeFBtjC9jUnzEDBUn/zWN j51OPqQkeBjwFwkHoYzSmJNEUexdthC/njGDu7WpteQXg22CONjzGRRBGuZ4+xc1CTm4 MIMQ== X-Gm-Message-State: AElRT7GwZPYkh8Ix8tjRbAbszMhKlHyfDZ04WBI8j1K7ao4VfRwqsFKR NRoqLTaiAo5QEhvt6S9Rsj2YnNBKPlcIHHqqEIQ= X-Google-Smtp-Source: AG47ELsc+eRKM/xPt65o+EDzLXstlsc50zO+8lUPyT90/ZEUIGareUheIcJe2vMiTFxnljZLAuWvtcwUfdhi1Z/eC2k= X-Received: by 10.157.65.140 with SMTP id p12mr7143785ote.167.1520133851702; Sat, 03 Mar 2018 19:24:11 -0800 (PST) MIME-Version: 1.0 Sender: hallam@gmail.com Received: by 10.157.5.5 with HTTP; Sat, 3 Mar 2018 19:24:10 -0800 (PST) In-Reply-To: References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> From: Phillip Hallam-Baker Date: Sat, 3 Mar 2018 22:24:10 -0500 X-Google-Sender-Auth: ezJErSToTCzOgN_bYVx5QUQdISA Message-ID: To: Ryan Sleevi Cc: Peter Bowen , SPASM , Stephen Farrell Content-Type: multipart/alternative; boundary="94eb2c1c1ce23dec0305668dbef1" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Mar 2018 03:24:14 -0000 --94eb2c1c1ce23dec0305668dbef1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Mar 3, 2018 at 1:34 PM, Ryan Sleevi wrote: > > On Sat, Mar 3, 2018 at 12:07 PM Phillip Hallam-Baker < > phill@hallambaker.com> wrote: > >> On Sat, Mar 3, 2018 at 1:29 AM, Stephen Farrell < >> stephen.farrell@cs.tcd.ie> wrote: >> >>> >>> >>> On 02/03/18 22:33, Ryan Sleevi wrote: >>> > That's why I think an effort to standardize there is bad, not good, >>> because >>> > it counterintuitively fragments the ecosystem, without addressing the >>> > general issue, which is in my view is moreso a matter of policy, >>> because of >>> > the inherent constraints of 2). >>> >>> FWIW, I don't agree with your conclusion that *any* standardisation >>> of revocation signals would be counter-productive, but I also don't >>> think we ought do any such standardisation unless there are a bunch >>> of CAs and writers of private key handling s/w who do in fact want >>> to use the same new format for revocation signalling. I don't see a >>> whole bunch of CAs and others wanting that right now. >>> >>> So in the short term, I think we agree as to what to (not) do:-) >>> >> >> =E2=80=8BAt this point, the incident that motivated this proposal happen= ed 4 days >> ago. So it would probably be a mistake to bang out a draft and promote i= t >> to RFC.=E2=80=8B >> >> =E2=80=8BWhat I was most interested to know is if we had done the work a= lready >> and the answer appears to be not in PKIX=E2=80=8B but possibly in ACME. = It might >> just be that all we need to do is to add a few paragraphs to ACME and ma= ybe >> get an IANA content type for whatever the standalone message blob is. >> >> >> I do think we will need to standardize because we are almost certain to >> want to pop these blobs in our CT logs at some point and it is in any ca= se >> the right thing to do. One code path is always better than five code pat= hs >> offering the same functionality. >> > > It might be good to start with a Use Cases document first, to figure out > who the participants/constituents would be. This would align with Stephen= =E2=80=99s > remark re: what writers of private key handling s/w should use. Consideri= ng > such solutions naturally preclude solving (some of) the =E2=80=9Ccompromi= se=E2=80=9D > scenarios that must be dealt with today, the merits of those use cases > could be independently evaluated before trying to shape such work. > > I view the transparency aspect as similarly orthogonal - such transparenc= y > is more beneficial for demonstrating the private key holder authorized a > revocation. In today=E2=80=99s Web PKI, that is a real problem with CAs > unilaterally revoking for specious reasons (=E2=80=9Cmalware=E2=80=9D, = =E2=80=9Ccustomer stopped > paying monthly fee=E2=80=9D, =E2=80=9Cwe added a new domain name to the c= ustomer account=E2=80=9D) > or Resellers, often misguided, requesting revocation per the terms of the= ir > contract with the CA without regard to whether or not the Certificate > recipient desires it. > >> =E2=80=8BThe customer's credit card having been declined due to fraud or a chargeback for fraud is actually one of the most potent signs indicating that the certificate is likely to be used maliciously.=E2=80=8B --94eb2c1c1ce23dec0305668dbef1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Sat, Ma= r 3, 2018 at 1:34 PM, Ryan Sleevi <ryan-ietf@sleevi.com> = wrote:

On Sat, Mar 3, 2018 at 12:07 PM = Phillip Hallam-Baker <phill@hallambaker.com> wrote:
On Sa= t, Mar 3, 2018 at 1:29 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie><= /span> wrote:


On 02/03/18 22:33, Ryan Sleevi wrote:
> That's why I think an effort to standardize there is bad, not good= , because
> it counterintuitively fragments the ecosystem, without addressing the<= br> > general issue, which is in my view is moreso a matter of policy, becau= se of
> the inherent constraints of 2).

FWIW, I don't agree with your conclusion that *any* standardisat= ion
of revocation signals would be counter-productive, but I also don't
think we ought do any such standardisation unless there are a bunch
of CAs and writers of private key handling s/w who do in fact want
to use the same new format for revocation signalling. I don't see a
whole bunch of CAs and others wanting that right now.

So in the short term, I think we agree as to what to (not) do:-)

=E2=80=8BAt this= point, the incident that motivated this proposal happened 4 days ago. So i= t would probably be a mistake to bang out a draft and promote it to RFC.=E2= =80=8B

=E2=80=8BWhat I w= as most interested to know is if we had done the work already and the answe= r appears to be not in PKIX=E2=80=8B but possibly in ACME. It might just be= that all we need to do is to add a few paragraphs to ACME and maybe get an= IANA content type for whatever the standalone message blob is.=C2=A0
=

I do think we will need to standardiz= e because we are almost certain to want to pop these blobs in our CT logs a= t some point and it is in any case the right thing to do. One code path is = always better than five code paths offering the same functionality.

=
It might be good to start with a Use Cases document first= , to figure out who the participants/constituents would be. This would alig= n with Stephen=E2=80=99s remark re: what writers of private key handling s/= w should use. Considering such solutions naturally preclude solving (some o= f) the =E2=80=9Ccompromise=E2=80=9D scenarios that must be dealt with today= , the merits of those use cases could be independently evaluated before try= ing to shape such work.

= I view the transparency aspect as similarly orthogonal - such transparency = is more beneficial for demonstrating the private key holder authorized a re= vocation. In today=E2=80=99s Web PKI, that is a real problem with CAs unila= terally revoking for specious reasons (=E2=80=9Cmalware=E2=80=9D, =E2=80=9C= customer stopped paying monthly fee=E2=80=9D, =E2=80=9Cwe added a new domai= n name to the customer account=E2=80=9D) or Resellers, often misguided, req= uesting revocation per the terms of their contract with the CA without rega= rd to whether or not the Certificate recipient desires it.

=E2=80=8BThe customer's credit card= having been declined due to fraud or a chargeback for fraud is actually on= e of the most potent signs indicating that the certificate is likely to be = used maliciously.=E2=80=8B

--94eb2c1c1ce23dec0305668dbef1-- From nobody Sun Mar 4 12:21:47 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FADB126BFD; Sun, 4 Mar 2018 12:21:44 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.73.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152019490454.12045.16543923308268355959@ietfa.amsl.com> Date: Sun, 04 Mar 2018 12:21:44 -0800 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-eai-addresses-18.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Mar 2018 20:21:45 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Internationalized Email Addresses in X.509 certificates Authors : Alexey Melnikov Weihaw Chuang Filename : draft-ietf-lamps-eai-addresses-18.txt Pages : 11 Date : 2018-03-04 Abstract: This document defines a new name form for inclusion in the otherName field of an X.509 Subject Alternative Name and Issuer Alternative Name extension that allows a certificate subject to be associated with an Internationalized Email Address. This document updates RFC 5280. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-eai-addresses/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-eai-addresses-18 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-eai-addresses-18 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-eai-addresses-18 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Mar 4 12:23:27 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A988126C0F for ; Sun, 4 Mar 2018 12:23:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fastmail.fm header.b=wrauf96+; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Un99fptq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aL4XDaxHjvfg for ; Sun, 4 Mar 2018 12:23:20 -0800 (PST) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06E2E126BFD for ; Sun, 4 Mar 2018 12:23:20 -0800 (PST) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 22CB620AF7; Sun, 4 Mar 2018 15:23:19 -0500 (EST) Received: from web2 ([10.202.2.212]) by compute7.internal (MEProxy); Sun, 04 Mar 2018 15:23:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.fm; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=Te7azzr/YvyFK/NTuJ/kC4y1kgaS7 KXr8sIDwi6btcM=; b=wrauf96+VPfQS1U+A8yaFpOoWIl/CLpQNeTcv8DIdSVuv bDxzZZ86csTSu93QlZ7lh0eFUy7FxF8Pr5dnlnScGksVFiRawCxFsFFFNMduN4Nv cRJydiaxXMkeltVGDOlXsjtXM1i8iboqWTMp0z3zM98CyYxXFlyPrmIoqa34/sMb TcxMim6d13o92jPPyWoQ49ThruHRRtfYYrvVf7vQUuTVT+SG+iK0GpypfHy9iU0P EJQ0QE9GvG5Q6CQh4f6R9KD1+lfO9qge3N14QF+WkEE+X0D19NBUjj9gBzXASlat 5CxIJ/G4i00HX8RpjM7xNrH8ZrBOU47yYlF7h5xEg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=Te7azz r/YvyFK/NTuJ/kC4y1kgaS7KXr8sIDwi6btcM=; b=Un99fptqw71CfaccCFIsxS Q6L2eVx+Z4UQXwqVoZ0oolQ4Z26BbW84cZFubRdsB0MDkQ0UKZ7BpEZ1kgu5Hlqb Jqoumhn4WqsZM3djw3ovTbnSCs1tOHM6S/n1WkbcTV1eT975YxKUJRrkPFnJSXfI JdGi89xKBBgZJA/OjMntTyiKh+XWvBO0j9IyO1aNmIq+WL+21R6AhwXgbScMLWak vw+ddqAVUBQxxTRjlMsOYanlvwStCaQHGsRB2fFInA50tUhvtLSg3BKnQjGhUre4 qPZULpB6/OD2w7i08xASamN0aWTi24Z/k9q+jxF0MEd8fcS1ihdLELcKl6iROsuw == X-ME-Sender: Received: by mailuser.nyi.internal (Postfix, from userid 99) id F364F621BF; Sun, 4 Mar 2018 15:23:18 -0500 (EST) Message-Id: <1520194998.2690284.1291141184.711C6A7C@webmail.messagingengine.com> From: Alexey Melnikov To: Eric Rescorla , Russ Housley Cc: Suresh Krishnan , Wei Chuang , spasm@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary="_----------=_152019499826902840" X-Mailer: MessagingEngine.com Webmail Interface - ajax-b08ff009 Date: Sun, 04 Mar 2018 20:23:18 +0000 In-Reply-To: References: <151564026499.22453.4457143592887035396.idtracker@ietfa.amsl.com> <1515687117.1257366.1232046744.30F6CC88@webmail.messagingengine.com> <39EBFE0E-F7D5-4257-9254-CEC8D15C4435@kaloom.com> <1518431987.1831236.1267758584.2A4EF883@webmail.messagingengine.com> <31F17EFC-2DE2-4614-BAC7-6822E7C152C5@kaloom.com> Archived-At: Subject: Re: [lamps] Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Mar 2018 20:23:25 -0000 This is a multi-part message in MIME format. --_----------=_152019499826902840 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" Hi Ekr, On Sat, Feb 24, 2018, at 8:13 PM, Eric Rescorla wrote: > I tend to agree with Suresh that a reference here would help. Could we > just have something like> "See [] for more on security issues with Unicode" I've added the direct reference to [WEBER], as I think it is the most appropriate here. Best Regards, Alexey > > > On Fri, Feb 16, 2018 at 9:24 AM, Russ Housley > wrote:>> >>>> The document already covers that: >>>> >>>> 7. Security Considerations >>>> >>>> Use of SmtpUTF8Mailbox for certificate subjectAltName (and >>>> issuerAltName) will incur many of the same security >>>> considerations as in Section 8 in [RFC5280], but introduces a new >>>> issue by permitting non-ASCII characters in the email address local- >>>> part. This issue, as mentioned in Section 4.4 of [RFC5890] and >>>> in Section 4 of [RFC6532], is that use of Unicode introduces the >>>> risk of visually similar and identical characters which can be >>>> exploited to deceive the recipient. The former document >>>> references some means to mitigate against these attacks. >>>> >>>> I looked at RFC 6943. While it is a good document, I don't see an >>>> obvious way of referencing it. There is so much material there >>>> unrelated to Internationalization, so it is difficult to find a >>>> useful way of referencing it. If you have some specific >>>> suggestions, please let me know.>>> >>> I thought of putting in a reference to Section 4.2. of RFC6943 could >>> be useful especially since I personally found the reference to >>> [WEBER] there very useful to understand the potential attacks. That >>> said, maybe that is only because I am a total outsider to this space >>> and these could be well understood attacks in the community that is >>> the target of the draft. I am fine to proceed without adding a >>> reference. Thanks for checking to see if this is covered.>> >> Where are we in resolving this comment. It seems to be the only >> thing keeping this document from the RFC Editor Queue.>> >> >> Russ >> >> --_----------=_152019499826902840 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset="utf-8"
Hi Ekr,

On Sat, Feb 24, 2018, at 8:13 PM, Eric Rescorla wrote:
I tend to agree with Suresh that a reference here would help. Could we just have something like 
"See [] for more on security issues with Unicode"

I've added the direct reference to [WEBER], as I think it is the most appropriate here.

Best Regards,
Alexey



On Fri, Feb 16, 2018 at 9:24 AM, Russ Housley <housley@vigilsec.com> wrote:

The document already covers that:

7.  Security Considerations

  Use of SmtpUTF8Mailbox for certificate subjectAltName (and
  issuerAltName) will incur many of the same security considerations as
  in Section 8 in [RFC5280], but introduces a new issue by permitting
  non-ASCII characters in the email address local-part.  This issue, as
  mentioned in Section 4.4 of [RFC5890] and in Section 4 of [RFC6532],
  is that use of Unicode introduces the risk of visually similar and
  identical characters which can be exploited to deceive the recipient.
  The former document references some means to mitigate against these
  attacks.

I looked at RFC 6943. While it is a good document, I don't see an obvious way of referencing it. There is so much material there unrelated to Internationalization, so it is difficult to find a useful way of referencing it. If you have some specific suggestions, please let me know.

I thought of putting in a reference to Section 4.2. of RFC6943 could be useful especially since I personally found the reference to [WEBER] there very useful to understand the potential attacks. That said, maybe that is only because I am a total outsider to this space and these could be well understood attacks in the community that is the target of the draft. I am fine to proceed without adding a reference. Thanks for checking to see if this is covered.

Where are we in resolving this comment.  It seems to be the only thing keeping this document from the RFC Editor Queue.


Russ



--_----------=_152019499826902840-- From nobody Sun Mar 4 21:10:12 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8288F124235 for ; Sun, 4 Mar 2018 21:10:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=kaloom.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iqDzCJlP3VGD for ; Sun, 4 Mar 2018 21:10:08 -0800 (PST) Received: from CAN01-TO1-obe.outbound.protection.outlook.com (mail-eopbgr670106.outbound.protection.outlook.com [40.107.67.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F1AA124B0A for ; Sun, 4 Mar 2018 21:10:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kaloom.onmicrosoft.com; s=selector1-kaloom-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7BlLZvA9rNOGJj3rR//0lpIF546o+4ku2OGHbLrZplI=; b=ZQh3y7yoeBhMRACg+kFn/7RWjW6am5qsINEodEbDsQ2HACzNnqdDLgCPKN3asJKFYoBRvyqWDbadVzxgzR6qonYlxoh62cRE/VrUmG0dfw/sF98hVFWxdm/IveisXbSvYlZyCTgcLjavlsjgqk786EQ9Rm9+lNhcvQzi4pt7N3M= Received: from YQXPR0101MB2054.CANPRD01.PROD.OUTLOOK.COM (52.132.77.143) by YQXPR0101MB0887.CANPRD01.PROD.OUTLOOK.COM (52.132.76.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Mon, 5 Mar 2018 05:10:06 +0000 Received: from YQXPR0101MB2054.CANPRD01.PROD.OUTLOOK.COM ([fe80::a0a9:b971:1b66:bfc2]) by YQXPR0101MB2054.CANPRD01.PROD.OUTLOOK.COM ([fe80::a0a9:b971:1b66:bfc2%13]) with mapi id 15.20.0548.016; Mon, 5 Mar 2018 05:10:06 +0000 From: Suresh Krishnan To: Alexey Melnikov CC: Eric Rescorla , Russ Housley , "Wei Chuang" , "spasm@ietf.org" Thread-Topic: Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT) Thread-Index: AQHTivbpv1XskNCM9kSVrS36C/KQcaOgjUIAgAA4aoCAASDEgIAFmbWAgAzBqQCADJWHAIAAky+A Date: Mon, 5 Mar 2018 05:10:05 +0000 Message-ID: <0D8E22F8-F743-423D-BDBA-69C070DA49DB@kaloom.com> References: <151564026499.22453.4457143592887035396.idtracker@ietfa.amsl.com> <1515687117.1257366.1232046744.30F6CC88@webmail.messagingengine.com> <39EBFE0E-F7D5-4257-9254-CEC8D15C4435@kaloom.com> <1518431987.1831236.1267758584.2A4EF883@webmail.messagingengine.com> <31F17EFC-2DE2-4614-BAC7-6822E7C152C5@kaloom.com> <1520194998.2690284.1291141184.711C6A7C@webmail.messagingengine.com> In-Reply-To: <1520194998.2690284.1291141184.711C6A7C@webmail.messagingengine.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Suresh@kaloom.com; x-originating-ip: [45.19.110.76] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; YQXPR0101MB0887; 6:sZv8yULmXiTemgrBAswMurysCEgj1LdxtuDhXWv+lsrtmpAtPuraTKRwooqD29bboIxYON2+OCRrwC/bcNgNk7PbD3n9+OzY15DRCbTBlV1ypFwHrxh4BAFXKjgAeZT9KmV8GuGLWIxclicNLBLS6bDv79YfoxybK2cCspPxv+aCSpAX4mangBidlPwrTRhoneXytPy2Ffe9aO5A4Z2QZpVc5rrnkjigahk0BEUw6S7lKw73xQq/+44bSaI+IHJJX2KJduF5uNk8Rf3TauiZ8Yg9/jMx6JOr4yrjXDWUGcbK6oQm63YYHwSLjAQYTS0C2XKDrz59SU2rc9ceN0GlS+ojK3eN8wlC+0XdozFBcMOlQ5tSpViuFOG+zxp1IFCW; 5:4di2e6ITnn5NXQMdA+Mcgzfrr1V2KERh6kfAi4+DnVVvdjHVRn2hNc59tiQnJvwnkorzm+NRqDN7gdXB6L/j29nZIE9PB1kIE4rCgsEqY2l6eAt7pbxNkmlapo5NeZcnP3cjk0M3+Oig0CJTnvbs2uGvUU1EEcS24j41YoGQDMA=; 24:C/M2SZvWE8Cfv1DL+fUgYYO1cdab8WQnHAMAs+Wsfvjgwc0PzE+3huBzdGld6jt3kCZIzLpYzb3ScBwVSdzdjfvhZSoJ/aO8LHcf6lzEwy4=; 7:8ESxmZDyP0WLTEPP482Hy57+e9BWgbgTZILQeBFqzz2pzA6vl8KtGoXnOV5+a+SSk43CL0PIA20MsAVzJshZhrC43QimvuIRg9kWxXFNVkP13ciGY3/BHjzg4w+vJg4LbXj9BPyi3fw8cJ704TVD1m6hECs2c2RiTmdgQBumxumvemyLe1edZa+RJuCLzUMF4btGexooqZt3OfryTDyOJGKOoz7z8TszkL5jdORWEELDiopD9PmSyDBmZXkcMhth x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 00eabdc8-ac01-402f-2297-08d582575c18 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603307)(7153060)(7193020); SRVR:YQXPR0101MB0887; x-ms-traffictypediagnostic: YQXPR0101MB0887: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3231220)(944501244)(52105095)(3002001)(6041288)(20161123564045)(20161123562045)(20161123560045)(20161123558120)(2016111802025)(6072148)(6043046)(201708071742011); SRVR:YQXPR0101MB0887; BCL:0; PCL:0; RULEID:; SRVR:YQXPR0101MB0887; x-forefront-prvs: 06022AA85F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39830400003)(366004)(39380400002)(376002)(396003)(199004)(189003)(81156014)(236005)(81166006)(8676002)(8936002)(3846002)(4326008)(6116002)(8666007)(316002)(5660300001)(76176011)(106356001)(6916009)(5250100002)(25786009)(2950100002)(7736002)(6436002)(36756003)(53936002)(186003)(93886005)(3660700001)(2900100001)(6246003)(26005)(6512007)(14454004)(102836004)(72206003)(86362001)(478600001)(59450400001)(6486002)(6506007)(53546011)(105586002)(82746002)(229853002)(66066001)(97736004)(2906002)(3280700002)(83716003)(80792005)(54906003)(68736007)(33656002)(99286004)(54896002); DIR:OUT; SFP:1102; SCL:1; SRVR:YQXPR0101MB0887; H:YQXPR0101MB2054.CANPRD01.PROD.OUTLOOK.COM; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: kaloom.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: obRLlIbubm0TXGCSFugTMcReBU1k9KwT0kvGIXcB5f6/QgeS9NoPJSFMUNbHIDJxjI/QoH0B4tTNLaTy6I5HdhoijImDvMuh5Iy8D7iArQ0D0k6YrJI+YBDA9F5hwghgQgJiISwfIWzwhIj/hIKzGDkFBFXnMm5i8b6+R2y1kPtADLERp2NMA5K6qknBDgEMEwNxcqfXPvZXj1jrpUBAzZNbzKug33eM6uvvzIhHmbJGQO8qWIhcUgzewBaFIuznih3JURSkLi4wHBqKOnmNXjZJH/W+aGEqlgfuGxxDQykLI8nqEc3jlANqu9TAyvbUoIqX1Y523PfQFZla4Pa2kg== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_0D8E22F8F743423DBDBA69C070DA49DBkaloomcom_" MIME-Version: 1.0 X-OriginatorOrg: kaloom.com X-MS-Exchange-CrossTenant-Network-Message-Id: 00eabdc8-ac01-402f-2297-08d582575c18 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2018 05:10:06.0863 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 47d58e26-f796-48e8-ac40-1c365c204513 X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQXPR0101MB0887 Archived-At: Subject: Re: [lamps] Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 05:10:11 -0000 --_000_0D8E22F8F743423DBDBA69C070DA49DBkaloomcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable On Mar 4, 2018, at 3:23 PM, Alexey Melnikov > wrote: Hi Ekr, On Sat, Feb 24, 2018, at 8:13 PM, Eric Rescorla wrote: I tend to agree with Suresh that a reference here would help. Could we just= have something like "See [] for more on security issues with Unicode" I've added the direct reference to [WEBER], as I think it is the most appro= priate here. Sounds good to me. Thanks Suresh --_000_0D8E22F8F743423DBDBA69C070DA49DBkaloomcom_ Content-Type: text/html; charset="us-ascii" Content-ID: <59A219C7FEE863489F7EA6C4BCB895A9@CANPRD01.PROD.OUTLOOK.COM> Content-Transfer-Encoding: quoted-printable

On Mar 4, 2018, at 3:23 PM, Alexey Melnikov <aamelnikov@fastmail.fm> wr= ote:

Hi Ekr,

On Sat, Feb 24, 2018, at 8:13 PM, Eric Rescorla wrote:
I tend to agree with Suresh that a reference here would hel= p. Could we just have something like 
"See [] for more on security issues with Unicode"=

I've added the direct reference to [WEBER], as I think it is the most appro= priate here.

Sounds good to me.

Thanks
Suresh

--_000_0D8E22F8F743423DBDBA69C070DA49DBkaloomcom_-- From nobody Mon Mar 5 01:31:26 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 750EF126579 for ; Mon, 5 Mar 2018 01:31:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FK4FDtSEX8p0 for ; Mon, 5 Mar 2018 01:31:20 -0800 (PST) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A332912D96B for ; Mon, 5 Mar 2018 01:31:18 -0800 (PST) Received: from [216.82.242.36] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-9.bemta-8.messagelabs.com id 01/74-28689-56E0D9A5; Mon, 05 Mar 2018 09:31:17 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA2WTe0xTVxzHe+6jvWCvuRQcvyEaVjWZIFg0zps Zo/6hVpNFja+tceotXGljH9hbZpfFQGTzVQ2iGLA8qoYggkw0XSJBApIYYmVDUcGp+ECztYJR EaKwxXpv7/UV/zn5nN/3+3uck3MoXHdck0TxHjfvcnA2vTqWuJUSyEzPHl9pMpw88S1b/Lwcs ZEHYYI9dL8SsVU9WWxpS49mIWls8N5UG5t8fRrj1foRzFhdPYoZC5ubiZWkibQ6zE7PZtLSVt GK51at8/xVNLEAPVu1D8VSBPMMA+/+XrW00TElGFTfHMb3oRhxcx9BUVeexGrGAD0tHZjECcx aOFPbGWWcscKNe2NqieOZmdDc34DLHgP81hsgZXZAfU1FNE4wU8F/qDDqp5kNMNQ4gsuNq0jo K+6PFo1hVsHwn8eQxIj5Al4FTyvNEuH2Y3+UgUmAh9euqGWeAOFHb0jZvwEqX7YrcT38PnhX8 U+Cbr8XSc2ACWBwxOfXyEIG/FH8FMn8HZwcDSqmvRgEQldJWUiF86/bFNNWGDo7SMi8HCKdRb icEMKgqGCn0joZdj89pwj/kFB25o5yqdlQUteuloX/MBgpvY0fRKm+j87nEzWc8SO4tn+M8EV vKg4uH30sMiUKJih97Zb9qVC9M6KROQ1qjg/gMk+H4YN3iM/j86Bs7KJa5q+gxPtQyZ0DA5de oGNoXB36WuBdP/Gu9FmZGWaXNcfitnNWW3qmgc2w84LA5fA2zixkZDnt55D4OPNVKnQeNXUtb UdfUph+Ar1RW2nSjTc7s3+2cIJlkyvPxgvtKJmi9EAHaVGLc/E5vGeL1Sa+8HcyUFp9Ap0vpd JCLmcXrDmyFEQLqBul/+7CqUB/WFzbouut0MAuXEc4nA4+KZEul6oyUpolz/G+6Luf040mJcX TSKVS6bS5vMtudX+qP0GJFNLH0/OlKlqrw/2+9xNxLEwcq6uvQhrLzX2QkgrQHqZn4+BQ8Eqh 8XD3C4Pz1945y2YtHn2V3896yrZ/c+DHHavrT4Vm+FPWsELy9/XTluzwbnXW1M2evG2z73pTj LmwLTy/s2+UympgL8aaWlsbtbUpkQvhNc/zqSVpju6XHSs2tXRYAj9QkblTYv+f+Utk/d/6PY 1poeDuOG3tonDvOD0hWLjMVNwlcG8BiUHkujQEAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-5.tower-94.messagelabs.com!1520242276!179782060!1 X-Originating-IP: [216.32.180.49] X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 142119 invoked from network); 5 Mar 2018 09:31:16 -0000 Received: from mail-by2nam03lp0049.outbound.protection.outlook.com (HELO NAM03-BY2-obe.outbound.protection.outlook.com) (216.32.180.49) by server-5.tower-94.messagelabs.com with AES256-SHA256 encrypted SMTP; 5 Mar 2018 09:31:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=I/j22b7MOecY32XZBQQU1qhbBIuaVCoF0Um9hKYniKI=; b=J2uZGhYlEbwIGyIDfbxgZKn68GSeV57CNjNgAcM0HW8mm1ZuXJW/6Vkl9mBjc+46U4S4WX4dr7pd9dpZkQZZlQbVXhJqKtCnuVbDeb+sWj8TtHOn5dr9dBuar8lb1udSU+9JbgY0mx0NfjlMgn+Ux2XgGUVje5ggPPnJ+3jNbl4= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1151.namprd14.prod.outlook.com (10.173.101.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Mon, 5 Mar 2018 09:31:14 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0548.016; Mon, 5 Mar 2018 09:31:14 +0000 From: Tim Hollebeek To: Ryan Sleevi , Phillip Hallam-Baker CC: SPASM , Peter Bowen , Stephen Farrell Thread-Topic: [lamps] Revocation Request Format? Thread-Index: AQHTsjInSyN45zGu70muhef4KLLyqaO9HOwAgABBwICAAAPKgIAAEXSAgAAHYICAAA1TAIAAhPcAgACyZICAABgIAIACjFYA Date: Mon, 5 Mar 2018 09:31:14 +0000 Message-ID: References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1151; 7:nr/TVkxNKQN9F3eL3AmBp8GcLbaBg8mdWJxjOB5Sqr84I5A/HXAgJB31JTPMBjjC2ptVIMlAwU8IEnwtL7LqNdg1OJ+ncAjlulRu3IxQKLD6HT4LHUC+5obBj7YiNwDJYxfdmfU0k/ua2W86asj2GzhK6k/ou/076Pr49T7m9lBLOTSJNLFSAU7iLMvcYibsjoli3ykN4Rhnked0+sff1g8uuWlD68FReV5/c2O20SAwUOY76ViHiT5Lffu3q3pB x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 7deb1bcb-50a6-40d6-f1ce-08d5827bd736 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603307)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1151; x-ms-traffictypediagnostic: MWHPR14MB1151: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231220)(944501244)(52105095)(10201501046)(3002001)(6041288)(2016111802025)(20161123564045)(20161123562045)(20161123558120)(20161123560045)(6072148)(6043046)(201708071742011); SRVR:MWHPR14MB1151; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1151; x-forefront-prvs: 06022AA85F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(366004)(39380400002)(396003)(346002)(376002)(189003)(199004)(2906002)(110136005)(105586002)(229853002)(8676002)(2950100002)(81156014)(99936001)(54906003)(8936002)(81166006)(7736002)(106356001)(6246003)(6116002)(68736007)(33656002)(5660300001)(74316002)(3660700001)(39060400002)(5250100002)(25786009)(4326008)(53936002)(54896002)(9686003)(6306002)(3846002)(790700001)(6436002)(3280700002)(97736004)(55016002)(102836004)(6506007)(186003)(26005)(86362001)(478600001)(316002)(14454004)(93886005)(99286004)(2900100001)(7696005)(76176011)(66066001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1151; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: x+/B1Wqqkhwvr2g4NLJREKs1y4Lh6Iofqq8aRjbY2Yp9EYtJGiBuEqBXrESVl8SRTcQULiAFjWPrldoSW15iRcb5XaGM0Gdgx4sgS9ICTo86VGa63S2Ahdz+ZwOt2Y+g7lq7ReopmRHLLtLi4wfy69E+Wc07EgBMITTmxHxdcnTP3aweHRbZk5CP/MEkdYAp7zBdW07UwnWBqKVoHuzLKiAnvhNVl9eE0k1Y1TCpEIM4YCyxcxBTbrZGlcwExI5En3VVhwWi8LW1l/C0V74sLOuQoxHwordMQpFvgv1prZ57VAJ6eLiL2tQ2yK0B3p05z3UqtBTCAq3EM5Z0jRE6Og== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_048B_01D3B42A.06C3FCD0" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7deb1bcb-50a6-40d6-f1ce-08d5827bd736 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2018 09:31:14.4677 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1151 Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 09:31:22 -0000 ------=_NextPart_000_048B_01D3B42A.06C3FCD0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_048C_01D3B42A.06C3FCD0" ------=_NextPart_001_048C_01D3B42A.06C3FCD0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I agree with this. There=E2=80=99s no need to rush into anything as no = buildings are currently burning down, but some of the things people are = doing are slightly silly, and it would be worthwhile to come up with a = set of potentially non-silly things, and look at the = advantages/disadvantages of each. =20 It might be good to start with a Use Cases document first, to figure out = who the participants/constituents would be. This would align with = Stephen=E2=80=99s remark re: what writers of private key handling s/w = should use. Considering such solutions naturally preclude solving (some = of) the =E2=80=9Ccompromise=E2=80=9D scenarios that must be dealt with = today, the merits of those use cases could be independently evaluated = before trying to shape such work. =20 ------=_NextPart_001_048C_01D3B42A.06C3FCD0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

I agree = with this.=C2=A0 There=E2=80=99s no need to rush into anything as no = buildings are currently burning down, but some of the things people are = doing are slightly silly, and it would be worthwhile to come up with a = set of potentially non-silly things, and look at the = advantages/disadvantages of each.

 

It might be good to start = with a Use Cases document first, to figure out who the = participants/constituents would be. This would align with = Stephen=E2=80=99s remark re: what writers of private key handling s/w = should use. Considering such solutions naturally preclude solving (some = of) the =E2=80=9Ccompromise=E2=80=9D scenarios that must be dealt with = today, the merits of those use cases could be independently evaluated = before trying to shape such work.

 

------=_NextPart_001_048C_01D3B42A.06C3FCD0-- ------=_NextPart_000_048B_01D3B42A.06C3FCD0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzA1MDkzMTExWjAvBgkqhkiG9w0BCQQxIgQgAssCSQoPiUYv4NkjQ04vXCpZJC6d 1NSR8Dn8BzxsZQgwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBADgtdO0X8Yhn+PNsNm/097bRxavAe/VEH4vK66fyhtl0UztZ/aeatccI5J5DUqoC1N7aUPK7 +Z2lqSwYKFJdl38XhRUnq1FbP03BT63NPusKX6kV7IFfAq/hJaCAV4OsjBBnNJ8354rFh6RSxYL5 z2BveD2zQW5SRSUeqhrhR95LOQTlygFRULimUSOgEitYx8Z/IEGfF7dZy9jXRk9LXS7fIW51RYQx CJmHops92Cw3lyeuKeesNLdQQhX+43SGFGVZcwQx5SjErzUGdOp2zvTMast+d9c5HjcF6KbkC6rl 34/oO2cJ3oKn6h2t4ydDX1GxfavhClMX11z7j3nFECwAAAAAAAA= ------=_NextPart_000_048B_01D3B42A.06C3FCD0-- From nobody Mon Mar 5 02:49:46 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 848AD128954 for ; Mon, 5 Mar 2018 02:49:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W87CoYXLLOQ7 for ; Mon, 5 Mar 2018 02:49:43 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0509312783A for ; Mon, 5 Mar 2018 02:49:42 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B045DBE2E; Mon, 5 Mar 2018 10:49:39 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zHt8dDrW0xmo; Mon, 5 Mar 2018 10:49:39 +0000 (GMT) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B722ABE38; Mon, 5 Mar 2018 10:49:38 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1520246978; bh=hgf0DrO+fNzdGaZ1u531L5Iq+leFNhPpd8RmK8ISCns=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=sOHo5ivC2MJfbeMe6/Vf0AzgH0KzVx52/pLwYBxWJ6zJ8RbvBBoKrbJVn/TxDcTKt 9IflQSsse7h8cBMJlB1xWD0u6lT2IY3KpBmAt8yNTNDwln9NWjBwBvzDD9uuGAmQ+h LdPay+CJ9gO7x4f9AfoZs4bT4MwBSF9X95GJr56s= To: Tim Hollebeek , Ryan Sleevi , Phillip Hallam-Baker Cc: SPASM , Peter Bowen References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Message-ID: <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> Date: Mon, 5 Mar 2018 10:49:37 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="NlE8WphOKU1FvWA1syKbKNnl9nKGZxWau" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 10:49:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NlE8WphOKU1FvWA1syKbKNnl9nKGZxWau Content-Type: multipart/mixed; boundary="wiY7QmwTNS52PT4esLcS1Idcr6QxBkHM1"; protected-headers="v1" From: Stephen Farrell To: Tim Hollebeek , Ryan Sleevi , Phillip Hallam-Baker Cc: SPASM , Peter Bowen Message-ID: <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> Subject: Re: [lamps] Revocation Request Format? References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> In-Reply-To: --wiY7QmwTNS52PT4esLcS1Idcr6QxBkHM1 Content-Type: multipart/mixed; boundary="------------2F75740FDDDBE566889A9655" Content-Language: en-GB This is a multi-part message in MIME format. --------------2F75740FDDDBE566889A9655 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Coupla minor notes below... On 05/03/18 09:31, Tim Hollebeek wrote: > I agree with this. There=E2=80=99s no need to rush into anything as no= > buildings are currently burning down, but some of the things people > are doing are slightly silly, and it would be worthwhile to come up > with a set of potentially non-silly things, and look at the > advantages/disadvantages of each. >=20 >=20 >=20 > It might be good to start with a Use Cases document first, to figure > out who the participants/constituents would be.=20 I'm not convinced that a use-cases document/draft would be useful, just on the basis that, in the IETF context, those often tend to produce text that ends up ignored (or OBE). But if someone has the interest and cycles to write such text, then that's up to them and maybe it'd be useful in this case, not sure. When it exists, I guess I'd read it. > This would align with > Stephen=E2=80=99s remark re: what writers of private key handling s/w s= hould > use.=20 I think s/should use/would use/ is more in line with what I meant to say, both for CAs and those writing/using private key handling s/w. Put another way, there's a lot of things we could say such folks "should" do, but there's little point in doing so unless they would actually do stuff. Cheers, S. > Considering such solutions naturally preclude solving (some of) > the =E2=80=9Ccompromise=E2=80=9D scenarios that must be dealt with toda= y, the merits > of those use cases could be independently evaluated before trying to > shape such work. >=20 >=20 >=20 >=20 --------------2F75740FDDDBE566889A9655 Content-Type: application/pgp-keys; name="0x7B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x7B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------2F75740FDDDBE566889A9655-- --wiY7QmwTNS52PT4esLcS1Idcr6QxBkHM1-- --NlE8WphOKU1FvWA1syKbKNnl9nKGZxWau Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJanSDCAAoJEFqy+vF7FyvqWh8P/3Us2D7HVIN0uZ7gMkwzfLLe BooC5Ml2ixJT16yY4zH2+7pq+1GNVdZp8hWmm37xJO4kJ6MzLub6TOIWBVqHvnfj +21tl7Yf96KZ6tLziKfLNUNIeyfpTHcBH6+JMbOBrrtw4984XWSEiwxgcmwcWn43 Fj6/V2I2YoNGjuwdPWjOX5b0zKPAJ2+LHd1Q2H/BelurlYgBbIQsHULQl/jmviOS 8S+RfdaOgEYeAkWVVz4vGspm61Lf9UvQyoOPLcIlX64CH8VRlMmb9Al7i0HY51Ex 0MmvZFEk8MZavBdSDgT8ewCS7EFQmHAApwviNDd8FtPxFHlCHL1v1aK2kTFryEBc h9qKGvaAyootcEMtBU0HFu5Yrm79pYW4OQvxEwprKK6R0YaIFM9xjP1fNlYCQEgN QkNqvQ9qR5IBi+QPZrx/LQv0krb9VfXfA8VhKU1erOoOYtdf249Ha9bEU68nga7F 03UvXBWa0qoDQNteNrERptJFLnNH4UGh4Ghm+C8qLPr6nkqkN8B5AUd8mOMipGiz lpbR8WGEnEC4LIFGg4smmSnK0q84FOpHh+d+2hGk7Bq4dEQaWNCp4D5o9E0jhk6o Fo1nA/yeD9KdwX8LZKU1FMh8GLz9KPPjfMQ6iTTnDBUoIaDglX9NwQU9CYDF6Q9k QHWgnFQf6J747JXrnnHb =+nK8 -----END PGP SIGNATURE----- --NlE8WphOKU1FvWA1syKbKNnl9nKGZxWau-- From nobody Mon Mar 5 05:50:14 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD47412D86F for ; Mon, 5 Mar 2018 05:50:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TvCs6n3ejAg3 for ; Mon, 5 Mar 2018 05:50:06 -0800 (PST) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C89D12D878 for ; Mon, 5 Mar 2018 05:50:01 -0800 (PST) Received: from [216.82.241.100] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-16.bemta-8.messagelabs.com id B3/C7-10703-70B4D9A5; Mon, 05 Mar 2018 13:49:59 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WTaUzTYBjHfdtu65CZMlAeCYguJsQpk2GMM8b E48vikfhJDcGjk8IWt0LWYWYkSpigggZRERxMjE7jAQpGHYRg4hRBCDpApzEi4oETnEeIB2jE dh0e/dD8nvf/f46+fV8SV36VxpGM3cZYWdqskkYQDzRnNiTLVrvSUlq65LqyT1VIN/7iHaE70 u9CupP+bbqKFr9smURfV/JIqm9y9sn0vktfML3bPYrpHc3NxDpJmsTEGrLtWyXGRsdXIsez2O 4fzCfy0QFdMYogCeojBqW+RzIhUFLlGLQ1/8TEoB9B6e1yPpCTUioF/C1tISGGKkDgdHySCQJ OLQFfqztkiqbmQ/PLOlzgGD6h8PE1ici74WVwQCowQc2GG1VHCYEVVDo8/OIJtz4thdY37SFB Ti2Flq7CUANETYNvHbWY2CwWnr6uCTFQMTDQ3SkVeSq8e/VLIvrTwTXiDa+r4PL7Z2F/AvTUl CChGVB+GTQeOYtEQQPXy4I8kzyvBZfHLnoOYPC06jsurqvB65GL9u1wZ6QuXF8N++84w/UDGD Q0zBM5HvYFr+JinV4JnC8YDpmUVAYcuzgx3A8M+quWH0Zq5z/f5uRzcKqG3/qybuQM7VIU3Dv xmhBNanAXjMtETgRPsBp3hv9C5dgtqciz4FjJQNizEIZbP6NTiLyIkjjGuoOxJqdqDFZTltFm oU3mZG2KTmNhOI7OYsy0gdNsy7ZcRfy5m8Q/jWj05wovmk5iqqmKzZGuNOUUQ3bGTiPNGbdYc 80M50XxJKkCBbuK16KsTBZjzzSZ+cM7IQMZqYpRYIKs4HJoC2fKEqUOtJi8VvG2CCedVwL8+0 lguAhXEmw2y8TFKvKFBEpIMOayf8pNXIcelBAXrUD8gMrIHMZqMdn+14dQLIlU0YpCoUqkibX 96TrED4TxAz3oqxYGstF/pbh8lLGoMu873pTHns7sWjhfWVtv9m6MdvekR0wuaNh1f7TSvoa6 sDaY507djRUmVgze0x4c6NOe25sMJXsSUzfFruz9ePJuZ2dH/aKZc/Y4zj/3racTZnjX0Emw6 8264+yk8dJpnpS5TwLt5Q6i+PMC3+BY9aFDjr4mOnf9mZEPNzNtKoIz0lo1buXo36pwOisJBA AA X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-2.tower-220.messagelabs.com!1520257798!179680002!1 X-Originating-IP: [207.46.163.87] X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9965 invoked from network); 5 Mar 2018 13:49:59 -0000 Received: from mail-bl2nam02lp0087.outbound.protection.outlook.com (HELO NAM02-BL2-obe.outbound.protection.outlook.com) (207.46.163.87) by server-2.tower-220.messagelabs.com with AES256-SHA256 encrypted SMTP; 5 Mar 2018 13:49:59 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=I5YAuQvw3aodjbsGBgWimeupB2aEVRkLHhQr8OUVy2g=; b=d7Kqvw9OdaOTgYM+tWjbQU6L1yLRwls5fGfZ+/hfyw9pc/HItRh2iJHPWI0bkhNKE/apZ00U+OWGky3Z76KL2p6q6K4/r8+uszvajaLIwS1OrhmaP+2QBjoSGT36ArW3zfqcqzxUbsmEkgQjW4K3hGBo2unixn5yCHCk2nBVrNg= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1392.namprd14.prod.outlook.com (10.173.232.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.548.13; Mon, 5 Mar 2018 13:49:56 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0548.016; Mon, 5 Mar 2018 13:49:56 +0000 From: Tim Hollebeek To: Stephen Farrell , Ryan Sleevi , Phillip Hallam-Baker CC: SPASM , Peter Bowen Thread-Topic: [lamps] Revocation Request Format? Thread-Index: AQHTsjInSyN45zGu70muhef4KLLyqaO9HOwAgABBwICAAAPKgIAAEXSAgAAHYICAAA1TAIAAhPcAgACyZICAABgIAIACjFYAgAAWlICAADImYA== Date: Mon, 5 Mar 2018 13:49:56 +0000 Message-ID: References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> In-Reply-To: <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1392; 6:HC9GG169Qp21IjU/DzBl3g6S/O+4PcKAyRQFbkZKK5l7gKhD7/eOPIHe5SEZ0wPiOEqf4VOuu8ML2sITiZGd0ysIc5P3+GgMeQhGXJ6DuYj0pQkJq5dxMH9DQI+8OQ+cKs51dw0uX2tb8fs3G7wHr/9tKBG7ydifb4JVwI6+qoS1kekTa2mnDhCPJg8zIuzyKUvsGwhyH4UgUs42vTK/U+iau2KKCXTvtlFQXD4IQLvbtdk2u+nWfyxvN3Zmglo2AkWg32KPCTZJqtuG36GwKSqFMCN/Qih0Flhh3Vmy4YioHqTom+v/mI5y3cPxeXcEQUaxW17ZikNmdxov1kp7tH+W25T8oJbSqlAG/0AO1CmBSV3S8PQZEro0DS3vg1Cw; 5:qSbC0OczmJlovNtKpRp2nJBgZ+mkADAZR2vLQGN5SyxaWAP3ZSNTTCf5FVTBKgUfdcUy6YosUCqIaqPepyCB8RIRNtGOJvj/lQ+WZrUf3nyl7ka8gPlTNnsiNL9ofA8b8kE5pXJM1ZlUZaV4MV8NlK/sAtDAGhKuCY4I601Ezwg=; 24:cjuekw6cW9EPdesQ8E3eYnyHtcPE14LMYE3hjD1Bu88tcergmGCzG8l9AeOZ911yCGJGVkNDihx+efHx+X7CH9hl/LfF+7tt+gdZhplyYm4=; 7:PhwshZCgwlCUwHR5IF+/BE8suQi34RauybwVeHvdeAk2qkc7TVpu1muhmMNqLvFPMs6i/TKm4Y5Ly9XNxrCYFPj7nPXsK+IHR8lL8cOZ5bQtn0d3lebDigqL/2AxAoL2sYrGq0KPPlZa3QwxuF9Rx+bMCMBVo89FTapimNSY4kfbWYxS4egYhvxv8dxjzDmsogf+ZLS+oBukTpzgrh9lB0Crmtf5S8UUmRPiRmaOB88HBJQ2YfG3ILO+hxSoPKMw x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 59aa3c2f-cdfe-4c23-f5d7-08d5829ffb43 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(7021125)(5600026)(4604075)(3008032)(4534165)(7022125)(4603075)(4627221)(201702281549075)(7048125)(7024125)(7027125)(7028125)(7023125)(2017052603307)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1392; x-ms-traffictypediagnostic: MWHPR14MB1392: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3231220)(944501244)(52105095)(3002001)(6041288)(20161123564045)(20161123562045)(20161123560045)(20161123558120)(2016111802025)(6072148)(6043046)(201708071742011); SRVR:MWHPR14MB1392; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1392; x-forefront-prvs: 06022AA85F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(396003)(376002)(39860400002)(39380400002)(189003)(199004)(68736007)(6116002)(3660700001)(8676002)(5660300001)(54906003)(14454004)(7696005)(66066001)(55016002)(76176011)(81166006)(478600001)(81156014)(9686003)(74316002)(5250100002)(316002)(3846002)(305945005)(7736002)(39060400002)(2950100002)(106356001)(97736004)(4326008)(25786009)(93886005)(186003)(99286004)(8936002)(3280700002)(2900100001)(6246003)(6506007)(6436002)(33656002)(110136005)(105586002)(99936001)(102836004)(86362001)(26005)(229853002)(2906002)(53936002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1392; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 1HfR8IMoeEImHrX9SOtA0ixbcCMRZMZUIzvbFh0WkUB1kJJP8aQG9TEJH3LSwZrSucOtjr+T53BHEHZd42P+CwpfIGpyV5lWnUXuCujhqWsHQbh2NKT/oGTUdekApm0KUor/GP+VbfoFgSbhqQZCFHLAywPz//2lY6lBbRTLuFAicJg1z3Hw6jY1SfWF1RFyvm2PPYH7CujP2NSjpq/lOoCcjkqD4xIx/ZxRGmKdnQSlK6bH6sARPYOgs2C+oswP8o7/loGoeIpogPuEZ49M5YWP1SZOPD+eqQsOmLaR17fkbZOpQVZqUCr/rUWrI+SB2OqmNX+DGvq1aVe1aLCCzw== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_04A2_01D3B44E.2AE202A0" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 59aa3c2f-cdfe-4c23-f5d7-08d5829ffb43 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2018 13:49:56.7864 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1392 Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 13:50:12 -0000 ------=_NextPart_000_04A2_01D3B44E.2AE202A0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit > Put another way, there's a lot of things we could say such folks "should" > do, but > there's little point in doing so unless they would actually do stuff. I can state with high confidence that at least one CA would follow the best practices in this area, once we actually figure out what they are ... -Tim ------=_NextPart_000_04A2_01D3B44E.2AE202A0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzA1MTM0OTU0WjAvBgkqhkiG9w0BCQQxIgQguydFSUModYEVNsO5ZVs34EUN2D8G SYhb4BD1UgKBhtowgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAJu2Do2w8EPCyNFkAoF69poM4VyoxCwmEdRYDyRzO95z24ZzuwmzwDMnGJqAc7lJmCgwadV0 YOl57GFVQyrw58bGOANMGqX7XJ5sNhDWGiTHHOE5Jfw8p4Q5eXDxOQCYPyFMJQDvO1erC6RozRvf idhRSx2cOHZdEzwdaXsyrfg+X/ifdaLVKa3brH9CmIZ04NVqPMEQkobLCBgpTE59k+tT01l84Vul 2vEkm8o4X6JmgEyQoVxJRI3BC8EmMBfy2Eiybch+nWIu2d8VhnK9z0Snea2rBr+3WAp17LX4kIgw I4+VlJOGUo64jiTIq94QxD8yTrLWfijhLevJZ9Goa68AAAAAAAA= ------=_NextPart_000_04A2_01D3B44E.2AE202A0-- From nobody Mon Mar 5 06:26:17 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B26E12D80F for ; Mon, 5 Mar 2018 06:26:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MItvxh8GIOrE for ; Mon, 5 Mar 2018 06:26:13 -0800 (PST) Received: from homiemail-a108.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 741CA1270AB for ; Mon, 5 Mar 2018 06:26:03 -0800 (PST) Received: from homiemail-a108.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a108.g.dreamhost.com (Postfix) with ESMTP id C59A120047618 for ; Mon, 5 Mar 2018 06:26:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=WHxvihJ6WRbMYWHW/O0oTb0sAWg=; b= h2ABgR54jVmqT2oDXY4XkKXMNKzynMJc8F10ZsQSq1knb1DW3y7qqA8Ce0W3xzC2 w5WRUHeOLNXdOQFR3LhDqTA+3Sr6DOTSWPg5X152R9B6jCyNJCvZNMjrnol9cn8i ssCbtJWSZRMC3QNqAlmVqC4IkH1dyOewoPYy1HrbcOg= Received: from mail-io0-f178.google.com (mail-io0-f178.google.com [209.85.223.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a108.g.dreamhost.com (Postfix) with ESMTPSA id B62CD20047613 for ; Mon, 5 Mar 2018 06:26:02 -0800 (PST) Received: by mail-io0-f178.google.com with SMTP id v6so18146807iog.7 for ; Mon, 05 Mar 2018 06:26:02 -0800 (PST) X-Gm-Message-State: APf1xPDBAWVZmBwk2aY7BMPn8n3/i+qA9UEwMGUWTa7xfmrUnntmevzP HDmmYPMsCDErplNxf9k3F18NmwEVfvakembrdTI= X-Google-Smtp-Source: AG47ELvhAWWrnKz4FJ1yrDu5lFwW7/vvnLcODbs8VHOf4AmD7+wwkaKQJyBF6K9JZiVHEr/R6nwCVBfw5X+4tCl60hE= X-Received: by 10.107.70.14 with SMTP id t14mr16894137ioa.281.1520259961994; Mon, 05 Mar 2018 06:26:01 -0800 (PST) MIME-Version: 1.0 Received: by 10.2.105.214 with HTTP; Mon, 5 Mar 2018 06:26:01 -0800 (PST) In-Reply-To: <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> References: <26f237b9-bbe6-6efe-2a43-394d44e8334c@cs.tcd.ie> <62156108-02c7-054e-1311-855636e3fb52@cs.tcd.ie> <08fe3fa3-563a-3f5d-47ed-0197bce568b5@cs.tcd.ie> From: Ryan Sleevi Date: Mon, 5 Mar 2018 09:26:01 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Stephen Farrell Cc: Tim Hollebeek , Ryan Sleevi , Phillip Hallam-Baker , SPASM , Peter Bowen Content-Type: multipart/alternative; boundary="089e0828610000450f0566ab1b44" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 14:26:16 -0000 --089e0828610000450f0566ab1b44 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Mar 5, 2018 at 5:49 AM, Stephen Farrell wrote: > > Coupla minor notes below... > > On 05/03/18 09:31, Tim Hollebeek wrote: > > I agree with this. There=E2=80=99s no need to rush into anything as no > > buildings are currently burning down, but some of the things people > > are doing are slightly silly, and it would be worthwhile to come up > > with a set of potentially non-silly things, and look at the > > advantages/disadvantages of each. > > > > > > > > It might be good to start with a Use Cases document first, to figure > > out who the participants/constituents would be. > > I'm not convinced that a use-cases document/draft would be useful, > just on the basis that, in the IETF context, those often tend to > produce text that ends up ignored (or OBE). But if someone has the > interest and cycles to write such text, then that's up to them and > maybe it'd be useful in this case, not sure. When it exists, I guess > I'd read it. > Yeah, apologies, document was a bit to overloaded a term in the IETF sense :) I meant that because this problem space is broad, and because the original motivation (Trustico) isn't really addressed by yet-another-format, in order to have discussion about the value of a format, we should try to figure out what problem(s) trying to be addressed. I tried to offer one ontology - revocation for non-compromise (certificate lifecycle management), revocation for compromise by 1P (certificate lifecycle management), revocation for compromise by 3P (incident reporting). In that final category, I tried to distinguish types of compromise (disclosure of private key vs signing oracle), and the policy implications related to incident response. While the original framing was posed as 1P, the facts available at the time of initial post identified it was 3P - although the requestor in that incident viewed is as a revocation request for non-compromise. Identifying the problems trying to be solved would help identify whether they are already addressed in other specs (e.g. ACME's definition of the CLM interfaces), or whether there are unaddressed needs, and for what cases= . While I don't think that deserves formal publication, it does seem to benefit from having a shared vocabulary for the problems - much like the W3C WICG's notion of "Explainers" that try to define the problem and demonstrate the solution, but are not themselves standardized - they're just used to help ensure productive discussion of the spec. --089e0828610000450f0566ab1b44 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Mar 5, 2018 at 5:49 AM, Stephen Farrell <<= a href=3D"mailto:stephen.farrell@cs.tcd.ie" target=3D"_blank">stephen.farre= ll@cs.tcd.ie> wrote:

Coupla minor notes below...

On 05/03/18 09:31, Tim Hollebeek wrote:
> I agree with this.=C2=A0 There=E2=80=99s no need to rush into anything= as no
> buildings are currently burning down, but some of the things people > are doing are slightly silly, and it would be worthwhile to come up > with a set of potentially non-silly things, and look at the
> advantages/disadvantages of each.
>
>
>
> It might be good to start with a Use Cases document first, to figure > out who the participants/constituents would be.

I'm not convinced that a use-cases document/draft would be usefu= l,
just on the basis that, in the IETF context, those often tend to
produce text that ends up ignored (or OBE). But if someone has the
interest and cycles to write such text, then that's up to them and
maybe it'd be useful in this case, not sure. When it exists, I guess I'd read it.

Yeah, apologies, docum= ent was a bit to overloaded a term in the IETF sense :) I meant that becaus= e this problem space is broad, and because the original motivation (Trustic= o) isn't really addressed by yet-another-format, in order to have discu= ssion about the value of a format, we should try to figure out what problem= (s) trying to be addressed.

I tried to offer one o= ntology - revocation for non-compromise (certificate lifecycle management),= revocation for compromise by 1P (certificate lifecycle management), revoca= tion for compromise by 3P (incident reporting). In that final category, I t= ried to distinguish types of compromise (disclosure of private key vs signi= ng oracle), and the policy implications related to incident response. While= the original framing was posed as 1P, the facts available at the time of i= nitial post identified it was 3P - although the requestor in that incident = viewed is as a revocation request for non-compromise.

<= div>Identifying the problems trying to be solved would help identify whethe= r they are already addressed in other specs (e.g. ACME's definition of = the CLM interfaces), or whether there are unaddressed needs, and for what c= ases.

While I don't think that deserves formal= publication, it does seem to benefit from having a shared vocabulary for t= he problems - much like the W3C WICG's notion of "Explainers"= that try to define the problem and demonstrate the solution, but are not t= hemselves standardized - they're just used to help ensure productive di= scussion of the spec.
--089e0828610000450f0566ab1b44-- From nobody Mon Mar 5 06:51:25 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51E06127337 for ; Mon, 5 Mar 2018 06:51:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yt3RNEnwiaws for ; Mon, 5 Mar 2018 06:51:21 -0800 (PST) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C7E712711D for ; Mon, 5 Mar 2018 06:51:21 -0800 (PST) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip1.isaracorp.com with ESMTP; 05 Mar 2018 14:57:54 +0000 Received: from mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) by mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Mon, 5 Mar 2018 09:51:14 -0500 Received: from mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f]) by mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f%12]) with mapi id 15.00.1044.021; Mon, 5 Mar 2018 09:51:14 -0500 From: Alexander Truskovsky To: Russ Housley , SPASM Thread-Topic: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 Thread-Index: AQHTrAmBaflTdAee7Eau/gq/BYxt66PByr0A Date: Mon, 5 Mar 2018 14:51:14 +0000 Message-ID: <7B204A35-12E5-48DD-BC73-870EC0E289A8@isara.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.5.17.39] Content-Type: text/plain; charset="utf-8" Content-ID: <7860D4BA5692024096812AE63D1742AB@isaracorp.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 14:51:23 -0000 SGVsbG8gYWxsLA0KDQpJ4oCZdmUgdXBsb2FkZWQgYSBwcm9wb3NlZCBkcmFmdCBvbiBwcSBoeWJy aWQgeDUwOSBjZXJ0aWZpY2F0ZXMsIGJ1dCBoYXZlbuKAmXQgc2VlbiBhbnkgbm90aWZpY2F0aW9u cyBvbiB0aGUgbWFpbGluZyBsaXN0Lg0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2Mv ZHJhZnQtdHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJyaWQteDUwOS8NCg0KSSB3YXMgd29uZGVyaW5n IGlmIHRoZXJlIGlzIGFueSB0aW1lIGF2YWlsYWJsZSB0byBicmllZmx5IHByZXNlbnQgaXQgZHVy aW5nIHRoZSBMQU1QUyBzZXNzaW9uLg0KDQpSZWdhcmRzLA0KQWxleA0KDQoNCu+7v09uIDIwMTgt MDItMjIsIDE6MTggUE0sICJTcGFzbSBvbiBiZWhhbGYgb2YgUnVzcyBIb3VzbGV5IiA8c3Bhc20t Ym91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgaG91c2xleUB2aWdpbHNlYy5jb20+IHdyb3Rl Og0KDQogICAgUGxlYXNlIHJldmlldyBhbmQgY29tbWVudC4NCiAgICANCiAgICBUaGUgYXV0aG9y cyB0ZWxsIG1lIHRoYXQgdGhlcmUgd2lsbCBiZSBhbiBJbnRlcm5ldC1EcmFmdCBmb3IgcmZjNjg0 NGJpcyBiZWZvcmUgdGhlIGN1dC1vZmYgZGF0ZSBmb3IgSUVURiAxMDEuDQogICAgDQogICAgUnVz cw0KICAgIA0KICAgID0gPSA9ID0gPSA9ID0gPSA9ID0NCiAgICANCiAgICBMQU1QUyBXRyBBZ2Vu ZGENCiAgICANCiAgICAwKSAgTWludXRlIFRha2VyLCBKYWJiZXIgU2NyaWJlLCBCbHVlc2hlZXRz DQogICAgMSkgIEFnZW5kYSBCYXNoDQogICAgMikgIERvY3VtZW50cyBpbiB0aGUgUkZDIEVkaXRv cidzIFF1ZXVlDQogICAgICAgIGEpICBkcmFmdC1pZXRmLWxhbXBzLXJmYzUyODAtaTE4bi11cGRh dGUNCiAgICAgICAgYikgIGRyYWZ0LWlldGYtbGFtcHMtZWFpLWFkZHJlc3Nlcw0KICAgIDMpICBE b2N1bWVudHMgdGhhdCBoYXZlIGJlZW4gc2VudCB0byB0aGUgSUVTRw0KICAgICAgICBhKSAgZHJh ZnQtaWV0Zi1sYW1wcy1yZmM1NzUwLWJpcyAoSmltKQ0KICAgICAgICBiKSAgZHJhZnQtaWV0Zi1s YW1wcy1yZmM1NzUxLWJpcyAoSmltKQ0KICAgIDQpICBBY3RpdmUgV29ya2luZyBHcm91cCBEb2N1 bWVudHMNCiAgICAgICAgYSkgIHJmYzY4NDRiaXMgKEphY29iIGFuZCBQaGlsbGlwKQ0KICAgICAg ICBiKSAgZHJhZnQtaWV0Zi1sYW1wcy1wa2l4LXNoYWtlIChQYW5vcyBhbmQgUXV5bmgpDQogICAg ICAgIGMpICBkcmFmdC1pZXRmLWxhbXBzLWNtcy1zaGFrZXMgKFF1eW5oIGFuZCBQYW5vcykNCiAg ICA1KSAgV3JhcCBVcA0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQogICAgU3Bhc20gbWFpbGluZyBsaXN0DQogICAgU3Bhc21AaWV0Zi5v cmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtDQogICAg DQoNCg== From nobody Mon Mar 5 08:38:00 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0BE81270AC for ; Mon, 5 Mar 2018 08:37:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ywEW5iX3zb9p for ; Mon, 5 Mar 2018 08:37:56 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C9B51201F8 for ; Mon, 5 Mar 2018 08:37:55 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 188EF3005A4 for ; Mon, 5 Mar 2018 11:37:53 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 3UOAhlYHpv4p for ; Mon, 5 Mar 2018 11:37:51 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 3B7F63004D7; Mon, 5 Mar 2018 11:37:51 -0500 (EST) From: Russ Housley Message-Id: <89A63BBA-F47F-4945-8686-7E38C83F8C89@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_708FD8BC-5D43-4A2D-8052-F256DB4A3A07" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 5 Mar 2018 11:38:02 -0500 In-Reply-To: Cc: SPASM To: Phillip Hallam-Baker References: <1153EA1D-5A6C-4EFB-86F5-8DAD45D64909@akamai.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 16:37:59 -0000 --Apple-Mail=_708FD8BC-5D43-4A2D-8052-F256DB4A3A07 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I am willing to add an "if time permits" section to the agenda. The = topics that are part of the WG charter must take priority. Russ > On Mar 2, 2018, at 10:18 AM, Phillip Hallam-Baker = wrote: >=20 > If there is time, I would like to propose an AOB related to the = Trustico incident: Should we add a revocation request message to the = PKIX message set.=20 >=20 > Or do we have one and I have forgotten about it? >=20 > On Thu, Feb 22, 2018 at 1:19 PM, Salz, Rich > wrote: > b) draft-ietf-lamps-pkix-shake (Panos and Quynh) > c) draft-ietf-lamps-cms-shakes (Quynh and Panos) >=20 > Frick and Frack. > Frack and Frick. >=20 > Ha. >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm = >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --Apple-Mail=_708FD8BC-5D43-4A2D-8052-F256DB4A3A07 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
I am willing to add an "if time permits" = section to the agenda.  The topics that are part of the WG charter = must take priority.

Russ

On Mar 2, 2018, at 10:18 AM, = Phillip Hallam-Baker <phill@hallambaker.com> wrote:

If = there is time, I would like to propose an AOB related to the Trustico = incident: Should we add a revocation request message to the PKIX message = set. 
Or do we have one and I have forgotten about = it?

On Thu, Feb 22, 2018 at 1:19 PM, Salz, Rich <rsalz@akamai.com> wrote:
  =       b)  draft-ietf-lamps-pkix-shake (Panos and = Quynh)
        c)  draft-ietf-lamps-cms-shakes (Quynh = and Panos)

Frick and Frack.
Frack and Frick.

Ha.


_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

_______________________________________________
Spasm = mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

= --Apple-Mail=_708FD8BC-5D43-4A2D-8052-F256DB4A3A07-- From nobody Mon Mar 5 08:40:16 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB12A12D879 for ; Mon, 5 Mar 2018 08:40:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nJMNWi8zkR6O for ; Mon, 5 Mar 2018 08:40:11 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D2B61270AC for ; Mon, 5 Mar 2018 08:40:11 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 4205F3005A4 for ; Mon, 5 Mar 2018 11:40:09 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id t9LD_x8GLNvD for ; Mon, 5 Mar 2018 11:40:08 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id F03BB300425; Mon, 5 Mar 2018 11:40:07 -0500 (EST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Russ Housley In-Reply-To: <7B204A35-12E5-48DD-BC73-870EC0E289A8@isara.com> Date: Mon, 5 Mar 2018 11:40:18 -0500 Cc: SPASM Content-Transfer-Encoding: quoted-printable Message-Id: References: <7B204A35-12E5-48DD-BC73-870EC0E289A8@isara.com> To: Alexander Truskovsky X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 16:40:13 -0000 Alex: Maybe. I am willing to add an "if time permits" section to the agenda. = The topics that are part of the WG charter must take priority. Topics = that have been discussed on the mail list will be placed on the agenda = before ones that have not been discussed.=20 Russ > Alexander Truskovsky wrote: >=20 > Hello all, >=20 > I=E2=80=99ve uploaded a proposed draft on pq hybrid x509 certificates, = but haven=E2=80=99t seen any notifications on the mailing list. > = https://datatracker.ietf.org/doc/draft-truskovsky-lamps-pq-hybrid-x509/ >=20 > I was wondering if there is any time available to briefly present it = during the LAMPS session. >=20 > Regards, > Alex >=20 >=20 > =EF=BB=BFOn 2018-02-22, 1:18 PM, "Spasm on behalf of Russ Housley" = wrote: >=20 > Please review and comment. >=20 > The authors tell me that there will be an Internet-Draft for = rfc6844bis before the cut-off date for IETF 101. >=20 > Russ >=20 > =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D >=20 > LAMPS WG Agenda >=20 > 0) Minute Taker, Jabber Scribe, Bluesheets > 1) Agenda Bash > 2) Documents in the RFC Editor's Queue > a) draft-ietf-lamps-rfc5280-i18n-update > b) draft-ietf-lamps-eai-addresses > 3) Documents that have been sent to the IESG > a) draft-ietf-lamps-rfc5750-bis (Jim) > b) draft-ietf-lamps-rfc5751-bis (Jim) > 4) Active Working Group Documents > a) rfc6844bis (Jacob and Phillip) > b) draft-ietf-lamps-pkix-shake (Panos and Quynh) > c) draft-ietf-lamps-cms-shakes (Quynh and Panos) > 5) Wrap Up From nobody Mon Mar 5 08:59:07 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4894C12DA13 for ; Mon, 5 Mar 2018 08:59:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SZ5_mNEtFxrX for ; Mon, 5 Mar 2018 08:58:59 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2048812DA72 for ; Mon, 5 Mar 2018 08:58:47 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id F243A3005D9 for ; Mon, 5 Mar 2018 11:58:44 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id F4-EPgSubNX0 for ; Mon, 5 Mar 2018 11:58:43 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id B713C300425; Mon, 5 Mar 2018 11:58:43 -0500 (EST) From: Russ Housley Message-Id: <7E8301B2-B15E-4B3D-A559-4F29D8031F2A@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_583F4112-AC0F-4ACA-8ABF-E7C4FFBC23B0" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 5 Mar 2018 11:58:54 -0500 In-Reply-To: Cc: SPASM To: Phillip Hallam-Baker References: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 16:59:06 -0000 --Apple-Mail=_583F4112-AC0F-4ACA-8ABF-E7C4FFBC23B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Phill: PKCS#10 does not specify a method to request certificate revocation. CMP has a Revocation Request; see Section 5.3.9 of RFC 4210. CMC has a Revocation Request; see Section 6.11 of RFC 5272. EST does not specify a method to request certificate revocation, but it = does specify a way to carry a "Full PKI Request", which could be a CMC = Revocation Request. SCEP does not specify a method to request certificate revocation. Russ On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker = > wrote: Do we have a PKIX revocation request format? I am asking because of a detail in the Trustico situation in which a = file of 23K private keys was emailed to a CA to request revocation. At the point, the circumstances of that situation are not clear. But I = can see a scenario in which it is entirely plausible that a CA reseller = would have access to large numbers of TLS private keys and that is when = they are either hosting or managing the Web sites. The management interfaces that allow Web sites to be wheeled around a = data center have become very sophisticated of late with virtualization = and much of that infrastructure is 'secret sauce'. What might appear to be a five racks of 100 separate machines is likely = visible in the management console as one single entity. --Apple-Mail=_583F4112-AC0F-4ACA-8ABF-E7C4FFBC23B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Phill:

PKCS#10 does not specify = a method to request certificate revocation.

CMP has a Revocation Request; see = Section 5.3.9 of RFC 4210.

CMC has a Revocation Request; see = Section 6.11 of RFC 5272.

EST does not specify a method to request certificate = revocation, but it does specify a way to carry a "Full PKI Request", = which could be a CMC Revocation Request.

SCEP does not specify a method to = request certificate revocation.

Russ

On Fri, Mar 2, 2018 at 9:24 AM, Phillip = Hallam-Baker <phill@hallambaker.com> wrote:
Do we = have a PKIX revocation request format?

I am asking because of = a detail in the Trustico situation in which a file of 23K private keys = was emailed to a CA to request revocation.

At= the point, the circumstances of that situation are not clear. But I can = see a scenario in which it is entirely plausible that a CA reseller = would have access to large numbers of TLS private keys and that is when = they are either hosting or managing the Web sites.

The management interfaces that allow Web sites = to be wheeled around a data center have become very sophisticated of = late with virtualization and much of that infrastructure is 'secret = sauce'.

What might appear to be a five racks of 100 = separate machines is likely visible in the management console as one = single entity.

= --Apple-Mail=_583F4112-AC0F-4ACA-8ABF-E7C4FFBC23B0-- From nobody Mon Mar 5 09:04:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98C0B12D86A for ; Mon, 5 Mar 2018 09:04:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c_QKoBTlxRcp for ; Mon, 5 Mar 2018 09:04:21 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FB7B12D95F for ; Mon, 5 Mar 2018 09:04:21 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 6823030066F for ; Mon, 5 Mar 2018 12:04:19 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 9FNnbo3vPGDu for ; Mon, 5 Mar 2018 12:04:17 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 68E3A300548; Mon, 5 Mar 2018 12:04:17 -0500 (EST) From: Russ Housley Message-Id: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F1D645F2-CB06-409B-A47D-932105249036" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 5 Mar 2018 12:04:28 -0500 In-Reply-To: Cc: SPASM To: Ryan Sleevi , Phillip Hallam-Baker References: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 17:04:22 -0000 --Apple-Mail=_F1D645F2-CB06-409B-A47D-932105249036 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Mar 2, 2018, at 4:19 PM, Ryan Sleevi wrote: >=20 > On Fri, Mar 2, 2018 at 3:17 PM, Phillip Hallam-Baker = > wrote: > If it is a signing key, just sign a CRL for the certificate. Now that = is not quite the same as revoking the key but certs are the only things = PKIX makes status assertions about. >=20 > Do we have to support self-revocation of certs with only encryption = only keys? Probably not. >=20 > Since a very common reason for having to revoke a cert is that the = private key is lost entirely any revocation format cannot be the only = way to request revocation. So I don't see the relevance of the robot = attack. >=20 > Because it's a demonstration of compromise. Any attempt to define how = that demonstration of compromise is proved (which I think is *bad* = standardization) is to make it more difficult to report or demonstrate = compromise. When we had a similar discussion many years ago, the feeling was = somewhat different. If someone has assess to the private key and uses = it to authenticate a revocation request, the CA should honor it. Since = the party clearly has access to the private key, thee are many things = that party could do that are more harmful than revoking the associated = certificate. Russ --Apple-Mail=_F1D645F2-CB06-409B-A47D-932105249036 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
On Mar 2, 2018, at 4:19 PM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:

On Fri, Mar 2, 2018 at 3:17 PM, Phillip = Hallam-Baker <phill@hallambaker.com> wrote:
If it is a signing = key, just sign a CRL for the certificate. Now that is not quite the same = as revoking the key but certs are the only things PKIX makes status = assertions about.

Do we have to = support self-revocation of certs with only encryption only keys? = Probably not.

Since a very = common reason for having to revoke a cert is that the private key is = lost entirely any revocation format cannot be the only way to request = revocation. So I don't see the relevance of the robot = attack.

Because it's a demonstration of compromise. Any attempt to = define how that demonstration of compromise is proved (which I think is = *bad* standardization) is to make it more difficult to report or = demonstrate = compromise.

When we had a similar discussion many years ago, the = feeling was somewhat different.  If someone has assess to the = private key and uses it to authenticate a revocation request, the CA = should honor it.  Since the party clearly has access to the private = key, thee are many things that party could do that are more harmful than = revoking the associated certificate.

Russ

= --Apple-Mail=_F1D645F2-CB06-409B-A47D-932105249036-- From nobody Mon Mar 5 10:27:32 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E56012DA6D for ; Mon, 5 Mar 2018 10:27:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tp3VqkWdB9uu for ; Mon, 5 Mar 2018 10:27:21 -0800 (PST) Received: from homiemail-a88.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11F1112E88A for ; Mon, 5 Mar 2018 10:27:06 -0800 (PST) Received: from homiemail-a88.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a88.g.dreamhost.com (Postfix) with ESMTP id C429EA007F06 for ; Mon, 5 Mar 2018 10:27:05 -0800 (PST) Received: from mail-it0-f51.google.com (mail-it0-f51.google.com [209.85.214.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a88.g.dreamhost.com (Postfix) with ESMTPSA id A7642A007F04 for ; Mon, 5 Mar 2018 10:27:05 -0800 (PST) Received: by mail-it0-f51.google.com with SMTP id u5so11323688itc.1 for ; Mon, 05 Mar 2018 10:27:05 -0800 (PST) X-Gm-Message-State: AElRT7FsrqI8D/s4aab605EXkK8vWn28K8RuACahMu7TvWoaX/ZX1MS4 m7GMdt7oB4glCWiQEJNdtuOq+ZNE8z2DF30ib5I= X-Google-Smtp-Source: AG47ELs92vqa2T856j27Wmuo0SXCKD4X1Jk11CBTCh6ey+IOFyIyc3hle910UOU1HZhLjDgBx89mu1Q+fm57G3BQ2Bc= X-Received: by 10.36.170.6 with SMTP id b6mr14921697itf.148.1520274425008; Mon, 05 Mar 2018 10:27:05 -0800 (PST) MIME-Version: 1.0 References: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> In-Reply-To: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> From: Ryan Sleevi Date: Mon, 05 Mar 2018 18:26:54 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Russ Housley Cc: Phillip Hallam-Baker , Ryan Sleevi , SPASM Content-Type: multipart/alternative; boundary="f403045fae28105a3a0566ae7950" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 18:27:29 -0000 --f403045fae28105a3a0566ae7950 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Mar 5, 2018 at 12:04 PM Russ Housley wrote: > On Mar 2, 2018, at 4:19 PM, Ryan Sleevi wrote: > > On Fri, Mar 2, 2018 at 3:17 PM, Phillip Hallam-Baker < > phill@hallambaker.com> wrote: > >> If it is a signing key, just sign a CRL for the certificate. Now that is >> not quite the same as revoking the key but certs are the only things PKI= X >> makes status assertions about. >> >> Do we have to support self-revocation of certs with only encryption only >> keys? Probably not. >> >> Since a very common reason for having to revoke a cert is that the >> private key is lost entirely any revocation format cannot be the only wa= y >> to request revocation. So I don't see the relevance of the robot attack. >> > > Because it's a demonstration of compromise. Any attempt to define how tha= t > demonstration of compromise is proved (which I think is *bad* > standardization) is to make it more difficult to report or demonstrate > compromise. > > > When we had a similar discussion many years ago, the feeling was somewhat > different. If someone has assess to the private key and uses it to > authenticate a revocation request, the CA should honor it. Since the par= ty > clearly has access to the private key, thee are many things that party > could do that are more harmful than revoking the associated certificate. > I think we=E2=80=99re in violent agreement on how it should work - any demonstration should be accepted as proof. :) I was highlighting, however, that a policy on which CAs normalize how that demonstration is done has the unfortunate side-effect of encouraging that to be the de facto way it is done, which changes the burden from CAs (to process/verify requests) to reporters/subscribers (to produce requests the CA will accept). I=E2=80=99m suggesting that=E2=80=99s an exchange of effor= t that does more harm than good, ties into the policy aspects of the PKI (what methods are acceptable to request revocation), and does provide compelling benefit for those reporting compromise. For those self-requesting revocation, that=E2= =80=99s an aspect of Certificate lifecycle management, and there=E2=80=99s no inherent= need for a signed proof (as demonsrrated by ACME=E2=80=99s protocol and the exis= ting PKI management tools). > --f403045fae28105a3a0566ae7950 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Mon, Mar 5, 2018 a= t 12:04 PM Russ Housley <housley= @vigilsec.com> wrote:
On Mar 2,= 2018, at 4:19 PM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:

On Fri, Mar 2, 2018 at = 3:17 PM, Phillip Hallam-Baker <phill@hallambaker.com> wrote:
If it is a s= igning key, just sign a CRL for the certificate. Now that is not quite the = same as revoking the key but certs are the only things PKIX makes status as= sertions about.

Do we have to support self-revocation of certs with only = encryption only keys? Probably not.
Since a very common reason for having= to revoke a cert is that the private key is lost entirely any revocation f= ormat cannot be the only way to request revocation. So I don't see the = relevance of the robot attack.

= Because it's a demonstration of compromise. Any attempt to define how t= hat demonstration of compromise is proved (which I think is *bad* standardi= zation) is to make it more difficult to report or demonstrate compromise.

When we had a similar discussion many yea= rs ago, the feeling was somewhat different.=C2=A0 If someone has assess to = the private key and uses it to authenticate a revocation request, the CA sh= ould honor it.=C2=A0 Since the party clearly has access to the private key,= thee are many things that party could do that are more harmful than revoki= ng the associated certificate.
I think we=E2=80=99re in violent agreement on how= it should work - any demonstration should be accepted as proof. :)

I was highlighting, however, th= at a policy on which CAs normalize how that demonstration is done has the u= nfortunate side-effect of encouraging that to be the de facto way it is don= e, which changes the burden from CAs (to process/verify requests) to report= ers/subscribers (to produce requests the CA will accept). I=E2=80=99m sugge= sting that=E2=80=99s an exchange of effort that does more harm than good, t= ies into the policy aspects of the PKI (what methods are acceptable to requ= est revocation), and does provide compelling benefit for those reporting co= mpromise. For those self-requesting revocation, that=E2=80=99s an aspect of= Certificate lifecycle management, and there=E2=80=99s no inherent need for= a signed proof (as demonsrrated by ACME=E2=80=99s protocol and the existin= g PKI management tools).
--f403045fae28105a3a0566ae7950-- From nobody Mon Mar 5 11:18:56 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA59C12D7E4 for ; Mon, 5 Mar 2018 11:18:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bkaT1XUY5eCz for ; Mon, 5 Mar 2018 11:18:52 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB806129C6D for ; Mon, 5 Mar 2018 11:18:51 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D34FB300558 for ; Mon, 5 Mar 2018 14:18:49 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id IVP25sh4ywjm for ; Mon, 5 Mar 2018 14:18:48 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 01BC8300435; Mon, 5 Mar 2018 14:18:47 -0500 (EST) From: Russ Housley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_1E9E4E46-F800-4565-832C-F3D717A0055F" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 5 Mar 2018 14:18:59 -0500 In-Reply-To: Cc: SPASM To: Ryan Sleevi References: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 19:18:55 -0000 --Apple-Mail=_1E9E4E46-F800-4565-832C-F3D717A0055F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Mar 5, 2018, at 1:26 PM, Ryan Sleevi wrote: >=20 > On Mon, Mar 5, 2018 at 12:04 PM Russ Housley > wrote: >> On Mar 2, 2018, at 4:19 PM, Ryan Sleevi > wrote: >>=20 >> On Fri, Mar 2, 2018 at 3:17 PM, Phillip Hallam-Baker = > wrote: >> If it is a signing key, just sign a CRL for the certificate. Now that = is not quite the same as revoking the key but certs are the only things = PKIX makes status assertions about. >>=20 >> Do we have to support self-revocation of certs with only encryption = only keys? Probably not. >>=20 >> Since a very common reason for having to revoke a cert is that the = private key is lost entirely any revocation format cannot be the only = way to request revocation. So I don't see the relevance of the robot = attack. >>=20 >> Because it's a demonstration of compromise. Any attempt to define how = that demonstration of compromise is proved (which I think is *bad* = standardization) is to make it more difficult to report or demonstrate = compromise. >=20 > When we had a similar discussion many years ago, the feeling was = somewhat different. If someone has assess to the private key and uses = it to authenticate a revocation request, the CA should honor it. Since = the party clearly has access to the private key, thee are many things = that party could do that are more harmful than revoking the associated = certificate. >=20 > I think we=E2=80=99re in violent agreement on how it should work - any = demonstration should be accepted as proof. :) >=20 > I was highlighting, however, that a policy on which CAs normalize how = that demonstration is done has the unfortunate side-effect of = encouraging that to be the de facto way it is done, which changes the = burden from CAs (to process/verify requests) to reporters/subscribers = (to produce requests the CA will accept). I=E2=80=99m suggesting = that=E2=80=99s an exchange of effort that does more harm than good, ties = into the policy aspects of the PKI (what methods are acceptable to = request revocation), and does provide compelling benefit for those = reporting compromise. For those self-requesting revocation, that=E2=80=99s= an aspect of Certificate lifecycle management, and there=E2=80=99s no = inherent need for a signed proof (as demonsrrated by ACME=E2=80=99s = protocol and the existing PKI management tools). Aren't we already there, based on the CMP, CMC, and ACME protocol = mechanisms? Of course, any report of compromise that is not = authenticated by the private key still must be investigated by the CA. Russ --Apple-Mail=_1E9E4E46-F800-4565-832C-F3D717A0055F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On Mar 5, 2018, at 1:26 PM, Ryan Sleevi <ryan-ietf@sleevi.com> wrote:

On Mon, Mar 5, 2018 at 12:04 PM Russ Housley <housley@vigilsec.com> wrote:
On Mar 2, 2018, at 4:19 PM, = Ryan Sleevi <ryan-ietf@sleevi.com> wrote:

On Fri, Mar 2, 2018 at 3:17 PM, Phillip = Hallam-Baker <phill@hallambaker.com> = wrote:
If it is a signing key, just sign = a CRL for the certificate. Now that is not quite the same as revoking = the key but certs are the only things PKIX makes status assertions = about.

Do we have to = support self-revocation of certs with only encryption only keys? = Probably not.

Since a very = common reason for having to revoke a cert is that the private key is = lost entirely any revocation format cannot be the only way to request = revocation. So I don't see the relevance of the robot = attack.

Because it's a demonstration of compromise. Any attempt to = define how that demonstration of compromise is proved (which I think is = *bad* standardization) is to make it more difficult to report or = demonstrate compromise.

When we had a = similar discussion many years ago, the feeling was somewhat = different.  If someone has assess to the private key and uses it to = authenticate a revocation request, the CA should honor it.  Since = the party clearly has access to the private key, thee are many things = that party could do that are more harmful than revoking the associated = certificate.

I think we=E2=80=99re in = violent agreement on how it should work - any demonstration should be = accepted as proof. :)

I was highlighting, = however, that a policy on which CAs normalize how that demonstration is = done has the unfortunate side-effect of encouraging that to be the de = facto way it is done, which changes the burden from CAs (to = process/verify requests) to reporters/subscribers (to produce requests = the CA will accept). I=E2=80=99m suggesting that=E2=80=99s an exchange = of effort that does more harm than good, ties into the policy aspects of = the PKI (what methods are acceptable to request revocation), and does = provide compelling benefit for those reporting compromise. For those = self-requesting revocation, that=E2=80=99s an aspect of Certificate = lifecycle management, and there=E2=80=99s no inherent need for a signed = proof (as demonsrrated by ACME=E2=80=99s protocol and the existing PKI = management tools).

Aren't we already there, based on the CMP, CMC, = and ACME protocol mechanisms?  Of course, any report of compromise = that is not authenticated by the private key still must be investigated = by the CA.

Russ

= --Apple-Mail=_1E9E4E46-F800-4565-832C-F3D717A0055F-- From nobody Mon Mar 5 12:23:24 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24F8812D810 for ; Mon, 5 Mar 2018 12:23:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TRv1qMo2LpkF for ; Mon, 5 Mar 2018 12:23:12 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9963412E8AA for ; Mon, 5 Mar 2018 12:23:11 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 7D9E2300A14 for ; Mon, 5 Mar 2018 15:23:09 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id tuHTRwbq3oSA for ; Mon, 5 Mar 2018 15:23:08 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 41589300558 for ; Mon, 5 Mar 2018 15:23:08 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> Date: Mon, 5 Mar 2018 15:23:09 -0500 To: SPASM X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [lamps] draft-housley-cms-mix-with-psk-03 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 20:23:23 -0000 I would like to make people on this mail list aware of this = Internet-Draft. Russ =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D A new version of I-D, draft-housley-cms-mix-with-psk-03.txt has been successfully submitted by Russell Housley and posted to the IETF repository. Name: draft-housley-cms-mix-with-psk Revision: 03 Title: Using Pre-Shared Key (PSK) in the Cryptographic Message = Syntax (CMS) Document date: 2018-03-05 Group: Individual Submission Pages: 13 URL: = https://www.ietf.org/internet-drafts/draft-housley-cms-mix-with-psk-03.txt= Status: = https://datatracker.ietf.org/doc/draft-housley-cms-mix-with-psk/ Htmlized: = https://tools.ietf.org/html/draft-housley-cms-mix-with-psk-03 Htmlized: = https://datatracker.ietf.org/doc/html/draft-housley-cms-mix-with-psk-03 Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-cms-mix-with-psk-03 Abstract: The invention of a large-scale quantum computer would pose a serious challenge for the cryptographic algorithms that are widely deployed today. The Cryptographic Message Syntax (CMS) supports key transport and key agreement algorithms that could be broken by the invention of such a quantum computer. By storing communications that are protected with the CMS today, someone could decrypt them in the future when a large-scale quantum computer becomes available. Once quantum-secure key management algorithms are available, the CMS will be extended to support them, if current syntax the does not accommodated them. In the near-term, this document describes a mechanism to protect today's communication from the future invention of a large-scale quantum computer by mixing the output of key transport and key agreement algorithms with a pre-shared key. From nobody Mon Mar 5 14:29:57 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A259A12EA59 for ; Mon, 5 Mar 2018 14:29:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KN7NqGoiZaDk for ; Mon, 5 Mar 2018 14:29:47 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CFF71275AB for ; Mon, 5 Mar 2018 14:29:43 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 21BB7BE2D; Mon, 5 Mar 2018 22:29:42 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vAdT7LDDO-YZ; Mon, 5 Mar 2018 22:29:41 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id BAE3EBE24; Mon, 5 Mar 2018 22:29:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1520288980; bh=yKMeVQefyC0arKUZqjPoUW2JEZtPxIjKinxfu1G950s=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=wWTYGWaola8qnFzk5zg2bUZKykMPgGhhH7PcnRUMSlh2/0F814KGvLJgpjs5vb4HY 6kYnBHJlgvXZx8N+atTzHeFSQPmbFv8D+B2zIEJxlnltdXZurMeaTIXwfqr98ptV2m JVvghM2ZIxPpTahul9q0fCs60kdckZBooFdGDCxg= To: Russ Housley , Ryan Sleevi Cc: SPASM References: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Message-ID: Date: Mon, 5 Mar 2018 22:29:40 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="b5UBljAzxk4sJHjH0JpFZDQSvUbaDU2kD" Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2018 22:29:53 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --b5UBljAzxk4sJHjH0JpFZDQSvUbaDU2kD Content-Type: multipart/mixed; boundary="B1FmAM2Gv0IvG5a8P5eR0ye4HNfC1g3Vl"; protected-headers="v1" From: Stephen Farrell To: Russ Housley , Ryan Sleevi Cc: SPASM Message-ID: Subject: Re: [lamps] Revocation Request Format? References: <118164B3-8A17-45CA-8FF8-C7D2945A7DE1@vigilsec.com> In-Reply-To: --B1FmAM2Gv0IvG5a8P5eR0ye4HNfC1g3Vl Content-Type: multipart/mixed; boundary="------------1860D6680916A07BBF8F1EDC" Content-Language: en-GB This is a multi-part message in MIME format. --------------1860D6680916A07BBF8F1EDC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 05/03/18 19:18, Russ Housley wrote: > Aren't we already there, based on the CMP, CMC, and ACME protocol > mechanisms? Of course, any report of compromise that is not > authenticated by the private key still must be investigated by the > CA. If something is to be done in this space (and I'm still not convinced myself fwiw), then it'd be good to base that on some public numbers wrt who's been revoking what for which reasons. I'm not aware of studies on that, but haven't gone looking. Cheers, S. --------------1860D6680916A07BBF8F1EDC Content-Type: application/pgp-keys; name="0x7B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x7B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------1860D6680916A07BBF8F1EDC-- --B1FmAM2Gv0IvG5a8P5eR0ye4HNfC1g3Vl-- --b5UBljAzxk4sJHjH0JpFZDQSvUbaDU2kD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJancTUAAoJEFqy+vF7Fyvqe+sQAL6urcwJRXgPNqImD6DHjf1S lIbNYtHqjtNpWsDP2FIn2754jyAMUq+SUx0l+UbCHKTmZm+m7MZ/20QwRAfFh2Ou zS4XieS5+tAeVA5d3EdLij1jRNclfE1Yt1o/uIZ+7YBthsqCWuTsqhbDa0B6jl6G iP2TZuuNlgWkPrQQYRBjowiFPoVGttgvN+qBPoEMHXSjZOSWIYHACR2Gr6XLXsTY kmoI3VgtMp2xmq9zxt4Apl8VIOO78do11IXOJ6U8g6w0Q57Veg5SHNlaV24ZPfqi i0B9OhFR8qzx0Vd+K8PVRLFHE8obYBSjcX6lzE9ImYPh00xfuPJh/W4Pdp0VH5yS RU4puD2So1gWEmBakYndM1X1oszu54USDLd3a/bJDgr+LRjsWg3A8NHv+28VQO9X 2B0l4h+tDiEvIZKeRQlcQmk2iqtkGGEn/SpcEKRsPLz9Br1QpUyiUoFVDM+3JWHH 2w/4kDUfpbtqzIYzleEyUykQCdV0n8ErTyi0oNJhBcPcFcE1hgGqfD4yTD1YGOb9 /+uDYOAo5jUu5RAf3l55x3vxsFOa8DBDnWrkWvObOAsXndNFygnI4sIcmv8hLX86 eJUX2+IRWYi+oXWRSUYrnXHKIIYLji4LZ+KgetW2D6g6cGi59Bas7mb84EnpIadG 1RJ2XPBCk9cD5boazeTL =2P1Z -----END PGP SIGNATURE----- --b5UBljAzxk4sJHjH0JpFZDQSvUbaDU2kD-- From nobody Mon Mar 5 20:27:37 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D102C127869 for ; Mon, 5 Mar 2018 20:27:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UehRmSFqPRXo for ; Mon, 5 Mar 2018 20:27:33 -0800 (PST) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6B1A127444 for ; Mon, 5 Mar 2018 20:27:33 -0800 (PST) Received: from [10.20.30.101] (50-1-51-141.dsl.dynamic.fusionbroadband.com [50.1.51.141]) (authenticated bits=0) by mail.proper.com (8.15.2/8.15.2) with ESMTPSA id w264R27f063556 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 5 Mar 2018 21:27:03 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 50-1-51-141.dsl.dynamic.fusionbroadband.com [50.1.51.141] claimed to be [10.20.30.101] From: "Paul Hoffman" To: "Russ Housley" Cc: SPASM Date: Mon, 05 Mar 2018 20:27:29 -0800 X-Mailer: MailMate (1.10r5443) Message-ID: <5B9ED863-9520-499A-89BF-023F34C09F1F@vpnc.org> In-Reply-To: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> References: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed Archived-At: Subject: Re: [lamps] Adoption call for draft-hoffman-andrews-caa-simplification X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 04:27:35 -0000 On 24 Feb 2018, at 11:28, Russ Housley wrote: > Should draft-hoffman-andrews-caa-simplification be adopted by the > LAMPS WG as the starting point for rfc6844bis? Sure, as long as the final document has a careful section on differences from RFC 6844. I will review after it is adopted by the WG. --Paul Hoffman From nobody Tue Mar 6 06:51:55 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B48BD1243F3 for ; Tue, 6 Mar 2018 06:51:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qL6n-7UNZNHO for ; Tue, 6 Mar 2018 06:51:52 -0800 (PST) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08FD9124235 for ; Tue, 6 Mar 2018 06:51:51 -0800 (PST) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip1.isaracorp.com with ESMTP; 06 Mar 2018 14:58:31 +0000 Received: from mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) by mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Tue, 6 Mar 2018 09:51:49 -0500 Received: from mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f]) by mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f%12]) with mapi id 15.00.1044.021; Tue, 6 Mar 2018 09:51:49 -0500 From: Alexander Truskovsky To: Russ Housley CC: SPASM Thread-Topic: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 Thread-Index: AQHTrAmBaflTdAee7Eau/gq/BYxt66PByr0AgABySwCAASA0gA== Date: Tue, 6 Mar 2018 14:51:49 +0000 Message-ID: References: <7B204A35-12E5-48DD-BC73-870EC0E289A8@isara.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [2001:470:b1cb:1502:b89d:e9b3:2031:7ca8] Content-Type: text/plain; charset="utf-8" Content-ID: <8C673F7500ABCC428A98316008E456D8@isaracorp.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] DRAFT Agenda for LAMPS Session at IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 14:51:54 -0000 VGhhbmsgeW91LCBSdXNzLg0KDQpSZWdhcmRzLA0KQWxleA0KDQoNCu+7v09uIDIwMTgtMDMtMDUs IDExOjQwIEFNLCAiUnVzcyBIb3VzbGV5IiA8aG91c2xleUB2aWdpbHNlYy5jb20+IHdyb3RlOg0K DQogICAgQWxleDoNCiAgICANCiAgICBNYXliZS4gIEkgYW0gd2lsbGluZyB0byBhZGQgYW4gImlm IHRpbWUgcGVybWl0cyIgc2VjdGlvbiB0byB0aGUgYWdlbmRhLiAgVGhlIHRvcGljcyB0aGF0IGFy ZSBwYXJ0IG9mIHRoZSBXRyBjaGFydGVyIG11c3QgdGFrZSBwcmlvcml0eS4gIFRvcGljcyB0aGF0 IGhhdmUgYmVlbiBkaXNjdXNzZWQgb24gdGhlIG1haWwgbGlzdCB3aWxsIGJlIHBsYWNlZCBvbiB0 aGUgYWdlbmRhIGJlZm9yZSBvbmVzIHRoYXQgaGF2ZSBub3QgYmVlbiBkaXNjdXNzZWQuIA0KICAg IA0KICAgIFJ1c3MNCiAgICANCiAgICANCiAgICA+IEFsZXhhbmRlciBUcnVza292c2t5IDxBbGV4 YW5kZXIuVHJ1c2tvdnNreUBpc2FyYS5jb20+IHdyb3RlOg0KICAgID4gDQogICAgPiBIZWxsbyBh bGwsDQogICAgPiANCiAgICA+IEnigJl2ZSB1cGxvYWRlZCBhIHByb3Bvc2VkIGRyYWZ0IG9uIHBx IGh5YnJpZCB4NTA5IGNlcnRpZmljYXRlcywgYnV0IGhhdmVu4oCZdCBzZWVuIGFueSBub3RpZmlj YXRpb25zIG9uIHRoZSBtYWlsaW5nIGxpc3QuDQogICAgPiBodHRwczovL2RhdGF0cmFja2VyLmll dGYub3JnL2RvYy9kcmFmdC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZC14NTA5Lw0KICAgID4g DQogICAgPiBJIHdhcyB3b25kZXJpbmcgaWYgdGhlcmUgaXMgYW55IHRpbWUgYXZhaWxhYmxlIHRv IGJyaWVmbHkgcHJlc2VudCBpdCBkdXJpbmcgdGhlIExBTVBTIHNlc3Npb24uDQogICAgPiANCiAg ICA+IFJlZ2FyZHMsDQogICAgPiBBbGV4DQogICAgPiANCiAgICA+IA0KICAgID4gT24gMjAxOC0w Mi0yMiwgMToxOCBQTSwgIlNwYXNtIG9uIGJlaGFsZiBvZiBSdXNzIEhvdXNsZXkiIDxzcGFzbS1i b3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBob3VzbGV5QHZpZ2lsc2VjLmNvbT4gd3JvdGU6 DQogICAgPiANCiAgICA+ICAgIFBsZWFzZSByZXZpZXcgYW5kIGNvbW1lbnQuDQogICAgPiANCiAg ICA+ICAgIFRoZSBhdXRob3JzIHRlbGwgbWUgdGhhdCB0aGVyZSB3aWxsIGJlIGFuIEludGVybmV0 LURyYWZ0IGZvciByZmM2ODQ0YmlzIGJlZm9yZSB0aGUgY3V0LW9mZiBkYXRlIGZvciBJRVRGIDEw MS4NCiAgICA+IA0KICAgID4gICAgUnVzcw0KICAgID4gDQogICAgPiAgICA9ID0gPSA9ID0gPSA9 ID0gPSA9DQogICAgPiANCiAgICA+ICAgIExBTVBTIFdHIEFnZW5kYQ0KICAgID4gDQogICAgPiAg ICAwKSAgTWludXRlIFRha2VyLCBKYWJiZXIgU2NyaWJlLCBCbHVlc2hlZXRzDQogICAgPiAgICAx KSAgQWdlbmRhIEJhc2gNCiAgICA+ICAgIDIpICBEb2N1bWVudHMgaW4gdGhlIFJGQyBFZGl0b3In cyBRdWV1ZQ0KICAgID4gICAgICAgIGEpICBkcmFmdC1pZXRmLWxhbXBzLXJmYzUyODAtaTE4bi11 cGRhdGUNCiAgICA+ICAgICAgICBiKSAgZHJhZnQtaWV0Zi1sYW1wcy1lYWktYWRkcmVzc2VzDQog ICAgPiAgICAzKSAgRG9jdW1lbnRzIHRoYXQgaGF2ZSBiZWVuIHNlbnQgdG8gdGhlIElFU0cNCiAg ICA+ICAgICAgICBhKSAgZHJhZnQtaWV0Zi1sYW1wcy1yZmM1NzUwLWJpcyAoSmltKQ0KICAgID4g ICAgICAgIGIpICBkcmFmdC1pZXRmLWxhbXBzLXJmYzU3NTEtYmlzIChKaW0pDQogICAgPiAgICA0 KSAgQWN0aXZlIFdvcmtpbmcgR3JvdXAgRG9jdW1lbnRzDQogICAgPiAgICAgICAgYSkgIHJmYzY4 NDRiaXMgKEphY29iIGFuZCBQaGlsbGlwKQ0KICAgID4gICAgICAgIGIpICBkcmFmdC1pZXRmLWxh bXBzLXBraXgtc2hha2UgKFBhbm9zIGFuZCBRdXluaCkNCiAgICA+ICAgICAgICBjKSAgZHJhZnQt aWV0Zi1sYW1wcy1jbXMtc2hha2VzIChRdXluaCBhbmQgUGFub3MpDQogICAgPiAgICA1KSAgV3Jh cCBVcA0KICAgIA0KICAgIA0KDQo= From nobody Tue Mar 6 13:42:05 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A20581204DA for ; Tue, 6 Mar 2018 13:42:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FG9eyGY1Yogt for ; Tue, 6 Mar 2018 13:42:01 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDC78124B18 for ; Tue, 6 Mar 2018 13:42:00 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AB3FEBE4C; Tue, 6 Mar 2018 21:41:58 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RE5P49RL7mv7; Tue, 6 Mar 2018 21:41:57 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9460ABDF9; Tue, 6 Mar 2018 21:41:56 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1520372516; bh=RtIzJ8aAN5vNyrVxclzBCmR5rgPK4ZS9oeYKHYajyJs=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=o2G52aVPCSUDoAkHiBgxBlk6vMhbgyOCAbnGvW+CiewzYqMpqOM7t5puYx/1uUk4k TB/8CobjfkfeRA6g21Y7cobxM7ARfDxSWMNiNMHhzp7l/fvf+V+qHhK28kExioirWC yA0JLw57Ui6Gi8cDPR9aI8Rgvm7H3Yb+sWIRf0cI= To: Michael Jenkins , spasm@ietf.org Cc: "Zieglar, Lydia Q" , m.jenkins.364706+work@gmail.com References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Message-ID: Date: Tue, 6 Mar 2018 21:41:55 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="4k0CBGFjRkPU75251vWYdflBYTvWNfqpI" Archived-At: Subject: Re: [lamps] Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 21:42:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --4k0CBGFjRkPU75251vWYdflBYTvWNfqpI Content-Type: multipart/mixed; boundary="MFZNJRvrOoWVoYzFO0VOH2PQo5mxFK913"; protected-headers="v1" From: Stephen Farrell To: Michael Jenkins , spasm@ietf.org Cc: "Zieglar, Lydia Q" , m.jenkins.364706+work@gmail.com Message-ID: Subject: Re: [lamps] Request for review of revised RFC 5759 References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> In-Reply-To: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> --MFZNJRvrOoWVoYzFO0VOH2PQo5mxFK913 Content-Type: multipart/mixed; boundary="------------E5176FB98A68A29059C90E19" Content-Language: en-GB This is a multi-part message in MIME format. --------------E5176FB98A68A29059C90E19 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I commented on making the suite-b profiles historic on the IETF discuss list. (Probably better to keep that discussion on that list and not here - thread is at [1], but briefly I suggested we not do another suite-b-like exercise within the IETF.) Russ asked me to take a peek at this draft as part of some offlist discussion about that. Generally the content of the draft seems reasonable. If it is the case that the choices in this profile are widely implemented (and I'm guessing they are), then I would support a profile with such content being processed as a BCP (and hence coming under IETF change control). If there is a real need to retain change control and keep this as a national profile, then see my opinion on [1], I'm not supportive of that. (But in this case, as the content seems to not involve any "innovative" or odd choices, and if done via the ISE, I'm only very very mildly opposed - almost neutral:-) I'd encourage the authors to consider if they need an RFC that is not under IETF change control for this content. I can't see how that'd be beneficial tbh but maybe I'm missing something. And if the content had IETF consensus, then I'd guess that'd help in terms of getting implementations that match the profile more quickly. If there are other documents to come, that do make "innovative" choices (e.g. algs or params that are not widely implemented), then I think even a national profile for that published via the ISE is a bad idea, (but again, discussion of that via [1] is better). Cheers, S [1] https://www.ietf.org/mail-archive/web/ietf/current/msg106634.html On 31/01/18 20:59, Michael Jenkins wrote: > The US National Security Agency (NSA) has begun the process of updating= > the "Suite B for..." RFCs to define requirements for implementing and > configuring IETF protocols in compliance with the 2016 revision of > CNSSP-15 (the Commercial National Security Algorithm, or CNSA, suite). > These RFCs are intended for use by commercial product vendors who wish > their products to be used in US National Security Systems, over which > NSA has oversight. >=20 > As part of this process, the older RFCs will be moved to Historical > status, and we plan to publish new RFCs via the ISE. We are seeking > review and comment of the drafts prior to publication, and so will be > announcing the drafts on appropriate mail-lists as we produce them. >=20 > The first draft updates RFC 5759, and addresses requirements for RFC > 5280 compliant public-key certificates and CRLs that contain or > reference algorithms in the CNSA suite. It is available at > . > We would appreciate any comments you might have regarding the draft, > either via the mail-list or via direct reply. >=20 >=20 > Mike Jenkins > Lydia Zieglar > NSA >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 --------------E5176FB98A68A29059C90E19 Content-Type: application/pgp-keys; name="0x7B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x7B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------E5176FB98A68A29059C90E19-- --MFZNJRvrOoWVoYzFO0VOH2PQo5mxFK913-- --4k0CBGFjRkPU75251vWYdflBYTvWNfqpI Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJanwsjAAoJEFqy+vF7FyvqI9sP+wUtkV8R8xy9EgVMRAZ6qS9h SSM7qLgk1qKL7h+hro4MYLoa0Jgfd28ZrnCmHj5daTwKH/uRvw8RRTT7hzOCsulv WnwTGpfh2X61Y47VL2BrnX0pKD0vboOJjWJbQqB4c0/sO1vNeYogVZU96CiNaDVt mSKlGBrMC0X/NiXQPVumlW0JloANA1S55WN9v/jTsRBKS1J62FUcq743aO76dFqz +01aEJfhQz5awVAK+ODA7sWKRVqXGtEQgpBpO6zi8PUZXy3WdODDW7CfKPHrukl8 GqEO/RzZBmsyc5TWHiegrFxkkugT4yGr51tmqNHdsW21JTxMPLPwRvqAyM9zGEiL HwPcr0Oj0FjE1ZrEz8Hc4UwR1iBWXAiZG8act1BSgKxL8wAdARIqtYTP6IYdwXfR LA9+WghUMuBIbDOkk0o2qSJa6DDi8FEfzp0/sOWkjjo6h0GcfhlM+LFuIIHzw0H6 JBUBw1sHB27pCj3X57dOrNou8hqrygUL4USiQAI6JwQFZBIya84VDyqg5PH0rfeo jhacUAMZVd1cAkjdQVBmGsY8uQmcGRHlSiaLQUcPBxTf5A5juUwkhLf9XC46n3Cm zjJ0fjRFP+AjLCZNK/cGcAsEBoV5Is9umPxpS4pykolJHYkJ+iwu8OVqmh26NcCp xMqbiJ8bln/zAXV9TscS =6vxy -----END PGP SIGNATURE----- --4k0CBGFjRkPU75251vWYdflBYTvWNfqpI-- From nobody Tue Mar 6 13:49:01 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD405124B18 for ; Tue, 6 Mar 2018 13:48:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gk6MDji-j2N3 for ; Tue, 6 Mar 2018 13:48:56 -0800 (PST) Received: from mail-wr0-x22d.google.com (mail-wr0-x22d.google.com [IPv6:2a00:1450:400c:c0c::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 159F31204DA for ; Tue, 6 Mar 2018 13:48:56 -0800 (PST) Received: by mail-wr0-x22d.google.com with SMTP id n7so133852wrn.5 for ; Tue, 06 Mar 2018 13:48:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6Kr5z5OBTPUqrGFZ60cefsAK0S1hbTTBWj/knT4+3ys=; b=MVQ6cKdb+kRdj2ADWq4dPeenqBbpkazLCgU8zSLdqcBzjLYdOSafEjjV9W+Lu12WIx 1Bt9Trgwl1G3Fvnyzqq47JeGoUqFh52FetPvNg37+kAbC2CEukefGia7Y8hMNScbg1mh HHzWQkqwmuCm1rX+LLjP844IJ3cJl9KHLIAwutbDC1z+TovINTTfEZYq1esSfj3rwJHD bpTuECcAewixxxtqJq5PxmDR0YXk/DDoq+5EAx6XaCNPH0DrhYt01bnK/7o9wGRTQ5Ij k54qTo9JM17vqB0UCIRuHmZNaoA9J1NUw8X/1N0ggQSYic7A9rXy4vYIg7+rCIPB32KV P66w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6Kr5z5OBTPUqrGFZ60cefsAK0S1hbTTBWj/knT4+3ys=; b=oqEFGmKmBzO5jW0M/jvToED9RaqszO0VP1qSuPiZppOq5EHbvw+/4PY881Zt9Myxv0 f/Vr3iVbr/0eT7xB8wJzWECeuD9JuWvV27e6JShCZPTBW5fxaKCV0Eh71P4KeITbbTJU 2m6jWsaXCkuRvddXEAsLUj+zz/tqIfbCqEb/8cgAizWJtsqc7g8U2hbF0DHxAtN+3Za5 4dtyQxlEHN+YbW9GtSHn87+orbS5mE6fsVm4Q42kg1JTR9dHAxuOuL6TELKrIWPyCx7u 1EuXLGPLn9d5irMPeEq49Pdr1gFRpnppyvEPciEJHQLmARdqsxspMzY0oz2UqKMsn42l M0GQ== X-Gm-Message-State: APf1xPA9DZs00dRCfl7D1MSVOv/76CwxlhIAL8OtRZ1empjxeabo1Qib BigD1iculJdT1ZSs/rtBUPr/Uj0GZnJ6n53CYUaZPw== X-Google-Smtp-Source: AG47ELsGkguyckJO/8y1iEzGhfMwSUIREfzzL4T3Y8P4XQQTDi7/CpmuxsCD+6jn2bP2rz+KrHj9Zzj3qowmPUmvNyo= X-Received: by 10.223.225.6 with SMTP id d6mr15590842wri.128.1520372934347; Tue, 06 Mar 2018 13:48:54 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.12.140 with HTTP; Tue, 6 Mar 2018 13:48:53 -0800 (PST) Received: by 10.28.12.140 with HTTP; Tue, 6 Mar 2018 13:48:53 -0800 (PST) In-Reply-To: References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> From: Richard Barnes Date: Tue, 6 Mar 2018 16:48:53 -0500 Message-ID: To: Paul Hoffman Cc: Michael Jenkins , spasm@ietf.org Content-Type: multipart/alternative; boundary="f4f5e80efdd8ada1a20566c568b7" Archived-At: Subject: Re: [lamps] Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 21:48:59 -0000 --f4f5e80efdd8ada1a20566c568b7 Content-Type: text/plain; charset="UTF-8" On Feb 20, 2018 21:48, "Paul Hoffman" wrote: On 31 Jan 2018, at 12:59, Michael Jenkins wrote: The first draft updates RFC 5759, and addresses requirements for RFC 5280 > compliant public-key certificates and CRLs that contain or reference > algorithms in the CNSA suite. It is available at < > https://www.ietf.org/internet-drafts/draft-jenkins-cnsa- > cert-crl-profile-01.txt>. We would appreciate any comments you might have > regarding the draft, either via the mail-list or via direct reply. > This looks good on its face. However, I would argue that the reference [CNSA] is a normative reference: one cannot evaluate whether the requirements in the draft match the requirements in [CNSA] without reading and understanding [CNSA]. A big issue, however, is that [CNSA] points to: https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm I cannot read that document on any of my browsers because the certificate used for TLS is invalid in current browsers, and attempting to switch to the HTTP version redirects to the insecure HTTPS version. I know that this is not something that the authors can fix on their own, but I would strongly object to the IETF moving this document forwards as an RFC with a normative reference that no one can read without making TLS changes in their browsers. Should we also stop accepting references that are only available over "http://" URLs? I might not object to that, but seems silly to do one of these things and not the other. --Richard Lots of US federal agencies have HTTPS web sites that are readable by the general public; this should be no different. --Paul Hoffman _______________________________________________ Spasm mailing list Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm --f4f5e80efdd8ada1a20566c568b7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Feb 20, 2018 21:48, "Paul Hoffman" <paul.hoffman@vpnc.org> wrote:
On 31 Jan= 2018, at 12:59, Michael Jenkins wrote:

The first draft updates RFC 5759, and addresses requirements for RFC 5280 c= ompliant public-key certificates and CRLs that contain or reference algorit= hms in the CNSA suite. It is available at <https://www.ietf.org/internet-drafts/draft-je= nkins-cnsa-cert-crl-profile-01.txt>. We would appreciate any co= mments you might have regarding the draft, either via the mail-list or via = direct reply.

This looks good on its face. However, I would argue that the reference [CNS= A] is a normative reference: one cannot evaluate whether the requirements i= n the draft match the requirements in [CNSA] without reading and understand= ing [CNSA].

A big issue, however, is that [CNSA] points to:
=C2=A0 =C2=A0https://www.iad.gov/iad/= programs/iad-initiatives/cnsa-suite.cfm
I cannot read that document on any of my browsers because the certificate u= sed for TLS is invalid in current browsers, and attempting to switch to the= HTTP version redirects to the insecure HTTPS version.

I know that this is not something that the authors can fix on their own, bu= t I would strongly object to the IETF moving this document forwards as an R= FC with a normative reference that no one can read without making TLS chang= es in their browsers.

<= /div>
Should we also stop accepting references that are on= ly available over "http://" URLs?=C2=A0 =C2=A0

I might not object to that, but seems sill= y to do one of these things and not the other.=C2=A0

--Richard


Lots of US federal agencies= have HTTPS web sites that are readable by the general public; this should = be no different.

--Paul Hoffman


_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--f4f5e80efdd8ada1a20566c568b7-- From nobody Tue Mar 6 14:39:46 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95749124319 for ; Tue, 6 Mar 2018 14:39:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id emtCTd57HR-a for ; Tue, 6 Mar 2018 14:39:43 -0800 (PST) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F8F21201F2 for ; Tue, 6 Mar 2018 14:39:43 -0800 (PST) Received: from [10.32.60.57] (50-1-51-141.dsl.dynamic.fusionbroadband.com [50.1.51.141]) (authenticated bits=0) by mail.proper.com (8.15.2/8.15.2) with ESMTPSA id w26MdDYV025252 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Mar 2018 15:39:14 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 50-1-51-141.dsl.dynamic.fusionbroadband.com [50.1.51.141] claimed to be [10.32.60.57] From: "Paul Hoffman" To: "Richard Barnes" Cc: spasm@ietf.org Date: Tue, 06 Mar 2018 14:39:41 -0800 X-Mailer: MailMate (1.10r5443) Message-ID: In-Reply-To: References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> MIME-Version: 1.0 Content-Type: text/plain; format=flowed Archived-At: Subject: Re: [lamps] Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 22:39:45 -0000 On 6 Mar 2018, at 13:48, Richard Barnes wrote: > Should we also stop accepting references that are only available over > "http://" URLs? No. Those URLs do not impede reading by developers. > I might not object to that, but seems silly to do one of these things > and > not the other. Why is it "silly" to object to a URL that I literally cannot read without reducing the security of my browser? --Paul Hoffman From nobody Tue Mar 6 15:02:57 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 128A0126C0F for ; Tue, 6 Mar 2018 15:02:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 479oq63IVncc for ; Tue, 6 Mar 2018 15:02:51 -0800 (PST) Received: from mail-wr0-x22f.google.com (mail-wr0-x22f.google.com [IPv6:2a00:1450:400c:c0c::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D8BB12008A for ; Tue, 6 Mar 2018 15:02:51 -0800 (PST) Received: by mail-wr0-x22f.google.com with SMTP id v111so290964wrb.3 for ; Tue, 06 Mar 2018 15:02:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ai92S9BpI3Au5cPnHzGMgVbR0ZxJU3Yxq0e7X7VZW4s=; b=B4+4pZHhSJTQxVBwrhKvM6kzYCs5zFZoREnXst+B7eEQapjCP0yvVVSCMZju5Zph+2 zMAVqh9pdrG2BvRM52H+Y6XiqK0b2Uw+zLWxe/ZL6K8LChyJ4kOgzfUEnuJr3F2NJOh1 BdjX0Mzr9PLTTf5GyK6+nRYP+b4H1Ocwupxh53v2leAi1/xk5KHH/wt+EvhKWXPenqqa 6IpXBvKGeHOJoY9rd5xREPjRrNyIy6X9SXBJjD5TuGw+Q1bZlKW5OKkIaphtb2FA7XgU ER/RIFT1XGz7KO2cHXd7qXHjDkD4VPaGd1X9M71kGlWBsYPIQwPQqCSajNbFurxu24G3 AuIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ai92S9BpI3Au5cPnHzGMgVbR0ZxJU3Yxq0e7X7VZW4s=; b=S6nF1mM8kjPXIv9xJmo+l8OQMplJK0Bu4x33Tf1H4XDoy2UUEOzlAbmr6YR6SeDRcq 1hCrRp50vOkgy2i6GW4+s0xYnFtrfWhho4GmHKfYaNMxTPvxPWTD0R2QzIaeZ2u32fuD 9m+UIsVn8H5Lxw9ndXBcl0aCkI900NOWFexaF7R7k3Jwo06uXJL1Gm1wqO2DUtTwbg+l 0+lDh8pGTztnBjH/RbBEcNv79VQDoNUAZNCocCtLnU58WHMnlFWSn+jULf0YsagY0U08 H/6R1NF7WRsufqvIRXWVloZfOanE4W58YlslWe/mkFPAVMVXzD1o2MGUloA2+WOqOtYm 7mrg== X-Gm-Message-State: APf1xPD995KLgKCQxq0h/sWkwCVQyL9hWhJZFM/mh1J38JsmOTYFM3LW Vk0RRqstg13v992PtOP2cp0XfAzT+WvXFIHcVtE5M1o3 X-Google-Smtp-Source: AG47ELsds348Yku7UpIR+anLp9J7fkYx+55vRfcfeSzqXU+L/6vLd9ebEMctdrtc43JiEXjlOtR6sYPm401sRIRk56o= X-Received: by 10.223.225.6 with SMTP id d6mr15711467wri.128.1520377369316; Tue, 06 Mar 2018 15:02:49 -0800 (PST) MIME-Version: 1.0 Received: by 10.28.12.140 with HTTP; Tue, 6 Mar 2018 15:02:48 -0800 (PST) Received: by 10.28.12.140 with HTTP; Tue, 6 Mar 2018 15:02:48 -0800 (PST) In-Reply-To: References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> From: Richard Barnes Date: Tue, 6 Mar 2018 18:02:48 -0500 Message-ID: To: Paul Hoffman Cc: spasm@ietf.org Content-Type: multipart/alternative; boundary="f4f5e80efdd805e2530566c67146" Archived-At: Subject: Re: [lamps] Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Mar 2018 23:02:53 -0000 --f4f5e80efdd805e2530566c67146 Content-Type: text/plain; charset="UTF-8" On Mar 6, 2018 17:39, "Paul Hoffman" wrote: On 6 Mar 2018, at 13:48, Richard Barnes wrote: Should we also stop accepting references that are only available over > "http://" URLs? > No. Those URLs do not impede reading by developers. I might not object to that, but seems silly to do one of these things and > not the other. > Why is it "silly" to object to a URL that I literally cannot read without reducing the security of my browser? The reduction in security from allowing an unknown cert for a single site (which is what your browser does; it doesn't wholesale add the CA without a bunch more effort) is no more than the reduction in security from visiting a non-HTTPS URL. Arguably less. --Richard --Paul Hoffman --f4f5e80efdd805e2530566c67146 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mar 6, 2018 17:39, "Paul Hoffman" <paul.hoffman@vpnc.org> wrote:
On 6 Mar 2= 018, at 13:48, Richard Barnes wrote:

Should we also stop accepting references that are only available over
"http://" URLs?

No. Those URLs do not impede reading by developers.


I might not object to that, but seems silly to do one of these things and not the other.

Why is it "silly" to object to a URL that I literally cannot read= without reducing the security of my browser?

The reduction in security fr= om allowing an unknown cert for a single site (which is what your browser d= oes; it doesn't wholesale add the CA without a bunch more effort) is no= more than the reduction in security from visiting a non-HTTPS URL.=C2=A0 A= rguably less.=C2=A0

--Ri= chard



--Paul Hoffman

--f4f5e80efdd805e2530566c67146-- From nobody Wed Mar 7 07:39:45 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B76DB128C0A for ; Wed, 7 Mar 2018 07:39:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V3OnMnd7pGn4 for ; Wed, 7 Mar 2018 07:39:39 -0800 (PST) Received: from USFB19PA14.eemsg.mail.mil (uphb19pa11.eemsg.mail.mil [214.24.26.85]) by ietfa.amsl.com (Postfix) with ESMTP id 5A9E3127873 for ; Wed, 7 Mar 2018 07:39:37 -0800 (PST) X-EEMSG-Attachment-filename: CNSSP_15_20161020.pdf X-EEMSG-Attachment-filesize: 259854 Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by USFB19PA14.eemsg.mail.mil with ESMTP/TLS/AES256-SHA; 07 Mar 2018 15:39:31 +0000 X-Attachment-Exists: TRUE X-IronPort-AV: E=Sophos; i="5.47,436,1515456000"; d="pdf'?scan'208"; a="9437922" IronPort-PHdr: =?us-ascii?q?9a23=3AfgdzFhempvwqL3MkB1Kv1TN/lGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxcW7bR7h7PlgxGXEQZ/co6odzbaO6OawAydfvN6oizMrSNR0TRgLiM?= =?us-ascii?q?EbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpTEdFQ/iOgVr?= =?us-ascii?q?O+/7BpDdj9it1+C15pbffxhEiCCybL9uIhi6twbcutcZjYZgKqs61wfErGZPd+?= =?us-ascii?q?lK321jOEidnwz75se+/Z5j9zpftvc8/MNeUqv0Yro1Q6VAADspL2466svrtQLe?= =?us-ascii?q?TQSU/XsTTn8WkhtTDAfb6hzxQ4r8vTH7tup53ymaINH2QLUpUjms86tnVBnlgz?= =?us-ascii?q?ocOjUn7G/YlNB/jKNDoBKguRN/xZLUYJqIP/Z6Z6/RYM8WSXZEUstXWSNBGIe8?= =?us-ascii?q?ZJYRAeQHM+hTso3xq0IAoBa6AAWhAv7kxD1ViX/sxaA0zvovEQ/G0gIjEdwBvn?= =?us-ascii?q?vbo9fpO6oJVOC50LPFwC/fY/5Y2zrw7pXDfBA7ofGLWLJ9ac3fyUgzGAPFlFqf?= =?us-ascii?q?t4jlNC6R2OsTtWib7OtgVeS0i2U6rAxxpzqvxsUyhYnPhYIVy0vJ9Tl5wYkpJd?= =?us-ascii?q?24T1R3Ydi4H5tLqy6WLY52QsImQ2xxvisx17MIuZm+fCcQyZQnwQbSa/2ZfIiU?= =?us-ascii?q?7BLvTuGRIS13hH59ebKwnQu9/VKvyu37SMm51ktBoCldktTUq3wA2BPe5tKHR/?= =?us-ascii?q?dg5EutxzmC2x7J5u1ZJ00/iLDVJIQ7wrEqk5oeqUHDHijrl0rolKKWbUAk+vSw?= =?us-ascii?q?6+Tgf7XmuoeQN49qhQH6NaQjgtC/Dv4iMggPQmib4v6w1KHj/ELlQLVKiec6kq?= =?us-ascii?q?/Fv5DBOcsXvKu5Aw5R0oo76ha/CSmp0MgAkHUaI19IdwiLgoj0N13UPvz1Aumz?= =?us-ascii?q?j06xnDtzwvDJJLzhApHDLnjZl7fheK5w60teyAox099f4ZFUCrAaLfLvWk7+qN?= =?us-ascii?q?zYDhgjPwyy3+nnE8ly2pkbWWKOBq+VKLnSvkOQ5uIzP+mMY5cYuC7nJPg44/7i?= =?us-ascii?q?l385mVgTfamn2JsYcna4E+94I0WBZ3rjns0NEWAQvgoxVObqkkGNUSZPZ3auWK?= =?us-ascii?q?Ix/io7CJq8AofYQ4Cgm72B0zmnHp1YfGxGDUqMEXi7P7mDDs8FdSbaAshvnDkN?= =?us-ascii?q?U/D1U4Y80VeuswH0zrNhBvTM/CZesojsgotb/erWwDQz/jx9AsDV8WyLTGByhS?= =?us-ascii?q?tcQj000aZ8oGRh21yD1u5+iOdTU9lS46UaAU8BKZfAwrkiWJjJUQXbc4LMEQ33?= =?us-ascii?q?Tw=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2C1AQB+BqBa/wHyM5BdGQEBAQEBAQEBAQEBAQcBAQEBAYN?= =?us-ascii?q?QZnAog1SYH0gGgQ0ngRaUSIIBBwEnBYUGAoMKITgUAQIBAQEBAQECAWongjgkA?= =?us-ascii?q?YJHAQEBAyMiNBALGCoCAgIYPQYNCAEBF4RzDRCobYInhHKDcoISCgWFMYIugQ+?= =?us-ascii?q?CLikMgniBLoIAAQGBPgERAgECM4J0gmIEjnGLdgmEA4FviwYHgWeHVYU+RYc0i?= =?us-ascii?q?ww1IWFxMxoIMDpjAQGBXoRmIjcBjAgBAQE?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 07 Mar 2018 15:39:30 +0000 Received: from rd2ul-48143y.infosec.tycho.ncsc.mil (rd2ul-48143y [192.168.26.149]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w27FdTNH021081; Wed, 7 Mar 2018 10:39:29 -0500 To: Paul Hoffman Cc: spasm@ietf.org References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> From: Michael Jenkins Message-ID: <19dbe3c2-dd6b-5313-7663-e85aba7c65c3@tycho.ncsc.mil> Date: Wed, 7 Mar 2018 10:39:29 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/mixed; boundary="------------030354029FF7DC07ACD6C14F" Content-Language: en-US Archived-At: Subject: Re: [lamps] [Non-DoD Source] Re: Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Mar 2018 15:39:43 -0000 This is a multi-part message in MIME format. --------------030354029FF7DC07ACD6C14F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Update on this, such as it is: As Paul says, access to CNSSP-15 without altering the local security configuration isn't in my power to fix directly. I am reliably informed that the DOD PKI is working on a solution (which might involve a new CABF guidelines compliant root). I'm also looking into having it posted somewhere authoritative but without side-effects. In the (could be ample) meantime, the best I can do is post the document to the mail-list. So, you can find it attached to this email (and, by extension, so can anyone who can access the spasm mail archive). I hope this meets the near-term need. Mike On 02/20/2018 09:48 PM, Paul Hoffman wrote: > On 31 Jan 2018, at 12:59, Michael Jenkins wrote: > >> The first draft updates RFC 5759, and addresses requirements for RFC >> 5280 compliant public-key certificates and CRLs that contain or >> reference algorithms in the CNSA suite. It is available at >> . >> We would appreciate any comments you might have regarding the draft, >> either via the mail-list or via direct reply. > > This looks good on its face. However, I would argue that the reference > [CNSA] is a normative reference: one cannot evaluate whether the > requirements in the draft match the requirements in [CNSA] without > reading and understanding [CNSA]. > > A big issue, however, is that [CNSA] points to: >    https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm > I cannot read that document on any of my browsers because the > certificate used for TLS is invalid in current browsers, and > attempting to switch to the HTTP version redirects to the insecure > HTTPS version. > > I know that this is not something that the authors can fix on their > own, but I would strongly object to the IETF moving this document > forwards as an RFC with a normative reference that no one can read > without making TLS changes in their browsers. Lots of US federal > agencies have HTTPS web sites that are readable by the general public; > this should be no different. > > --Paul Hoffman > --------------030354029FF7DC07ACD6C14F Content-Type: application/pdf; name="CNSSP_15_20161020.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="CNSSP_15_20161020.pdf" JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIv TGFuZyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDUwIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0 cnVlPj4+Pg0KZW5kb2JqDQoyIDAgb2JqDQo8PC9UeXBlL1BhZ2VzL0NvdW50IDkvS2lkc1sg MyAwIFIgMTMgMCBSIDI5IDAgUiAzOCAwIFIgNDAgMCBSIDQyIDAgUiA0NCAwIFIgNDYgMCBS IDQ4IDAgUl0gPj4NCmVuZG9iag0KMyAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAg Ui9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNSAwIFIvRjIgOCAwIFI+Pi9FeHRHU3RhdGU8PC9H UzcgNyAwIFIvR1MxMiAxMiAwIFI+Pi9YT2JqZWN0PDwvTWV0YTEwIDEwIDAgUj4+L1Byb2NT ZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYx MiA3OTJdIC9Db250ZW50cyA0IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVu Y3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgMD4+DQplbmRvYmoNCjQg MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTAyMD4+DQpzdHJlYW0NCnic tVbbbts4EH0X4H+YR2kBU7xLAooCsi0nXlS+SDKKoOiD66rZLBKr66pY5O93SNmJFcttWnsT gKaGMzxzOeTQj7f13ZfVuoY3b/y4rlfrv8rP8MEvqq8f/eLxa+nPV7d3m1V9V238/Pun2oiu y9Xncvv2LQxGQxgUPccfM2CSUAnFl57DgOI/A0E1oQoCKezKA+pd5QHcfus5FG7NcNVzPrjg fYTiz56T4EZms2fziChxaN7W/afnLF5aNIBck0j/kgWjJAxfZcFCQUINOpIk2FsMPelWXl+4 Dzh58Bh378xXXZclWPkGpl7grqzQC3HV6Et3YyX3ZoDcY8wt19+3dt0oPnp9uZM/ovI3Kyzt 9nZ+Km9SMKKitofHMUGSDsE/Uf1BVdfVw2kCjKuqbhHgRT6ZJiHvqllHfU/qPufeH3NgvMWt iBKKVvxHZRPw745kaPA3OIwz45wOOZEM0GgnQIJJquG+5+Q9x2FCEdnSagQvtGREwpZWI2hp WQccSQ2IUpJoq6k0PxDs9tsp6YjQllIjaCshA2VLqRE0Sk9HDHPAiJSRaDJGJA8YhMgJNGAa 1uY4pmW9YhRGFSwOLC01wJ8bUqTDyQjortK4paQhoSFoiqfAnHlbbh7Atuw57/+Azb5g7GXB pMZDCZpFe1IiHKo0l4G9B4ZTZHlumG0HmBvmV/f2MKxx6RGYOqjxwob42/4oVI3koUMd19Gi IxnsIsnASgo0VCT6Efh5GKIbg1OYrWtPudUnk9oSU7u9YF4xoSav/2doivNuDE6ZvjxFjkOx fxcE0orgpfHTnB1xkV+CiyEz4CrihO3BjXx7u59lr/JFXMIXpgjqqSAk4pcSIZ/BTYPGO44z QRQHHgVEABcBiaIu/LCFz7F96QgvcUlCcYi/zPG8JOD1uTsbN80Xp/Pl4B329Ynp/1aQF55w 4+koPuLGOV5JpDtjHV5l5oUwMq4dk/G8NCgiApDUbnEAOJ6Z2DPIExPyMsMhuSy04CegJ6Y7 7PDTuJjg12x64bDxUSEEiADTHR1i59dxhkm2LlxdNtxAEqE6IH9GeHVEeHwpKBMDM/0M+wu+ jtrwT2Gio0EAjIXmdjvALK69vnYnHt934JHXD9zZcJkmU+R1gR0ZOZ6ZIcnNOHz6nnhMuAM8 C80CpF6f0UY6NZvYWSNcpier9uoQWIQ3C74Jkadctypl/C5i9HY6wmLF2SgnADezJUqso3hM I3eU4OfcqMZZgcGZUwuzDOIrkwAbrA3t5nxPOeXmlYeKjLaSncY3BrXJ5gKny6c8NTIYm59l VlwnLedtfVL0nkn3nXkiJbvyeP3QjQtbwhmydUrOdl4qTZTqcL6Lnf8Bl6jSnA0KZW5kc3Ry ZWFtDQplbmRvYmoNCjUgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05h bWUvRjEvQmFzZUZvbnQvVGltZXMjMjBOZXcjMjBSb21hbixCb2xkL0VuY29kaW5nL1dpbkFu c2lFbmNvZGluZy9Gb250RGVzY3JpcHRvciA2IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIg MTIxL1dpZHRocyA0MjAgMCBSPj4NCmVuZG9iag0KNiAwIG9iag0KPDwvVHlwZS9Gb250RGVz Y3JpcHRvci9Gb250TmFtZS9UaW1lcyMyME5ldyMyMFJvbWFuLEJvbGQvRmxhZ3MgMzIvSXRh bGljQW5nbGUgMC9Bc2NlbnQgODkxL0Rlc2NlbnQgLTIxNi9DYXBIZWlnaHQgNjc3L0F2Z1dp ZHRoIDQyNy9NYXhXaWR0aCAyNTU4L0ZvbnRXZWlnaHQgNzAwL1hIZWlnaHQgMjUwL0xlYWRp bmcgNDIvU3RlbVYgNDIvRm9udEJCb3hbIC01NTggLTIxNiAyMDAwIDY3N10gPj4NCmVuZG9i ag0KNyAwIG9iag0KPDwvVHlwZS9FeHRHU3RhdGUvQk0vTm9ybWFsL2NhIDE+Pg0KZW5kb2Jq DQo4IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YyL0Jhc2VG b250L1RpbWVzIzIwTmV3IzIwUm9tYW4vRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnRE ZXNjcmlwdG9yIDkgMCBSL0ZpcnN0Q2hhciAzMi9MYXN0Q2hhciAxMjIvV2lkdGhzIDQyNCAw IFI+Pg0KZW5kb2JqDQo5IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1l L1RpbWVzIzIwTmV3IzIwUm9tYW4vRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODkx L0Rlc2NlbnQgLTIxNi9DYXBIZWlnaHQgNjkzL0F2Z1dpZHRoIDQwMS9NYXhXaWR0aCAyNTY4 L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDAvRm9udEJC b3hbIC01NjggLTIxNiAyMDAwIDY5M10gPj4NCmVuZG9iag0KMTAgMCBvYmoNCjw8L1R5cGUv WE9iamVjdC9TdWJ0eXBlL0Zvcm0vUmVzb3VyY2VzPDwvWE9iamVjdDw8L0ltYWdlMTEgMTEg MCBSPj4+Pi9CQm94WyAwIDAgMTk2IDE5M10gL01hdHJpeFsgMC4zNjczNSAwIDAgMC4zNzMw NiAwIDBdIC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDU1Pj4NCnN0cmVhbQ0KeJwr5OUq BKNAMAIyDC2NFQyAEELrGugZAIGhqZGppUJyLi+XvmduYnqqoaGCS74CRA8An2AM6g0KZW5k c3RyZWFtDQplbmRvYmoNCjExIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFn ZS9XaWR0aCAxOTMvSGVpZ2h0IDE5My9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29t cG9uZW50IDgvRmlsdGVyL0RDVERlY29kZS9JbnRlcnBvbGF0ZSB0cnVlL0xlbmd0aCAxMDMy OT4+DQpzdHJlYW0NCv/Y/+AAEEpGSUYAAQEBAGAAYAAA/+EAWkV4aWYAAE1NACoAAAAIAAUD AQAFAAAAAQAAAEoDAwABAAAAAQAAAABREAABAAAAAQEAAABREQAEAAAAAQAADsNREgAEAAAA AQAADsMAAAAAAAGGoAAAsY//2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCADB AMEDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgED AwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcY GRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJ ipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo 6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgEC BAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl 8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaH iImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn 6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iiigAooooAKKKKACiiigAooqCa5htlLTzJE oBYl2AGAMk8noB1oAmorF1LxTo2lPCt1fIplQSDb82E/vnHRfc8VHN4s0mC+ubNpWM0Fn9t+ UZEkWDyh/iPFUoS3sRzxXU3qKxZfE+mQzaTFLKUk1QA2ykcngHn06gfWtC3v7a6uLiCCZXlt nCTKOqsQCAfwNJxa1aKUk9i3RRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACClpKo 6jq2n6TCsuo3kFrGx2q00gUE+gz1oSbdkJtLVl6sa/8AEVhYalHpbSr/AGlPCZLeBsgSkZwN 2MAkj1rjPEPjHUpLy8s7O1lVLZY760vLNzKs6A5AdV5MbHKkg4Heti/0+38a2Og61bwRTIGz JFL08p1w4yedykAj3WtlS5bOezMXV5tIbmV4h8d3MFn4f1Owljigukkmnt5Uy0u3aDGpxkNk nHTlag0jStFuvFEkljG09tq2kvJBNM7OytuKuMk/LkOMiuo0DwXYaDJFJHdXNy0LytAZ3B2C TbuHHX7vWtezmgS5ktLe3EKId3yptHPXj1yaVTFUqTUI7vT16ijQnNuU/wDhjhtG03xBp9mt wuj/AGl73SorSSJ5VQwyxhlG7J+4Qc8ZNMn+HmoSWPlrNELuDS4Le3n3n/WqHDgjH3GV8V31 z9s+0weRtMeT5nqBx+dTXkcstsyQvtkIwDWTxs/ecY7fj6Gn1WGibPPrvwZr86/aluLcXVpD bRWcIwQwi2ucsQNpLg/hW54dj1HTtY1WO80m5UX98863KPG0YTaAobDZBwPSunt0lS2RZWzI ByfeoLL7YXm+1BQN2Ux6fn+lJ4uUuWDjv+HqNYeMW5J7Hmviqe2m8bq8k8okgkgtRGJCk8LM wKywj7rqc4IbJ+WtHTvGGq3niKcLeWaaabiTy4rm3dSYI+HkjkUYJ4Y4au2luIDqSQPbh5Ap KvtyR+mRWBdeB7QWOo2un3l1awXls8QtfM3W8Zb+JUPQ564Pet6eJo1VZdNDGdGrB3T31NHR vF+k67c/ZrN5RIYzLGJYWQSR5xuXI5Ga36851i51u30Qy6hpthp9wpSwtLmOXd5IkwrybuNi 4AwPXHNXYPFcGkyzWiE3GladFFai4GZZri5OPkTH3iF5OAeacqN9Y/5lRq20l/kdzRVLT9Rt dTtFubKcTQscZHUEdQQeQR3B5q7WDVtGbp3FooooAKKKKACiiigAooooASilqlqWoQaVp1xf XTFbeCMyOQCSAOegoSvohN21ZDqmsWukRwtcsxeaVYooo1y8jEgYVepx1PtXP+KoJItY0/WH 0uTV7GKKSCS1ijErqXxiRVPB4GD7Gua1Ca58Sw/2pbSCHVrdAhSJwEa3nOVg3NkCYrg5XGN2 M12egJe6XofmamiQRjAgsosEWsQACpnqzY5JJPPStajjQh7ST23MFetLkRm+GNAitLGHU722 ltHhlnktbcsQYIJDkROOhA67egNdbAIns1FqVjjIwmxQAB7DpTPOtrmwM8uBCVLMW4AA65+l cVc+I7rVFSHw+fsmmchr1kG+THH7tW6D/aYfSsUquJk3pyNGt4UY2W5vXWt6f4XtvL1C/Etw xzHbr80r+gVc5Nc5qvj2+jtjJaaaliZD+7+1NuuJD0+WFRyfq1YWpadpdpafYls/tV5euSgk clpHHJdnzkAdSQfpSW3h/UNM23NlfxzXjRhJPtalkwOykcgV20MHRpQil07nNUrVZyf6Edzf +L5LJ77VfEc9pbgAiC2iVZWJ6LwBhieAMmmtp+qx6PfX1/rOptN5DPFB9tkxEQpIyQfmPrxi lju9RvdYV7vTGmj05iMWjgjzyAc/MQThT+bVPrGso+j30TWF9E7QOPniGBlT1IJFdVrOyS+R j7tru/zI7zTtUhtYbzTtX1UKsQaW3F3IS/GSUJP3vQdDRDqHjC2s0vdN8QvqNmyhtkkCPJju MHqR0I3Crltram2hWLTtQkIjUcRBRwB3JFZ6XOp2WqvBZacsEd+xkiW7cbRKBl/uEnBGDj/e pJX0aQ2orVN/idPpvj26e1W4udLF6I+HexbMyHuGhYAqfbca6O11Ww8TQo+m6igeMgyQg/vE 5GQ69R+Irze88OX+oLJd3F9Gt+Y9gW3UpGwzna5+8R75qxp1hpl7axrDatZXdi+0iJislvJ1 OGz8wPUZyDXLXwdGrC35G9OtVjL/ADPU9QSzlsHi1CKOa2YbZFlUFW+oPFcjrXhK2Sya/wBN ikSK0tmksbCzTYVuDyJcg/M3QYIPFR23iWaxBtfE+2azZgsV+iYxnoJVHQ/7SjHriu0nuIbK 08zH7sYwF759K45Tq4ablUaUF/TN7U6ysviPP9Cu9Q00XhtJVmtdOElxqk8hVVvbtlyyI2MI qEckd+MV2+ha5ZeINKhv7F8xuOUONyHurAdCKp6polt4jtrNJZXTThJ501soAE56gMRzjPJA 61gp4jUePbuPTbO7vLWGAQyrZxKVacsMlmJA+VQB1rovGtHmj6mSvTfLJnf0U0HIB6Z7GnVg dAUUUUAFFFFABRRRQAlcHruoazd61He6XZfbtK0uQiaGGcBrmQgq4AB52f3SOSa6XxHqJ0vQ ru6DSowTaskcRlMZPAYqOoBOT7VznhOwvtO8g6TrVrq+hSkmUMwEkLnlmVgDuy3JU4xmtYK0 XNmFR3lyIfovhnRo7sa/ZzXP9nHNxBp7ptjhlPDOEIyDgYAxxziuqW9tpLF7qR1W3UEuz8AK OpOenFSrJbz740KMF+8o6c1w3ie6Gs376Bbsyaba4+3GNseaxHEQI5GOp59BWMOevVvzLksa S5aULJalXUL2TxVcB5FaLRYX/wBHg5H2rHR3B/g9FI96lubmGytJLidtsUa5P0HQD+QrNjt9 Y07d5U8eo24HyxS/u5EA7BgCG/HFZtxrdrqep21jeLJYQwHzbiO7wgkYfcXOcEZ+br/DXqRg umyOVzt6vuamkWk26XUr2PF5dAZjPPkxjog/mfetC8uVsrK4un+5Ehc/gM4qRHWRd6Mroe4b I/SsrX/3tva2P/P3cxxt/uA7m/RcVO8rsctI2RNols1rpNusv+vcGWU997Hcf1OKdrX/ACAN Q/69pP8A0E1eqjrX/IA1D/r2k/8AQTQneVxtWjYs23/Hpb/9c1/kKo6/E76U9xCuZ7Rhcx46 kryR+K5FXrb/AI9Lf/rmv8hUhAdWVuQRgj2PWlF63HJe6NilSeFJomyjqGU+xGRWZqsEttMm sWiM08C7Z4k/5bRdx7leopfD5I0pbZuXtJXtj9FYgf8AjuK0pJEiRnmkWNB1LsFH601pIl+9 G7Ejkhu7VJUZZYJUBB6h1Ipml6i3heX7PNul0KZju35Y2WfT/pmT2x8vXpXO2GtwWF3c6ZZR S6hHv8y1FrhlRD1UtnACt/6FWhLZapqfF3cx2doww9vb/Ozg9QzkDH4CnOkrOM9hKd9Y7o9P nvbe2tlmLKYmxgryCD3GOtU76+tNB0lrtLYLE0qfJEoGWkcDJxx1bJNc34Vvfsd3/wAI5elp bdgZNPeRs/KuMxEnkleo68fSurv4LK8t2068RGhmXaYycAjjgd8+mK8tqVKq/aNculjrvzw9 34jnNA8Taje61La6glusJedF8tGUwPHIFCOxJDFgwYYxXZDivOrnSdRTUo7TR9HcaZp94bqd ry8ZGvJtoIYOQxKqcHJPJX2rutNvBf6fDcgxZdfmEUokUHuAw4PNb1YrRozpSezLtFFFZGwU UUUAFFFHagDzb4g+IIrO8t0stfay1GxbzJLZUJMqMB3Kld2BwCcVreBbSGexm10i1e4vz/x8 W0TxmVBwN6HgODuztGK5TX7i+uvEUtrqHhmKC7eUi0vbS8FrPImeCshyHbGMrnPtXpMljcfY 7eCG5l3RKoaRyCz4A5b1Jx1rbFTdKilGN38jmoLnqtt/mU9euovD2kXuowpuupMJEp53yscI PpkjPtXKafZ/YrJIS3mSEl5ZD1eRjlm/FiaxvjFr00N/pmlWs7xvCpuXdGIIblV6d8Z/OvNf +Eg1n/oK3n/f8/4114PBKNFcmiephXxaVVqWtj24kBcngDk1kaHGLixmvpVUnUJTKQeRs6IM f7oFeUPr2sOjK2p3ZRgQQZTgg9R1q9pbeLNSTZpbarPHGAv7neVTHQZHArp+ruK1djL60pS0 R6OfDWmCYz28UlrMf4reUr+mcfpVK7stQ/t6zgt9VeV4YJJlN1ErBMkL/CATnJrDi8LfEmXl YtQGf794q/zasSCHxbd3M8lquqzzwMYJmh3uUIOSpI96Iwvf30wlUSsuRo9B/wCKojbldImH /bRT/hVfVZ9d/sW+E9hZhDA4Zo5ySBtOTgivO7nV/ENpcPb3OoahDMhw6SSMGB9weauwweMt RsxJDHrFzazKQGVZGRl5B5HBFP2NrNtEe3T0VzvobjX/ALLCIrCzA8tcF7g9MD0FL/xVEjf8 wiEf9tGP+FcDpq+MdURv7OOqzpEdpMbNhSO2emfarF1p/jyytpLm5j1aKGNSzuZDhQOpPNS6 STtdXLVZtXs7HWafZX51bVLafVZYmJjuG+zIqh964J5BI+7V+Pw1pSTCeWBrmcf8tLhy5/In H6V5ppz+J9WunbTZNRuZwoV2hZiQoJIBI6DJOM1qNo/xARCzW+sAKCSfMPQfjTlTs7cyRMaq tflb/E7fWwLT7FqKrgWkwV8dPKfCt/MH/gNa9eIS63q00TxzajdyRsMMjSkgj0IzS/2/rIGP 7VvP+/p/xpvCyaSuCxkU72PYdRtpbi1DWzbbuBxNbP6SryM+x6H2rtNHuLXXbCx1pIyjumcd Crchgfocivmv/hIdZ/6Ct5/3+b/GvU/g9rUt5Z6ppU0zPKrfaY2J5O7huvuAf+BVxY/CL2PP Jc3Lqjow2KUqnLHS51XjbT9Qu4reSytp7qFYriKSGBwG3SRlVbkgEDJzz/FmmeErT+wNQk0m 52R3F3El0kMS/IgRERxnP3i3JxxW7Jpss2j3FnPe3ERkUjz4H2ug9VPY1wGn3vhaw1nTLjSY NTmkSYebqEkbDzEkJjBkd1BZdx4x3WuahOVWjqreRvUjGFW6PVqKKKyOgKKKKAEqvdyRxWUs kswhjWMlpSQAgxy2farNZXiK3t7zw5qFvdz+RbyW7iSX+4MHJ/CnHVky0TPMvDGl2d54ltwd Vk1JUfzo49Wt5FdlHO6FixDY4PSvUxf7tRa08phhc7j0riNDudT1jxJpcWsX2ln7HbfbbZbN ZA86upQOdwwBgnIHOa9B3KdwBGQefrj/AAqsW5yqRtK36+Rnh1GMHofNfxEvTfePdVctlY5R CvsFAU/qDXL1f1uQza9qUrdWupSfxc1Qr6OmuWCR4M3zTbNTQNJbXdfstMVtv2mUKW64XqT+ QNfSUn9meDvDk0sNusNjZxlzHEBk4+vUk9ya8G+Gtwlt8QdKeTo7tGPqyED9a9w8e25ufAus Rr1+zs3/AHz839K8zGNyrRg9j0sJaNGU1uefTfHGbzD5OhII+2+5Of0Wui+F2pJrC69qKW4t 1ub4SGENuCkoM84HU89K8C7V7b8Ef+QDqf8A19D/ANAFXi6FOlSbgrE4WvUqVEps0viH4Cj8 R2rahYIiapEuSdpHnqB9047+hx7Vr/D1Hi8AaXHIjJIsbBldcMCHbII9aRfGNtF44n8NXe2K QpG1tJg4kJGSp9/SuobhG+lcE5z5FCfqjshCHM6kfmZuhWlnYaLbRWCx+RsDbo8YZjyWz3JN ea6r8YBHcXenXHhpmjVnhkSa42kjkEMNhxmk+Fni3ytSufDd5J8rzSNZnHQ5JZM/qPxp/wAX PCHmofEdkmXQBbtc9VGAHA9uhropUoQrOFVb7GNWpOVFTpP1R1nw3tdPt/BNlLYIi/aN0khD ZO4sflY9yo4/CsHxH8WH0LXbvSzoLSGBtvmPPs3DGQwG08HtzXIfCzxd/Ymr/wBlXT4sb1wF OP8AVzHAB+h6H/gNdx8U/CH9t6WNVtEzqFmhyN2PMi6kfUdR+NN0owxHLVV0yfaSnQ5qTtY8 Q1K5gvdTubq2tVtYpZC6wBsiPPOAcdM+1U6KWvYSsrHkt3d2Heuz+Fl+bLx9ZLnCXKPC3vlS R+oFcXW34OkMXjTRXHa8jH5sB/Wsa65qUkaUHarFn0ut8X1BrTymGFzvHIrzC/1DTdAY6Xd6 Fqt7Ihe3gxiLzk87zEEYDFmCkDDAV6yWUMqkjJ6V5X4gsb+w8V6pf6PqOlaTMBG9xcS3EjMV bgbkZWUZIOAK8DBJpSjOV/w9Foe3iejiv1PVIpDJCjlCpZQSp6jjoalqpp/n/wBn232qWOW4 8pfMkj+67YGSPYnpVuo6m62CiiigBKyvEGmpq+g3dg83kidNvmkZCnsSD1Ge1atQXdrDe2sl tcRrJFIu11I4IpptO6CylpLY5XT7bVrzW7PUNbn02JLBXWFLRifMZl2liSeFx0Fb0UNpDdS3 C3Kl5RgguCO1eIeO/CN94WuvtNvcSyaZM5EZ3tmInop5/I964qa5u/JPlXMu/wD3zn+dctWo p1IupHWOx7tHJITo89KrdPy/4JLrCmPXdQU9rmUf+PmqNJGWeMM24uepPXNLX18Jc0U11PgK 0HTqSg+jaLNjeSafqFteRf6y3lWRfqCD/Svqktb6zopKNut7234Yd1Zf8DXybXr/AMLfHUMV vH4f1SdY9h/0WeRgF2n+Ak9Dnp+VcOPpNpVI9DqwNVJunLqeWanp1zpGp3FhdoUmgcowPGcd D9CORXsXwR/5AOp/9fQ/9BFdprHhDQNfnWfUtNinmAAEoLKxHoSpBI+tVvDGn6fpOpazp+mW q21vBJECqknLFATyTnuK56+LValy21OmjhXSq3voeQfFclPiDcsrEMIYiCOCCF4Nes/D3Wbv XfBVtd3zbp1LRF+cvtOAxz3I61zms+D9M8XePdWjubueC5t4oWCptIZCuM888Ec123hrw7B4 Z0VdLt5XliDs+98A8n2qcRVg6UI9VYKFKaqSl0dz5knllt9Tlmhdo5EnZkZWwQQxIIr6N8G+ II/F/hdLqeNPOO6C5j25UsBzx6EHP44rm2+DGkSXDSvqN2QzFioAHU5xXZaZpWkeENFaC2VL SzizJI8j9+7MxqsXXpVUuTcWGo1KbfPsfOvi/Rk0DxZf6bEzGKOQNHnrtYBgPwzivavhj4ok 8ReHnt7pt19ZbYpWOSXUj5WOe5wQfpXM6d4b0b4m32o6695cwyC5MZhGOEAAQ+2QPzzXoPh/ wxpPhKxljsU8sPhpppGyzY7knoB+VPFVoSgoP4kGGpTjNyT91niHxM0KHQvF0i267be7T7Qq hQApJIIGO2RXG113xH1+LxB4smmtn3W1sggjYYIbBJJGOxJOK5GvToc3s48255lbl53yi9sV s+EU3eMtGG7H+mRkk9OGBrG7U2RpI03RswfIwV4OfapxMuSjKT6I2wNF1sTCkurPq54rR79b s3Sb1GMBxjH51yuoeGZ7rWridL7TzZyTNdqs0e4mbyhGofnDIv3hXgsVzd+UN9xLv7/Of8a9 A8AeC7vxFKuo39xMulxvjZvbM5HUAg8L6nPtXyuHqezbVKNr7n3GMyWnTp+0rVNF5fhue06P ZLp2jWVkkvnLbwJEJP720AZ/Sr9RQwx28KQxIqRoAqqOAB2FS10N3d2eJZLRBRRRQAlV7u4+ y2sk3lSS7FzsjGWb2A9asUUAt9TwXxXZ+NPFWoma40a4SCMsIIAFGxT3PPLHua5W/wDDes6T bfadQ0+e3h3Bd8mMZPQcH2r6kxXN+NfDknijw9JYxTeVMHEkZIyCy9AfY1hKjfW59BhM6cXG m4qMfn/mfPI0PUn00agLNjaMGIkDA8DOTjOccHt/DVSa1ltziaCSM8j51I6cGuzlHi3wxDZ2 1xoxSOydmSaJCwJKsMllJA+/z0zgZqiPGc62VvbqlzHLBbyRGYXByzMgUMeOxBIySc96mFer S0hJo9GphqWKvKpRjPzVr/ecptU9Go8uvRf+Em8M3VzI99bmSNmiZVe3BMewklc85Vu+MZrP vJvDNxf6WYEtBEu8zqEMQb5crvJHrkY/XB46o5liYr4r/I8uWR4Cb1oyj6NnKQahqNtGFgvZ 41XoElIA/WnJquqRvI6X1yHkILkSkFyBgE8+ldbd6Z4YZR9jngmfbIwUXIiDuGOEyx+UY5yR 2681Xh8P6C4eafUfLg8rcuy5RiXAkLLwpPGIxnHO7iq/tSv1Ufu/4Jk+H8vavea+a/yOXGoa iLproXk4nZdpl3ncR6Zz7VN/bes/9BO7/wC/p/xroLvQdBsnmDXlzIqNGA6SxkbWdlzgLzgK G4P8Xaq66DpIutRik1JvLtJooElJCiR2yGbH90EcD071X9q1esUSuG8C1dTn+H+Rj/23rP8A 0E7v/v6f8agub2+vVVbq7mmA5Akckfqa65vCOmR28jyX08Mw3BIZXQNkCTBOByG2AgccHqe9 LTNF0W+s7WS4v5bN5E3yM7qygiVUIChcjIORnp34p/2rVW0UJcO4Fq/tJ2+X+RzlreXtlvNr cSw7sbvLcjOOmcVJcajqN3F5dzfTyx9druSK6S+8P6Pa6lpsMN150E+fPdrlFCkKD97ooB+v p1psWleG2kYy6g8Kxq5KtMjGQrIQBkDuoGMA1DzWu3svu/4JrHhzLkk7zfzX+Ryfl0mxR1au y0ybw9aeeszWbol6T++gMzyRBl2eWwwAMBs5H4VZvPEmiWqTLp0KtPl2huooRGUOUIByoJHy nsMfjUSzHEyXx29DenkWBjKyouXq2cXb2st1IsVvBJKzdAikk1budF1GytzNc2bwxqQCXwOS SAOvqp/KugTxu63ck8dk8s7O4UyzZBjaQuFK4ySM4HOMdqeumeLfFsS26aVKITKsu908pAwQ JkFjjkAEgDrXLOrUq6Sk2elRo0cJLmVONNd9L/eYlj4Y1zU7Rbqy02ee3YkK64wSDg9T611/ g6Lxl4Tv8pot1LYTMPPg2qSQP4l54bH4V6v4T0H/AIRvw7baYZvOaPczybcAsxycD05rc75q 40ba3PIxWcyqqVJwTj8/8yKCUT26TBXQOudrrgjPqPWpqKK3PDCiiigAooooAKKKKAGMoYYI yD1Bry/xd4d0vSdVbU7iwgk0u9IErbP+PeXHDZHRW6Hnr9a9SP3eK5HQNSt9X/tfw3fhZJrO WSJ426SQknafyODVwkk/e1REqs4NKErPoeZv4bsdXR/7O0eSzTtcXUrp+Kx8k/iRVW88DwWc 1ikt9J5dwxiebYMJIeV4z0OMdetdxc21x4Yu0sb12fT5XCWN0eT04jk/2h2OMEd81Je2cWoW U1rPu8uVcEjgg9QR7gjNdDoUZW91WNaeZY2C0qu/nr+ZxL/Db+7qv/fcH/2VUNR8CT6fa/aD fRSIHVW+QrgMwG489Bnmu70i9lnSS0u9v2+1ws2Ojg9HHsw/WrF/aLf6fcWrdJoyn4kcH86z WDo81mjqWe47lup/gv8AI4I/DrURwL60P/fQ/pUF54E1Gzsri5e6tmSNC7AM2SACfTrXoGj3 ZvdJt5n/ANdt2SD0dflYfmDTdb/5AOof9e0n/oJo+pUuazRf9v43lupL7jh4/AOqTxJKb62+ ZQRlmJwRx2pf+Fdah/Ff2gH/AAL/AAr0G2/49Lf/AK5r/IVT12d4tIkSH/X3BFvD/vOcfoCT SWCpN2sKWf41RvdfccJp3gOfULGO6+3RRpMCQDEScZIB698ZrRT4bf39V/74g/xau3t4Etre O3i+5GgRfoBgfyrO1e5lLR6ZaNi8ugfm7RRDhnP4HA96awdFvRESz3HKOs9fRf5HI2XgeDUE umhvpBGkpjhlKAiQrwzYz0zwOf4auJ4f07SFQanosk6d7m3leRB7svBUfnXZW1tHZ2sdtAuy GJQij2FRWFjJ4uuTDEWXREZkupx8pnYdY077fVvwBrRUqMbvlVjlqZjjZ2vVd/W35C+DPDmn X1//AG2lhBFp8IMVmpi/1rZ+aX3HYde5roLLUNUbxK1vI2bfey+V5YG1RnBzjIHTBPXdSaxq 0UGuaN4astqzTSK8iheI4EBbHsSVwPbNdXWDmm3oYqUqju5N238xaKKKzNQooooAKKKKACii igAooooATNeMeLBc+G/iba67HvWzuZI3Mi/dYYCuuR7DOK9n59K8o8Vaz/wjuqTaRrOmDU9E uT51uDw0I/iCnH8JzjkYDdaUjjxdrRb0szT8a+IW0DX7WG+t1vdE1GHbPDKuVBDYJXt0IJGO ahl0u80iC3n0tpNX0mZfMTDbp4UOMEc5kUZHAGR70XenWvinQrXR7u5/fhBLpmoyciZeyH/b A4Zck8ZqTSdG1ObwW2lRXbWet6RO6RSIxA/vD6oytxkfhxWkKkoN9jK8+Zu2nT9V/XyMfUZ7 O5iTVbS/ghurTIDSMFB9YpASCAfQ9DUdv4nmv1RNP0qWa62BpYpHESx59yMsPcCsfStWsde1 VNO8S2Sx6hJNsTUYVEciSZwBIowH54yRXUXXhHV5A8lreWeo3Fv8i3MTfZ7iL/ZZQCrf7rEV 2069KaWuvmKFRzTlHb+v6/UyIE1a01Z7eW5trOO/YyrtiMgEoABQEkAEgbunNS6vpV2NHvZZ davJNsDkoFVVOFPBGOlU7u81j7I1prXh/Uw6HdHfW9uSUcdGwOAR7NzTX8UwXWiX1nfK8N2L d1DMhVZSVIBGRkE+lb2k3dC5oWs2attpN6LWFk1u8GY1OJFVgOBx0qnjV7vVt0ctpex6aSAX QxB5WGCMgkZUd/8AaqO98VQi0js9N82S4aJQZ44i4i4AJAA+ZvQfrSWtzrU1slhofh7U7eM9 bu4tzuYnkthuMk85JotJav8AEblDRL8C1c+KZbJHhu9Mkhvgu5IQ4dSM43FgPlXnkkVYsJbD T4Wu57+K4u7xstJF85kPZI1GSVHYDNXLXwdqaMiXF7Z6bNc8PIW+03E/cj5gAPoMgVydxrFv YaummeELGNLozeV9vkUSyyuTg7NwIRSf7tc9SvSirLUJ1HCzl/X9eZ2KaZNqFpPe6+7aXpNt 872+797Mo5HmY+6p/uYyat+CvEj69c6peeUtlpVjEsVvbpwiryST2zgDoOBUHiDQL/8A4Rex 8Ox3bXOqajcB7m4kY4YKMsx77RhQOPSoxa2Hh3w5PpFvcMbSAeZq1+gx5h6GFDn77cLjPyj3 NcM6kpvUbc4yvskvx/4Bi/DuK71nxve+I7oP5CCT9633d7EAKD7Kfwr2Uda8w8G6xJ4n1WO0 0/TU0zQNP/ePDGf9a/8AAGIx3+YjvjnNenipjsb4NJU9NRaKKKZ1BRRRQAUUUUAFFFFABRRR QAlZet6FYa/p5tNRt1mjB3KNxUgjoQRyK1KKCZRUlZnlT2Xw80YvaataXdrcDnyrozMfqpQl T7EGq0HiLT7W7lu9E8WKHaIIbbVrd2XauSBuVQeMnnJNemazoljr1g9nfwLJG3Q8bkPqp7Gu X0n4aaLoV7/aAFxfyR8pHPtYJ7gY5I7VNn0OGVCpGVoJJd9n+BwHiGLT9Vi/tdUbTNWc+Ywk Vhb3eOd0bEZDHGQGxmux8S6dqGp2+neLfCsrfbhAPNKHBljIyPlPBIOeDWn4s8caRpNsILqw lvRKcGGSBlTHuXXBPtXOvq/hzUYkbwtb6jBq5XItdNjMO7/rp8uwqCepoMnGnFyipJvy3v5H d+FNbOveHra9kG24wY7hcY2yLwwx29a2yAetefaN4O8RLK2qXPiF7O9ulBnghgBXcBgE/Ngt jqcVPq/iXU/CUkC3lzY6sruE8mNfJuRnoQoZg34AU79zrjWcIXqJrzO66VznjPXJdB0B5bRd 99O4htk27sufbvgAmsnRNd1bxhDLJa39jpaBiogC+fcKB3bLAL9NtVNY8IeJYrg6xYa89/fw oUihliVcKcbthJwrEd8UX7BUqylTvTTt3INK0298PeG9Y8SeIZm/te4gYK7EExrj5VwOAS2M ge3vXLeH007w7bjUoU/tDVY+tyVc2tnkc7iBlmwedoIrdOt+FdNgZtetL+81hQN1vqaGV0J5 wpK7QvoQK6nwv400rW9P8uCxntCmV+zrbsygegKrj8KWhyxjTlJRjJJper/4c5GbX9InvTda 74r813i8l7fTLd1TYTkjcVJwT1wQasxaX8P9elS10eyurmXrst2lRV92LkAe/etjUPhdoeq3 /wBu/wBJsTJ80kFuyhM+wwcH1xXXaZpdno9jHZWMCQwIOigDJ7k+pPc07Pqa06FSUv3iVvvf 4jdI0ex0OwSy0+AQwLk7QSST3JJ5JrQpaSmdySSshaKKKBhRRRQAUUUUAFFFFABRRRQAUUUU AFFFFAGfqekafrNr9m1G1juIs52v2PqCOQfpVbSPDWjaBvOmWEcDuMM/LMR6biSce2a2KKCO SPNzW1M3V9Ol1Sz+zR39zZZOWe3IDkemeo/CsXRvAGl6TqbalLJPfXn8Et028p7j3966ztRR YTpQcuZrU4/Uvh7pd7qp1K2nudPum5drSQpuPr7H6V0WmWU2n2KW0t7PeFTxLNgvj0JHX6mr 1BoCNOEG3FGJq3hTRNelWXUtPSaRRgPuZWx6ZBBI+tXtP0yz0q1S1sLZLeFeiRrgZ9T6n3NX aKBqEU+ZLUWiiigsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACii igAooooAKKKKACiiigAooooAKKKKACiiigD/2Q0KZW5kc3RyZWFtDQplbmRvYmoNCjEyIDAg b2JqDQo8PC9UeXBlL0V4dEdTdGF0ZS9CTS9Ob3JtYWwvQ0EgMT4+DQplbmRvYmoNCjEzIDAg b2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMiA4 IDAgUi9GMyAxNSAwIFIvRjEgNSAwIFIvRjQgMTkgMCBSL0Y1IDIxIDAgUi9GNiAyNiAwIFI+ Pi9FeHRHU3RhdGU8PC9HUzcgNyAwIFIvR1MxMiAxMiAwIFI+Pi9YT2JqZWN0PDwvTWV0YTE3 IDE3IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9B bm5vdHNbIDI4IDAgUl0gL01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDE0IDAg Ui9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFi cy9TL1N0cnVjdFBhcmVudHMgMT4+DQplbmRvYmoNCjE0IDAgb2JqDQo8PC9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDM4Njk+Pg0Kc3RyZWFtDQp4nKVbbXPbNhL+7hn/B3yUOjFMgODb TadzzluTm4ubRu50bpJ+oN4szkikQlLO5X797S5IiSC1Mtu248SxFsBisfvsswv49q6ss3W6 qMWPP97e1XW62KyW4vPtQ7H/4/bh+351+zF9zPK0zor8dnaY1/ijd6t0uSp/+km8fP1KvHy4 vrp9q4XS4mF9faWEB/8rkXjS00ZE2peheNiBzM+zSDxW11eeeMQ/fr6++jwR0z/Ew7+ur97A JF+vr369vhJvPrwSt4xWL4u6Lna8Ym+Lou4p5otYesZRTYeejJUIQ6mMId0+T151FMGBJ9lw IHs/vQkms6kPXyqGLdxo+tdqMVVqUq6mN2ZST5WepCV+m6VTFUxqgYO+TJhlfD+SftJdRoD9 0KSLz5P/3HGjTCyj3iga8WXKjQiUVIm7neEZdEcoX8s4FEEow9AxQFrT7qYqmhTTeJJPb8JJ up0qz7HIjT85oJXKrEbrfEcp+vxuaiaPUwVC+TScLL5Pm5//QIZKcEwMU3jN13HO9Cl9ROOu BC7/aaoSWB6XXuL8nSlQ+ABfpGFNpyJYq0TS+O4eQ0421DJSrqyCZULUOOAGRfFgAVaZmI7I kYUdJZO3uM0av/uwStHOyxWal7asGzNF8BXQ1/nJTRBI3VPkhpWNpVLjrGJCH/23IytuEADw H+CPKmQVihJwRWegdeHLXqmjSMYBjJa+1+q2ABeMJxX6VPVPdBFyyYpMJdFI5G7kLE89bW7f gqObPk74vpGqt8h5tc7gn++F0gsgRGX0zODeCO3J5MKII4zCP5XUKvDtcPAZgILYkzoQoR9I XywQdD+s6lRF4nUhumMJZMXtR4TXD6/evxaeg5nmjDFUBDsxIowTONYW0GHPNB2eNUCYPTjB ebaKI6m6M5w5aueQlSejqDvggqwJx8vG+llZxiNUfHHkwK7qcpJsjRoFYJhnlG6MwYgOVtad lfvLhQrcY8QcvqP9WYMYArbQgMOd89nBlGacQXwlzSgDB8+qCBiEYRWqQJqwmfItJJ9fPsEf b36Hv4LJ6wsJ1ovcsRfVCZ/ZnjHoOAEEQtDmDikeNlnFx4wn/dgZ8fFieHUli22GGWKB6fD7 1IfMXO2nNwCHK9j6Ar6ydbaCbFEJyOUAmBv8uThU+DNRrMUe8+e8nQQ+quo0X6aYSsslgatY FyXYT+CnwHZUCOtob7KvAWYhHT8i9paUnkFgv8kWYo/yRfM5Diu2zxAQLyabRb6Mmn3hZPlS 4F/b0zoFcIzNDoFeZHmNOuN2ymK/mkatEmCIebbFzzLcst+YpS5ArwJJQkg61eIeJ69p50VO CwlaadbOi2KHkmbx7KYFfKZ9+31Vr3aV+AJMybdD6I8vUyksAeKSoU/JsLPVl6A7Lk9nshRF Ps5YQSKTrrEaU2llN1xlFVEHOIVkshY1HDwcIm5rjfqt0WLWDvac1uIr/vxAc9WHHQ2mw9vt D2TqLH8EEgj6sQTXyCRxFGMJkG95R0f0PWbunHQryl0KyrZHI+6q6lAiL0TVyNPJiYFpgzCN u5veRMiI0fCN5+C2m8/O6xB4kUyMo8PNKMNDGmrhedUafr5d4ZJRsw2yOYRNONlR9cIBvhfI UDkzsrkBFu+JPhDhJXts8mJbPNI5Wj9lS51YJpEzS8eKD0iuvkzZwQmQkcQZDBG1PBwjqnrB HndAhHrEPtEzeqLgujyrD6UfONIcdPpAXz136y52clQ9lEkwTnWgDD3Rw35JIEMng85SiQu7 MUhD3b0TJpxCdJR/QjWnuzB6qDeAm//DY0IVGlDFWCZsOEJqRRiJ35XFU7YkvHgiD18WZUXe 3Y+tB3EgQo5agsiuwDCl4ORslMRko66O+YpqTUovjGFUIoPEHcWWNNqXQW+Fk/3LHW98CDDf HbfeohH+i9vN5uQr1mPqJtIwr2Qj4RpopWnn3a1WAA0W33JKbOgWWWmLYNUCF+a4FeXSPapA ZipTwO1+fsOIL9vz/XrISlR7t8rrSvJxFtBBdNV62OBh0vG1frcWiMTnPchNy5QkNztLF/zn Og6NUTwjw3b1bQGmYGiPTqQOXXHu/JXvS92bGrN+hGePvMdgChP3sxmaU3zLtmRLMbf75rAP CmVgmM6s+x7FWqIvpKI6zCs6qq8HCp5aIArUND0EGKXSC2zQAH9EEOiuxGGaCRQUZa5sceJy 5BiSJSKwo55NmVZdl/1G52oOS3lNFMr4XNHhyIZ6IKtZL8VaoS/9ieXGGjfkyBIlzcBfAbQq DApL6VpHhgNDb4WzsmlaVJu0xAO1TIc/JB/yKACSsxbBewVBl1Fg2BBhbO8lyJRGGcwoPZBt uewCsACC9FCK+5aAt6RJilERiE0dr532A2dZLIld0WJJaJoLVKHYEVs85NkiPeJakVcECQLV DIcMhSCtSTSMkbVBvuGsy8Wnr4nYOLI89Gkkn44swdjWptm5rQUWRZ4jTC+OVn1ClCP6z6Ue gx2yUUoYHQ1k54eaRwVgUIErDu65yZACkvKblvv36B9/9CbBPmHTWLNEf9uWPpTzWiq9b7M6 ZQXIKoBya4waIOoZEBwsIFeCTplMd5yFePBji3wpgjAutMlWTxnbRjWYlxzlmhRZOXWtE8Vu KYgMpo2Hc6lylHUgP5oujOyKBhQAMjBN9mqU6lQkVphu4skOki/U/StBvWyiWtaxaAiRLc4G QHc85apQl7hcXu0ye/fA8eGYvKo7kscwNZC1eGhaOLQEhdxA2J3uVriZbSeOW0o4xqZaIcXq MFt7kFiKit0RNTHs4CTRQLhb3Rj5keBtBUypdUf6AZuxw0iqyF2Tq0905A1k2SoIC/ie7NEV q30BtkCUmBRUa+8s83jELebEFVYshEGlYUYqjKVGX5an3HogW5SirdqKHDj+jQqa4yywUXDT NFNszyerEdeDybgmjoGy+piobPWTsrSOKnBnBMTMHSEJYoTFj4YfN2FDcWZZJ/V6toLYbst6 K9AZArJlzMYS5mOY0pCmkxVOigqgbLsVR8CicmfLnZBRCqmZoy+fts1AFti0vZ94OiqX71rK ndcvgIxadjjK0H5iOrkgXx4qipUSJ6SzfNHGJky7EQ1qoSNagvKYiz0VXXWOhoPyDZN3viTk 70Jq3rEgftj0yorykSAJ64LI4R581WEg9UIR7qh+qTVqoL4HcHLkWTJsc6Mj61b46N/uWrxx 8ZalnWVdIMs5nPpzBIhoil58LIod/hRAoGH+xdo6LhbXj9MEXda4cWS7yMHgagmiFVCmq8aP nvdS/dQfObyU0lF/5AUm5A1kgVjS9Vm27JWngm56iVFziXVNQ0vMkYgsvRQ5yu5heMpGwMax r5DxdaEBLI7dQWwpgV2VnizW7sesQ6dKncYmIpcvxJHELLlsAA7tR+6sXGWq/VD6fldW2AcU eEFWF+ytVyDDxB1FI9hlgDqFgauS7eKIXYq5FU6Da7T4XiAT3x3LtxCgMvEC3vpMBRnzFSQ2 /4K2GPX5qhBQoS/9wNabPl5bObLP38U44pcvYxzR4W0Me9VnkOI5g4lA1OmcdR/qADtD7HLV hm54bLnF0iHglIk7Ou3c90ACgBL5kAHBKtbY+TvCW/fKh6KluHDlsyi2mEf8sZQQa7y4bb8P b5geifXSCm2SOXsbxGccDfTWU+46vGw8kKVLHWsiQLYlJjtj0YENIY/Cb8yCvucPZC9es6W4 2aHBl3T+CwLL+bGHt8EjLL71Cg3+KIDdeK0WGVX0++1q12QyS0xo3vPHdNN4AtqJay6nC1Aa mR0e5tnSLbpYuV3gFYBbyt0ChwgGkgZkO0cWESFFw+0h/aXNzdg4GqaTCLsUHZytsKIJ2VYF Jq3EHXYpZ/VEse9ToBnx3OlGd3hT2omLpr9p2v7mt4waN/0C7qmtTq3NOcLuA4iEkasQlv5w tDYgu8QWSSU4TprjYY9DAx370hxd8AyllfzDE8gJOnRn4GUTBHlWlklcCZ+4dBBgINupzHOJ y5Ee8TLAkb+cjRzRM28DDqfHAWWFXrpsT6xJH+wjyQim93vz276fLVpqutPo3V67Dy08GfQ0 vGdlE3yW5cieua3nimODTyadwTO2OFYDpZir/wuNvNAft5rxDbaNHVnnLcGr++5LAvbiOpZR zyvGhZdR+KKu9SO05KA+UsGLYXkSDh65QASFvQnvMVbT4wltxXtsJu1S9xo/zRfkJx9h6cV3 Qib4CMuL39oGI1ZNHw9z7GdOIKHMKPuWywp7jj61LsbsVdOFzfEGmW1BaBmGrjQbjToYyM5O zkKqzzZpSfUeX7MkCb7fG7Wi9vRAFozzHp9JEP+x1tW2s8HMEVOec+bAXqa4p7GGogmb32JG jXrr9Xh5BEcz+06cdLUjfvls7dmkYWetgTud8rAaCPduyzmOZcJIJvE4G5pIyd4qSvyCO62L Od2ujvMnIOy6nUB7Sh+7K6/wANrrxLvlU1YVJcSSthT6A7oF3otDCrMDDjtbdDZ3vJ5mi3ML LN2FuZrPB1sisHRlFS4/Kpp9iOZIuaN/o+uyZ0ORWp2b/o0/b0Ugx2ZE7Ajr5eDgRExOEIKO SM7bB5sZNaZPsP0XHdg+NHDU5IFfD2S/TD7R1e/6yGSJEZ7eLHFRaoCLBHFvMi4BGHz/Z1xh 9po38Qay464GVRye8svdcpm5yXdR7DP7osU2uYiqsUCmE2yTOFNyRAbbJABYjuwwT+2ArquI vYpDbhcqdxL+rXA4kLVsuZjXqW1C22cP9DqtLHaUr2btBQb1VOtjI6nMqOslqMdug94pnxy8 GHUQkZZx+1L2G2bPeWVdHOf7x5nHqrN9mp/eJ3vneGvgIYK6U3+D6b5JhMa8qmSnzn4aLtF5 /6zOzK+1wj6DMz/nohrK3zBxZUfQcXXu+XPzK0nKRJ3X23/zP9ZtqP3lLHVb3XLSiY8B6Cp2 0az+he3ZNy5jZjEXZgGwM3/VSGzw0ktsZ+pPVKa+n2p/Qr7/Dn8v6BN+91rgt5ISJfwUAuLf by5kw6g38eWdB2d23vz+hcJ3l3/G1UJ+LiggYs3/LsdwrnMvaJq58EnOn5qr7aXC5+0beEMo FtH1OQQhTFeurq9+/0HkbdbD6JdJ6L6gx+cliQgDjdnCKvDqHRzO3XsEse6bm19Jnb+3HF48 6N5ywl2DNvt/xY8Uew0KZW5kc3RyZWFtDQplbmRvYmoNCjE1IDAgb2JqDQo8PC9UeXBlL0Zv bnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YzL0Jhc2VGb250L0FCQ0RFRStCb29rbWFuIzIw T2xkIzIwU3R5bGUsQm9sZC9FbmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0 b3IgMTYgMCBSL0ZpcnN0Q2hhciAzMi9MYXN0Q2hhciAxMjEvV2lkdGhzIDQyNSAwIFI+Pg0K ZW5kb2JqDQoxNiAwIG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BQkNE RUUrQm9va21hbiMyME9sZCMyMFN0eWxlLEJvbGQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9B c2NlbnQgOTQyL0Rlc2NlbnQgLTIyMy9DYXBIZWlnaHQgNzE3L0F2Z1dpZHRoIDUyNy9NYXhX aWR0aCAxNjU1L0ZvbnRXZWlnaHQgNjAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMi9TdGVtViA1 Mi9Gb250QkJveFsgLTE5MSAtMjIzIDE0NjMgNzE3XSAvRm9udEZpbGUyIDQyNiAwIFI+Pg0K ZW5kb2JqDQoxNyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvRm9ybS9SZXNvdXJj ZXM8PC9YT2JqZWN0PDwvSW1hZ2UxOCAxOCAwIFI+Pj4+L0JCb3hbIDAgMCAxOTYgMTkzXSAv TWF0cml4WyAwLjM2NzM1IDAgMCAwLjM3MzA2IDAgMF0gL0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggNTU+Pg0Kc3RyZWFtDQp4nCvk5SoEo0AwAjIMLY0VDIAQQusa6BkAgaGpkamlQnIu L5e+Z25ieqqhhYJLvgJEDwCfrQzxDQplbmRzdHJlYW0NCmVuZG9iag0KMTggMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE5My9IZWlnaHQgMTkzL0NvbG9y U3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9GaWx0ZXIvRENURGVjb2RlL0lu dGVycG9sYXRlIHRydWUvTGVuZ3RoIDEwMzI5Pj4NCnN0cmVhbQ0K/9j/4AAQSkZJRgABAQEA YABgAAD/4QBaRXhpZgAATU0AKgAAAAgABQMBAAUAAAABAAAASgMDAAEAAAABAAAAAFEQAAEA AAABAQAAAFERAAQAAAABAAAOw1ESAAQAAAABAAAOwwAAAAAAAYagAACxj//bAEMACAYGBwYF CAcHBwkJCAoMFA0MCwsMGRITDxQdGh8eHRocHCAkLicgIiwjHBwoNyksMDE0NDQfJzk9ODI8 LjM0Mv/bAEMBCQkJDAsMGA0NGDIhHCEyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMv/AABEIAMEAwQMBIgACEQEDEQH/xAAfAAABBQEBAQEBAQAA AAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEH InEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZX WFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6 wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEB AAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2Fx EyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVW V1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4 ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/APf6 KKKACiiigAooooAKKKKACiioJrmG2UtPMkSgFiXYAYAyTyegHWgCaisXUvFOjaU8K3V8imVB INvzYT++cdF9zxUc3izSYL65s2lYzQWf235RkSRYPKH+I8VShLexHPFdTeorFl8T6ZDNpMUs pSTVADbKRyeAefTqB9a0Le/trq4uIIJleW2cJMo6qxAIB/A0nFrVopST2LdFFFIYUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAIKWkqjqOrafpMKy6jeQWsbHarTSBQT6DPWhJt2Qm0tW Xqxr/wARWFhqUeltKv8AaU8Jkt4GyBKRnA3YwCSPWuM8Q+MdSkvLyzs7WVUtljvrS8s3Mqzo DkB1XkxscqSDgd62L/T7fxrY6DrVvBFMgbMkUvTynXDjJ53KQCPda2VLls57MxdXm0huZXiH x3cwWfh/U7CWOKC6SSae3lTLS7doManGQ2ScdOVqDSNK0W68USSWMbT22raS8kE0zs7K24q4 yT8uQ4yK6jQPBdhoMkUkd1c3LQvK0BncHYJNu4cdfu9a17OaBLmS0t7cQoh3fKm0c9ePXJpV MVSpNQju9PXqKNCc25T/AOGOG0bTfEGn2a3C6P8AaXvdKitJInlVDDLGGUbsn7hBzxk0yf4e ahJY+Ws0Qu4NLgt7efef9aocOCMfcZXxXfXP2z7TB5G0x5PmeoHH51NeRyy2zJC+2QjANZPG z95xjt+PoafVYaJs8+u/Bmvzr9qW4txdWkNtFZwjBDCLa5yxA2kuD+Fbnh2PUdO1jVY7zSbl Rf3zzrco8bRhNoChsNkHA9K6e3SVLZFlbMgHJ96gsvtheb7UFA3ZTHp+f6Uni5S5YOO/4eo1 h4xbknsea+Kp7abxuryTyiSCSC1EYkKTwszArLCPuupzghsn5a0dO8YareeIpwt5ZpppuJPL iubd1Jgj4eSORRgnhjhq7aW4gOpJA9uHkCkq+3JH6ZFYF14HtBY6ja6feXVrBeWzxC18zdbx lv4lQ9Dnrg963p4mjVVl00MZ0asHdPfU0dG8X6Trtz9ms3lEhjMsYlhZBJHnG5cjkZrfrznW LnW7fRDLqGm2Gn3ClLC0uY5d3kiTCvJu42LgDA9cc1dg8VwaTLNaITcaVp0UVqLgZlmuLk4+ RMfeIXk4B5pyo31j/mVGrbSX+R3NFUtP1G11O0W5spxNCxxkdQR1BB5BHcHmrtYNW0ZuncWi iigAooooAKKKKACiiigBKKWqWpahBpWnXF9dMVt4IzI5AJIA56ChK+iE3bVkOqaxa6RHC1yz F5pViiijXLyMSBhV6nHU+1c/4qgki1jT9YfS5NXsYopIJLWKMSupfGJFU8HgYPsa5rUJrnxL D/altIIdWt0CFInARrec5WDc2QJiuDlcY3YzXZ6Al7peh+ZqaJBGMCCyiwRaxAAKmerNjkkk 89K1qONCHtJPbcwV60uRGb4Y0CK0sYdTvbaW0eGWeS1tyxBggkORE46EDrt6A11sAiezUWpW OMjCbFAAHsOlM862ubAzy4EJUsxbgADrn6VxVz4jutUVIfD5+yaZyGvWQb5Mcfu1boP9ph9K xSq4mTenI0a3hRjZbm9da3p/he28vUL8S3DHMduvzSv6BVzk1zmq+Pb6O2MlppqWJkP7v7U2 64kPT5YVHJ+rVhalp2l2lp9iWz+1Xl65KCRyWkccl2fOQB1JB+lJbeH9Q0zbc2V/HNeNGEk+ 1qWTA7KRyBXbQwdGlCKXTuc1StVnJ/oR3N/4vksnvtV8Rz2luACILaJVlYnovAGGJ4Ayaa2n 6rHo99fX+s6m03kM8UH22TERCkjJB+Y+vGKWO71G91hXu9MaaPTmIxaOCPPIBz8xBOFP5tU+ sayj6PfRNYX0TtA4+eIYGVPUgkV1Ws7JL5GPu2u7/MjvNO1SG1hvNO1fVQqxBpbcXchL8ZJQ k/e9B0NEOoeMLazS903xC+o2bKG2SQI8mO4wepHQjcKuW2tqbaFYtO1CQiNRxEFHAHckVnpc 6nZaq8FlpywR37GSJbtxtEoGX+4ScEYOP96klfRpDaitU3+J0+m+Pbp7Vbi50sXoj4d7FszI e4aFgCp9txro7XVbDxNCj6bqKB4yDJCD+8TkZDr1H4ivN7zw5f6gsl3cX0a35j2BbdSkbDOd rn7xHvmrGnWGmXtrGsNq1ld2L7SImKyW8nU4bPzA9RnINctfB0asLfkb061WMv8AM9T1BLOW weLUIo5rZhtkWVQVb6g8VyOteErZLJr/AE2KRIrS2aSxsLNNhW4PIlyD8zdBgg8VHbeJZrEG 18T7ZrNmCxX6JjGeglUdD/tKMeuK7Se4hsrTzMfuxjAXvn0rjlOrhpuVRpQX9M3tTrKy+I8/ 0K71DTReG0lWa104SXGqTyFVW9u2XLIjYwioRyR34xXb6Frll4g0qG/sXzG45Q43Ie6sB0Iq nqmiW3iO2s0lldNOEnnTWygATnqAxHOM8kDrWCniNR49u49Ns7u8tYYBDKtnEpVpywyWYkD5 VAHWui8a0eaPqZK9N8smd/RTQcgHpnsadWB0BRRRQAUUUUAFFFFACVweu6hrN3rUd7pdl9u0 rS5CJoYZwGuZCCrgAHnZ/dI5JrpfEeonS9Cu7oNKjBNqyRxGUxk8Bio6gE5PtXOeE7C+07yD pOtWur6FKSZQzASQueWZWAO7LclTjGa1grRc2YVHeXIh+i+GdGjuxr9nNc/2cc3EGnum2OGU 8M4QjIOBgDHHOK6pb22ksXupHVbdQS7PwAo6k56cVKslvPvjQowX7yjpzXDeJ7oazfvoFuzJ ptrj7cY2x5rEcRAjkY6nn0FYw569W/MuSxpLlpQslqVdQvZPFVwHkVotFhf/AEeDkfasdHcH +D0Uj3qW5uYbK0kuJ22xRrk/QdAP5Cs2O31jTt3lTx6jbgfLFL+7kQDsGAIb8cVm3Gt2up6n bWN4slhDAfNuI7vCCRh9xc5wRn5uv8NepGC6bI5XO3q+5qaRaTbpdSvY8Xl0BmM8+TGOiD+Z 960Ly5Wysri6f7kSFz+AzipEdZF3oyuh7hsj9Kytf/e29rY/8/dzHG3+4Dub9FxU7yuxy0jZ E2iWzWuk26y/69wZZT33sdx/U4p2tf8AIA1D/r2k/wDQTV6qOtf8gDUP+vaT/wBBNCd5XG1a Nizbf8elv/1zX+Qqjr8TvpT3EK5ntGFzHjqSvJH4rkVetv8Aj0t/+ua/yFSEB1ZW5BGCPY9a UXrccl7o2KVJ4UmibKOoZT7EZFZmqwS20yaxaIzTwLtniT/ltF3HuV6il8PkjSltm5e0le2P 0ViB/wCO4rSkkSJGeaRY0HUuwUfrTWkiX70bsSOSG7tUlRllglQEHqHUimaXqLeF5fs826XQ pmO7fljZZ9P+mZPbHy9elc7Ya3BYXdzpllFLqEe/zLUWuGVEPVS2cAK3/oVaEtlqmp8XdzHZ 2jDD29v87OD1DOQMfgKc6Ss4z2Ep31juj0+e9t7a2WYspibGCvIIPcY61Tvr600HSWu0tgsT Sp8kSgZaRwMnHHVsk1zfhW9+x3f/AAjl6Wlt2Bk095Gz8q4zESeSV6jrx9K6u/gsry3bTrxE aGZdpjJwCOOB3z6Yry2pUqr9o1y6WOu/PD3fiOc0DxNqN7rUtrqCW6wl50Xy0ZTA8cgUI7Ek MWDBhjFdkOK86udJ1FNSjtNH0dxpmn3hup2vLxka8m2ghg5DEqpwck8lfau6028F/p8NyDFl 1+YRSiRQe4DDg81vVitGjOlJ7Mu0UUVkbBRRRQAUUUdqAPNviD4gis7y3Sy19rLUbFvMktlQ kyowHcqV3YHAJxWt4FtIZ7GbXSLV7i/P/HxbRPGZUHA3oeA4O7O0YrlNfuL668RS2uoeGYoL t5SLS9tLwWs8iZ4KyHIdsYyuc+1ekyWNx9jt4IbmXdEqhpHILPgDlvUnHWtsVN0qKUY3fyOa gueq23+ZT166i8PaRe6jCm66kwkSnnfKxwg+mSM+1cpp9n9iskhLeZISXlkPV5GOWb8WJrG+ MWvTQ3+maVazvG8Km5d0YghuVXp3xn8681/4SDWf+gref9/z/jXXg8Eo0VyaJ6mFfFpVWpa2 PbiQFyeAOTWRocYuLGa+lVSdQlMpB5Gzogx/ugV5Q+vaw6MrandlGBBBlOCD1HWr2lt4s1JN mltqs8cYC/ud5VMdBkcCun6u4rV2MvrSlLRHo58NaYJjPbxSWsx/it5Sv6Zx+lUruy1D+3rO C31V5XhgkmU3USsEyQv8IBOcmsOLwt8SZeVi1AZ/v3ir/NqxIIfFt3czyWq6rPPAxgmaHe5Q g5Kkj3ojC9/fTCVRKy5Gj0H/AIqiNuV0iYf9tFP+FV9Vn13+xb4T2FmEMDhmjnJIG05OCK87 udX8Q2lw9vc6hqEMyHDpJIwYH3B5q7DB4y1GzEkMesXNrMpAZVkZGXkHkcEU/Y2s20R7dPRX O+huNf8AssIisLMDy1wXuD0wPQUv/FUSN/zCIR/20Y/4VwOmr4x1RG/s46rOkR2kxs2FI7Z6 Z9qsXWn+PLK2kubmPVooY1LO5kOFA6k81LpJO11ctVm1ezsdZp9lfnVtUtp9VliYmO4b7Miq H3rgnkEj7tX4/DWlJMJ5YGuZx/y0uHLn8icfpXmmnP4n1a6dtNk1G5nChXaFmJCgkgEjoMk4 zWo2j/EBELNb6wAoJJ8w9B+NOVOztzJExqq1+Vv8Tt9bAtPsWoquBaTBXx08p8K38wf+A1r1 4hLrerTRPHNqN3JGwwyNKSCPQjNL/b+sgY/tW8/7+n/Gm8LJpK4LGRTvY9h1G2luLUNbNtu4 HE1s/pKvIz7Hofau00e4tddsLHWkjKO6Zx0KtyGB+hyK+a/+Eh1n/oK3n/f5v8a9T+D2tS3l nqmlTTM8qt9pjYnk7uG6+4B/4FXFj8IvY88lzcuqOjDYpSqcsdLnVeNtP1C7it5LK2nuoViu IpIYHAbdJGVVuSAQMnPP8WaZ4StP7A1CTSbnZHcXcSXSQxL8iBERHGc/eLcnHFbsmmyzaPcW c97cRGRSPPgfa6D1U9jXAafe+FrDWdMuNJg1OaRJh5uoSRsPMSQmMGR3UFl3HjHda5qE5VaO qt5G9SMYVbo9WooorI6AooooASq93JHFZSySzCGNYyWlJACDHLZ9qs1leIre3vPDmoW93P5F vJbuJJf7gwcn8KcdWTLRM8y8MaXZ3niW3B1WTUlR/Ojj1a3kV2Uc7oWLENjg9K9TF/u1FrTy mGFzuPSuI0O51PWPEmlxaxfaWfsdt9ttls1kDzq6lA53DAGCcgc5r0Hcp3AEZB5+uP8ACqxb nKpG0rfr5GeHUYweh81/ES9N9491Vy2VjlEK+wUBT+oNcvV/W5DNr2pSt1a6lJ/FzVCvo6a5 YJHgzfNNs1NA0ltd1+y0xW2/aZQpbrhepP5A19JSf2Z4O8OTSw26w2NnGXMcQGTj69ST3Jrw b4a3CW3xB0p5Oju0Y+rIQP1r3Dx7bm58C6xGvX7Ozf8AfPzf0rzMY3KtGD2PSwlo0ZTW559N 8cZvMPk6Egj7b7k5/Ra6L4XakmsLr2opbi3W5vhIYQ24KSgzzgdTz0rwLtXtvwR/5AOp/wDX 0P8A0AVeLoU6VJuCsTha9SpUSmzS+IfgKPxHatqFgiJqkS5J2keeoH3Tjv6HHtWv8PUeLwBp cciMkixsGV1wwIdsgj1pF8Y20Xjifw1d7YpCkbW0mDiQkZKn39K6huEb6VwTnPkUJ+qOyEIc zqR+Zm6FaWdhottFYLH5GwNujxhmPJbPck15rqvxgEdxd6dceGmaNWeGRJrjaSOQQw2HGaT4 WeLfK1K58N3knyvNI1mcdDklkz+o/Gn/ABc8Ieah8R2SZdAFu1z1UYAcD26GuilShCs4VVvs Y1ak5UVOk/VHWfDe10+38E2UtgiL9o3SSENk7ix+Vj3Kjj8KwfEfxYfQtdu9LOgtIYG2+Y8+ zcMZDAbTwe3Nch8LPF39iav/AGVdPixvXAU4/wBXMcAH6Hof+A13HxT8If23pY1W0TOoWaHI 3Y8yLqR9R1H403SjDEctVXTJ9pKdDmpO1jxDUrmC91O5ura1W1ilkLrAGyI884Bx0z7VTopa 9hKyseS3d3Yd67P4WX5svH1kucJco8Le+VJH6gVxdbfg6QxeNNFcdryMfmwH9axrrmpSRpQd qsWfS63xfUGtPKYYXO8civML/UNN0Bjpd3oWq3siF7eDGIvOTzvMQRgMWYKQMMBXrJZQyqSM npXlfiCxv7DxXql/o+o6VpMwEb3FxLcSMxVuBuRlZRkg4ArwMEmlKM5X/D0Wh7eJ6OK/U9Ui kMkKOUKllBKnqOOhqWqmn+f/AGfbfapY5bjyl8ySP7rtgZI9ielW6jqbrYKKKKAErK8Qaamr 6Dd2DzeSJ02+aRkKexIPUZ7Vq1Bd2sN7ayW1xGskUi7XUjgimm07oLKWktjldPttWvNbs9Q1 ufTYksFdYUtGJ8xmXaWJJ4XHQVvRQ2kN1LcLcqXlGCC4I7V4h478I33ha6+029xLJpkzkRne 2Yieinn8j3riprm78k+Vcy7/APfOf51y1ainUi6kdY7Hu0ckhOjz0qt0/L/gkusKY9d1BT2u ZR/4+ao0kZZ4wzbi56k9c0tfXwlzRTXU+ArQdOpKD6Nos2N5Jp+oW15F/rLeVZF+oIP9K+qS 1vrOiko263vbfhh3Vl/wNfJtev8Awt8dQxW8fh/VJ1j2H/RZ5GAXaf4CT0Oen5Vw4+k2lUj0 OrA1Um6cup5ZqenXOkancWF2hSaByjA8Zx0P0I5FexfBH/kA6n/19D/0EV2mseENA1+dZ9S0 2KeYAASgsrEehKkEj61W8Mafp+k6lrOn6ZarbW8EkQKqScsUBPJOe4rnr4tVqXLbU6aOFdKr e+h5B8VyU+INyysQwhiII4IIXg16z8PdZu9d8FW13fNunUtEX5y+04DHPcjrXOaz4P0zxd49 1aO5u54Lm3ihYKm0hkK4zzzwRzXbeGvDsHhnRV0u3leWIOz73wDyfapxFWDpQj1VgoUpqpKX R3PmSeWW31OWaF2jkSdmRlbBBDEgivo3wb4gj8X+F0up40847oLmPblSwHPHoQc/jiubb4Ma RJcNK+o3ZDMWKgAdTnFdlpmlaR4Q0VoLZUtLOLMkjyP37szGqxdelVS5NxYajUpt8+x86+L9 GTQPFl/psTMYo5A0eeu1gGA/DOK9q+GPiiTxF4ee3um3X1ltilY5JdSPlY57nBB+lczp3hvR vibfajrr3lzDILkxmEY4QABD7ZA/PNeg+H/DGk+ErGWOxTyw+GmmkbLNjuSegH5U8VWhKCg/ iQYalOM3JP3WeIfEzQodC8XSLbrtt7tPtCqFACkkggY7ZFcbXXfEfX4vEHiyaa2fdbWyCCNh ghsEkkY7Ek4rka9OhzezjzbnmVuXnfKL2xWz4RTd4y0Ybsf6ZGST04YGsbtTZGkjTdGzB8jB Xg59qnEy5KMpPojbA0XWxMKS6s+rnitHv1uzdJvUYwHGMfnXK6h4ZnutauJ0vtPNnJM12qzR 7iZvKEah+cMi/eFeCxXN35Q33Eu/v85/xr0DwB4Lu/EUq6jf3Ey6XG+Nm9szkdQCDwvqc+1f K4ep7NtUo2vufcYzJadOn7StU0Xl+G57To9kunaNZWSS+ctvAkQk/vbQBn9Kv1FDDHbwpDEi pGgCqo4AHYVLXQ3d3Z4lktEFFFFACVXu7j7LayTeVJLsXOyMZZvYD1qxRQC31PBfFdn408Va iZrjRrhIIywggAUbFPc88se5rlb/AMN6zpNt9p1DT57eHcF3yYxk9BwfavqTFc3418OSeKPD 0ljFN5UwcSRkjILL0B9jWEqN9bn0GEzpxcabiox+f+Z88jQ9SfTRqAs2NowYiQMDwM5OM5xw e38NVJrWW3OJoJIzyPnUjpwa7OUeLfDENnbXGjFI7J2ZJokLAkqwyWUkD7/PTOBmqI8ZzrZW 9uqXMcsFvJEZhcHLMyBQx47EEjJJz3qYV6tLSEmj0amGpYq8qlGM/NWv95ym1T0ajy69F/4S bwzdXMj31uZI2aJlV7cEx7CSVzzlW74xms+8m8M3F/pZgS0ES7zOoQxBvlyu8keuRj9cHjqj mWJiviv8jy5ZHgJvWjKPo2cpBqGo20YWC9njVegSUgD9acmq6pG8jpfXIeQguRKQXIGATz6V 1t3pnhhlH2OeCZ9sjBRciIO4Y4TLH5RjnJHbrzVeHw/oLh5p9R8uDyty7LlGJcCQsvCk8YjG cc7uKr+1K/VR+7/gmT4fy9q95r5r/I5cahqIumuheTidl2mXedxHpnPtU39t6z/0E7v/AL+n /Gugu9B0GyeYNeXMio0YDpLGRtZ2XOAvOAobg/xdqrroOki61GKTUm8u0migSUkKJHbIZsf3 QRwPTvVf2rV6xRK4bwLV1Of4f5GP/bes/wDQTu/+/p/xqC5vb69VVuruaYDkCRyR+prrm8I6 ZHbyPJfTwzDcEhldA2QJME4HIbYCBxwep70tM0XRb6ztZLi/ls3kTfIzurKCJVQgKFyMg5Ge nfin/atVbRQlw7gWr+0nb5f5HOWt5e2W82txLDuxu8tyM46ZxUlxqOo3cXl3N9PLH12u5Irp L7w/o9rqWmww3XnQT5892uUUKQoP3uigH6+nWmxaV4baRjLqDwrGrkq0yMZCshAGQO6gYwDU PNa7ey+7/gmseHMuSTvN/Nf5HJ+XSbFHVq7LTJvD1p56zNZuiXpP76AzPJEGXZ5bDAAwGzkf hVm88SaJapMunQq0+XaG6ihEZQ5QgHKgkfKewx+NRLMcTJfHb0N6eRYGMrKi5erZxdvay3Ui xW8EkrN0CKSTVu50XUbK3M1zZvDGpAJfA5JIA6+qn8q6BPG7rdyTx2Tyzs7hTLNkGNpC4Urj JIzgc4x2p66Z4t8WxLbppUohMqy73TykDBAmQWOOQASAOtcs6tSrpKTZ6VGjRwkuZU40130v 95iWPhjXNTtFurLTZ57diQrrjBIOD1PrXX+DovGXhO/ymi3UthMw8+DapJA/iXnhsfhXq/hP Qf8AhG/Dttphm85o9zPJtwCzHJwPTmtzvmrjRtrc8jFZzKqpUnBOPz/zIoJRPbpMFdA652uu CM+o9amoorc8MKKKKACiiigAooooAYyhhgjIPUGvL/F3h3S9J1VtTuLCCTS70gSts/495ccN kdFboeev1r1I/d4rkdA1K31f+1/Dd+Fkms5ZInjbpJCSdp/I4NXCST97VESqzg0oSs+h5m/h ux1dH/s7R5LNO1xdSun4rHyT+JFVbzwPBZzWKS30nl3DGJ5tgwkh5XjPQ4x1613FzbXHhi7S xvXZ9PlcJY3R5PTiOT/aHY4wR3zUl7ZxahZTWs+7y5VwSOCD1BHuCM10OhRlb3VY1p5ljYLS q7+ev5nEv8Nv7uq/99wf/ZVQ1HwJPp9r9oN9FIgdVb5CuAzAbjz0Gea7vSL2WdJLS72/b7XC zY6OD0cezD9asX9ot/p9xat0mjKfiRwfzrNYOjzWaOpZ7juW6n+C/wAjgj8OtRHAvrQ/99D+ lQXngTUbOyuLl7q2ZI0LsAzZIAJ9OtegaPdm90m3mf8A123ZIPR1+Vh+YNN1v/kA6h/17Sf+ gmj6lS5rNF/2/jeW6kvuOHj8A6pPEkpvrb5lBGWYnBHHal/4V1qH8V/aAf8AAv8ACvQbb/j0 t/8Armv8hVPXZ3i0iRIf9fcEW8P+85x+gJNJYKk3awpZ/jVG919xwmneA59QsY7r7dFGkwJA MRJxkgHr3xmtFPht/f1X/viD/Fq7e3gS2t47eL7kaBF+gGB/Ks7V7mUtHplo2Ly6B+btFEOG c/gcD3prB0W9ERLPcco6z19F/kcjZeB4NQS6aG+kEaSmOGUoCJCvDNjPTPA5/hq4nh/TtIVB qeiyTp3ubeV5EHuy8FR+ddlbW0dnax20C7IYlCKPYVFYWMni65MMRZdERmS6nHymdh1jTvt9 W/AGtFSoxu+VWOWpmONna9V39bfkL4M8OadfX/8AbaWEEWnwgxWamL/Wtn5pfcdh17mugstQ 1RvErW8jZt97L5XlgbVGcHOMgdME9d1JrGrRQa5o3hqy2rNNIryKF4jgQFsexJXA9s11dYOa behipSqO7k3bfzFooorM1CiiigAooooAKKKKACiiigBM14x4sFz4b+Jtrrse9bO5kjcyL91h gK65HsM4r2fn0ryjxVrP/CO6pNpGs6YNT0S5PnW4PDQj+IKcfwnOORgN1pSOPF2tFvSzNPxr 4hbQNftYb63W90TUYds8Mq5UENgle3QgkY5qGXS7zSILefS2k1fSZl8xMNunhQ4wRzmRRkcA ZHvRd6da+KdCtdHu7n9+EEumajJyJl7If9sDhlyTxmpNJ0bU5vBbaVFdtZ63pE7pFIjED+8P qjK3GR+HFaQqSg32Mrz5m7adP1X9fIx9Rns7mJNVtL+CG6tMgNIwUH1ikBIIB9D0NR2/iea/ VE0/SpZrrYGlikcRLHn3Iyw9wKx9K1ax17VU07xLZLHqEk2xNRhURyJJnAEijAfnjJFdRdeE dXkDyWt5Z6jcW/yLcxN9nuIv9llAKt/usRXbTr0ppa6+YoVHNOUdv6/r9TIgTVrTVnt5bm2s 479jKu2IyASgAFASQASBu6c1Lq+lXY0e9ll1q8k2wOSgVVU4U8EY6VTu7zWPsjWmteH9TDod 0d9b25JRx0bA4BHs3NNfxTBdaJfWd8rw3Yt3UMyFVlJUgEZGQT6VvaTd0LmhazZq22k3otYW TW7wZjU4kVWA4HHSqeNXu9W3Ry2l7HppIBdDEHlYYIyCRlR3/wBqo73xVCLSOz03zZLholBn jiLiLgAkAD5m9B+tJa3OtTWyWGh+HtTt4z1u7i3O5ieS2G4yTzkmi0lq/wARuUNEvwLVz4pl skeG70ySG+C7khDh1IzjcWA+VeeSRViwlsNPha7nv4ri7vGy0kXzmQ9kjUZJUdgM1ctfB2po yJcXtnps1zw8hb7TcT9yPmAA+gyBXJ3GsW9hq6aZ4QsY0ujN5X2+RRLLK5ODs3AhFJ/u1z1K 9KKstQnUcLOX9f15nYppk2oWk97r7tpek23zvb7v3syjkeZj7qn+5jJq34K8SPr1zql55S2W lWMSxW9unCKvJJPbOAOg4FQeINAv/wDhF7Hw7Hdtc6pqNwHubiRjhgoyzHvtGFA49KjFrYeH fDk+kW9wxtIB5mrX6DHmHoYUOfvtwuM/KPc1wzqSm9RtzjK+yS/H/gGL8O4rvWfG974jug/k IJP3rfd3sQAoPsp/CvZR1rzDwbrEnifVY7TT9NTTNA0/948MZ/1r/wAAYjHf5iO+Oc16eKmO xvg0lT01FooopnUFFFFABRRRQAUUUUAFFFFACVl63oVhr+nm01G3WaMHco3FSCOhBHIrUooJ lFSVmeVPZfDzRi9pq1pd2twOfKujMx+qlCVPsQarQeItPtbuW70TxYodoghttWt3Zdq5IG5V B4yeck16ZrOiWOvWD2d/AskbdDxuQ+qnsa5fSfhpouhXv9oAXF/JHykc+1gnuBjkjtU2fQ4Z UKkZWgkl32f4HAeIYtP1WL+11RtM1Zz5jCRWFvd453RsRkMcZAbGa7HxLp2oanb6d4t8Kyt9 uEA80ocGWMjI+U8Eg54NafizxxpGk2wgurCW9EpwYZIGVMe5dcE+1c6+r+HNRiRvC1vqMGrl ci102Mw7v+uny7CoJ6mgycacXKKkm/Le/kd34U1s694etr2QbbjBjuFxjbIvDDHb1rbIB615 9o3g7xEsrapc+IXs726UGeCGAFdwGAT82C2OpxU+r+JdT8JSQLeXNjqyu4TyY18m5GehChmD fgBTv3OuNZwheomvM7rpXOeM9cl0HQHltF3307iG2Tbuy59u+ACaydE13VvGEMslrf2OloGK iAL59woHdssAv021U1jwh4liuDrFhrz39/ChSKGWJVwpxu2EnCsR3xRfsFSrKVO9NO3cg0rT b3w94b1jxJ4hmb+17iBgrsQTGuPlXA4BLYyB7e9ct4fTTvDtuNShT+0NVj63JVza2eRzuIGW bB52git0634V02Bm160v7zWFA3W+poZXQnnCkrtC+hArqfC/jTStb0/y4LGe0KZX7OtuzKB6 AquPwpaHLGNOUlGMkml6v/hzkZtf0ie9N1rvivzXeLyXt9Mt3VNhOSNxUnBPXBBqzFpfw/16 VLXR7K6uZeuy3aVFX3YuQB7962NQ+F2h6rf/AG7/AEmxMnzSQW7KEz7DBwfXFddpml2ej2Md lYwJDAg6KAMnuT6k9zTs+prToVJS/eJW+9/iN0jR7HQ7BLLT4BDAuTtBJJPcknkmtClpKZ3J JKyFooooGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAZ+p6Rp+s2v2bUbWO4izna/Y+oI5B+lV tI8NaNoG86ZYRwO4wz8sxHpuJJx7ZrYooI5I83NbUzdX06XVLP7NHf3Nlk5Z7cgOR6Z6j8Kx dG8AaXpOptqUsk99efwS3TbynuPf3rrO1FFhOlBy5mtTj9S+Hul3uqnUrae50+6bl2tJCm4+ vsfpXRaZZTafYpbS3s94VPEs2C+PQkdfqavUGgI04QbcUYmreFNE16VZdS09JpFGA+5lbHpk EEj61e0/TLPSrVLWwtkt4V6JGuBn1Pqfc1dooGoRT5ktRaKKKCwooooAKKKKACiiigAooooA KKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP/Z DQplbmRzdHJlYW0NCmVuZG9iag0KMTkgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1Ry dWVUeXBlL05hbWUvRjQvQmFzZUZvbnQvQUJDREVFK1RhaG9tYSxCb2xkL0VuY29kaW5nL1dp bkFuc2lFbmNvZGluZy9Gb250RGVzY3JpcHRvciAyMCAwIFIvRmlyc3RDaGFyIDMyL0xhc3RD aGFyIDMyL1dpZHRocyA0MjcgMCBSPj4NCmVuZG9iag0KMjAgMCBvYmoNCjw8L1R5cGUvRm9u dERlc2NyaXB0b3IvRm9udE5hbWUvQUJDREVFK1RhaG9tYSxCb2xkL0ZsYWdzIDMyL0l0YWxp Y0FuZ2xlIDAvQXNjZW50IDEwMDAvRGVzY2VudCAtMjA3L0NhcEhlaWdodCA3NjUvQXZnV2lk dGggNTA2L01heFdpZHRoIDIzMjMvRm9udFdlaWdodCA3MDAvWEhlaWdodCAyNTAvU3RlbVYg NTAvRm9udEJCb3hbIC02OTggLTIwNyAxNjI1IDc2NV0gL0ZvbnRGaWxlMiA0MjggMCBSPj4N CmVuZG9iag0KMjEgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1R5cGUwL0Jhc2VGb250 L1RpbWVzIzIwTmV3IzIwUm9tYW4vRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5kYW50Rm9u dHMgMjIgMCBSL1RvVW5pY29kZSA0MjEgMCBSPj4NCmVuZG9iag0KMjIgMCBvYmoNClsgMjMg MCBSXSANCmVuZG9iag0KMjMgMCBvYmoNCjw8L0Jhc2VGb250L1RpbWVzIzIwTmV3IzIwUm9t YW4vU3VidHlwZS9DSURGb250VHlwZTIvVHlwZS9Gb250L0NJRFRvR0lETWFwL0lkZW50aXR5 L0RXIDEwMDAvQ0lEU3lzdGVtSW5mbyAyNCAwIFIvRm9udERlc2NyaXB0b3IgMjUgMCBSL1cg NDIzIDAgUj4+DQplbmRvYmoNCjI0IDAgb2JqDQo8PC9PcmRlcmluZyhJZGVudGl0eSkgL1Jl Z2lzdHJ5KEFkb2JlKSAvU3VwcGxlbWVudCAwPj4NCmVuZG9iag0KMjUgMCBvYmoNCjw8L1R5 cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvVGltZXMjMjBOZXcjMjBSb21hbi9GbGFncyAz Mi9JdGFsaWNBbmdsZSAwL0FzY2VudCA4OTEvRGVzY2VudCAtMjE2L0NhcEhlaWdodCA2OTMv QXZnV2lkdGggNDAxL01heFdpZHRoIDI1NjgvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAv TGVhZGluZyA0Mi9TdGVtViA0MC9Gb250QkJveFsgLTU2OCAtMjE2IDIwMDAgNjkzXSAvRm9u dEZpbGUyIDQyMiAwIFI+Pg0KZW5kb2JqDQoyNiAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5 cGUvVHJ1ZVR5cGUvTmFtZS9GNi9CYXNlRm9udC9UaW1lcyMyME5ldyMyMFJvbWFuLEl0YWxp Yy9FbmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0b3IgMjcgMCBSL0ZpcnN0 Q2hhciAzMi9MYXN0Q2hhciAxMjIvV2lkdGhzIDQyOSAwIFI+Pg0KZW5kb2JqDQoyNyAwIG9i ag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9UaW1lcyMyME5ldyMyMFJvbWFu LEl0YWxpYy9GbGFncyAzMi9JdGFsaWNBbmdsZSAtMTYuNC9Bc2NlbnQgODkxL0Rlc2NlbnQg LTIxNi9DYXBIZWlnaHQgNjk0L0F2Z1dpZHRoIDQwMi9NYXhXaWR0aCAxODMxL0ZvbnRXZWln aHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDAvRm9udEJCb3hbIC00OTgg LTIxNiAxMzMzIDY5NF0gPj4NCmVuZG9iag0KMjggMCBvYmoNCjw8L1N1YnR5cGUvTGluay9S ZWN0WyAxNDguNzQgMTU3Ljk0IDIyMy45IDE4My43NF0gL0JTPDwvVyAwPj4vRiA0L0E8PC9U eXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0cDovL3d3dy5jbnNzLmdvdi8pID4+L1N0cnVjdFBh cmVudCAyPj4NCmVuZG9iag0KMjkgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIv UmVzb3VyY2VzPDwvRm9udDw8L0YyIDggMCBSL0YxIDUgMCBSL0Y3IDMxIDAgUi9GOCAzNiAw IFIvRjUgMjEgMCBSL0Y2IDI2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNyA3IDAgUi9HUzEyIDEy IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRp YUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50cyAzMCAwIFIvR3JvdXA8PC9UeXBlL0dyb3Vw L1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDM+ Pg0KZW5kb2JqDQozMCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzNDg3 Pj4NCnN0cmVhbQ0KeJyVW1tv2zoSfg+Q/8BHe5Eo4k2XxUGAJG3O8eI0ydbuAoue8+D40ghw JNeS2+2/35mhZIuSqTAoHFv2zHBIzuWbIXt1s6uy9XxRsd9+u7qpqvniZbVkX69mxfbvq9mv 7erqaf4ty+dVVuRX0/1zhV/9sZovV7vra3b74Y7dzs7Pru4F4zwIFZutz884C+EfZypWQcxi oQIFP7wC2e/TmH0rz89C9o2euKgffz8/+zq6G//NZv86P/sIElHqQU4iglC0BX0dPYz1aDod y9ET49rBp4UIuM3GWqTfz8/+fX7GPn66Y1eOVbgtqqp4dS/EfVFU/YUQ1irIUAahZhLWImzU EA6NZZj2aPsq2xwRcogwSAc4aJLs6gmn9+lu8oGFls68rzNJjVIQe0pqTx5vyesKieOAewkR J4TwUOPeR5EM5CkhNm3So/0y/Ti+VCP2eD9O3YxagaFYfE9jzkdfbv8cX8rR5I5NZ+NLPbp5 GKvRhxv48/kD/Jl2xJ3YfBHrIEqH1T+x/iJOgqSj0T1q9PiZTVElmJQY3X1BTcaXsXl0zU5q EBbbwiYPIE6AuE80r9nkEaU+uEQozQOubRGkxx83nycP4IW/jxPn+JqHgRjYwp4dyBN2AJYY CsUilQbaS4ga9spGntRBmvjI08MeIxSskGSR4EePae3UWwss0iQQ2mafOIOECNLOUH2bivs+ rbtsv4XhLb9+0xolhPa3BjzSqh6t8aXPaGn08XGKHz+6JMQhmatrNModzXLzNFC4t2kQK8YD wXar87P1P5xxLxq2Ci4iiiAQSKSxChrtDdOIT8UtI0mnKtCNffGgt0tJTwOpe3z9ze0rrlSP bfaSlewJl7rYZGh9C/z8ayzDEVuOL9PRCsJHuQDv3WXP48vEPLPqZYUPTkuN4kBxe6TdahyP vu8zeNej11VelRdO+0CH0x32YnMY3hnD0kB22C5ctJHo0TrViXSPdg565EuGK0QTK7dFXtIC PmcbfMsq+rsq2RzmW5bFIkOeaoWheDmcr+scpZMwiJsBf2bVCyOZL7gGbF+uYFNYsXbmq4R8 wxKy3T83u6zcm4feGduMSL8bX/IITIOHo21V0CSLb/iULdh2B5MsqmJRbHDCslkbnDJQgj8T ZbGDWbxisAMTKtgWP+0AHQEzjlCxBwqH3Zx5yDCwER3FnMkognzWWcJ6z8B2/ZY/io5hP8vX xQ74XwnbMTLiMltmiBtymhvIpYmuzFJF9CHLL1ixY9VuPo5GeflK9BVtI/68ZM/4Vv1codfh xxyWwDV9mcgg5rZeAXNabSp61PegBarzguqz7X63ha0qStA7HJEKJRpUBTGhixWOq3R1r3uB pV4wLQOeHLKGlNeXEt61CEN1D68786yi60uN399dixDeQ/gtlPAcw2+38Epaz8m1QlINr9B8 fSuviRukp81P4kCtzQDEFJsxOSnB4eHmmtOAIEXCs4zwZZS5VcQTyl6mOwHXVBBxa7bgnZuN M2sDpJE2uTvDRz1ashCW5Qej2YGz1R+rg8Ut2ZwCc5YvNns0S3HCLJmxYtjn2oy93ECmTZ4z caDIq3mWm0HBknZo0n1bR+8fsndVm/tAkZOk9uAgfA6h9rXIjxFlCM9qbvOjZ8Hcuwm27V66 M6RHlZS4gagWOtDaBzimXqWWBowFk/JWjYcndBOAgxLNVBpjeHCD0MnEAy+KNEWDbQvzxYuA NDuc7s1EqNWhvcG6ZoYq//EI9vZ5Mvuvc19FIGL3SAYrNquiA55CrScIMr6NFTn3KiFUorA2 8gWL/GSVa9CiAugrG6MS/mjR4vNHixbbzCQODDX76gWzOWyAAEwgMNAUjLBFWe5XxxzyRDjB wpZIDKhzucKEmv1YLdkaw8SueGVYJhJMIvoiJ/zApk12xPCzN6OGtaAPCChhoMWB68eqA26c oU3p6OifSvTw6NV95AD/FucDjj8/qLxhT4iOBOCiX2CZbI1BEZbN4LapPQ8F01AE4x7woS1l uloAu0U2awLphn4rXhFMvu7zDAUeeAGB5X4IUynACM00Jpgc6sQw/VVWiC9fu1j7VD4MKWlZ spwJLkx7tH+NPuOU1g1mIjydL5o9Z88uWVgDph1Z4wv2E9c6oxSBy/LCin1lIHm+MpUL4GYo JwjCNWD1gNgGgPwak9/Ob2FFghWMUYqQer3lORYxg5mLa45lhiWhzlwXzOTfkvI77FBesZ/k DTDLj/9r6iMaqu0Lj4jOl7S2sHk4Uymlj7XLWAahtHX5kmcVuOy0mlewJhNM4tVqYxz8G+X0 RZ3c/VaK6yYyQlBfgKK15hgbmqX3iFYQsaPIlnZRYyLcYig4YQGikSlLGpNDSzvsfMvknBYH CEHagyyctNSds2j/GruIIUXFcUd7J63u0ToVThJykTZtXQUVBN10HaCP5p8twarIvkzsXdJu kE92QmwZOIsvlQZCulV05dJTPb0m4Ib8dPZyyVJuWTKJj8Fb+mdQi88/g1psD7DuGSDzBMF4 Xc+bDkx0IkvSFiDIr5E/lGe0Z+V+u0KOXUk2fejJMAwBJjtT/KMUTZtpSKi4Iwu30iYEtWKN o3p5LAaFQ8B9QLBvZ2saeTIGnV2BwYXABfYQY3sAn71+o+1ao2dsD50EgC6xb/QBa2gnVYRd Rp/zj/it9rAKVMqkFEGYnkbmLjdPad2OjOzSKDdbfHX3kyX4VMQtNuBCpYBr4uws87AzGBD7 tJZ5EkTaHg1H8q0XhOqwD9QLIu7R0kLePVJvefgkBGBFJN0D1a1ls1VQNWicqcTTK59yIfGz KVgrLf3LhXQg2IUqiBvzVO8Idm2+dwS7Nhs1l10wJ6L2uUX/5KKNIZHYpP1uNQw13243mYlq 8DVGo+cNxsQYQhybbzbutotAydYAy4FDmC4txrQtDrerXhHr5VUfsfSaZhJwnrRnha4Qvd2A klpjQTu4Q+0+SJe26V277B/8tMfx9nSgwg3j7nSallvTx+OmaVd36NSd6fbpyG/iCvws5X4T V2D+Xdq/Rpg0P1zdlE4kpqLQe21VJE+s7aXpZX/fZ6XpftXJ0Su3CjxMP9j4mqG+lEpvGHXV EL7ytP7K6VkpFhCWqEunZ0k8KrVoKVU3zXtwoCV5EA05I4Cx3RXLfV3SVCUzPXCqTHbbgnqT xxK+bkKiuEXTGCdss8WvquLYydthb4++fTl5oIC/+FW1Ai8TtI19g3irdfbgrLwAtkY2uwuq 8Ej0aN2hTr+DlsKiRUtLX7H5cokbYY6bSqi9cC9qS4DvWetIatA+RBwFIrWHcNmHSEI8crZo B+1jS+1lsA8yDmeI4dhptaQ6D/VQ29hv8WSc9mitY0dXUFc8DTj3G0ThhaEOLaSXcm6AdglA msfmmKyG5HHjwl7GG9FxQVt5l6lANESzajO0j1fJbcqyOHRCMqjYqQmPm9c9T9y2z+GakAVV gRzRoRyIIATlbJ7rOIhTWxn3eWr4DlrZox2CFRIqXqg5LXoXrJCpwksEFm0fV6CVG1whm8Nv XFJhdncNS7bfUKPIb3vxbsphezHkkStRBFzVnUA6Z61NBgo8bI3+yLAzMnT4LSALQalvyXe2 EMK4R+s+DQ57tKbTiwUeWstm78RKGlY2tnmx+HVdGkiwHPHTKuY9WtMbw9VcZ0s05dzYMWUA +mSKYko/F4fj6T1sI1Au2oXsBctBksP/ZYr1gTW0K3wqRUdK9qY3rZbtnlJaRh3XCz/rAWwe H1fycK5mEmi7L37RTgf48Qf+MR1NitvH5ibsI0UrZzsHRw25PbhH/SxOnT7VVYkQ/Ag4hu/7 8eGiua6YapP2EXjqbEXoEOs5DhHBVXqbQzFnUSwwp1r8/3FWpwS2LFqf+hnBr83mXTqnbw54 vHojsNVr0Zr7WH9iIJrcOU/ZIPdq7h7ElM3NMnNTNqdoCx5ls5BeZTMHtOI8ZHOJHmgU8igK 4nou2r90brP5V85trhNdtaEzMMJ/hxSSG7B9aCKahrczkNLdU2vwqRM5pmmX2FlI4Y3mSFu0 rigpwXcjbpGapEu3q4ofCIKWjGbU3EHCAsJEc3MFiYIqMb1QgVTP3I3gpK3awP0NpTgWtkOb eiRVXdLn1mUtJ/oEs5XKb4REdkkhGfukDjwgafxye/LOFaI7520ibMHgwC0pPs6lB5wL8ug7 urEiGhAlQLlaVPQOP22xvcNPW1yzghHQKPc7bMSzn07ABVCdW6zZ8nAtp9xiL97k5SV7V5kM GIBOcYotXd+iHym181Zub04S7Isz7ntmeLgdxZa2Fwy7Jk6rhHjeWZkBh9KhuYjbov6nixTS apo4N8plKifv2prdgwim6/8DQT1ylVC3e+5jNWD70hJA/Wsv04lEZ/Cvoy9OTwvxJNOiNXc9 BwJzSA1vi8dZ0nOCzhbtiXBbXxXl9V3RsprnS7zJuls6K3UZIzD2UkIq6gBYtM8NVDXB0l3k CwyyFmv7eiqlhrbDHFND5jqsVZJ6npZMd5DnPVoMqAVWaMWmdMdQvFykOjtLZR5dfXgjihsL wrPfA+9rfd2mxgkue4LxAHNZnE7bgDiltE27z7Pv+xXb1fXn4Qb3IXxhqwEjmIEmUA2u6M6h uTreuqe8xVlaF5A9jErFdH3VS3vMo6myaZ/JoOoLrupUA5HCx/8BZXtx6Q0KZW5kc3RyZWFt DQplbmRvYmoNCjMxIDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UeXBlMC9CYXNlRm9u dC9UaW1lcyMyME5ldyMyMFJvbWFuLEJvbGQvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5k YW50Rm9udHMgMzIgMCBSL1RvVW5pY29kZSA0MTcgMCBSPj4NCmVuZG9iag0KMzIgMCBvYmoN ClsgMzMgMCBSXSANCmVuZG9iag0KMzMgMCBvYmoNCjw8L0Jhc2VGb250L1RpbWVzIzIwTmV3 IzIwUm9tYW4sQm9sZC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURN YXAvSWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDM0IDAgUi9Gb250RGVzY3JpcHRv ciAzNSAwIFIvVyA0MTkgMCBSPj4NCmVuZG9iag0KMzQgMCBvYmoNCjw8L09yZGVyaW5nKElk ZW50aXR5KSAvUmVnaXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQozNSAw IG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9UaW1lcyMyME5ldyMyMFJv bWFuLEJvbGQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODkxL0Rlc2NlbnQgLTIx Ni9DYXBIZWlnaHQgNjc3L0F2Z1dpZHRoIDQyNy9NYXhXaWR0aCAyNTU4L0ZvbnRXZWlnaHQg NzAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDIvRm9udEJCb3hbIC01NTggLTIx NiAyMDAwIDY3N10gL0ZvbnRGaWxlMiA0MTggMCBSPj4NCmVuZG9iag0KMzYgMCBvYmoNCjw8 L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjgvQmFzZUZvbnQvQXJpYWwvRW5j b2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDM3IDAgUi9GaXJzdENoYXIg MzIvTGFzdENoYXIgMzIvV2lkdGhzIDQzMCAwIFI+Pg0KZW5kb2JqDQozNyAwIG9iag0KPDwv VHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BcmlhbC9GbGFncyAzMi9JdGFsaWNBbmds ZSAwL0FzY2VudCA5MDUvRGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lkdGggNDQx L01heFdpZHRoIDI2NjUvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvTGVhZGluZyAzMy9T dGVtViA0NC9Gb250QkJveFsgLTY2NSAtMjEwIDIwMDAgNzI4XSA+Pg0KZW5kb2JqDQozOCAw IG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjIg OCAwIFIvRjggMzYgMCBSL0Y1IDIxIDAgUi9GNiAyNiAwIFIvRjEgNSAwIFIvRjcgMzEgMCBS Pj4vRXh0R1N0YXRlPDwvR1M3IDcgMCBSL0dTMTIgMTIgMCBSPj4vUHJvY1NldFsvUERGL1Rl eHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0Nv bnRlbnRzIDM5IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2 aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgND4+DQplbmRvYmoNCjM5IDAgb2JqDQo8 PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM3NDQ+Pg0Kc3RyZWFtDQp4nJVbW3Pbxg5+ 94z/wz5SZ2yKyztPM52xU6dx59Txqd2+JH2QJdliK5EKSTnN+fUHwC5FLldgmOnUSSxgbwA+ fMCu5ldVkz8vlo1482Z+1TSL5Wa9Eh/nj+X+z/nj1/16fr94yYtFk5fF/OHw1OCv3q8Xq3X1 44/i+qe34vrx/Gz+zhdSul4oHp/Pz6Tw4D8pwiR0E5H4oRvCBzsQ+/khES/1+ZknXuhf0tf/ /Pn87KPzdvanePzl/OwGRsRRj+Okvuv5/YE+OnezyHl4mAXOvZARoxf5vitNNdET/Xx+9t/z M3Hz61sxZ07humyacscfxLuybOyD8I1TCLzA9SIRwFl47TICZsWBl1my9pJNjRg1fM/NRjRo k2J+j9v79e3tT8LrrbkdSsZ0zHEmXZnqoZaz0KlmlzJ2vs58z9k35Uu1gKPfb/IlswffT90o MIcRnGwgLdn97DJzqrIplzBPua0vBMzvO3cPV+yhxW4ozUEuOVnpuUFiyi5gj/t9Vb6CN63h 7yuxy2eXgVPX9EdZiAMuqcg/H9ZiX+GqYHGwMrGbXfqgfikjdTziCfXHDdaecpK4QbuCQ72G uVc/iEWx4k7KS9w4MtUm2FmesnMY0goiOPt2qCd3MO/8XTp0ZBkFlt7QsCf8v91wX+1qOYud z4e8WsNpss4BgRNnfUVx6bkyisXj8qNzy7mDL2PXN9U80mDnkdlAQflEsRJo99uZDBx2ssi3 dDnf8yNYWGTKor8UOAtO+LRd45SJmvIRfS10ytUBg7CpxZe8mV2GzkbkRYOOuZ5dRg6GY+I0 oLjE352OVfhlpj2Ug9gscQdLazaLhgNWGQ2l/82Kpm6W8k7D+K1/ym9TjxzJj9ykHeqTIz/N JrhuBi4fm6pTXBdOJTC1fodQ5dwocrOBdM1ipOfGcnw9nWxgybaQtQfYqAClUvpNs2bHSKXr D8bYH562BHAckAfSVuImCGRoyS7RP8EhO38EP5TOy0x66te0C0gkYgFosO0+LKu82RC21oj9 HgnWAlcLf6Kv5wW3kNZJYO3ZEW1Y2dSNY1O2KDAk/2FtDFiWmRo8rESW7DXEqigrgTErMKzL 3U6FMsBAfaDN6oAW9QHj3afPRPksiPGgMJsHgSaliTkhmwfT2M0iU7bLg2AblQjt9M+ZcNwc UZaa+Xb7Mkv7dv6BZwiU96wB+EQZhRiGhkJ/cAtqAp4KRWl4Ottag4Q8XkWJ10HfJ8f/Drwy VCfj1ahWl1w9N4xM2duZH2DIcf4MvpKYGsqF90CKn7atH2Oe2oi7cVeFHA2YZozFuipgZTSY 16ZsPTSDJfyNKXXdI2baZeC34m/Km6PZsLUcJOwjmu0WxQLHJ9/HOXfrogEgeq5wOEKoplKp +kBBAtwmgdNczAL9c6+ZLaT12MkXDZdIAvA6mZmzD+lZJwsWl6bsqKNGpxzVj2m7oX8a1axB 4pFB/Awomh4kmcIqg8jSm+LqisQaavdoH9MPerbWlM5yDduwZD6CZDAwfoRGjo82xgG0nRmj RKnrJ+batDc0GypmKFsDwqNL+ICDDXyAJYBQlQDCPaKrpp7ACGH1sBFkpKO1hZfSoUDmCaLp jFkiGzHVFGPmQlJCSQ2x2FOYxGTx0yObVVxWHQREcrNeYtrTuEE/xO5Qk5Quq+ygf+oRW6gP RTs9nBPo4tE2Ygn4pLiFFfL8AXrAVtuNEZwR4d4Yy1DcCwk2JOs9blanzrwmolIWNdrxYY21 TtOWkqqiAJz940LcL0irzaOKyu83LMeC/J5l5uJiVja1ZC84WSiGh7LsGiAxDWXJ4GTcVw7S QuSwianmCrYYCXw3GVkQUzMkPCqFAJPJdwyVjgyVBMic1FDpdIAz9KYDnKH2WAosmIEpApzE TlcIhphWWtpGbvSUU0JGCgkR+JXL6XHqhll/EgF44VPwX7BEIAkxeRtKpLFgFTI3Hc7i+SEp bbdszRKfnoYvcrKBwkfnp/kQ9ObvIqtDJz0szAfrU8fwxvOi2POu4x+/abEASt3hNkcXHPhy oPDRyQvCKibhVFjqrakawvIcgfM1XxEswV85ShwmMSZ2Y54Who/paGJuCWOvS2qUrKrXHDt1 elWlqCkL7/dlBR82grajEhllhEWbJ6Z0V8IMyb8xJ99doTLZkB3PSXiWFbVXIPHUdBAqE8Fu 6HRU7ideQGu9e3jALMzCFuT7MOivALNv6+dfck4tlEM1r40MzIJd8oMd4AFPMlMYd6m5Jmtg bmUZQCItLTb5Q/ijN/Vl7dSsfPZS+QU213M8UtWl4EuMJHWDwBz6ucRQYDWyiEK3rwFUim9T +BRxffFv90GQF0tTiZ0AhLzBDsZ66MeQON3+4FwmTixzsV6ZeJYsQEaBJqGu8zR/gpQcdRgl eCqZWeLjLRUZ+W440GDrsiiyZK852Thwg9CU5aooGceWLLuGOBuVZRhFdoJRZAodQsgbJ8mJ 3c0/eW2jeYkXduiefQcv6et9By/pq1E7f5OvX3NCW4WYGIaVTgyfD5oUA1XeqgIsRLYIfo8c WZUHALwQDB3yAlvOMUH5DmW4/VqVQLowg0+pdVZSZYWFFRcrEdmrv17KQeKvtryYEgBIko28 QlVFoIoaimududXmucaZpvgAhqqoszthQIsfVaHx+dCmLoVPTb+KgU/g4LBqhISU00nst+ud Ohy6pBSLAieZFt8B3isN8kVe4NKGnZV+6Xyst1Q+71fbqoimD6l0nVZdUwOU2igRsh3cHJss gsxHixorp6kqtgrxEjfKTA0WNoETDmWVJx+NstXUGrerLUBmqRpE96IxCxz+6AGoIiOSqKtW rdChUnVwMJWvTX/Ro018/yrDgt4YefKNlu8j5zJ0Wc4F0JMEpuxamdzmW+NXE8YYulHWUjNs fqR0Kur01bXhCrmQ4mvKN83mQb3BnpvBoSZZAygnbKnbyyvZ+oDtOuQ1ZSVe24Kdq1xkSu0R Y6h81Y6AdxdtbCz1/2DtdtDiyJpUI3XkIjuW5hxvEUCQpHLcxMM8Y6jwPCawZO/BNcsWCo6B fle6Qko24jK8kjCGserK+bt4mGRCGVl6d3TZ3qaGxVbclxgWTr78OiCIvHEDuqJT4/0MbFUX zAVCHQxFOetKu1OXs9psBIB7WwAf3R1XIa5qqMUBaJV7Ki8DD/3koM/fXuExfZrRtT54IduA C2WCDQ9jeVzMhVg0JqbsTbFQ0TblDPBRTKt43A5s5bH1O9zJpii35ctXca+iMMYC6ZvUwAeq idDRn4Gn+oEl+8n5Ded/XqMtKK33goGtoTOCj/44XB2MZ+YHgzmHtzGdcIZdeEOY7cJDhRBI fuPc44xTrzM0KQw8KoWmkMKTd+WKFPpZiO9r1CiAGBNYYSgtxems0FB7UO34v1QDlM9VgaWJ wF6q/hURJaOBf2SYh5xwdKVRU4ffc4lIWomiLEZcBkLHmJG9fAoCrP0MWd0GYPtjQUz9VEPH 7kP1u7qAtIZ0DdmrPNABqDvYskAo0kS4Eoc6120JxQk3eT0p9v3U68M5YxAZukloytqw35bl mgzt9x1HXPQYfC2+YO4mQquIeo6Qc+SBfVmdsqse76HxKQ1yvcUgyej4+qtlDZ9GlizfbE8t 2bb/A6e9L4msqxdi2JeZSbzHgd1GerNtN3aaYaAAPaI5JiH9zMy8OyifMYvgvYanrFA3611N 54i8BE6WqMSO7iRapR2+T0uM92nqYUbe5EuU3KrLjZKSH85XFvqShq6hpqw+CjrcK6sXrHGK /H9ta+OYsqncI6Kc19QlhLQD9Q5IP6IHfwGXX+mSYEmka7UWm5Jqmi2kUFG3nblDRU8jPBsY qO7iO20JckxjuY3htttp+4XUcMRmugEOBxfAxz6tJqiXoVnXttxP/eI1Jwvka2S6kb4tXq3U lWF9rJeIOt78QzVSm6cPegSa6wM6jYYIGfgwiJ+yVTGUs9LcycXpzZ+gZ+05+FGHWTd1s1CP APJ6Q7ypeCGX+oAp/VmBOd1agBunIy9CA1yRMfT7cqfRndxA3agpHwjZq40ARggzcyCeRKSW LM6k0ZUO11pE26zoFgJSRMHLA/lvPqwPTuTNyKOrV3aVvA9K2QFTR5ySDni+zZ2wRQZ1ijEU VzvLOHXTeDDt7EIcy5YVuWbaeSaG47h3BlzZoF+eGZNNKRsC4NFDPbKINhECHlhtizS+WqgL YghZ7DQg023Ws0GcQsD1bn6n2AWf4ByRvEev2WON8IWRocWbK7Vkr16GBjtFzlK6/5k2SZpZ skNeDj87vsVe3UT4ascY53nkmge835xT+5YCQez9xX3EXKuWedsUYYk5vmzI+J1zxPzkmzBF qbG4l5N4+ck3YXoQqJSOtFxOp+V9vemsvK+FzyR2iyOpvhCHvX6VgFEsVm0IUO0rkXniK4v2 kQXi+V373snM67/SM5qwbfQhw6BnjgAMRalE8Q7o0uSHSHTgT7zEnFa+yih2jxc9ZT86j90P 4uaH/Uo/iW3Ux4qf1kRq7Ouq9q3q4JLmsv9AlRq11JnqnqeOXIWEEVRyibHg8ZsQvJ/F+O4p 8Jc6sSlKN42pumm8nnaQULMm/etGpNnlgQ5UUNTh+3ysM7KO5qsPiL1JqO3Myov60cDj7vEs u4qh7Ra7fPaN8aFst6BpMTrykk1CPs8mxejISzYpo4mBnhhfAJJWW0RCiQKO4El809mrjW/Q h94+3n7Af9yJP07A6fxdYg2X0vdr+sO98bxraT1QsBeiakxjIfzFamLJ/nbzgBFxPwNS9EH1 Wm+v6ed/6Ocj/QR/oY1xbUjsrPsjq6Dvhukzy2CrYQj47bkhZHvXBwc8P3v+F+8V6fiXsXR3 JYXN6a9L0XTfsvCp2zvtJhC03Xe1pD8dyw3F6WBuqL1f65uTFb01+x3+5pJdXIHtTUB51d/c UQlSsE0YH685EnNsvmXhg1k82Zfu3suM3Nd4EebivtaU5xHI6QZq/cdD3PdOAp/ejRtq1mOc nhP9H+zbLk4NCmVuZHN0cmVhbQ0KZW5kb2JqDQo0MCAwIG9iag0KPDwvVHlwZS9QYWdlL1Bh cmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjIgOCAwIFIvRjggMzYgMCBSL0YxIDUg MCBSL0Y3IDMxIDAgUi9GNiAyNiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzcgNyAwIFIvR1MxMiAx MiAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVk aWFCb3hbIDAgMCA2MTIgNzkyXSAvQ29udGVudHMgNDEgMCBSL0dyb3VwPDwvVHlwZS9Hcm91 cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA1 Pj4NCmVuZG9iag0KNDEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjQw Nz4+DQpzdHJlYW0NCnicpVpZb9tIEn434P/Qj+TCptgHr5kggOMj6x1E44mEebHngZYomxiJ 1JBUsvn3W1UkJTap1lCzCOBIZFV1dx1fHa3JTVGlq3hRsQ8fJjdVFS/ekyV7nszz7R+T+Y9t MnmK39IsrtI8m8x2rxU++ncSL5Pi40f26e6WfZpfXkweBOPccRWbry4vOHPhH2cqUE7AAqEc BS82QPZ5FrC38vLCZW/0jYvm6+fLi2fr1v6Dzf9zeXEPElHqXk4oHFd0BT1bU9uzZjNbWk+M ewY+TwiH62ysQ/rX5cVvlxfs/sstmxi08CmvqnxjVsRDnldDRQhNC9KVjusxCbpw220ow46l Gw1oh1vWOXzkEK4TneCgQ7LJEx7vy+3jHXM7e25FcaVQzX7EHR6SKHbtgk3h8+LZip3enicP Yf+o3BOO1AS4xMsGrAMtcV/0Fn+27rNyV4CJE1tZbAF/8s12bV9LK42zBf5PL76n1Tur8Ot7 WvZXOqiJOzLQxT8ZaUPHjXTafJ3iCrCqZ/2wpWv9zOJsaRLgeY4vdQEjbMJP2MT3HNmKeh1l CTngO8MKXbYnPHiRf0uXCcScScHCFaTgLucuW5moeehI2aNeG6kld3xPp07JEdYQpSYmz3d4 b4lHm0vrhhVwjgQt+dcuLfBQmySrzK4jA0f0TgZcgbWOK3TAJavyvf/Z11xYjFSmu4wB2aQ/ kG3ah5LRgHa/MkXCNLZ9q6JV8yyGJ+vT2NFa2+OO10r8EkPAATNs+s3mLoVYwexr33qx7kBV qLBrZWE0VnlxxaZAjks1y9rXkdUsPUMZyI60uyKFjYK8H7Zw4YhAdmNfB4c1MKC5V7++qt/P cdU5LvATPOC8NZ9JP0qQfrqnuTfSRo4X6bQZLkr7qU+Pu0LHMCUXl7DuIIHAUvoEeC92P0YP bBGar8s3xEgDQIhjACF8sqHwnKA9CZdjEELxAeMYhGgAqcs2fydkuCPfEAffMAY/hDPXRUxn N8bg9wbURsky7NGSUYQiDX9PjVDh9tkOXOu1kSsgDOtyEccVW+UFRCJ5ceuz4OsYFtmy89QE OCJ0Qk8/8bURnIQT9WgpnHCxV4LHax7U60E8hRbbFvkSQmpHVioRPpT1ThGMr6pkAchWsSlE L7DMTF4MJlQ9L/jJSKsc3zcb0ODs0pwNvShyov+nQukKOLdC6fAOciOqcfktXSRg/Sv6VpaE i2UVZ6j9RYuJ9dvGGwh0dumyW9UAsptMHgjHD/R93E2MzhRJR3KdumRpxlI0/JJ8pcbuFcIt 4W+aEdzStmqn2EN+k1xG5RUv9A/1D2VMPd9SplmykvICbmQNztcmsAMaG4MdTuYF+iplgoc4 JBzhGlOvlIRCGru5BFBY0Gm0qJd8AYfJ1+UVWxSH9LXFrVf5mx1aRQyn3r6npE/cFpl9fVBv Dtt83yBqllfjlArW36f/xoe2WCTnyzakN2itvKxYvIU3qk7K2yKNYbNVQtXKe5IiD8tQ7VQK LUtCLXBi2n6RmzInRD76U3cb4P61zWp7kZOjPhp32oIuClwcFLEYd0gvPOTlNKvaqCjyLboR afW1rgDJyrKpyY1pIUKk1qSOQCB1AoEAdvdgdkY9rvGdgTldtjtEl28UL/kWuxC0GCgl3+zW b3ZUV2PkYQQk5Izvyd80RtoKhGq717Z+BSG/JPixrd14k8CyVYGPCeeqYkd2r3YU4ezFevoF EY8IX2xj0QZVut9bvkXGMY4CfQSkvwMfeHy+Bc/ee7uxBoECUOr8W+3IxqwvBoy3GL8URThF SJGdjJCwp7x20kWKtjC3GApaDDk8zT620YirdJ3A59KkSVc50tNlmAJCuYETcJ12REB45oBQ AMbcG6TkxeiU3BVwbkru8P6j8PgzqXs09O4NvYrrEqrbBG32PFnFENshYR9o94ndqHLuQXeg b3WEyv0TKvcDNHgtajkegzS+M5TcZftae7wC6E++t2kNVF2HYJ1AviFU1/mOgoD9ic/PVnU9 8SGq8mdjAEXKiSLz0QzaDU5oF9ojb+jQyXiH7gg426EPvH1dHz8/j6Dx6fGZJzU0TdFox5iP nmsQ2Y0bfNlIwcd8b2QsfINeSw3156poUBIzBzJT8VInj3IU9isBINYeoHqPqwYrsRjHj16n JMqLTplZQIVu19FqAlMJyAgory1xcuKnBFZFGv0I/wtP+B9YKer4XzNYWI3yPxdr/a6Esx3w wHtOsFOdAdbuOka53SsejUH5EWr0zswoq0tPg2ZDhW6qbciIAmEwoO04cA/qtS5nE1c1Oqmm dDB1/SoIsIjU1jDNelToOoF56waniLTrBD64TsBE4kEX6DkRPyJ1OFY+NusX0NHwgEkwN2+l zFBL92js2/njr/hlyn43Nl/QT0qd/9FYYirstDTaoSsGw3uToM/2wXU/8Y99ziMqkn+74IHW H9De3T+gUzxOH+ePqIZfp6Y5iIw8J5Tmleieq9W1RzNH7nMch3BHsCK5vFj9y3wfwE9fLEX1 kEoqwipcnJYbd9dwYpaI3W4g21miGj9L1BjHzxI1NirfVmmWVjSgQHBI0SUzcyUvHcV1IVSQ T2c0gWaPNvSHWVnRaB67lOAwxpjmDsSnGw1mlZMHf+BVkNahghsulG82CGzUpVYJ7p/lxu0q wbFS0aRMUUq8H9yv2YwGIfUIQwFaqSMm1QyHN1agSLwFbIXOflByTTbYMzDC4BcLm7FaOfgH FRRBc4ZP2ed1XpZx0R+XHDEbXseISF/NPJFVA1rYhnl8KzydeJ98VjRbpjFS1tYLiUlQ6OME ddwOQ0CyQKd9M6KeN5AL6jNDZMjHbUK6guC0S1un13pWVKfS+raHn77oxOuh3haNF50BeHTv 6IOLTocZXRlwPTqhZRP0yFEJTkBJH0ajEtyxQQ06KYCuCDne5f6TBOfjqTR+c4KjUWKHFu8P 8FhQdD2OSnURRokmAJlH5zuvx34q34UD2q91viPNfL2f3tqNlvpZ79iPGyIaIRiXbhJgbYsg xIEthyYtCLUEODTpsVFDk+8E8J+f74420nW+E9AXH/KdqcOSYkBr+t0Jl+GA1lQjNqlTozXZ rsmXGm0XH4MBPOLMaZXT/AOKc0CNJ4xrPcYRWag9I+b6dxZZte/N0yxZQr92YnKF9h+zfYl9 SY/2hrpDGkP/11jVSyyuxi2BE3qNtnsBeGMygoyob+uyDTsm8qn/AbG4wt8NCmVuZHN0cmVh bQ0KZW5kb2JqDQo0MiAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJj ZXM8PC9Gb250PDwvRjEgNSAwIFIvRjIgOCAwIFIvRjggMzYgMCBSL0Y2IDI2IDAgUj4+L0V4 dEdTdGF0ZTw8L0dTNyA3IDAgUi9HUzEyIDEyIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0lt YWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50 cyA0MyAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJH Qj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDY+Pg0KZW5kb2JqDQo0MyAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzMjc3Pj4NCnN0cmVhbQ0KeJyVW21v2zgS/h4g/4Ef 5UOiiC96IbBYwE3cNu02zcUp9oB2Pyi24ujWllJJLjb362+GkmxSMmUZRdMknhlSw5lnnhmq V9OiSp/jRUV+++1qWlXx4iVZku9Xj/nrX1ePb6/J1X28SrO4SvPsar59qvBXH5N4mRS//07e 3VyTd4/nZ1fvKaG+KwPy+Hx+RokHfyjhXuB6PgkFdz1BHjcg92EeklV5fuaRlfqJsubHD+dn 3x0y+Ys8fjo/m4HJnVmhlHWz1HM9qps1NX+en/271u9uhAVqiyM0JCzBBAlhqSiyapDZl2ty ZfHgu7yq8o3die/zvOo4kRHwh/6owoeNhyRgLt896vRuIpy72YQ7/yFT+JZUecdtrbbPmEtN 5eGnFqHn8oiIyPV3GteTS+bczeeTS9+5n1zy3iHtVgNfMWYqU39wa4bs8NaYDNxAEi7ccO8J i3Hu+S7npuylVVa6rGOX2mQhxAU1ZUcFHvNcOaChwohc3WMAfbm+vSFeN7XMqGBh5EZwsBCk shMVGBKWzXPuUmkq6VvpbYJqm+g8TxCGLh1lhA0YCbjLRxnhB4ywwHdDTgIhXb818jB7P6Ge M8OIfZjdXUOKqO/nNpeIwOXStKFvRIHUbqEQEIFEnhsEglCXkSI5P3v+14HtioFn5mCsXkoZ P/Lg/oAlRkeeYzAMMQ3SBV6EqY/2yCX8SsD3i+9O/GPSw+SoZ0KCqmnCU9p9PO8tT0EJ/Krp mpBDpstfaZkXk8vQeZtwzyFfJpdwyAmE+yYv4smlcLLldkM8ZjllFlJ1gPoKNjRgoY8oY8hS /6L/HEEvJyXvaX4rkwk8Qf5M7rdPa3yodEHmVZwt42JZkmdE07wgFX7ygg9E5vh1AX+3RQLR S+YvcZHix9nKBruNA30pXL9dGFa8zZ7zYgMVRy2Skelmgv+uyB2a2/0+XtvsMqgbkW/a1baX Vuj5N7Vp/FpWCa5QHj9xjnWbm4YvJpfSIZ/UyW7BU5Q2h8086pMfDlgGB0E4gFtC5wkEJAgw ECi3r/BB4BT4pUSnLXGTyx8T11qoPKg9kbmBwQwKD6Rh63YAhHCUkeiAkSb3/AB4SWvkaWTG yaijOD7ZDLW7eBI4u3AA162JSjzzqMHVtb9vUjgCiCD8qNb6pSJXsFFZEkD14Z0NdAPyPm9y 5Q12Rp7rDBH9DNFCEAL+Dn/QzcyTBegbYkdSyOcYF/WuHtEOrrVWZvLNBtfM0oUicSWBJIYo ZM4+0SDJ5m8qDfxRacAkAoax6AXxyScV/6xxN5XSs1UvSd2AmwZcqyxwFt+UHYxWeSjkgT6j m7jcQ9wwg/AGYp75ru/36s3ihHqjmzi13mi6353ZP5PLaB/welh/LeA0FaIUYIkDvHA+KtDR V9Rc5luWVtAZQAGokpLcgs2sStZrtdoKl8gWbeKR6QLWbTYCP2MMcydNxsSVDFVY6Cv3drwj /B7vCQurMGU94ZsEkmO37c1Tgv4iiOZURvSCIKCUx/KOUgzO2iAqbJJsiXaXNj2fYqdh6Nki n/qiJzsctId4bxP6Anwrx1k5RHyb0BeRcGlrZXkC3BuK42PdUDO4lernAG0jANuaYFmcCBQq YMPr72VFT/Yud8Gvo/KGcmzHTO3hAvEh/wX/qBTN0myFn2DBAArxsk+ln9u0TLEO7AjRAY40 HKaqOW73NC3LbRFnCwxTFe7AUSh3bqfo1x8TVR6Av93aujEGraQfmjatpJRCf8JN2RkiVhY/ rQFQbuH5midRboEnedQr+EuWr/PVG7kv8uUWi1k1AkYEZDnrLHphAwYW9WStIMJpT5Z6LfXL 1IkB6eM2delj02io21JfyKgnO5y0hxrNNvX9YI96w1YO9X9t6gvWwpBe9ZITqp5u4tSqp+mO r3qcQSSz6ISqZy5TVjE2P1C+yheVgtCEVC8J+Qrmn1UPlNZplD8DENnihgPm847pjzmSMkXS IN96hM8SFdB+iNA0ZA1WEfRkY5usz3qysCkdiY7gC2SRHPloYEwBeb7NEHzwANP18TBgApwY mitdkIh8VaiQN9WbeZ51AsaoG0nTgJVzAoJ41JQdTpxD447WOYCXB0tP30owkH4ebaFApR8P VAI9j0o/2Edgmjg5/fa6J6YfH1c8m/TTl1Fh0sQNNC9rqBYcqkURl7heVWwX1bZIoDZMoOfI KxVnu4KYZkQRzzp89U5nCoT1eA1ByDK3cwHncyQPeBTukXZ0ZNKQ4xDPULZywjDoyRLrriJg vUFHeDAAB8YFHHY5koYOzAu4L9uUwjBGr0Mcrk5gkrqFU6NY0+3QydsJg9gqIahaUNpFEjJA 4SHH9OSoUAbkDcMDa9WNeN0PVUldN7L+UOsAYBpjKqL4Rk3a6meoB8Ww7zn4kdqvOVovwAYp b3b2YZ2XZVygiW7ZOeRHLGXCtGDt0Kgf9oSnr5gNqSqqakJmI46erO9MNF1bTjBs7jqy1tEg 9Qdl+8E8ME7gnOFlzZi7hIFxAqcRcuTaysspmaArnpAEutr7pv9Y1iPKeBI6a6Lq/i1GEsCm mlBu4l1PDyGreq8iX2DQoHJZqk+ggYHAxBEcxDdOipWYrRPmnnBlOPwQe9mwJ6s2sX2qZxCY sLGetD+c97dYFpSU9RIFB99jt4CXeIe28O3dBFqo7qnt+wvuSjpuCYF3vB1ZKsMxmCN8r6c6 XWKV/oXnCt1eQ8mWx7ABTiVsLcwy7D+LN0Cd151n20sAHG3DcU9xEdXSzQ+Ebp/GcYlTVGMZ K4Aw4feEmbUGs4Di7ZIhfZf/QpzdjKCHHFwnTW0rPQQuGlJTdjj9BwYzTKq58hgrA4MZhtea vKmK6jdYGdNRaIIo3bFwYl3VdNXMI3RUPVVI8IiAwJxXBTCK7eMY5Ejyzu+x9v2YkMizzZBZ WN9P60tbxxCReu3CkPUD+x285wYdy3Zk4j3ZhxYXfxHbxR7n1JXSVBuT55yHPb2HBH2FTqwJ hhrHLvejoedcVXdyH6eFDXkChuA2ypciCPDayJD9E2tFWibkc1LP4o52jAxv0Hc4o/fZG7wI yyoyX7yo1MUvDef5VqbQgN+k5aLA28kqIX/kq5q71KzqZWPvwRnelxvL1v1FjW75SpmJX19G sCBBJea/Ycw+p4Zesiv8BUojDZp7EuapmbN1bBQKN+o4zDo2gkPpyg5DysGxUXNEQh6uWX0r A2Mjxv0WJDVg+u8pwKRbOBWY9rrIdSBEFK0ZZAXQtvZUrdEMQl3ZlhXYSHEEjeU441DQOqI0 CqyNoewK2zKYRtyFMmrIijHoQ6XfU7xJV3XuYedS3wdlMfTlLQa2fAF/rjkDd27miBKj+AL3 Ve9qLHnRvW23pDw8JlT0Ua7mUdCTHRrlUq8nbs1JylX+27bRz6aBWRLDV2fGWRmYJTEwtsPu v0/oOAzFE7JQV+tlIXaCeyYN0Wmr+E2I68aOhbguK6yysid7SjboevMdy8G3YKBzIh/j8sXk zNSZf1QJMCr+uVAFf3Bze17q9YSnuNJWdWbbslLFhtnfbRReTQR0C9bA9iCipT0m+iE5MF2i UowtWQPTJYgd1+/WmvUJtUY3cGKp2at+b3rnSpGhIsP3fioyyxRoqZNIM/WRGpOmGTZPdev8 GKsXMFDub4KteV7smmyMHQgoZXr2iOooABT5AekDSvzcqma8wrezJL6ddY2EsHkXJKusxyjx nSZ9+907tg6U6aL2C/egKwr7tzEkD4NOl1UUGp/veuAqhPumfWsPLkK8fxm1beijO6LAHG01 F6kZF4b0qGYd5DtqX/ANt/q9uWHeTJF960rL7bourmT2DwTPa57Vp502Ndk6BxOYtbq5ujZ/ wSD7egM27jEuhweKzJduQA0rN2lzMdYdsu97sQBnObqOtW2rW2Nd9GObN2vVL2zijKyKfPta 7tqcW8w7X6Udh7T7jM0RKqimBG8umpvlOFuNuNmi0DfInYNuISI/4yqzxjfHwYGrIqGbuSAd +u/ZaAaV6rV0Xdl6LyB5V3QYRQ+ONZtn5tKlY4zwgakmhbanR/s3Y6CYeurlat3AqVC8Uz0w jbAy+RAvVnRVpVD/vwH7GALfL5GRoWclJaGP7z3ron6AUP0OCoR1X0C9PGooPVhn5iFORHTR egphm3kxFmLRNY6quZEZddHBuSv8/kE9YP6184jmZY4TBxIcuiTqj/IqDxi+laGL/onHrcYR qkHYZ39nzgBIl1XHAIDSHUrPFXCot8V6UwkFO6J+Ga6A2g3HGqtrpLxIregZ4l2EvsL/lJfA c5kVPeGMTR0rOGMmmqIHJx7IPMZMPbAVw9qo2bMzUZxAmLLzlom8VsnmqXaTlTyopk/XhmbM xt+FoF1pK2UVQjENi/cUwP0fGQgsZw0KZW5kc3RyZWFtDQplbmRvYmoNCjQ0IDAgb2JqDQo8 PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUi9G MiA4IDAgUi9GOCAzNiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzcgNyAwIFIvR1MxMiAxMiAwIFI+ Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hb IDAgMCA2MTIgNzkyXSAvQ29udGVudHMgNDUgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1Ry YW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA3Pj4NCmVu ZG9iag0KNDUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDU5Mz4+DQpz dHJlYW0NCnictV1tb9w2Ev4eIP9BH3cLWBYpUi9AUcBxnCbX5qWxc9dD0g+OX+K92l7fep27 /vuboUiJ1IiUqN1D0daJh88zJIfDeSiu9vBos11dn19skx9/PDzabs8vbq4uk8+HZ+uHPw7P /nq4Ovxw/m11f75dre8PT5++bvGvXl+dX15tfvopefHyOHlx9vzZ4SuWMJnWRXJ2/fwZSzL4 hyV5VqSZTEqRp5lIzu7A7ufTMvn2+PxZlnxTf2Jc//Hn588+L5LlH8nZ354/OwHIFlaoxjYs y9KM2bBuy38/f/Zb077vCC+UixNa1EDBRVICVVV5WyQnb4+TQ88Ivlhvt+s7/yC+Wq+3vUHk CYyH3VUhi7Ssk4KnedvVo3dLsXh3sswXv/fHyzSTGUsr7jZ74bWt01K4tl5cxnu2STNOZxef F9u1rxXnKXMbqQbhGRBlluZVIqpUtn4dLw/44t3p6fJALj4sD/IFBF2Q1Gkd5uN1iTGSi7Qc HTPoSFqXru2B17ZK69y1ZT5bWEN9HyZFNs/SOtBCxWly+AEj9O3xm5dJ1l+7btjxsk5ZmRSw Cupe2P2eeAcl52mVu41sV4gTzHKi15+iLFM2CYQHQIo8zSeB5AMgDECgH4WoU2lA3p0eeTrP 8oxY+yKCwfzWrunR8qBcfPiwZHzx8f3fT176FiCHwJO52/b4/fKgXryF2cF/T3CJfDyGn94c /Zq8Ozp78x4XyjskgL+ApaNtjj+Bzcc3Z//0cQlepqXs+fnrz8ty8R6aIejrt96cAnFcuE1t GpX92wGGdceTvK5SBmOT8mRz9fzZ9Q+9jhdFyiGJ5BITECIqjM+LL5AUJE7MlyVkRF9fckxy pd388+LUuwiLVNSu7ac3Zyc+cwH7HnPNSV9b9/OU8wRWF65vu68kJEUgrjkzK0wPQjC4ZXiL YbApwvgXkKZys9OxlGzEFWkHHe63o/s3pROCNDu7uYI5TK7Xt7fr/6zuvy3rRbJdHjC2OIcY /Xp7lVwsi8X6vvu71f2jd4lUIi1ql0BF/5slz2HSIW7PkuVBtbgAnA0gFou/ljxbPMD+hfDf lizDvy8U0cPN6iLB1viH22/LarHerLY3d7iCHpNzCLmHh836O5pfgcVl8hVA6gYxnLn1QMga VnTV5Zdku04AcXt1AQtt6+0kq9NC9hv7IpoLlpa5a92f4c5WEFvPhgI/wlhXZSILmfIaMiYk 7QICI61UXP/jh+QeTK1QLHQo6paFUE1zT8uBekwWMKsmF92qqdLz0Xn4m3IyEp+JDDOWjZ+4 mFavWc3TIm+7zSpc24Ful123VVNu3MKWPOgWFCWF69YrWApP9xi82xUG8/qe9D2ShEPfBZvY 95yxVEh7yqUM9b3q+m41baYE9oaAW5iHC9cttXofcKFh/1fXqwtYgOehoYjlhNRc1xOHQsAi FJU9FLDFBIai7oZCNS0tt8oq5Jbgogm4zi1V/mLXN+eQKO6utjgqm0cyALFMUHjVYsoAOJWc qSfVfgRLL68AA4tI0AcwRPifDCSb2e0mWajlqyzQbU5tMMyZjYK/HDLCtdAAwVqAirBvg4IS yvkWqKxrymYiqfVIUiAB+Bg+QY/MjLRAJSWTUHvxwgGibJOMzFCr+VdD3c6+PYbtr7GtY2EG x1iowXEsTK/9GMZTy0K4Fr0NBcq1wmRtCcuLSc+aYoxuKdBY1nZr2DjCu4pUW7FVUB1dfj+H PKvSbLOvezeYeDZIt9xhOwEe6dYiOp/tkxbqvLy2aVU23Z7fX2JXN5fJlwX8/wgPFtRvoKDe nZxB4ZsPkY/vrk0MNJtrOAY43V+1h83eF/ZQb7EkBmAQWA7zkWeLuzv1M0bCdqM2neTr7fri Tzo98/lJVKgt7uHmaoO18dPjFbBeQo2MpeZmn8Rkalb31+sNkN+p86p9UjGOLSwqVelC/yaV M9P5uChwS6Z8U/aynFYsbTqSgobiUM1CgukV9u3NEoJIbdxqgSXqx08vUO7ACHlrl+nsVYlS lLL3uk37LEJ9ltP6TAIY8sl4l8bAeZbKcgD84z6wq2HHcZ1fX0FZtTG6DhL0gVQ/0eUQz1vC nlsP8K72gS2VDZ0Mms1ngNcqMxPw0fiSvdK3slihaA6ymuKXRPWnR3VswGWRfF1t1Yr68woS tWyS9iNK6eF6eA496bSTu5Knh0S5sE7O3i/1Kt8Du4QqqR6qGUaHvNjDkA+XDCfHH9Up4tke Breo0yGe0d4ZSd2WtwIfeASlRGMyoiU6nJCY0FBhNdFCBeVE51VAT4S9aiVeCxVQFDaUXy00 W60aTmujtQeqs8D2PSMzBK2RGoKekelcEMm4bRuJvpErHoTMcRe0qlNf3VgR7RBsO1BUixpC gDm1/O3tCleHLuExOSTqsdXT5jtuKd6KPpoa2kmH+uXq+hoq+NXVzhQY2bIaoDjYHZpzjHQK /RpPWXGHvb3Fgbs794uf6KEqs7RkbmlyAkxqXl6+hp++LJNflrjBN7tH7/B2N3JZoL0dIv81 x883eIBzr44x9zBpeQm5lNKNKi3D0Ekt34KpidCy2/Kgd40EoAvm6BFHQ405yixXZfm0QDQt CbeB8/zJIiuancQf1iltoB3Uqs+P2/Ovt6tHHIKbu6v77c7svMoxC1P2CSqIZ0QRKF5uCRHo XVgS0MkmD2JOceCbYgkyu69EjaGuMtwpKDVNXXPABRbJFFwWR15hMGPcSLR61U4MOBZ1cgAc g+97wvfSAQEKdIhjrKDjbDjemC1MRkZtIMsHuzQJu9GfFDs8I9Ogq2G3Z8nP6bSN+qS0/9oD tBKfAxPhFZ8R2DWG1Ggyo5HFd4+ssT2VkuZEfVmrqFFF/lWk5RdNM1rxOvXkB58KiyGsJFbZ U5LmHPAaNyoKjkojINFnDBhJOzto9Ah6LdJnZD0xHCbMFs8jfSYLwtXoabB/k4ggYQzxjHZO 9jQ6aDg28rivMRnR6B1OSKNrqLBGb6GCGr3zKqDRw14Zjd5BBTS6DeXV6Hr+Wo3eHybr90ZX 97vfmbT6vN+tEIp21zERromrzPGOF88tKZP5HpVzelMk3HhIeAneW46ztXk8N+ztVe6KcyXz mnNKJT4SdY11hRrkHjWAusfwtFEZfn+O4I1SxxH32gzKnv2RZQwbeHS2uqK3M5VWuYRpVOUa ilbl+oOP3texG/Owf1rykeCbpXPjeUngTRG6e+Qn8XapItyO+0e1CFUU9gOf3l+JdoRX6tMB 1JEpqpfeVrIisxE/WTmm3sjUjz78qwpffRxD3zz9o/Re5RsDXjN1tkrAxV7Ay2Fwr9qZMStk YfjVYQy61ocE3asPo8CrYddnKcQYYq0RCfGfewGvhsH9KjFqFYDrcgB9tFytg2tfBpOOCbKx pEM/eUDP2eJZxzZDysqI7rBYGzngH2KjPMhyjZKnMYRank7IbHPAG3lKwEfk6YwBIzG5gzyN oDfyNHpJ5HxCmIzcWaVLYqI+jWBqBGr82stdgYpCRuStQFWaqCdQtUknUB0jS3mJ3JaCxEof 44vcEqiOkaXQRG4L1J5Ve54lckugOkaWkgt4pQWqBVVSPkvxidwWqP2xwuHUE+gVqNbvfQK1 M/EK1BCKdtcxCQtU3HCNCilqjKdhiZALqk+bzdpqPHYjM6+K3oI8NboAEwJWxJBAX5tPnzze +JVaPHeZj+rCL4vT1yHNNp2UlSKF+aOk46qtmZFGtAVnRFLRph1sNEPYwUa90Bmho2K00+hT whn0ZHwwDtZ3D09qX8BPRlWL5HywyJtPKmsc2z7p/aUqK3Vn90gnJH7YxKJTYf6g/gsSWT0K B+Jtc/l0fb1P7pxhC+9V1z0wcQnJLx9gGv1ETZd7oOoLRnpBS8ZuKcIGEHRQ14w00sdFqvfx bAx9I1IpvV+kRoA3IpWC+0VqDHg5DO4XXPGzQhJAQKRGoDcilaL7RWoMeDXs+jyRGkHciFRK fLsXcPUoc2BC/CI1Bl1dpJ28HzrLv6RFeceMH3IOMeuqnEax1m5q2b8+8hblEUxlpoqvCSt9 DrjAVEzBx0Rb/EiROdpFtE2n16JtNERofFTD8WGz5iN9JiXBVM02mUhJNsoz2rnalWyYlEsZ fKaoTcLPFC2cwDNFAxV8pthBhZ4pWl75nymOeKUlmwXlf6boQHmfKer4VMMJ08cEufdrWWD7 npEZgtZIDUHPyHQuiGTcto1E38gVbxxiSj+wD9/7FRkRb6pt7mk7JJ9YiWVezOXbyRT68i2l 8F6+nQ7dXL6l0BGXb6OHKsvxlSVOTfMS0udr2Elhw/mlYR6/dxvLy6saX2Qw+97t9EFVTyQp 3ai2NQE7eu9WMKJtjXdTr6DSKZ/1PDKalkz+LvduY9npnOxy73Yyu753GxMRelewUhi9mOZE BL3UZsWrFCH3jNYgEaHE38kZLkh8yUTyEScHf1IH+rBbQ0L2Fb/R7ANZYXdsrXMItlfnREBX w27PUjnTabXGIbT0hSfR0BVTCodOhFfhRGBLVUcS7NGXaVgrgN5Kc1ZA/4ZlabtXViH3TJlL VsDb1b26m3D3dBeo42OYQEaWQ3t5npV8d/S6Hkb3SKwIaAlTVw5VCuaTlrs7ryeBhvb68klV IU+PKK34Qr0QCTYIfCdS4b4TaSdqmqBRzKGQ+zB8L2ouDwRBHXgEtjuP+hQlpZlwmiBET1BB nmN5WFA1JiOCqsMJCSoNFRZULVRQUHVeBQRV2CsjqDqogKCyobyCSk+h9xmY9XvfM7DOxPsM LISi3XVMhp6BOUEhXYFUJqxS7xtTxbBMKp6W3svQpvwuGLZwNmFYVCry6fFSNAtjeSr4AMvY CYIoBvsmTKEPrCO3HLko0yqOs9yZMxf45r8Rzk5aGPxGWvTwHdcqIi3MLDR1bsA3U2WTOZgl LaJpyTTsIi2i2cmEGGmxKwFnAvtFCeimHg+tXkVLoWNk0HS2Sr3MdjR0B1cMvYxlJQdI8MHk oDUGDUz6HkhPpRtDJgrMVpRMUYx+tDGGqfloI2XyPjuLAlcfbaTgskCh/GLwevz8qSGL1yvR YsCbTzhS8OYTjmwvsy3wA47xe4CkF/2sTUDK0Eoyg0ZWkl8zT8duNDPFDk/INOhq2O1Zmnk6 baOZKa337ZAR0NUwtF8zT8duLq5O2+mdyKIfnY2OLAgCHkdKD6CiSbMCm8WQ0k9VWku3LMNL 16gxkuGmqf44rkb3Uy6/7o/Db5T/lK0gHlxrfwoe1v6zJoPk0QH1vw+6iim5QOjch7l77BhZ xlPOFmYxkbU77SVNMUxFrUYvPkvQz7daWaKhHbk/PCNL0JeNxZKqUjeOtHDPUVBvi+7B9NBd Ym0Svkts4QTuEhuo4F3iDip0l9jyyn+XeMQr6/xK2A+mh+4SO1Deu8Q6WNVwttNnDZP1e3TI MdHd70wUgWOiuxVC0e46JsI1oUFBdT9Ec26fcFTeV6Np5c/KynyJxfRzlOks+hyFsowGfBXq WzGtb4Uw3w8xlbXeA6vMet8hMcZaZL1Dkryl7Q5Y/EPcnBjQIZ5xTDKLmIzy/IOSWfxkvPfx kdAoT/D7bKp6zsz3n7zPGoC8CHxfxyBt/43Gs2h5br5DZyotffWttbwaaeyn1WU9jfMdPv4a Q9/cLKb0/tORCPDmZjEF994sjgIvh8H9Wng6uMgytbVFJ/iCvhPYph3ZV0wwkNzzZfFxnvyP 4G4OACi399OrUeDVMHjgCCACvTkEiN8YC7mP2YrPj/QtsxatrrXHXjNLY9NW5D75EkED8YDf ejFhfc0Bl8PgQaUfgd8o/f+P8zLzjAwq/T3AM5nKSRl5fuyQlTLz+sAscrJeGpG/DwbJVNom DBNumc/oCKlQJl74jlyFqDTiiyH6gYcZPYwvhug9+hm0WR277fZuuKPgZKV9IaO7/6wPErSJ cyGDXNy2cLqrD66VfriHUPaFDHK9u4OyLmTYVu1xsPZKUihLcQe80gcJFlRJ+Sxl3kJRQjOc WWF6piaQD1hIGFXvyc0EEzUnjUn4cMdyxpw30DdtW2SBEyDDFzwB6vjaIxD60u6OL3RMZPXP f0wU7l9rFOyfCYGOz3+W5PCJPl9rZPFR16dZkWVb2t+o2jtwqPHLMKd/X2M59L2o+tsCKwbO jXzP6/8AOoPEaA0KZW5kc3RyZWFtDQplbmRvYmoNCjQ2IDAgb2JqDQo8PC9UeXBlL1BhZ2Uv UGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMiA4IDAgUi9GOCAzNiAwIFI+Pi9F eHRHU3RhdGU8PC9HUzcgNyAwIFIvR1MxMiAxMiAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9J bWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA2MTIgNzkyXSAvQ29udGVu dHMgNDcgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VS R0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA4Pj4NCmVuZG9iag0KNDcgMCBvYmoNCjw8L0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjE1Mz4+DQpzdHJlYW0NCniclVnbbuNGEn034H/o RxIYUWw2r7tBAPmWSbIZzMZeYAFPHmiRsoiIpIYXZ+fvt6qalNjilMFgAI9FVXdXV506dYpe b5qu2KXbTvzww3rTdel2n2fief1UH/9YP3075uvP6WtRpV1RV+vH/qXDRx/zNMubH38UN3e3 4ubp+mr94Anpiafd9ZUULvyTInEd1/NF5AcOfFGCzU+PkXhtr69c8UqfYIH++NP11bMl7D/E 0y/XV/ew3dfrq39fX4n7327FmvHvpu66uuRdfKjrznBx9MsPQidKROg5yvXJsWdr88n2rU/3 trL+K+xVZN3YkSW6euLRdIfA8xxpbjB33jgych0VCz92gtOKW3vlWZ8eH+1VYH22V8oSMnj3 PGP1++d5SeS4gVC+E51W3DCbwx2cJDJtV6xt7CTKtPU4WxnMfHjfa+WGuMJzneSdFQQKsf6M cPjt9uc74X4nx9KDrTwRJtKR8eioc+Hp+iG+xKxUwWydmC2bQV36/mzZJsuKrsDE1lUK6DoA sKS0frY9ZVW72l6FVlOmdmCNRv9gAukFieNK3icmLPJ7YRn8DJWjdITFCqrUh223z1a6JEAB oN7YwKW1S4IEBWMe/qyB/ytWHMVFtFAUrvXNhh9tl5etSPG7JsdyLCrRofk+h2iKkqJZZC08 g4/1TnQNPMdIV21BD4ENKLTVqy1dS+waO7RqvU484hcfN0zIfS8hipi6ytWEr5QTBaatBO4Q VNn8EVHiSH/hEbFCvpmaekEo6K7Z+zU1Bt1PnGBcu4V1fYPRwEhW3QGCrnTQBT4pjwdCJEQq GR57gBEOnpF0vMA8gbuIF0EvkKbtS0EZ6cTvmDPKy+YSiGdOiRz/4qxL5J1sgUeW26qZLXlS lBClgsKB0W7gt1iH5IPAMOaY46bDMi4qjSyM4Ne+OJa4SAd4wC3u0AmCZCuqusMGsCx7wErR 6Fe7tYcayPoDdMIdnF03gvgE6+R4oJrR3kEyc/wEPqTgxn44HCkHv2LjAb3Gjcxzt2N1oefM MsB0kpjL2CNib2bbtzncTZQ13IyiL86RhxpWQ7jhHhjw6j1UBoAUSKWx/WpRrD3pJGdsdjpg u7qBE8VdsdshIHIO316E/dHYg60FJZ04MW0/Yq4wawe6eJlWpEZ+hXvLaYX+z14llBDCVIWf iOPwu5YtHqBuLzIPZLMTBH/DNp7Zbg4d4a6B1hdZnebqt/yAng7lk7J8CsCQy472FbT5i3hf hIWaBbSObd1jCjXCFgEBtI4cNwU6z/LjoT75L85ZKo4EkmILjBACsb5hKdKxW4IrfqQ1x66m QFCq6DG6edxzcQXpJAPTj2+sbUJBm9ryxe3NbL9Y9+AKSVL68cVmV0eR4ylzNciYlYx450CN xtEy53zXJVqY2mKUskzo/3RFQmtPD8TAdUv0Cr8ALeSLMhsk/rmRdg1xyVkyiL/0Efu678Sx qd+KrAAMDyICzzjUQ8VxuQChnpinsIIachEEpu2BSHp3QtELNRGivl3RibopyBWYdxB/nhwA eWzGFW1fQl/I+hwpa1FAYvfc9wDqjLMy8nGKMa0hHkcYtKjPFSNbH0SaveVQDdB36h32TPG1 p5rseuqLOnXlsdfZhODGFstbMRwrzWP5rhItt4UB1Ve8LaOrPV5XB4F/7jYvi9S0mq1brqSN ZQ8obrE15meWA5CSJMDIt3XVfhAZERBmi8iMwANYKvOqa0XfTuWyztBJxRC68FmRHmjnLke6 21f1oX6lXTUM2xpBqZvYBJ24AptouBCRvntmdMIYknetzxwHJoSWYtPrQU5Alxo7/eeTZjnp Wf/awFrSeI/UXGn+eBh+hR/3d7j3MJ+LjLRbKrQMoMtgPCDgW4jvEKa+QuY4NWoYSYqqy5sx gkBUi64OGkLKUexhIo8kgKiRjjc/Me4YW8rWUIFVT7xBSaohq7n4nW6xAQoNcWIAGQPb7lgZ o+IYSdjwhGWwBLpJYNp+R8bgyd10fkPtJgZ9tSwuUmFpDxyZE70Az8B1HtkhywMtEUpzKa/H QieITFucsiZjJyKhygcdDLWWY8toSpa4YEd1cTpLRtDAF9tC07i0vVtvWs48jJxQLdw6cme2 MFBUbPIlSj/DvEI2Z5q7hG638JK+DGa2ZxV2Gkzvb29p/oemvV8EIz9JcN/x9QPT6cIYmdWw 5XAjI8+JTFOEje7ifw48eKJH4mMYDxtsilQI6Viru56oAtiOSOZ7OvaLhcudk95nkRcqRyam Ux9Y23Bmy8IjTGa2kBQujMgjXrQsjMgjoCsNWxXjTX0Qoy94b+wfA5eSnGCAA7nzLvJMsoMx R/56J9U8kGIYLccVlNa2aCmBKU7bmHdUNTQyNIDOEttiiwBA3Q9UQtPBXrT9Dkf4YlsMLwvK 08z756joQIjmFS7Uk5TRCzgM+MrF2chwk5+j1N+wDWe2T3uulfigUcKlOwfRzBY66OQ9Cvt+ LJ5lpGhZa0i1G5rWpujlcx5JHJ3OY8lbXWQ6Yf1BS1n97owwuq+PrfiLBBnh4410FMjlti1e Tirpn5OueJLwE6h/4EclnbSpT9gG+MRJRwWmPXI7ETbNNnN6XRQUmP9Prd/g4y2N3HTtVuj3 XfqaIFOR/4jdePZwA8dNzO35P0wk+KcDwxbmBr7bujNzuD1Me6gwobb4/hg7YWQunIpKG6pz g5pRBlpGmoqSYyyFcsvYlE0iNPPLmI8iFeX/Qhz7/qS/04ybjz3nHTGLOeuoOw16th1BeuTY WAHo8G7TA00py7Ya0pXGwrJv2VePcUjgnprzQ2Iys9X6ue2pLLvTOwAYADZ6ANfDixbWSyIM CAsmEUZU5cMr2Wx4VczJJE/SW3JjC2d2KA2m/wcK0lSnDQplbmRzdHJlYW0NCmVuZG9iag0K NDggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8 L0YxIDUgMCBSL0YyIDggMCBSPj4vRXh0R1N0YXRlPDwvR1M3IDcgMCBSL0dTMTIgMTIgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94 WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDQ5IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9U cmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgOT4+DQpl bmRvYmoNCjQ5IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE3NTA+Pg0K c3RyZWFtDQp4nJ2ZbW/aSBCAvyPxH/YjroTx7nr9IlWVCCFNrmouVzjdnap+oMQk6MBOjanU f38zaxu8LGNbpygJLzPj2Wdn58WeTPNiu1mtC/b+/WRaFKv1a/LMvk6W2du3yfLXWzJ5Wr1s 01WxzdLJ4vi9wI/uk9Vzkn/4wG5uZ+xmORxM7jjjyo0DttwMB5x58MOZ9ALXUyz0pev5bLkH uY+LkL0chgOPveh3XFRvPw4HX0fM+caWvw0HczB5Mutr5aZZ7rkeb5o1NX8MB3+U+peOiEC7 2EMjhksIn4VwqSgiNdj884xNCII3WVFkexriXZYVFxAFAx7NpfoqcMOYBcKVp6VOHx1/9Dh3 5OhvNmOFMxaj7IJbra6EcLmp3b5sP/RcGTE/ctVJY4ZXeFwsnLEaPTljae3S6WoASwhTmZOy gSWrWldhiLavQsQhbrf03bCxiuvGpadcLzZlx6RsbNmlFijhOFzK9gpS4blxi4YOOTZ5wmD7 PHu4Zd7lMTQjSISRG0EMQEDHFxEE4UM5L6XLY1Op6YrlBG84cbGeIAxd3suIaDESSFf2MiKv GBEQ1QEY8WNXnRjMgMGX3x//gX+f4XdBofC5Ky90mw7oRHa6AMSdYPAG95y7guXJcLB5d8VN v2WtUrlheSltvGPBqj2DVIkswDNUJ7IpJg9qwZwLNzTlqQPPIZ/CevvJQha6lJ0+/1w5wShd A/8Efp/ZPHXG0Qjf586YB6NfjvBGb8UW006WsgX+L1bpM6rlz+TRE3o3KLcshMGVzai5eREm RCMTTkkcsMTAVOlC10u2Qme5ku33CATR5WsnHG1XO/aIaGpgK/hmx3TmTvAPgj3mW6gZ3CvZ sunOGcejFwc+yPAVfPu6p8AG3A0V7bQFNqTBqth3VXRZYihYqGOqdIDtJ1uCtV2pwCIoiLck AaQMwu8q2zJ0z2RFTRawc1m+PhTJ/kBChdwR0g5bUKMWqBGkntrI7YQMVCjUQWBKd/HsJVvx NLxAeG8IKy/2CeSdtJggwKkzDsuwQ3wpht4agCkAdt24ULErQ9oRi1PcwimARrA0wsblR8s1 +HpPLcwLXWloeVqhC9pZoRtaU/Z2u9kAtm1C6cA6IFgMHapp4RhYvil7j/CR+26He7FfpRR0 qEVxSC/EbgS8FupKnhPyfEY1H5xLhN0U7uLcS7bibDix28Fp9usKg4eY6QRwzH8mkFApW0JC jbzwUetB1ToVLUinnJchnq/wy7dXjHIyvmOI75Z126ivNV01ahmfU/R8Rgc2lCzMBE3xLti9 ZCvYhhtdsLuiXkD5EbFplIp6EShXKFO2d9RjIxYoeqX2VlxrXeutEMpVqrJyhxd+cKAu6EmK 7sF8ja+p2rUtvWSrbTFdCsrmS3cIEKkhlDUdutrPdJNhTOf7laNOtY9p7/NsjduHyoeD/ibV 0d5s01CM7NMgo3NOe25jvtbc15i57k1OEb8oiwzFTO+sodPFzLDfHcqaRNlANLow+Dga6dah OObY6iI8owdr778iDYxy2wZ2bcyogPkwJMfqVAO5CnRJeyCZeQLHkqZaryLYUOiEbMiW4Ydk NlkOQbrXt0/Y9HA45hiMVc+A/ReRA0KBGZV0wMalWnBFPjBqujZfYj65I4+wwonVUOsi1Uu2 ImW5kxYJ+pOnGICFnqQgnsowTJM69eVbPWGV53SJGA9a7l+GeSDLqxNNDVahG8S0nzbQlslK 32q6En9LMv5gEDe0+oXfWaEbalOWCL9lgukQw+41zXbZi86UZE0PYywkpA82sJaJCe8FnvJk yxRa1g5DuotRL9mKkeEFOWw2JiICjQ8trDTNVRPp1cmgZTCIAmzGyEXYkFsmKN8X59zaMpFC CoaG2JDugtxLtoJseNEHMjl26tNNzZ4i0jMV6ZqNrmWo8kV0zrO6QfiEO/lAnudYJ8imVhfC XrIVQsub4/fduVp/SvBlSQwQxXWzk9cF+1Dkx3VZp8n6Ekkcjkiv7BucLcORD/WCG/7+edMy IPnC1Ogi10u2Imd50iSne5cqGCkuHA5kSF/T5tIyyfgeP+fOL1idsFDRsyPevDR0usj0kq3I WL7gGfxx1B1wwbBOyKoRbNyaSwvy+EGDgvWUcsEG1TJnyCg85z/d/d53lAhDowNTP9kSk+3J OVXp7lgPYvqQveret+5TWptfESrs5khHbFgt04IMZZ3xGHziR7qVWDyRuUo/fjC0+jQfDYVu ak1ZTe2txob3df/XQVTlMyjKCxtZy7yA01rPNFe30T+GAx+yPA9gHAeAAuYRiUWfQ1cU6Wcj f71jaf2oV7D48gGyH+kHUAIWEFy7dP087D9ouD5RDQplbmRzdHJlYW0NCmVuZG9iag0KNTcg MCBvYmoNCjw8L1R5cGUvT2JqU3RtL04gMzY1L0ZpcnN0IDM0MDIvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCA0ODE4Pj4NCnN0cmVhbQ0KeJzdXFuPJTcRfkfiP/Q/mHb5LiEkIKBAQoh2 V+IB8TBJDsmSzUw0TCTy7/k+d/nM7Ikv5/gRabXtOd1VLtflq2rbbe+3ffNu82bzeTPGbmHf TPBbMJuYsAXZJKTNp82avAW3uV22YDfn8aQHGZ6Mm8cj/Cf7Fnf8gEfyFsVv0WwxJTS35NC0 W8p2i27LLmzRbznjXtjM7kGY0D2YJ/RvIFEyuGYQQSxx+Fs2Yw3+jrhCkGQ346wHY1zRR/Ib yMyWwM9n3MdzwcUNt0zcd/SMK6QGS5N29A1+yccNApm8Z4iEK0ad/SY79JADriFARijCpA2i iqHocROxIAZPEXLdoSqLnim9WPLZ7QaR0fEOJn7nLXD11PDuoFDDBvgEDsaAT7QYNYQQasvs 6CqRHMOVDB7GgHOmZSCYpXTGODQCySNMI7wV0Cha9JsVywasBjLqcbPWUZH7ZmlBIwYNH6ja zfqdt8DZk6HIZoOwAT6BahXwiWSIX20kQwvyRHLIbTNkMYIucmQjwEcsJIRt3A7tGQuvMeXh tDk6lbERjchn4EmWD7t9cw4aNTaj4WljgZNhcAaadb5YG3wCuMLsaNB+Ds9Ezwb6SlAkPAGN wF/QRaae4Wku04kwfr+jZwMCv9NwdHreN3A/L9Qz/MMLnIviektRPZzcclwMEmfZgL879g57 eO/oduAcYHODMPEB0WHgRz5Cx/BANEiOXzEIUqH3VMjBOXtGG8JsJzm0H3YqirFEdzCIn0AK w7ASWhmBFYQxgvAJlkYB92DhtbR9cJ4N8PGGVAzSSEcHOR7CLyAPtCAUGiL7QlyFRI+CpUOi URBRIdMhEUIhZzYQrTs0aqC1SM81DGoOrkSoCBsIYWHQMsJLOGCQ0SJsDH6NMCF6xy+exkWQ xGD5DDAi0LiQKUZaBx4TIzslNpQoQMThB8QE/APex7hEmO8wrhS8AFeB+hIdVnYiR+TDAZCB UQjETZL4DEACYYBGRgNjEnhMcpaBDXKHTgVaSx4jRcgDSRijcO4UYCsEPzDFxAKLiTYVBFpK ZIhAS7SpwOQpw09pqrwTDyAlIpi3BNAjxAxgDy1DrWWBEgAnaGQ2ADeMUxHiEckResBKUgGp PMkxpOw5QEuMIjm8KgdYhrwQgmyAc6LwUGhOJLcEMkMqom4hJ9Ds+F0KdDEgxBGFGDpCX9mp OnGEOqEC6Oq7JRNXMC6S1hLSChfiuINhhUCzFyUeEEjso/PsRY30eJgM4/ekjeTCEN6LJj1l SeTi2QeGjFYByYKgxLI9kNYTHQuXgpNwMcAqgZJcClIKDXIkNXJhFAFLoAu6LcKev5ELIAAt cvb0rYKpgaOMBVQjKcglSiy5EC0EhjCoESp+K0CGyCBFwVrPFmFzJ34TkaFItoipBNwSv8I4 k5LdaKYSOrA7OROfLTQhzG1QNkbJEIFi+RxBm0EkBZoD+2DSgOBskR8zrzD/oUtYlRkPrEBB 2EFCKVmFLWhRmP/sTk2WDAuDbHJAfCCtJxLzLgPZUg7KCOCGzLYANmCfOYk4D5ktswsyCjkT +5n0LIISORuuZ3fyo7NaAh6AlfmspIaS6/hcCnyOtPBztBKzA+4y+aMV2SLSl/xE4HKELssk 5Oi31jBFcFyWGAjMZoZkInHMcYb8XORvgYmDqazkCZ8pFZ8L8EwMmknEMZey38i7UmoNjkjY b2Y2FnLJkS2mgp05ElGLVmKrpBlEmGVG9cQ7S2hFliEFW5St5ECPdImWsMW7THXeU+aSdjxl LvkrUPeWySnAtpax6iN1z5j2LG4sI9kXTRJlPTOhZayGoknGb9h5lzEdSn3AOA/EJeoLOcfx N+YiWqoUD8FSqpKxHGX2Jb/RHr6kM9qDEY+UA1rGbwiFgn3EQkF+sVBQlkQKRnegT5acEeiT lvFbEo5lTEdWWLZkQaZjy5iOBHGWgWjR+ozkSE1YRjLSDvplIo6ucGHuKZoMpQqkJhndJQdZ RnxkoWMZeQAkw3KH+ZSVFOM8JtDZSFkyuTC64RAcZSrVJKKCdxMLEeIisipHzohP9DPLiE+2 cMnMsMLfHFuJrZJ+GQuM7sRawjK6kXhQXzEuU2TpRixJRB+bSg6mnzLiU6bNS6YuMcOIR/ph SSZscUSlzi31Y6l0WX6UqiEzsVlGfCbOMZqRwlkfMuIzNWEZydmVyo6JGcGAVsnerNIY8QA9 lnslkbPM20s1DTkcIx5ZiW8O7COCv2OU5QRPcoxulBiWpSJb8JCC0Tuld8SEndnTsQDeWdk6 ovXOCgk1JQsA4V3LFrRDQ+x0Uc9c7jBmwqihcMwBMAsKMyb+DMOH0gAVE7+YUpgGZmNbHIKZ mimYUIacAc5MPEBYGqyU/HSjVHIqhvab39x9yTepfXtz9/buy7t3P/94unv7/PTT189//HD6 4e6zf2z+n9vdl99uls/89re//tVBYpXk3em/z189/rdJyLe0N03qpNSfmhbhPqRpCmkWupHb u7HLush8hq+p5WKOi/QUFOxICrcqRXBdi1TqT2VgEdMhGpnkJhpp0oQ87CeNOxroI+4v+uiR t33HLgzOrXTkFzoKCzRxgaateODLQfP2x/uHX5Cdn7/7bMtKU5752+//8ubub1/9GxVdud1g nK9lbPZfSvP5+4fvm4M4QjKZritcPyBjrtV2GaOOiJNEUzdsu347XiZEK75rJs7bJlpxXrPi vWbFfRXUJN8OajfRyAKNXaBxY5o2svuFjkKTJtfM+fnvH7/5eYAxl3TnCP1ziyjnl+DoSfl5 kzDNCUewdpse8wqRWXLBtg9ysnaif9P2RM7ujizA+eA1E6hMK4NsBwCnF2eDbIcBp6eHgzT7 8iCv8NCO/Veiz7TDb9ZVO/gmXbVDgS8dMyu044HvQmMrxFUrmCuctA3PK0Eok0TQNoKspALp hILYmRGkEwoiYyOIWzXCIdPKINuRwLWb2SDb4cAVnfEg++mB60OzXtvhZCSPe7Wm3+uLxG3S ZYA6lFiF6wzZzYZc38rTBaGdjPj1LMAl7dS6ZrHTNOhUxmp2h7JsHLCYZiGZ9d2W2+3dTic2 PjRSRRtzGE5tXEjspijjOoSzobrVoTq7OETfkXTqhaFDOIEY1/fC2RD7znfVa/ylpN7Mhpg6 hPt4iF5Wh+jN4hBzR9J5+dtBMD8pf31YHmMf+66r8X8h6rz87SCPn5S/YRl5/CrimA7khCnk mA7mhAnmhGXMCauYY9qgc12JfxtRO/avq/AvNRmnFZDpxGGYVEDxirhv2yD2XZTbSa4rX44M +4pwUknEVyH8C9pry5ebO02DTsflS9TyJcYBi2vLl37fbbnT3u80yaxT2yE0k07toNOpW7jF TgdukaZvx36x04FN03T2LSx2mvud5ilKxLVOsxl0OnWktNjpwJEmUXc4d/W36gLVKlVRVfZm FzPw0/pelwxM6mvoqvKpRzOeqLypJ9NBv/lEsengz2Sq2OS+r07Um/uIe10RcxtRG3WuqyRu I2pH/VULI8cb3G0LIzfRyAKNXaBxCzS+ScOdllfC7CXhGHzEvAafjqBN11WRFoYYO5JO01fq EI7nduX13O6NQwyLQ8xtSWVe3bZjgBtjh2MUszpG2RfHaNqhJzKtfUw7AEXG5Sn3Aq8O0q0O sh33IvNc0o5+kXEukdeTpTcOMq0OsgM6dgo6poM6doI6dhl17CrqmA7s2PmaUgd37AR37DLu 2FXcMR3gcfOFhQ7w2AnwuGXgcavAIx3gcVPgkQ7wuAnwuGXgcavAIx3gcVPgkQ7wuAnwuGXg cavAIx3g8VPgkQ7w+Anw+GXg8avAIx3g8VPgkQ7w+Anw+GXg8avAIx3gCVPgsR3g8RPgCcvA E1aBp0rqbkHkBRpZoLELNK5JI2E6Tec7hOO5fnk9kdoTtGOy3KWUOBxj6BBVhHn3SVtUN+jQ jzqMix2GQYdx1GFa7DANOhxufM5rHaa+9V9oe1tdNbd/tMVWYgX7d2/aQzzmrtRgVY91eOUj sq5E6bp3n0uqmQ4GbpWGbmXaoDDvceBXaehXpg0pM6oOqEzlTGqTQaSfp33HbzG3UXUAYibv MVNcPhLs6/d6r47Xe3VSr07q1Um9Wud65aPp5EtdjH2sAyXZTXQx8LE89pYOlkx7HIBXHoKX tJP4jKoT7xOqTsxORscPRWlJfiZ6XPs+xs8NRxK0Y3hG1YnhqdxO5fUD61Qe05gQf31MZI2F XGMhqyRWr30PtecNum1dtPGBn76OddHHMWuGiCTtCmLao+lnM3uePm732I77GVU7didUth1/ 89GpJY36mOn7mD3PJLclaMfyjKody3O5o8rbR6wXHtOYsPbqmFC/rt5W7VLHWT7j7kokZqiL Nj7Y8/R2RxcywDEZv920c/u8x369ZWWYC20n7qc9DpBGhrnQduJ+QtWJ3amc6h0y8oL9ar/M 1/ulaFYTjejDDnWc5YP/rkR2iC2ugy3n2eiOLmy/YrLn/cntHjtYMu1xgF52iEOug0PTHuOg x2EGdJ0aYtrjwLPOtFPPcu56z7KKcLqVWjVZx1eOeehK5Mae1cGfCVUHQyZUHRxwE307jSen o3cDH3NjH+tgylSCgY+5sY91aokxle/E+4SqE7MTqk7cTXWilajXLOwV/fwgF052CHTicULV ydkTqp7fT0bt1Qe9YrsfZEV3NRb4cD0WOMUCpxjgFAO8Rokf+KofvtX5TnxOqDoxNaHqxMV5 V3VH/3reg9UDH2wYeNv4zIfQibEJVSfGJlSdGJuOVr0tqLeFgbeFYTUVOrE1oerE1oSqE1vT 0aonB0WWway6jcM6PnTy04Sq4/8Tqp7/T0YbNY51LtcOJuZfeE2RJNxQr+oRKuq71ap1vOV4 o55EL2eB3H/14dR+2T/Gp3OFdX6kvhPWGrxWTBUt61gXFn3iyipW7MTzfEd37S1cEI6XiuxH iwUXtOep+en290vC8TZy+9Hs/CXt9DMfWew09Dt90VKbVD3yo03hoW3WNgddCbGvTwLpcRgu id707ccCjSzQ2AUat0DjF2jCAk1coEkLNHnFpkuOsOIJZsUVzIovmBVnMCveYFbcwaz4g1lx CLPiEbLiEbKEDSseISseIW2PcOa6XU49qj+9//anp1Z5MBZxcMCY02ly99E0+QWf8yrE/dNz +5Wx8DgqDT0abtMaW4sgrUW1FNWKSEsardj0wzBdgz+2OejRVpsmMP16RRc09RsWXdbUdeFj WXjTVddj0XU7Vjo3LZl0DehYjNTTfcq548fV6FW/mNGVIT2Dphwwflz1yxmjz+usudH1B6OK 1QNFyqnhx1W/j9F6zegsp555UY4HP676hY7OVRmt5/Sz9XI293HV53T+QD+ILmduH1eVw6vc aiWjb3wmKD+1lwnKTw1nQn1e+avRjCrTqDaNqtPUlTXVp6g+RfUpqk9Rfcqx4lbOkz6uur6/ 694LXZXQ7xPKwdHHVVfyVK+68b0cCH1ctR/Vo26nLgc9H1flp3OAukm3HOB8XJWf6lu3fpYD mY+r8lN964bCcsDycVV+qm/dplYOTD6u+pzqXVTvonrXPVL1raMcf3pc61uFvt2p+1t1fKur +1YjwGoIWI0BW98b1G5W7WbVbjYrX10ZdWpHp3Z0akendnRqR3es5ZbjSI9r1GvSq/JTezq1 p9O4cfX7EoWdVzDz7ul0evP4+Hz35vHD6a/3P266dxNwdHoodzfdB1omvQ42r+5+Afj77PTz y46gP4HZw+Pz6e4L/vfHh29e/qhQ+fb09fPdp6f7b05PR5s0tf3nhw/vH05vv7uniPzhdw/g cP/8/vFB/356fv+vezTKX39/fPr+q8fH7+8+efz6px8gVPnlP9+dTs8HpP71/uunx1d//+E7 /P/q70/e3394/PbVD28/vP/m9OrZox889u3T/Q+aJXSsX/z0w39QfW9ew3OrflbP9rObekw5 TLq0fDmnla1QzmllK5ZzWtlK5ZzWAp3lnNaz1YaHiOrRnuczV/l4M0XckBsU8Q8CfS++PlPU 6RBKcnvWUDTcZ1lD1V6zhnr/PGvU52dZQ58/Zw19vh7jw8HpCTf10Jl6iMurlKJMzimlPldT igp5Tik6qJpS1N4vKUX5zVJKfC2k2lY/La+fatevp+sHzfUb4/rZb/0St34cO8hLir/7MC8d wtyenDQ5nJOTPl+Tk5rrJTkp6J+Tk/I7Jyfld05ONXkpP7XcS3JSfufkpPzOyUn5nZNTTV7K L7yyxNUZKipzDU7dmVo3jNZ9nHX3ZN3TWHcaXu7ku9wpV/en1V1jdS9Xb9fT5a6iupen7rCp +156O0Qud2DUfQ91N0LdI1BX7i9Xxut6dF0lrmu3dUW1rnPW1cXeOlxdHZutCPXWTuqKRW9u vzcL3psv7s2s1vnMy8rkcCKdl6tTZS+zV8fN/5eaxdVB/Q8PSbxtDQplbmRzdHJlYW0NCmVu ZG9iag0KNDE2IDAgb2JqDQo8PC9DcmVhdGlvbkRhdGUoRDoyMDE2MTAyNDExMjMyMC0wNCcw MCcpIC9Nb2REYXRlKEQ6MjAxNjEwMjQxMTIzMjAtMDQnMDAnKSA+Pg0KZW5kb2JqDQo0MTcg MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjI0Pj4NCnN0cmVhbQ0KeJxd kMFqwzAMhu9+Ch3bQ3HSXUNgaxnksG4s2wM4tpIZFtkoziFvP9kLHUxgg/z/n/gtfemuHfkE +o2D7THB6MkxLmFlizDg5EnVFThv096V284mKi1wvy0J547GoJoG9LuIS+INDo8uDHhU+pUd sqcJDp+XXvp+jfEbZ6QElWpbcDjKoBcTb2ZG0AU7dU50n7aTMH+Ojy0inEtf/4axweESjUU2 NKFqKqkWmmepViG5f/pODaP9MpzdT7W4z1X9UNz7e+by9+6h7MosecoOSpAcwRPe1xRDzFQ+ PwlJbysNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0MTggMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNTcwMjgvTGVuZ3RoMSAxOTgzMTY+Pg0Kc3RyZWFtDQp4nOydCWBU1dn3 n3PvrJk1mezbTDKTbYYsTlhihDBZiYRAgKiJoiQskU2MglbRV5a6Rq20Whe0ikvVaiuTSatB XFK11rZaqNaKSwErtmpVqK22btz3f84MBFop4fs6X77K+U2e/zn3nOec89xlbu6ZuTNDjIjS ITpa0zD7xClnNT/hJ2VPBVHaxVMaGpsWOM+cTopvGZFy+5S2GbN3O4NmUoqsRD+8fMrsk+qe /d7iK0h56QairFVTZ7c3neVfbEB7J3rNndY+u3n7jOO+SVTwPpHttBmzy4OpXavuQV8m1He1 1U9rvzjt0s/Q/1gsjz+5obVj9kPLk4gqm4kSb5h/Vndv00PeK4lddinanDv//JWe3o/+cjKx OxGfqbCn98yzFnm6Pyd2xT+I9B+d2b2il5IJ8fl86M955rILe8aOeU0l9oMOojZatOCsC775 zvN7iRreIBa6f9HC7gU75v4sRMSu4eMvQoFLZ1uP5Wew7Ft01soLzM0J+zD2IiLvpUsXnrtc s9A2UpIRP3tt2dnzu9uXLr6d2KfoPzN8VvcFvanTXJtR9w7ae5Z3n7WwpOOtZ0hJ2U1kz+09 e8VKzUdPIz4dr+89d2Hv0uUnzCF2LbaPq5b4vtAnvv/O7U8UznVM/NiUwTcT0V1vjWvi6XNP Vc74/Kovr3GSaRx8zcKfg9SYt6+RTnHS51d9ttNJB2pi6JbyEtspNIVUUaCQk8rpZGzFqzEu R1WXKI+Rnkz6DfpKdFAQTdWN1KMkMb2imFSjXq+oul3k14boAt7KzBu2t9Z7CA+PS790XxOr NOaxLSFimqah9X36aXxNSWc4nmVHB47ZA7RJdw6F6StA3SxYxj+VBQ+sDdFU2BWwg8saYdO+ qr+vQv9zcupPpgDSmbAs5Et0b1GZ4XiaDQuoOVRywPdkKjReSyXwy0FdG/zGxvoo1K2gJaif inwF7xN7LAmpHZb078ZHrHPQNqBeS9ORzkA645D1PZ78B+UDhgdoGvya+LrvL0ebFsQ5E9uG xzH5n/pPHOm2kIwMHWl7RjuGgzn4GJFIJBKJRCL5T8Nu1B4d7RhGiu6P/z2xSiQSyWjCSHvU BHOSPG9KJBKJRCKRSCQSiUQikfx3YzvFyBj7rkEsGHhi4KkhthCjoDnT4JpV46kiSm532GZR mj03eV3FM/Wx+mnT0qelIy0nGnfttGnQTAO/8eaWeIRsOLILFcRjYMnXAXZkl/2UHNlFMkJw lhntECQSiUQikUjijkoq4+hVlSm4/knXv28Zon+YNDKRWdtHZkqAJgi1kAVqJav2JdmE2skO dQh1kkP7ghKFJpET6qJE7XNKpiRoCrmgqZQMTROaTinQDEqHZkI/oyzKgGZTJjRHaC5la5+S m3KgHqF5lAvNJzfUSx7tH+SjPGgB5UMLyQstgv6diskHLaFCqJ+KoAEqho6hEu0TKiU/tIwC 0HKhFTRG+5iOo1JokMqglVQOHUsV2t9oHB0HHU9B6AShVVQJPZ7GQatpvPZXOkHoRJoAnURV 0Bqhk6la+4hCdAK0VmgdTYTW0yTtL9RANdBGmgxtohB0CtVqe6lZ6IlUD51KDdAWaoROE9pK Tdoemk5ToDPoRO1DaoPuoZk0FflZ1AKdLbSdWqEn0XToyTRD+4BOEdpBbdBOmgk9lWZDT4O+ T3OoHXo6nQQ9Q+hcOkX7M3VRB7SbOqHzhM6nU6ELaI72Hi2k06E9Qs+kM6CLaC50MfRdWkLd 0KU0D7qM5kPPgr5Dy2kB9GzqgfbSmdqf6BzoO3QuLUJ+BS2GrhR6Hi3V/kjn0zLkv0FnIX+B 0AtpOXQV9UIvonO0t+liof9D50IvoRXQ1bQSuobO03bTWjofuo6+Af2m0EvpAuhltEp7iy6n i6BXCL2SLoZeRf+j/YH66BLo1bQaeg2tgV5La7U36VtCr6N10PV0KfTbdJm2i74j9Hq6XNtJ N9AVyH+XroTeSFeh5Cbqg95MV0NvEbqBrtV20K30LeRvo+uQ/57Q22k99A76NnQjfUf7Pd1J 10Pvohugd9N3ofcI/T7dpL1B99LN0PvoFuj9Qn9AG6AP0K3a6/QgfQ/6Q6E/otu11+ghugO6 SWiY7tRepX66C/kI3Y38gNAf0z3Qn9C90IfpPugj0O00SPdDN9MPoI8K3UIPaq/QY/RD6OP0 I+gTQp+kh6BDFIb+lPq139FTQp+mCPQZGoD+DPoyPUs/gf6cHoY+R49AfyH0lzSo/ZZ+RY9C n6ct0BeE/poe016irfQ4dBs9Af0NPam9SC/SEPIv0U+R/63Ql+kpKEaDvkI/g26H/oZepWeh r9HPoa/Tc9A36BfaNvo9/RK6g34F3Sl0Fz0PfZN+rW2lP9BW6FtCd9M26Nv0G+gf6UXt1/Qn egn6Dv0W+i69DH0P+gL9mX4HfZ+2Qz+gV6EfCt1Dr2nP0156HfoXegP6Ef1e+xX9lXYg/zfa ifzHQj+hN6F/pz9A/0Fvab+kT4V+Rruhn9Pb0C/oj9Av6U/aL2gfvQPV6F2oPKfLc7o8p3/9 zum3yXO6PKd/7c/pY76G5/Q98pwuz+nyOv3/w3P6K6N4Tieccck2x5JqJlXVRd9J1vGv3tB9 xbveJpPZZDCYzagzJpgSjGQyGkwmq9EUqzcY9MId9boEI3J6vc5II3uD+qgZSae6eAws+Tqg jNzVGL8ojjmYJXW0Q5BIJBKJRCKJN9Z0MbeKXkX+u7mV2WiMzq0sZj634lhMcm4l+W9Dzq1G BcWaPtohSCQSiUQikcQbW2bCv86tjEYjl2Evs/nA3MqEuZWJzJhamW3m4bmV4dC5lcEQv7nV SK545dxKchjUkbuajuwiGSGKLXO0Q5BIJBKJRCKJN45cK6ZU+uhVpF7Phb9NZeIy7GUBCWaL FXOlBIfFaiaLKcGSYE9IiNUbTUbhzudWVp4zGEWXcXnhfyRXvHJuJTkMRzG3MscvimMOxZE7 2iFIJBKJRCKRxBunR8ytoleR/25uZU0wW8XcymnF3MpqTrBYHJb9cyvTYeZWcXnhX86tJP8X HMXcKuHILpIRojg9ox2CRCKRSCQSSbxJzLcNz632/4KD2WzmMuxlsVqtFovdhjqL02qz8LmV FTlLrN5kNon7A/ndgHbe0GQ08OZxmVuN5N2EuNyMKPk6IOdWo4KSmD/aIUgkEolEIpHEG1eh g/R6fXSStH9ulcBv9ks46MrSZrPbbVaH3UhkTbI7rGS32Gw2l80Wq09IMCfwKY8efw7e0GQy 8OZxualqJFe8+ngMLPk6cBRvaVrjF8Uxh+IqHO0QJBKJRCKRSOJNit+JuZUxehUpvr7CKG4B 5DLs5QB2u9OJOrvL4bSTw2pzOJIdjli9xZIg7g/kc6tE3tBkMvLmcXnh33JkFzm3khyOo5hb 2Y7sIhkhaop/tEOQSCQSiUQiiTfpFS4yGIzRq0hT7DNSVquVy7BXojMx0elIcpmJnGmJLgcl 2hyJiWnOxFi91Wax8SkP/3pBlw0NLWYT7zIuL/yPpFP57dmSw3AU027HkV0kI0RNrxjtECQS iUQikUjiTdb4FDIazdGrSPERK5jdbucy7OVKSk5OSkxJSSBKykhOSaRkR1KyK9uVHKu3O6wO PuXhX4GR6kBDq0V0GZcX/u1HdpHfni05HEcxt0o8sotkhKhZ40c7BIlEIpFIJJJ4k1OdxudW TrEgPmKVIG4B5DLslZyckuJKSk1DnSs7JS2JUpxJKclZKSmxervT5uTzKD63SneKuVUC73Ik 06CjZiTvJsi5leQwHMXXnCTFL4pjDl1O9WiHIJFIJBKJRBJvPKEMMpks0atI8RErmNPp5DLs lZaalpaSnJ6BuhR3WkYypSWlpKV50tJi9c4kexKfR/GvF8xKQkO7VXQZl5uqnEf0kL9MJDks RzG3Sj6yi2SE6Dyh0Q5BIpFIJBKJJN7k1WX+69wqMTGRy7BXWmp6empyRqaNKNWTnplM6Ump 6Wme9PRYvTPJkcTnUdG5FRo6bKJLZzxCHsmdWnJuJTkMR/FRPDm3+s+hy6sb7RAkEolEIpFI 4k3B1Bwymy3Rm/vE11fAXC4Xl2GvrIysrIy0nBzMrTJ8WTlplJWCkoKsrFi9K8WZ4iRxP2FC TgpmVU67lXcZl5uqXEd2kb9MJDkcRzG3Sjuyi2SE6AumjnYIEolEIpFIJPHG355HFos9ehUp vr4ClsI/SHXgw1QgNyc3NzsjL89JlF2cm5dBuWnZubn+XHesPiXNlcanPPzrBfPTkjH/cdpT eXk8Qh5Jp/KXiSSH4Sg+ipcZvyiOOfT+9tEOQSKRSCQSiSTelM3xkdXqiF5Fiq+vgKXxD1Kl HfSqfZ47L8+d5fMlEbkDeb4systESVl+Xqw+NSM5g99AxedWvnQ0TE5y8PsF4/LC/0g6lb9M JDkMR3G7aHb8ojjmMJTNGe0QJBKJRCKRSOJNcEER2WyJ0atI8RErWEZGBpdhL1++z5eXW1Tk wjSrwleUS77sPJ8v6PPF6jOyU7P5+1R2zGpKstEwxSW6zKA4MJJO4/IFhZKvA0dxu6j7yC6S EWIILhjtECQSiUQikUjizfhlfrLbk3LFQhL/fBQsi3+Q6sCHqUCRr6jIl1fiT8E0q7LIn0dF uSgZV1QUq8/KSc/h71Pxr24P5GQSpack5fDyeIQ8kk7lr75KDoNl5K55R3aRjBDj+GWjHYJE IpFIJBJJvKleWUoOh8sjFsTXV8BycnK4DHv5i/z+Il9paRqmWVX+Uh/5PSip9vtj9TmeTA+/ rdCJvwp3NlFmmou/6J9DcWAknTrjMbDk68BRfBTPd2QXyQgxVq8c7RAkEolEIpFI4k395WMp MTGtQCyk8vv6YPn5+VyGvSpKKypKS8aOxfypdHLF2BKqKEBJXXlFrD6/ILeAv/XFv15wfAEa 5mam8i7zKQ6MpNORfJeg5JjkKD6KVxK/KI45TPWXj3YIEolEIpFIJPGm5cZqcrkyom9AiY9Y wQoLC7kMe42vHD8+WFZdnUMUbB5fXUbj/cHx46aOGx+rLyjJK+E3UPGvF5xYgllVXk4GvzAt pDgwkk7j8gWFkq8DR3G7aFn8ojjmMLfcONohSCQSiUQikcSb2ffWUkpKVvQqMpt//wTMz2/2 O3DDH5hYNXHihMpQrYdoQtvE2kqaWDZh4sTZEyfG6v1lBWX8fSr+9YL1ZWhY4MnmXfopDoyk U/nLRJLD4By5a2Xcgjj2SJh972iHIJFIJBKJRBJv5gw2U1qaO3oV6eafkYKVlZVxGfaqq6mr m3T8lGYf0aRT6pqPp7rKSXV1c+rqY/VllSWV/H2qTPy1VqJhiU90GZcX/kfSqfxlIslhOIrf s66KXxTHHNY5g6MdgkQikUgkEkm8WfDcdMrIyIteRebx+/pgwWCQy7BXc31zc/3E1ulFRPVn NE+fSM1VKFnQ3ByrD1aNqRpD4j2v7FlVaDimSHQZpDgwkk7lLxNJDkPyyF0nxS+KYw7bgudG OwSJRCKRSCSS/weoMcsmJpafwRJy7Jeko/uJf77Jg5yB8qmESjGzGU8nUht10kJaTGfTeXQh baQfseMMIY9L0+DvoWL4VdA4qqVpNIu64beMzj3UT3vrsI/5eNzzRXjX7bF4RgAz0AFnpihE yj87YBV1epG18C+KcxK5klOI0g/+Ea+CwqLiEn8Ak8TyiuOClTRu/ISq46tP2H/jY0Nj0xQ+ mZxGNKNt5iyik04+pQPL//HfRFWF9o/E9eWD8v81eytUd1J7aHLNpIknVB9fNWHc2MrgcRXl ZaVjAv6S4qLCAp83P8/jzs3JzsrMSE9LTUl2JSU6HXab1ZJgNhkNep2qMBrT6G3q8oQLu8K6 Qm9zcylf9najoPuggq6wB0VNh/qEPV3CzXOoZwiePf/kGYp6hg54MqdnIk0sHeNp9HrCLzR4 PYPs1JkdyF/b4O30hD8Q+VaRXy/yNuTz8tDA05i+qMETZl2exnDT+Yv6Grsa0F2/JaHeW78w oXQM9SdYkLUgF07z9vaztBomMkpaY3W/QiYbggpnehsawxneBh5BWC1o7F4QbpvZ0diQlZfX WTomzOrne+eFyVsXdgSEC9WLYcKG+rBRDONZzNeGrvb0jxnqu2bQSfO6AtYF3gXdczrCancn HyMxgHEbwmmrdqcPL6LzpPqOKw6uzVL7GtMXe/hiX98VnvDGmR0H1+Zx7exEH2irFDR19TVh 6GuwEVtmezCacllnR5hdhiE9fE34WkXXb6G3kZd0LfGEzd4676K+JV3YNZl9YZp1YV4kMzO0 WdtFmY2evvYOb154cpa3s7shuz+Z+mZdOJAR8mQcWlM6pt+ZGN2w/XZHLGO1HZxZeKBO5IQ7 z7XMOrBlGY/IeyIOiLBnvgeRdHixTlVcFlZR3/wquIFOhlbhBdgji8Pm+q4+ZzUv5+3D+gKn 19P3MeEI8H7w/qEl3bESQ4HzY+JZfpwcONRQvz8fDgTCfj8/RIz12KeIsUYsjysdc/6gcoe3 1+lBgs1Hbdi23Z3V5dj8eXl8B189GKJ5WAivmdkRXfbQvKwIhcoDnWGli9cM7a9JOYnXrNlf c6B5lxdH8o/F8zwlbCo88OdwproaF1WHWeq/qV4YrW+Z7W2ZeWqHp7GvK7ZtW9oPWYrWVx2o i+XCrvoONUuJ5ZQsVdTioJxzwJkvdFjDugL8GcRBvWDQaMJRKUqYpyns7GqOamdCXt4IGw1q e3krkQw3i4UZrg4cunzCIcuHhGftUxGwrlBpaT+1ry/hkLomnIH6+pq8nqa+rr7uQW3NPK/H 6e3brBapRX29jV379+ig9ujVWeGmazqxEotYNY5Wher6vezKmf0hduXsUzs2O3FGv7K9I6Iw pb6rrrPfh7qOzR6cdEWpcqCUL3n4ErUwHOkRxSSqsjaHiNaIWp0oEMvzBxmJMtP+MkbzB5Vo mVOUAf5Er2/vOHgXiudFZyn+m7V7BnXWAas9yNOIKy04qLMMFHvcjlqnLonWwBRyQCfD5sJU oYxCuqTIBZWhQSTnRpPl0WRJNGmvDD0Gx6lUqQ3pkgbS0oO8eCDBGlzDU5OZLydGTq0M1Zp1 iXSy8Euk2dE00lYpqlt5L4k0JVo60NAYbVUXLa6JOVdXumt9WPbAQrBe2CbYXpgB0SdSOWw9 TIPpxBL3Ww27DrYRtov7it5MlY7aLJ0TNU6x7k5yw8phKnXpzFj3sFCHzoStYqIZsDt0RtLp EiK0zL0ZnagDjSJSdSBQJtJIcUlQVEQys4OP4z/lLVREbhSwSGqWqKFIXV0sM74qmhnwlwZ3 1iboiPbAFB3pGC4KRKuB4rLg3iexzNR95GCMl6pfDDiTMZr65YDDFQzVOtVPqQ2mUFjtpyGY QmerH9NqmAL3TZHS4/hA6qaBBHvQCf895IGtgam0EcrEcgjG/fcMuFJ593+KOBJFu52RirHR zIAzPdhWm6y+gXh+ob5IXnKrf0Cai/TnSHOQPqs+RzYR5z0DDmdwDca7G+53qxfiisitfl9d hasit3q/egllCbdXI/boOK9Giv3B2gT1PvVi4bJCPYfGIl2mLo0E3Z4t6j38eFTfHzBbeHzv R5wpwcfVd9WllAyv3fBKczseV5dTOYyvyeCA2RZcX2tVB7Gag9gsbsTI6A6hIfXFCDrCeD9Q 11Aq6raqaykF6QPqukiKe2iL+nfh9gnvBePdhSOGJwM2e3Co1qzexY8Q9SNs8Y/EaH8bKKwK Um2heg1VwBRs1LeQews5p/ohch9iN32IXfMhds2HiOJDHLSkfoCaD+BTru6gXvV1Wg+7A3kd urwwgi24WWR8xcHN6v+oF2NLOLdg2zGUXjJgtvPILo4kuYTbxfwJPvlx9RWaAVMQ/Hb+jDx7 i/otsSrrB9KzeIPfRsxWbLqLovsCDVfxffC4ukZdJ7bEWrEFwk9gEce/+k3RWBuwJgZXY++3 Y/Fs6HWwbbA9MB3c2rEO7TQXpsK9bcDuCDq2qKeKxidG7JXux9VmrHqz2FrNkZR8EfOUWEbn iGTlBp/gGSrFP7Ggzq4zRMrdM7eoLTh+ZqjTIwvciH1mBP3yhtMHqqqDFVvU6WJbTI+4vdHi iCtDZJoi5uhxVT+QkMgjaRCOgYjJLooDsaek6h9ITgu6cZxWi7WtFLOVCdh9E7BrJuB5Uil2 RnDAmYSjf4EaFGsUpC7YRlgYpsM+DsI9iH0cpF2ixKGOx+qOJw2mYt+Op70wnGrU42gy7DrY k7BdML0o7YIpKK/ACF3Q9TAFPZZj2QkNwbpga2AbYUOwvTAjbVVLMU4pvCuga2Bh2E6YDvtq DOIYg7ok1UNfmvi9kauVW0LVbDWtZquV1epq3Wr9aufqRFNoXMGYYGgJlzIuxZAJXeZe8xqz WmEOmdvMqtPsMSuD2lDEWF2JJJRkqK58rfW91s9a1aQJ6w3rjcrWWitLpJ2wPTCVtjInlpxY coauULfW7KzZU6Nubd3ZuqdV3bpj5449O9StpTtL95Sqodas6uCEuexstppdx3RuVs4msxlM N1c9W12tXqfq3Gq5OhnHgq7L0mtZY1ErLCFLm0V1WjwWZb1loyVsGbJss+jDhiHDNsMuw16D vs3QZeg1rDGsN2w0GNzGcuNkY8ig21tbr7yOjboRGoYptAa6XuScomYIuk0srxfLXdBesRyC tomcF1rBczAv+noNfmug62Hcjy97oRV8GebF2f1VlPVC18MU5dVQdn6FL+RTnD6PTyEf2+tj 23y7fErYN+RThmqrle0iyu2IcruIcjtabhdjb0e/yMG8iPYV4fcK/F4Rfq/Aj+e+qqwL2ity IWibyHmhFTynvBLxTnDUpim3ose50DtgO2EqlUMnw84WS27uodwKDSkbBorG4B++siFSiHMk kvxokhtNskUykJEZnFvrUDagyw3ocgM64Utu2GS+pA0pt0QauO8tkUnRpLpyZ+0E/BflodxC m2AKzYDeIXLl0Mkit0n4OA4sh6G7RK4XuvFAu7ki54bub6sqG/C4BTmHsgqlq0IWJfqtokmJ pqRB5dHI4iT3oPLjSLETyUA0ifCk1qWo2PY29qHQh4TeIfQGoacIdYQsXtunXtvPvLb7vLba BGUq+VC8V+i7QpeE7D7bOz7bsz7b3T7bXT7bFvYW5aMiL5SZb3s73/b7fNsj+bYH8m3X59vm 5Ntm5tum5fOuislDNiWHKztDaHYozWP7wmN702P7lcf2nMd2p8fW6bFVe+DOPsL/Uxu7TehN Qsc9MtbmHmvLGWt7VMGZiZ0WcZB5i6Kw08imJkT8Ne5B1SwSJS/SWoAkO9JaiyQr0joLSWak 9Vwkrkjr9e5as+Jg/bhYcSt21m/iqTXiX4tqSzQxRfxnINFH/Me7B9m+iN+L5PNITw6SzyI9 uUg+ifSMRfIxTx5jf6UeBd2wv0R6bkf37D0q5t2yP1Gh8iDSwUjrZHg/Eh2d/ZhqWAGKMa3i UbAfRvwIjt0f8RcjuS/i9yG5N5rcHfG7kdwZ6SlDcnuk53ok34v07EayIVK8jPd3CxWLfm6m QpGuiLRmofqcSCvvoTfSWo7k7EjrOCRLIzUvIFkcqdnNm57J+hmObNZDfhFpd6THj+q5sRU5 nYpF9RwaJ3qeEmnlm6SJd1JrY42xFWlg9fyaj9WxftFLKOKvgFtNxF+IZFJ0y02M9ASQVEWK sY3ZhEjx7dhy42MDlPD98xjzIQzekTfifxBO7khPCZLcSE8jkizeEkG5YqMmUY0IKjHi517O iN/jfoJZqEf0mECFbMPD7i/R7+c1g+zkiPuz0KCJRdx/L0bysPv91nnuP7cO4orX/R6ewg8+ 7N4J1x01yIYs7jf8u92v9+S7f+mHRyjL/Qt/mfvpwgvdg8Vb3AOtue5+BBbumefe1CN6eKgQ zSLu+4sHFYbWG3umuW/2B9w3FQ7yGL4D5yv4GOjoMv+F7nWFa93n4VBY2XqVe4U/x91bfIZ7 STEfKM292D/LvQgrcibaLOw5093tv97dNU5EfIb/BffscWIdWnrEGp1YIyqae2a5mxABKibz CkRwAo7LIJqWjdvCtxGuVOoHXnCfNOExBf+F2RrYuaEy4+PGS4zzjO3GOvy/KTIWGPOMucZk U5LJabKbrKYEk8lkMOlMiolMpCQPartCAf4SabLByRODjqtO5J0KV/5qKq5JFGZSMNEKu9QW pWV2XXhCoGXQqM0KVwVawqa20zr6GftWJ2sJD82nlnme8CezvYMsAbNgvbeOhZNaqKW9Lh3O YeVKTCfbOwaZxltclsVfWtpMjI257NosnjZddm1nJ6WePzl9clJN4vFNDV8hXTFtbAgMkx4I HLKUE76xZXZH+IGcznCQZ7SczpZwCX/5abOyTFnS2LBZWcqTzo7NbJGyrHEWL2eLGjrhdoJw oxplKdyolSdwU+ZQDXdD+ZyD3Fg/ihv6a2qiTjNYP3fCk2aGcDo16lR/sJN6NasXTvXq1cLp 9uiAfsSBAUM8gZt+GfnFgH79MuGWzt36CwvRU08hd+kPFsKhvzAoqmcOVxdHq38Urf4Rrx5k bLh+XGE02mIqFCMUKsXwCYwiC+v+DxqxgUnnL+/gLxt2eRsXwrrCV5+/KD28Zp7H07/8/Njr iYVd8+Yv4mn3wvD53oUN4eXeBk//pI6vqO7g1ZO8Df3U0dje0d8RWtgQmRSa1OjtbugcmL62 6pxDxrrqwFhVa7+is7W8syo+1vRzvqL6HF49nY91Dh/rHD7W9NB0MVbLrDrW0tbRb6K6zvo5 0XRAsSTg2dKVlddZl+rsrRFPnRPy0i/JelRH7H6yBDrDVm9d2AbjVaW1pbW8Ck9pXmXnLw3H qtIvOSEv61F2f6zKieJEbx2tTG9c3IC/FWDlyvMAtvGKFdFtnR6tWBloFPVwWIncSgE8kee2 QpTG6lfSecMEAlFfWhGo7+hvbW1MX9yQhYv4AX7dHehcQYFAdMBAgDAm1lpc6KeKC32LIbXy 5da3Wz9uVYfEFf422C5xhT+Eq/ttsF24ws9Vh2q21eyqUYdat7Xugu+ObTt27VCHSreV7ipV J8Qi4EN1MkQ4/DgvsOI8XhxgYm3FevNAEDQyfK33b4YVomKl2DAgWi6aBtBR4EDzwHBmRbTy PNEkWrpi+BhGBe9+5XmBfyVWilOw/lvk1k8Tlq3ewH+LWHsTthv2zr6p2hf6peTdt0Tbpbpw uvZFLUYBXYoLvXfoRnqSTqdf4bqxkZVRB+lYOmXgxH48tWDzpZEe/16LcdXYQm2UgnP928xG m+g4eo810Vr8c55Bt+G6cDom6bX0bdrIpmjv0lp6iS2mB9H6fhaiIprGmrWdNJPatEcY/4zZ CXQTbWB2/LOaxhKYV9uBHlbQFfQo/Y40OpVu1m9EL200i5Zrj9Ac+g07lZ2mZdOJtJwuoZvp TnqcdrMr2ZBOr3XROJpH5zIjc7FidZ12P1Xpt5t/oj2jbSMn/O9Er+8rAV2T9iGF6B0d0xbh 8HBRJR7L6S56mN5g6WycWk92XH7Owba4mDapxYixma7Cuj3KLmKbVLt2D9ZmAs2n1TikLmBD Sp5+u36vtoqSsH5jEWkf3UM/pafpz+itibWrZ+2brE3H/0gTBagRI11Kl9ND2HJP4fEMc7A8 diJ6/inbwd5Ul6t/RM/30Qf0Cf2DFbPF7BJlsrJOH/xyrfYTKsQahtDHiXQKLaMfskIWYqeh 7W3KN5RLMFV+WH1DV6zbo1VpT5OBMCWndfQA1uvX9BK9gv3VxFrZ75RL1AH95dpFiLecFmEt LqXv02b6mOmZmVlZMvOwSjYBa3YRG2JvKjmKV+lQ56mb9NdoF2rXUh6OldNpIVouoW/SZfQI baU/0J/pA5aJluVoOZm1sWsxRX5G2aqeos5Rb9SFdDfqHtQ9pftCn6h/at9v9u3CVuf9VFAr HqdTD63Cth7E42l6jaksi+Wip0lsKnqay3rYxWw9+y67m93LHmY/Z9vYu2wP+1RJV65RblC2 KD9Ttirb1BzVrzaod6jP6/J0r+k+N3Z/mbPvyX17NIsW0Cq19dpt2uvaB2IvZOOIn0z1OLqW 0hqs/Xr6Ln0P2/zH9AK9jONup3jspr3YB58zA46mDESUz7ysiI3B2p3COtg3WB+7nt3DnmVv st3sC4UUq5KPh18Zr0xV5ijrlPeVL9QE1avWqheoN6kvqp/pLtQH8XhQ/xP9XsNuY4Hp+S9u /XLHPtq3eN+N+27VxuFYNODIc+E5N5bqcMxNxV5eQOfgcS6dT9/ANlqFLX4bjpxNFKEt9Bw9 j22/lV6nN0S8/PEu9sTf6EvaxxTsTz0z4RGNvQJ7ph5HSxdbiH0bfVzE1rGr2M143Pq/fF0J gBPV3X/vTWYm90yySSbXbCYzmWR3s5vNnpBl2R3uQxYWLw6Ji6gIgrKLFjxKRUUQbAseFfBE K3j1E+QMeFGlatUqVv20aiu1lNpjW/sV0Qqb/f5vkhXs134b8ua9ycvse//j9//9/zOr+AH8 EMj3bfxL/A7+BP8OfwF7QqSOjCITYEfd5AKSh1cPuZjcSG4ju+H1Jvlv8hH5lHzNiIyHiTEp ZhxzGXMrs47Zwexm3mXesyQtoywTLYssr1jehp1PZCexPezF7G3sQ+yP2RfZ19ij7CB3J/cw V+A+4+18K98NtHQt/zj/DP8xP2hNgT11werP/L8G3IkvsNSTDXiQFGDfz5OrmdfJXfjJM+8g s+tgBZdAMl1gniP3f3cD8ynzE3ITQpax5scjAcXeQM+iN9h3LH72M/QKCaO/Ah7exVxEnodU O4hbmRGWWyxvAOpcC+v8MfmE8GQ7zPgzaKMHnYdD6H8s56O/gfzfYteBTMeT3+AnycuQOufR B+gR8gyCpB5diofB6i5Be9DX6Ha8n1HwXrC7G9Bh9Bd05Iwb8/UDo0knFyTLuDbQ0H48ffAV Uj34Z/D63+Jb0EfM12D75+OpuB5tQ78Drb+Hm3HMUrRE0NuAfJXoXrDaP6Bd4IOvWRLgQV+g /Uwzmm05AjqvH/h5cSx7NXMzPkFGgTolE7mnUTQGDN4EWEVx1I22gyUAipge/Wf0C6yCFN/h PkT3oPXoAONHOrOVrCSDzKsWBd2BjjBT4LeuAHyK4ma40hVoIexDGTxWfASucDkajobjeXg2 GgufTESVg1fAyrcBFhmDcwY3s7PYNHoTT8F+9AKgVxCkeDdrK/bDzN3ghx+hifg2tKt4CToI cSWIddwI1tTPLmM3sE+wu9nn2V9wDega8Np7QYufouMQNRR8McjiT+hLsPXR4D214D+jYBUT IYYtJrOY59AYHEa9gIFVgNujQQazQZNXwVVuQt8Hf9oKMeRN9DkWIeN9Hn0AniOBn18Mv98K 1zkLnQdavwptA3S8Ge+CM5egSlQDcvoau/FwcjX8PoqzdwPOHoQ1fYyOAXIMmuuqxSMgTT4f rvUl9WX4Da2oG/IBNLgX5SBSjmXeQL9HCYiuo8FHH4HvzQXbcCMZ5djfYYJqi1MHh5OFzHM4 ANHQDVZ1LkT2kbgPViHAPgaQH09DLcUJcLUnAcu62a0QfdMQGfzEb5nBngfr/hAi2Zto6eBM fA9PPYDgKGg3ytJHSXg0ejfBL3F8gbEaFYi1vMQgO295CaOQlWNfIsyzeBSygRLOR8G0eKJ9 oH2qeLy9a6AddUJfPAVNQzbuiXt0aHDUgk4pzMFTBotOIsVykD5ps33w95hyDxFQ93vPkR2w tTC5E1WSO3bJNowKTMgIeyZJjg2VWypJpSSFnb5JYWSEYs3oRYzNEi70sVMIx8IkXCs4Y07i LOAKw/YCh7mQ/MFbwTSsKd/Vnz+a9+bS9f1psX+qOO7SscfyqLNr4FhnQxaPHzt+7KSxWEum UsmW5tamxoDfx/McQ4+cptJzeHEtn2qunzN5Yk9jS1Qd09MzZkzPhXj/0oc/PHRe14U9k6Yc /vDq4ts9Y81P5ppFvLeZA7AzJ1hcjxEhVq+vmVgjcjPCdovLLXkQ5jl3wE3cBXydEfL5eOxZ s0R6UCJSOGJfo1iwJRQ+vfyp4ol81wDIVezv8+Ry2OPN5egblg+kU2NOL/zbg3zDAt+MkeOn BvHKxkuDszomnBUmb+Mbz8p1zLigpe7C4o145cxs28wLG7QFNE8/uzif3AGr9qJuo2qNe59A hlk2kbtsj5GtNha/iBjni64Kl9MJc7M+gac1aYYvkB8ZNkPE4vkVS+6mhpDvz4M1iPBCnf2d /Q1ZlMd57Od4eHlErxSQ/EnkERG5Y0HD2GR2xlnN+b8Xn8ZT2UWZsaNm/2B78eXiB8XCpeNb Gqfjf4CHGJhG5hCsbZa5trMNtdWyhr1VKAiWu8lm2zbyuM0Cq6uA1YHVirxSXpVnGl2VD2Hs dLqyFWevhdUdNxdmLvKM1VW0tA6Dl0ckqWSqJUBXF1rQMCZVWhyeVny6OD8zbtTs7+/AbcC7 JpiLK7qKzxZ/WqSUGTXiJeRa0gFeEzac5COEwiwOWf7rB1SBR8VjqL4LfhOOt8TJtQP7yQS8 5C1q/5MHjzJ72AXUK/FkI2SLcDFOt1VLfDDiV/x6sNrGW/Fyq1zA9p1eNgWHXZzLKxUYu6Ej I5FsRkY6A01TKzQjRjYb4PVb6BrqvIIaA8ZBZ7rXu7DLqPA3u0K1X/ydLuhEeil4xJiZhqQa iVSzSi+i0ouo9CJLVNxH04ZZMNHsdPXTIosEuRZMlmjOBfPNI3yFHvfAt+ZK5W+VpTrmWmMe rlHisTjhBLfoJlxC0zXCOZx2p81pdVo4f8AXIFwoGA5GggxHgNhZMMPVpKvThKv0qPNQkocm WiHNw1UsNHG3PA9rztQ8FAxAL42hZ2bxtKkp/9yI+nAf9vFuAp4LugRfGNZKvUEKsCIdayrP gRVKgUBTI6ic2ZNTr7rj/HkPjKyNpzuaDl+97BfZMcU3LPZkaHg6pId9wvBMY6iGI9te37F4 3fRL8mP7Nv/41/s3//ihW5/5GF8y4rYGJag9PfC34pF5E7LK8O9QW1gD4HkxaFVCNz+L3Pi/ cAuy4q171R5+CU/wKJd5hsf/hGQpgLciAX8JQN2CAoQYbsGKWCvvhJMxiDQFBhzL7e4Wlgjb BUYUsBAKup8nCFnJyyhIJPyJibxHKUjk27vEgTzF3k5v7ov+U/iLNM6nweg8Pthrkz/e0tTY 2triaU5SGaR0cm9gfFdsoDUxY3LY26A0TfLif7ALTj65YlytrleNX0leuLA+riSOmtYNO7oP dhRFnxmJW8lT5CcMk3L+iCF2h92BERvxbgnsDpBAlMCa7A5rtIDn7vXWSzsAzgpY3Ym9Vmou DleztcAkdrtZ7GQK+LgRQazIEvZj7ztCFL8QxdFwpYDxCxjjkHwAePQGZPpPvg/8ta/r+ED+ KOrs7KfJvVFhNQKuTqshuaEJCdC4cqb9gRDGzCnbK8ww7RQmmceIaB53Rj2d5tyjHhNGKZzm PTlvDobiz0FkeZSPx1uQt6XZlJVpQBRPORwHGQ5rYrpPfYqX3H/Thfecp7d+vOGyJ+ZOvrT4 E6wvHlWjJgJ4D85sWHjbPa6DhbmPTrpl7f7iHm96HJXjOPD3XZCDq7jbyLg5bLOH7FWoirH4 7P6IP8oM5yZx+1jGwWIIAlGLLEIrW3DYwoC45hgiUn0IqeDbGKmi6d623V7IxC0F/Le9XoV5 gSEwUd2FkSVcwPcYdqEiVkEqPna6SIG8ugu/bUXPEPqAp4y/MMKGtdu6xcpYwwnx7fUqVilG qCGthBHHASOOAgD0A3wdB7H35/shqlPRGj7GAAEyBkiTofJnqCZMeRb7TNFbQNQww1IWuaWs AvMIU+lxp89pfiU9qz9Pv2RUqvSiKr2oSi+q0ouqBkxTDa+jNDc9aw2bSa8QDyGPV6JakyAA or48Xprvw3EmzlvoM5+cRVOHIjnEGvDz1pbmRFzlgY5df+nAn5rwrAObf1gs3rNtVseodKr7 opG1sdTZVxW3FI9HWtkpxeIa14M3v7Tibzd21A5Pj1bG1ojOa87d8TGtZU8B/b1oenYKvWXY fAyeH1gWIPbC4FeGHyJ8DZPwv+JnOq2sGgzGWFvS/xx5DcLPj4BZ2fA9e5JJEbExgPHdokv9 GJjKb3ehcHWwQH6+p0RhKF47fFQRvlDVkCIAqykB6DrRT7HVm6vvF/uPgsmWDNeE2kxEt1ck ktGIHCGcV3cndbs6D1d6wvOQIkBPcyTn4UhFbB6Ku6BBQ7CZrknfeCPKA1JAgHYTHmKgyRw4 SnxIS7M3gTm/z1sSokjRk3lxz0c3aLXyqNGbXr/ytatWvLv8I3xn8efWlky8LjNxTHpSFbsg mrn9rc2VNt+vX1h95Lq12HrvUbz2jwNXrjPWFYvN+qJHsG/hWHq3GpjmDpAm5Po4a9ypig5v 53xxmbhcWyOu1p5w7RP5u127XAQnNIJUTYvb3Q7ZLsWDsuSwYRuxyraAxy8HcMKO1MBVmiAq GoqLcRLXSLzOI/o8HlEjWpxUuQWf2y2QZW7stl/nwXGPKFgCWtzjJhYsaYKaqALvxPioaIgC A6HBbrdZhQAOHMA3IQ1nDE2xh7LJ3uTK5Jbk4eSRJKeLSSVpJLvhzIbkjiS//gpQVZ+YPx4K dw0Aswh2mjSjsz1MMXmg3ZP7xmKBh+Zza9yZtBUMGY5B2skfSlMoyuWCSOzH4sFSmz9zwIvt 7Xx7e5lNpXGcB81QLhVvAUjCTThQGtCw1tIMoS7FMMy5xXgumolcXhw56cJx+PcV+I/j69SO gd7INCXAkejlrx3GN60anc5FRKuuOy6+19J28rEHqmOsrgfESm+FbfQ/8DvFOmAUadCVG5Ar ghKoAZ9n3L5Jwt5LI8vIsuyjwSdrD1QeqH2D/7jun/X2KjwcT8STIueRWZFLyWqyKvsYfqX2 3dpjlZ+pJyq/Ur/KeiZak3o0kUi5FdmmqoIi+1Qtq1cyCZRRsg01SK9MQBZi80Uzum7zJTJ+ v4/UZKxWmxUpokKU34Tu91rCTYkGIRVLkVSd4A41NhWwZVd85MxgOj2VJiH5o9RlxszcizJi hmS6/piPPJ3p6p91nPI+oNH07aG+FKKt6U3lSAA6govworudShucqzFdF9cCQZaXdDUp6Vyy VtcCSj1WaZPmM/U4HkzQRoNzWh1bUw8OJrYPuRj83Hgj9TJsoqf3uuwf60iyNp3NqbNqV9f+ N8/Rj2ZBE5DMIAOh55tI3RI3Iw/H0jNwgvd4eF+gqTxi1v90au/1G4tHBqZdOCYSGZsn6/74 Yu8PB377wzUTJ6y6Aw9r7V4zceY95K0644LbN19yra4Nv5LpvTKn6udszc/b7DWunj37qnY8 cF+xq7F12IQ15/RsbKdxavrgb9kZwLUTWN6PAoMrd9nszdFC6ciVjy44GrOg4wzbIq0VXeHV gdvC6yNro9ZFnkXeaz3Xetd6HuUec22VXpFej9i5AEqOCYyKrgzcIq2OrIruszxTaa9PLogt 55a5lkVWVxwQ+GFujzcho9lEhuQO+wzoxh/3eN3s5TLjvtxvwz31HuwJ9yZx0qtfuR83mvQA eKxNsMfsxN4VCh2nit5V6vUDg81D3nTUpKTgXH85Do7Uf7wf0SB/1jnXPt1oBfUmAlHO5QTF Wm28jXCRpCtg1xEXhcYRdOvIFmZ1XFJmDVUlzvchiDcm9fRolE1x1BW9VCvD/BQ5EyZyNjWa sDmMnZGq/XzTDe82dM45dN/K95Yt/XLrr4rb972OZ724/sE5IaWeZxcVawqH7li2cf/e4nub e9d+Z/mip/D4wot4zsGORH0TzRQi4H99pv+lscOYE14JgtdoI9ImTZvLKhYEL9PvqS5UsZd5 FsJgo2dT4JEK7mI3r8hIVa2K7Fa1aEZwE7UlEkFWb11UkGMykTusWR5385hfUTtyTynl7KMu BIwShCuipJgkyS7kE31ZH+NrBZGCkPcmu7I+bI76Z5Vdqj+dLgn2QirYyVpaDHsrPBWEq0pV p2pSDHd6RLiAX/IH/SG/hUvoaTGp4xraaGFoUhVR2qThXFr3q/oZ7lRi+aY30WETZbXDys5C vUUKeP0+iGScxgDxlUyW7zGZf6RuRKdgC4zJ1ZGef9y155k5d7ywbuTNs8WKSNOjM685e9T8 ibqu+Bcy313QnNJHTy8W3lr/9/t7wk7L4MnfnJu0C0vvgVyUve+62hh4SDVClq9BHw14qtEf sIRsRGnKNvU2bWh6THrf9750TPpSsl1rv9r/3cxa5g4fu9a+idlkv9P/GPOYnVN84/xGU3fT tQxrZ+x20kRpzl2W+2yPWJ6ybfOxToz46U7n61aZVxQ5qKrp6Q0Nv62V09x0jF9nZS6uyNWq hjnk5F3IL/qJP5D2+QOMxEuBXd5MsKGqGmeczmA1CVo5XuCn8aQTmvX8dv4t/hOeE2gmwjc2 bU+/kCb16c70tHRPekn6hvT69INpa/pmMdAb2BBgAmGjCTchwRVzEVdHXAk1ls3DNI6yc+X7 KHvuW1oPqUeZnIj9/e3leAe82gTWNDjeX5A4UD4MDRmRLYe0dF8efiB781CFNnm0DNFKmQsd MqW4ZirazOJA1dT3oEcykRuvFpNJZ9f8iyqa26Y///tGfeTJxXUjEmG3g7VHkqPrLEuS8sK5 w++xFAc+ePiBgbar72oq3tTbqOzYXZyu+91qcD7z3Tl+DYyuuOTOlZX02fEM6Hcb6LcWx40u 3mKz1zKqY7KD5VjODs7AJC1Je9KRdE5jxtunOebbl9lX293XVW/I7LHssb9sedl+zHLMfoI9 Ybe7zfAmK7JfVZPTa2sLpMq4PCUnBSu2UiXbZCskg/x0Ql7nZL5SkROqZuX5JHFOc5FpOPmC jvXwjgzOIOwS3DE3cXfIAooBJnRUVsqhOp+/tipBqnCV0+VK+Nxyjp7QUZWeIH5rXeZZTIBg jcQ8YGUaNNRO9dN+vJ1GvfZ+c4BNjYr9ecpV2kt6hfEx8Zg5qayrL/L/cqS+TrGwpDJTZ9QH z0g3h53pmUPqakrNXjrNqWkVjy9KSeCMAyNKqqKOabmm2n3VFe0Pg6LeaV15xcCMn15fvIi6 45CWaL94/dpVEQF0dM7gES7BLkZNeLERsItsgtHd1dfEbo2tSqzSf1B9a41dK8cq57/Erhoa u8ZAZwG/wLHcsTyxn3neUuD2JfYl99XYx2rjq42aNdWra9jNyY01j3I/5h9z/Ex/vZqf7A7S BKU3iCtflYNzVJpMGj44c4OEPa/Kkqo1nRG+VDQ7+3i6MobFmEsKBlW2Jc24WlQb8oge4unA leEW+n2bU2xu8VaFmluexeeArq7ER5DJYih7EWwxG7GZ7MVmBrT0ifaucumKKseby2F4I3Eo ttGkv5T4IwrE4ygQNyo1nOAA8eupBIAwrzs1m47ccXE0VmKCyNXAyJ5y6UhQXKORtdqMdwC3 lMJ+kyPgPhNwqbq1ZAKCHhmKeUMahtgHgdBD8y+q6hYRUTguxcBb9DHF4w9ueu3cOb/4QcNl rYFxDRq586wRou2m4h82/nTwpWHjMYS8S6fX/swbzfogIKqH3niy+OZDLxU/XOf34XB3fVLX 2ViiYnLxWNuIhU8uWvckbsTbROtZ1TnKWICfcj7w1zG40/COUSEPAKYoW1U1SLPHIJWze1i0 EwXF4JYgQ1G1QH61T21U5BpVbaMfV8C8NgPmCG2xtu1tzGhFboM5e1WeXoH/5gq8yG/hGazI PL2C5lGo2quHrlBtXqE6Vr29mtEApWGOcaHWpMg5VVPjVWMQdd1OWlyvqa4OBiXSlstZrbxV Q6PF0WR0R6PQhOFfD+DuCjRu7jhijOset2XcjnGWcUqpJtThQSKGf90iFleMHbmsHK+XlgN2 vu/E0AANJSG09eYAoQfaTdtIl9szuiYQixSL8X9yYD8tnVEFx//PmX/9Bsn+q2eTn9G+4MCf BMbmasmh2nYNRrQ/0F7qk+8X5/yrq5f6xZV45enRqVWn+/gRVIrF5K/06Qa0zqiLUwXYFZmo aliRvaoaUWRg5Q5F9qia10MItoaFSCxCIh0OO9VacLzWecSOs3bD3ms/aLf0QEPsISVOP4xE 5OYjcdwbPxgn2bgR74mvjO+AAWfKHQSdNmWfHpJ3J/UXiotAW/6zAKm4yF//nXhAbPq/kYC5 Z9hpEligC3aqo/VG6zy8HF+v9aYsG7QNiW0J5vSmp6il7YKXMhEtgZAu6r36Sn2LzuoFvN8Q lXgVAVlgK7Hqv0T34wLZbgROiyWUzKaM1JYUQ9OpqflyvD9+fADiB1jTQPvxfDu9CSHlzM2a CSnz/21XMsM4wICr6eSUM3b9zghz10EtNLdv8YaF9fjjYuLf7H7LgpzbNuWRLSVd8wtAAq14 mrG0klYMHJXYVnl9JckOH9faPfxR9Cpi9WgrXo6WR5fLq9Ga6Bp5s/yY/Cf5a9nZO/zIcBLz xipiPjEh6qzgFSoEH6S0uq2VO9NoMm1yUi1LMdYm66pWr8gtKsSTW40xSI4qGKGqaMQXjUZQ aytCdXKlT5YrEW6Vo0wMh1FrC8EkqctRr8eK0LDhETGMwx32txyfOIgjPNzE/Whls7mg4TQa 2fyB5uGVsar6DP3MQz/LHMmQg5nDkL2Ghg0v4HMhvV0WLODaW2hwyJtGB8E6vTRNwzUoyMxk g2CF9Ie25WzWuiaTZleIh+AYNDtDTzvS+J1fStMZ1JfG+D/7M9YAFSiU03OB1jO1zBzGvaSq tj0ROu3OtD/wVXDgc9Y1I1/MuuumVjkIfJgmNfhN5nug1Xjw0lM3neHt/SfTljdOjbtEauzU dRxrrndcwMy+rCmlU/+WIRvdCDqP476dXi/45Vc7XTl6MJY7c2I0KohRWRZcbRTuIxSOVdIm 8yqF5sCUckUI+FdcjEpYkOUOhH1wWTmiIo/gxliW4oDAPCJSwCrYMK0WuXCPC7tWdGtYEz1V URTB3RGMIkvAPVaoZcjty1OUpYh7otSj5GoIa0uFBEp8aaVnjWXFIQQng6WqDhX9GrF9xaE1 4iFMtUBvr6DBHUa6ogUJojAMLVV64yuVlfHb0QZhg7IhvhvtjrssiiVeY0k51IqaMCcWBi/Y WdECh20Qd+iT2KIPi+IGvCW6Q9wRtSLKAiBi08f/9ohWX6RTpA/r2rzBTmR1V3SiwuDn5ZHg 6xQKg3/YBXPg+OFOt9RZKlyYz7lhSrh58GY38XuoGZQsg9YnUhDlW3CR3K9l+/DB80fE1VOL Fo1TirHemXJ6dAc75dQ+MuG6dBvRdYc2be7JjZaFpx7+ztmg4NmLmecSrSrR6Z8IgXY/Zxch F6rETxpNC8QFFZvs73vfD30Q/iD6vvwHr40P8pUSCTqlsBRNiamKlK8qbK+kKa9EG3+Z1Aln FCbo0Urd6hLK+ugsTBvvRnw32cxttt7t3OjaRrY5X2Ffsb0sv4/fd7mIhbdyNs4uYYlITskV kG3zQ/Oj17DLnctCy+SNwt7gXvn9yOdWx/ludwtiAi28zesIxa6caZoDkDUjhCIimEiXwWAm XK90KkQRvDEv8QJ/o6y6j/I4Q/jWBC+9uUs/6h+6c0Zp23RK29pxpajLSV/SprPJUDgYJpzg 8uogp4iO/VboSRz0PE63jl1RAi2usAd0FLZAk063w6uUMpdqUBi8nFagdls5b44tDB43HN4c CXpzTniTwuBnOz05IMp/gQNLR66cDUZPu3JoqIw165uCFpgWTgCP5UlcSSU9ImJV3ryrRhHD 2yJChiRBtvyjja8W7yze8eoD+F48/MBF0647b/Nl42bOu+RetsdZvLL4y2LxUPHUV4ewC2fw nVOev6/4cXHrtqsbDRz6FM45rqSVj2bIxLaC94cBpt/ajxTwfmdOod4/x5GblsQbgyekE8o/ VUuNNYqwE3iZqgI741TNRaFci2S8KBONchVewnNWMY7jv5kbWBl4ENLbdfVJnIyUaFWdCzlF J+l2znUS5wo9+a28icLtEL+i9Y68GepLye4QeTJLhZUxzRcOSiGJcJovXo9jYWhUf6IeK1Il LQtSjZTLF3RgIq3/W/U+hZb7eI7xlG5cQMZUHRk355sC3zScKD6y4aI/xD3XrVp1M5lfvJWW 804X9g7ft+pZNUg2Dewlt2/a+H0qQcoafgUS1FAdvsboPC+8NLzJz1i1oHZWeEJ0gnpR9GKV 9yIWcSIrcpZs/WWR5ZHl6q3aG5HXtcP11s2Bd8P/DJ4MnQyz9VZngby325Sx2aFiho6Ro6KG YGg6QJ2m+jRNvUG7TSMaqonGIyvVo+pxlRHVbvWwyhxWsSrVRFUtqWciBfypIWlA3xN1mQpQ kvLLeFxVIZWwAgXDLKRHqEasITW/kQoMMQLOhA5Boawzp7Ob4nRm5H4cMu+E5ttpDmve4R+g +ewQBzbrvQPtZs470F4u9PYtzedoYT6XpyCdd0NkDJpRERSppGp9Yb8eSlbptb6aepwKQ5MO 1NXj6mCyHoUjp+u7JW2WbjpWgVk6nLm01ZmLBiv8HbgEonmY8W9UXb6pyJdL95jxlAu7GlFA 1wOTyzpfduLohsXjvovHG5Hq1uJ5xbNm5W5bN+32h8jlxVXf1v7YfdffPa8jVmyZFYgxOrmc bB54qumWRffeRePo5YNHLHFA2hyuM3LB7Izq5XGGc2ObwKe5bFCQ0nVCWqz21KtKOlHbWtOa vqx6bfXamsebCzUHmity32S2kww/mi20xlpJ6+MNwHpmK3JMieFYAaxrfOVsFBbDJPy4vzot WJOCQxCijqhgWSYsq75X2OrY4zgkcOlqwWHR2JYGRmvx26bhoT+bZPGMUrGxgEXD7Q2PMByu 5hGCNQZEFU7tjjVkQm0FnHu6jLlH+/M0IzYf7ykVeaVcvs98OoamxPnj/flywZf2ze7THP0P DRgK42AEolcn05c7FgrXOa4VVlffkv6R8BPHM47XHK8JLpTvm0WpbR9w24pSlde83WK+/D6L +XgBLf1qnqZA2VWTqQwx7zuWs17mRUe1/LtV85f7ZaP+ib+ec3bxyzeMpednY+E2r67Xnry9 95amBav2Pzzjr3tGd9SviYQrXZD5tj/x1hUT6rT6TPzc7yxYsPqJL8IJX1U1QR/87rrp2dnT R12w8oGeh4+KzlHKSKrVyeDdTvBuBf1kP1IHD+4KhptVyiFHiN5mRTXA5Q6qlix0CP41z58C HQYVWVRVmyILwG5/HQ6fqpRjfLgKKUQUrKgXUyXXGKq1VHzoCIlBrAS7gxuCTFARY1iJdcdu iG2IWWIHcA0Kkqd2xWkQFE/QsjEkoO00WSinQwPtQxW/oZIfkE5aScDletD/rReZJFTzsM6E MnVssudSaUxb3UBbKT+at7ZjhpRkpxRvv2FJ3HvyT6cppCXQNv1uvIRKJDt4hH0EJJLBjPFQ UAipJGhPqTXa9doP3D/Utmu/0AY1m/m3SQzk0ERkeoHC3hC4QdrvfrXqg6rPqtys5neLqhJP ag3x2Sr/YvwLjWxz73WTJitP00k1ZpZla5SMjNREqQQQlCQM13RenrABZ1RuiOGe2GCMxFZk s0a2O9ub3ZJls1b60BThO6qru2twzYr6ofS99OyGGV36SlyyvwRc6SFAUuNVNsGeTOpu3aFb 61GqyqWJEFvitpSzHgkqNFTE7enSdygo9S3F8K6gtJ4rk/oy+KSSpfysRPbpLQvgciYq8Vny rDZtRGjY9+ZeeW9XUq47G78XzU3xuDqPv7Nj7s2Lw8b57BQ93nb1wIK9y6Ze/NQHpPqCqYKk 65mMcs7AwN/e3VlvvPo42fSdnIrNvwIDdrfT5O7yfqSBVbaFE82HNdxk2egnooaHSzgnLZQe lwqSJSBJ/mAoRP+UQEYhAHa/W3Y5rQ7ZGQ8BfTcKg983WiWeU6y0CEN4vk4Cl5T8LMdVSSHo hfxWnrM42RAEYL+VZfm4y4kg6tsgbzu4r25SsyZJYXQAZ5CEbzK8itOAc3Od2BlStcXx9Vec Tq7S4VDXwEBwKn1SMG0acns7LWjTx+6k3JquTJpGC5YmVG7z7m34Wzduv3X7do3obqfvEvLs CypWTzOwTGDoFGBASZCBpUuPx0GeRTl1KRHzQ96MsRkPqL7YnZPbas4p1sWL9efmppF1gZmK JGZwHDuzASWWngBqcY5p3H/yuKX1pbE2XQ8Isrdh0UCezLpicrgy4/T8L3vfAh5Hca1Z1d3T 0zM9j9a8H5qZnveMRqPRY/SWNS0/ZNmWbcXYxgYUW0iyLSxb0li2kbnEBvMIJMFAgoE4LA73 8gwbDAIjnM3FhFfYyw1ObgIk2Zt4c70skOsAwRASImlPVbdkEUjM7rf7fXu/z6pPp/7urq7u OnWq6pyqUz3UlrJN/3c9mSupYnhl/IDhozSzxDPgfdAz4fmh9y3vW2l9owfry90ojurQyuoN 1V01W8FCqJZqyHrFcM2+mptrDtccqTH8AL9S/W/ofTRdrdth2OEdTV1r2O89jO53HkHPIoPH mwYBzdU0oiVye1URFbEBSX6psA9hg9erNxiMXq/H5xNE5IdW+D84qG91UtRtC5TIKbDWELRM kzUghXzQN1WVVQaqFC7NIXFi+ppxj2gE/e8KZSANrdGHBAlGByGbTjnS6ZQJiRJY2GLW43Z4 PG6D0SAYUx4vYC+v16fSZZCozG0SjZyU8nnJR8E8/BpoiumydIp8M8wEFoBYJYeIe6JoFPSG GiIybUb8fehg00wLUqDDKwCWpo8flUryEll5ZjaPz5UeKjw+z6TPq0kQNclVs1wVoiKRIttf CJLwCYmaI1sZRBWWxr8hY3MPPui+XhJaBGJetuDujCZ2ZbLBnJdTmtiBvtI9MoKKI8QvU5O8 WeHjyUiH7TCY0UldPT2221VJrNX/LpF38I1TFyanjkzdFJ+av7BOYToX56qw8WcNFdVtBeaW RUGnJ/uHf41KDStBKtlY3HTg42+zl/35IHfB/e18PM4kA4krJrczzM27VoL2go36sNO9a/JL zKKL5pemcwyVVAuMa0+BpBbwLcqLtiXmDmlJcGnoevzHeXy6Pt2wFG/Gmyr2yHvCl+cOlj8o P8k8JT8dPlZxrPJY4d22EofkCHorWSs2JK25EPZzoRxfmcNVwZBsqQpaZUtBQjlckHiLPsB7 g76A9+YkTuZSgWRjoSnQqMNcQIc82CO5A56EDFZYQ1V9oKEyZEWcjtKEtyBJqWCVIxiswrmv WnCuVbY4ZMi4KicHJQsWdLMo4W0DKdJtaPxHhuyWvRolIA4xGcXq9SqNDckE4/XwOkFpm8A/ 0ySp7FqyWjMzj0N0nTNnJs+cUcWJrq0R8bGA/HTPuJHM+kURB4ZzSIpK8SfOWeFPlQykunmF JK+1YKEkZbEXsGzzqDMD6zF2aY4n1NOEVTsrqt4SP1qME8mZfozIjtteT9WjmTUCPduDd3Wv rJvcurJCb2l44ZXuypyzbfIP62sWXI7NU/evMfnzFcy3I00V+kUPHNgeapqH32/uSPu2sP7J n93YDBLEx3w2S3AVjk/uSAeqRThjjlbcijvwx1dawqX6eDxe6pK2TKNHrq/zV/hAxPxxz5W0 /6M+R51gCV38FIpNvznuCBeiZC7kAXNjKF7uLveUxTJxncPj8IZilyW4GxP36u6JHdVNeI7G JhJHcv8zZmj0tkeV3OZgX3R3dFdsLCnEuZgulkiUJ7J1qA5Xc4IzlvEM51g6jrnkgKUzkgng QCwYCID2YO6MSqW41OMPlEpZnE2UB7KxuDWO41m3x+GOJ9yeRDye4nUOPh7jdVBUN8pmA4FS xmwRKsFencB144oO6yYYs2LgY6Mhz0oPAxKTUJxuXu/WFAzkUlzDriMuznWMeRPlYOA1W235 kzlckaMjXSbTnSE+0ETJONN9mvyrRi1ROjCdSbxeUHug5yhQzaNPiFJ3Zm5E9ToqPJmZ0ezT 84hzpQJ6FCo9tbojC2LVg1O/cLXVdU7qF9PVgKlnNqxoY24MNOe6PjhzsS9yMXQkhmDZ96ac UxMDNbPz/xKz6OF5OB6P2GO3TBXwnQer/DavLk6s3kum32d/xT6LqlALs1Rx8pLUyMlSY7XS sjD/ldqv6w/Vsq1ETe5ZVnu0EX9Jf1/24ZYnsy9kXw+/ln299o2soVa/SL/UvtS9pHade5Nw GzpUey8+io8Kpho93td6J/fN7LeqONTa1drr2thadB90PoLvbXoan2w1Cq6u1tFmtkNgnDYn 00ye8py78Z1mXF0jwJCTKU9lyuOZ8nRLzXdqvlfDcjXzapbXXFnztZq7a/5zzfdrflTzrzWn a8ThGlzT7BDCQr+wU+AYoVnoFPYINwh3C/cJPxR+LhhEwS8MC6zDJrAecyKUgRzTm3LNHUz1 7ag7l2M8SjqTt3pCng2eIc/dnkc8T3v0v/b8u+fPoMd7FIuU9zAgK6K1PFSeKy+Uc+UL0wus 8VCcib+NUM5QMOw1PG3gZIgYZJDAEpjA31MkpXVfK6O0bmxlWh9wYifZg6ukulKFaT/2Z1C9 VM/UV+uUaDw/pHtXx1TqFF2XbqOO03nnNawBMa26Vl2vyiw/PXJmJPNMNxgMZ7q7i8Rw/5BY cQWyTwOuE8Eky9OTZ05Jql1XpH4GM9sfpJcEqcXS0kK8F4vqIPe4yRPwMKh7veq21dBUGjVK LGeF7jscFxONCUuwJIhMsiGII9Emtj6IpFJzEBsjQBq45qDmF6lq0JrbFoYxko6TIxlEHNzj 2paQeK3qSE2twtmNIqrPqaZr17upG2WyhFdT1VQzS77z5a7LJnCtW0m1lflKE0uaC2uKL2+/ 9pDbYnSYff5g9daFXRcZx5qTYW+2+sbbB1Zu/c5NX7ysPh2weZyhTKpqUWdNx/72kfllt0/d poSluGfpgmW34cbFX6irr4j6idxnpk9xfujh3CiJv6BYbe0CcktuBnu8JbGQewL/TvFHE9ew +mBCFC1Fq1US3QhJxP1X77ORdczHltXS5cyG5nn5rvSJNFOZVtJd6eH04fSR9PG0Pm2xIKs3 5GW8ZSU2RcKVkiJ1ScelE5JO8qZWjNB5GNURGJSkcW+YTD2DWSrT+DF3iDjzridGYmNO6i5m MjRpWk2a1pKm5yT9cKZrOkVM/AxrkWBI7Fbr2BfnzLp4LOH3lfoY3gBDdZyLJHHA5A0isyVk BBzlE0nsMweDKCwEk5+oY+rPtWCdEr1SN2wYlvfGDgr36+4TnuSEq4VrDcxebq9xb2hv/KDu 9hhPp0/X4xLNF1ytWrBT8+o0uLo+Uq2OiNEIfmTXVzc+tHHPy/s7dzUeiuiNmRp8DW/sbK5Z UlWXnA9G1OTknpETX77zT/sr6/q5e79gL/Uz8cl/mNq4N9q8pOnhk691NZHxasX0KXYD9GJR 9J6y7QMexwx4veG+4PPM89HX8dv4N4zeKOBypsxxYWiTYXNol2GXsRi83f6w/WHHBHPMcTR4 LPp88JV4CcJOO2ItpSfQSZCRE/gkZjjswAwO28Hm8rxbgkt+60mI+nAHJ1ot2JIhu6vGq70F usvKbyjJWzE+jI/AHb5H4u9AH2EtDZUypdV6LR2Jj6Yy+RN6rFe9Gix5vTfWcJPqw9xNtpHQ SXBo2pnlp4p0uub0iNRC/V67RxpHqHes5n5PfLpH4rT9MGQHR83MZqyZLRyqvlFdxyqh+c8P fe/kpitev+U7ixqalxt4tztUGcmvXlK/rGrde56/G8O+F56+5ZFbL2pcuKKv4PXWLL/7mvea MxWkrayEtrII2koQ9IE9SvQO8wPmp8xPujibrV5AQSnIuENZg+C5JxR8PqoOrNB+Hsf38CEA Fz8pZK4xgX1KPo6jeN1j4YRDD1kh1SIpI74GjKeMMtACHLLilZg5gjH25dRWRqJxaGQ56kUC /OrKncgxw7nDOSYXgpFeIe1FcZJbZ1rZCYmTvBUNV3lmO1HCU2hDmQ/Vo9PqvMvpM9TBVaL7 QLrVJjPbaFKRMrM9Fo/GGd6WUH3xLDCCJpKozAwkXhIGVdiaSWrT1dBKymgryQ2bh+3DkeGy I7njOX7Yste2y703Opy+Inud+8bsHebbXYfK73N9p/xYuWWf9YYShtRi93raunNq685prTun tW5MNwx1q40HDPladSpipiOlbStaa1c37WhVXs/+hBeyDVM7Fw+1j29ZveWJLQu2NBtMlfOv X7o17onn8ll3at0KXefHL29zhGUuvPwba1sPX/3929/Zk2/Dvq2uQGnZ5HU3OULf+vajDyXs N6pSwHZDG3MiGdcq63jbMke3Y8ixxdnvGXPo48b7mReYl0p+zPyYfd38uvN99iOzca9T3S6x lt3EDkV2s3sj+9nrLG+b33QayoRpFxYMhgwRA1lghW6d7EK43TWBU4/7E3a9bgIHx02iwUW/ TAG161K8kbxrAJEWRCobmj3dLWPJI+qgUFKLfLlIIbIh8k6Ei8hpdfK7WtJaHo2DNjVOVOap 1JhAnE6ADe0Nay2QrjqqbtHdH2YyRFgyGXWD3plJVQs8haWXRtRljJJgIK4uY5TaQkHkc7iC OFjiD2K3E4i2jEGWlDKkkkdwWG2N6ohHKtAG9afPzzRWJ9s9OW24aFFPy6UNkc6JsRNb104+ dNOPfxeNO6P5cDP+4NjgBQsudB266vBVT7+NnW/d8+3LQ7aa9YeiUDtl0FCjukEkolL0S8UV 3FfiLlhLQJEvBSPdJpXy7ljIRpplxBwLlRAQ9cRCpd+jnzbjyVp6vi7/CI95BWFTKW8rMRoI g0rhrKrVKGzaZFJ9HMs8bgWyp3uEmmrpliE5qm51s7tprOSylfkjbnzAjemw6r5CCXYFmVBw Y/Bw8EiQywULwQMAjgdPBvnAiuMwGILO8mF3N90clyGjHqg13eqcUuG05oBDHEbwnP2mduIz oRpTdLquFifaLrpYUS666OWKBVP61qCjYr5ukJ5QlIunmif9vfVcLMZE3L1MBGBc9YhiYtC3 SQgKayNc22jDR2zYqkM8kkI6CTRiXoyFeMo7HAvpKO9MsZBElARXFO7kdUZtqaXMJBLOiCpn SDSezedFjUMkVqLAoiMiPiBidQ7mipDtsO2Ijc3ZCrYDtuO2kzadjaSvyudJfDRbkS+hDAJb ZOQTHJpxpKGMIZNjn2LH+Fk2dH68a7bw7A8vJYWH0ncixO+ENt3OrFBCixlss4UUY7BesNpR C2oP2UHg23lcV++NhWCgfO3xSDYWSgFQHJG2WKglGrHGQvZoVEniSCyUnGBefzKqNOP6WKgZ sFIWnR8LtUej+ki2LqzHXLClehMX3GQ0cnrUzrc0p5IOu7FDgcbZQTizJhjJo47DHUc6jndw HW63z2K1hqyMtcznVebVepVMNn+392nvK15W8R4AveqtcKSsIguXsvRS9unsK1lWyR7IMtm3 kLU+BCp22fw2krMvEMlvbDvZxhxuO9J2vI3NATnRxrZ5F3dMMBeMh1dcpa5ezrgo0dG3ZXIm 7m6hEwoj2lwDmW0oEE9QsjVCdd+l7mGqnxhLdkRoQ0gsV+UPiGYdX5koTVTpKoKY1wdEXxCb zDm+Ooj9pqDaTcxMSNMdEEtWjym2kCwYZFDEdCFDOInksKDHdKIbqapYbGPHyQ6GN8VMeZPS 8aqoW6lbKawwrBSPd+gamJX8StOfeI4suI0U1aGlg2wqC1BGj0vOAj8x/dG4w6TGNrFgAuN+ Ni4xq+chpsdWUT22atcl7T6IyfGj4tm1b9rlkbHKqY5N2p7AT0omXRAq0XbltDIzmy3Jub8Q 4JeW719x0Z5w19e7enZkk61TgUa/zZEJZNZlS9xtU6XJrNWR86fCuVq4Fmz2liRb2fuvWL1g 9dqLutbfcHDqqsG8EIvpkv4efOuVC8OFwpSxH1RhaAXRqlX41r1KzBlaNmXsLfCxGC+7Bhnp srxAeoV2hLh6aBcZhnsKesc3nxAbDTzOUn1/WW1XFut0Oj7Osz9nXmV/5mOdfK2unWFfxb/2 MzarBYVRJmSRwlLmEevTVgH7Sx2xkHWC+aVSEknEQuFoxBgLWaLR0lhInmB+oTijyVgoE42G ZdlqtRi9m3Qsp/eDujR+giwyTT+hrPXU4jFQNHhjyIANZU6nQwm3FRwg+1YHlh2vOBiHsmhx 3qEsqHUojU0AauuAVFYBgbbhUJIpIJEYkGAICJmSdWAHsVStoeyRLJPLDkOzUVprSRnHIQca QyY0hnxoXF6hxpAbjSEvyhMrjPHZUtXduiyZTFBdDl7w3QTOJY4nTiRYcmq8vilP41wVjRVD IJZPeMtXqHpahnRwGXWJR5qRJmL1npUt2hy17btwwwhoby1zVoBm2h4VeBkeBAIt0weBpFvJ 7gF6ZHeZ4chtAeK1AvFLxKPn+GNhR2HWhaOqEhXJiA1KI3H6cs4xWT8pyJ+W2Wc7rum8+HKH BCKZrHVLtoxv7dJk7VRSE8+xFYv7lzXeM/WNwVp9LKaPe3vx4R0t4SumxIEG/SfEUNv5/iTI oRmF8WrF86IPJ03YdqFgSZgx0rsTeoMgBhRuRnfmlEQmb+Uw54uqujONFqtRgUbjjfPyJFZi YIUcj56IMiiqRDdGCdQp0bujTFR1xlFOiFjUdCcaQ9YkPgoqk+glPn77Hk/WNoyQnlOtPFXL HilSDpI98ctPI7WCWtSd7gsxmOJMPBSUgwzvsDvtDM8n/KW+Um8pS3x2kmT9K4hdBlsQefSB JPHZSeIgawliu9EdRKU6d3LOXvZMGTFMoTOsSuFGvAQvkcZMumF+r2mvNOzdxx8wHZD2eX/I vBAy7tWDTm7d6zmg32feZz3gEYirwch64p6jORdQA8rmjtBJfG3Tex1dAsRTe36yrX/Pa/9y 6q1Xapa4LWJHRTaYNDsScR/77JfevPHF6+7BqWdfwpnFy//tv27tXrzUG5m3AYcf2htwkhF2 GULsdqjBNE4qRjEhNooOk6QyFJqjSDzK/KF8RhvxId73WKiWHgaC6mmrRGMl6XDlpQw+KN6c YUSvGUzNAJhR6VBACkppHjtdbjeKgA1GFRX3C6EAVVSisVCaKCqBqLHaqgRbQN5L6wvWzaSL QWk+GDBau5HxGN6AOLzhyZv1J/QnyWch8DFFRGmrOwS6W1k0okpThPYFebpuPu6X1fVzh82V Px7BwzObrX9RtmINndtQNRUYPc+c6T59Wjql6nItZPcT8QbSU2OLDJQogzWthjrTaY1txpDV nC2dbtX4UX3qtNmEl7q/2tawoK2idoXeaA740k4Z6025hin9vIxgTFSy9//0lg2LCguWLuR4 V6TQs/O1hkbJ72VhSGjcw+i6XKU+XZzu4zvF/BTqqJp5SLlErHRKBU4ypx1SIM3xDpfjhfgL iZ9Lb0t/lPRpKV7WINWVXS/eFr0t9qD499EJ8fGoqDPpzELaaVosLjPxiqiYGFt1CB1iQhiT Xgcroq1wN/UXWKTY0SFbDk7kc+9nPCHvIX/I5yPNCpLc7MO+CbxVCXoPud632XSJjN4WTNhE m6pcKjZnHl9MPDtPPm5w8GsIUIwGB7NGdd6khpJozatHEQs5boLWG7Jgi8+ax7n8yvyG/FB+ b/6RPJ+3CTLJhFBmjeo7osDNKor40qkZOyuFUzMzFSlvDWnwpL2DZXQK9PIROi/1hCBDJ0o+ XqC44RZBcYQLQoszCsQVh0Mom9avkg7iwyIxwWduDcvAIVoUA+QR/iLcT0pCVhxoDLnQGDIi 8WOzeWXWn8rQPfFerKQ8wOTSEiCSHwjxzVTMLm3rPFhv5EHBYNBaCE5M/2bc5FBjSEFi4spJ E9J0TyEdDLg2SKsLQkJdEFLpHDNJyAaS7syMtwz9xII1pxhLCjnFYAWi7tcn22czairy5HgW Xg2a+olxNYaiwsATz8IQBEf/ohgAxLMwKsUnpt8bB4Mf4lNPeuSCqdQbLpzVrdajEXUjf3c3 tJk57jacNtNGW0uUnfW0Ub/sUTezxZL5hjUyb39buskh40T3ipvWLhgOimFXWIpk72qvnNey 5c7s/Nu+1rnYX2Jzedhnpp65aUt9zO9Nv/iVtSsOdpWJ1bjrmmuayyrbF1/WsKp38JG41Rol fVxi+n3mIDeJvOgOxXJAPGBiKBFNyDuBj0L9cA4H69zPYF4WyffcWbFo6LeI5CMMFiWgE4+a fH7McciqC+kYXZnd5RxzOOwKcN9OREoC7T1nP24/YWftXh/pXVRDHVSFM1QbgOGf7GI+DYeo MHmqm/jTUFu9BdOJMnXzlTM6O99MO5bakijdEj7xq19ZE1JbU/ALR9dfUWLc86VH53OTUw/1 Tj79hVyg13W8d17kIP5jdP1zY6SshelTXBV7P4rgW8nK2HHlPtAHYydijMHkN5WZlpi4RtM3 Sx8snSjl3tH/TmAixDcrTAhYlHawJ+3cr/V4Wo+JKRmNqvZTMBaKRKM6sCO9/QbRKKJIBBjA I75MMyuDPFHveND3eFDxeKLi8US744lixxPFjid6Hk+0O55od6/w2MpjmX+FZxAv8QxPVD1j jGiNMdDyYpqWF9O0u5im3ZH4sTL1MuQc05Q8EiteUPKOx3AodiTG5GLDMSbmCDmxs8xKOppx yNii6XgWTcezqJnRfsgOqt67FpyzHLecsLAWb3TF7OQcHSWI1TWrO5C/M91zj8gwcvrsTh3Q KajGR9zO6LedaKMozlrAdNY5oepjYa3W6QasZC37cmre1P4F112w8oqyZCu+0p72xwKpBqKZ Tca2gkp2ZdeSnqvvwTuICjZ5VV9T0O5bic9odkHJVDt7Gmo/h3ufoHMhJtKav2t3tpJp4qVo qbnDt953kX9dxWW+y/xbKm7wT/h/6Lek7ClHA2rwtaN282Z+s36z6Y7cA+gB32teM8iUOWc2 5Sy8SR/inV5XyCmRbw5yIeh07CFHmTOZimUsuVy7z+vw+bwms9kDPZL5i8Q932xBGIdzPq/F bEJ6ZzKHYgSCdeKLvZ25OWiNvR10OqBr0PE+JG6sOln1bhVbRerD7Ejlq8DEtjpzTsY5gVnF rUun5WQ+uTDJJl8KZ5DuBLRFb2UVXBsPP7NGNZDpx2WgyakeP8XZpVAwhgunqTWsOo26G22N 1wsVGXVh1KKtkCLNo/RvfL1BkFqEFrq8nkHdurmeFnQdVDvUY7JzOfKJr5eQBfXfT/1kYVsF fq8qVX14W3NVK26saFo49UF/1aItF2xenK+eh7EgWD3+VF2CeeKuDks8zkQ8ieGpW7H/9uZ4 OROP6+Y9Orls6s8tqzcsaOpUFiREMVB2EOpo+h18FycxLsQiv2JmCmhK/XTV0kUzn64qzHy6 ipM+/jUXxneNgbzQWTmQFwndqTh+/blnlUqjSOLnziqRH8Ng1FkjdTIpok4miXZXXptGstFZ cNARQ7aNZ+eT2BJtci3zYTdpL8VPTxx9etrosdlpI2gUn54zmz6G4/ggQ7616fk+YtmfgIq7 Ff5ffVSHc9IZVKCMKAnjg1Mx/N8graTew71x7nu4N/70U1352Xsw+mv3fHD2OWjqGG4/e4/w Oe4R0B+OCXPukf7qPZOz90jonWOSeg9CdVr4e5CE2YA78SEtHCWB+TZrZL9LAneTrvazAi/q Gf0/CV837DeuES82rTf9iATzSssSa4PUIb0lvVVy2va6vceRdLzjWuge8vR9MnhP+l707yod C3Ro4RQJwd7QO+GaiIOGN2LXxf4c/1gNiY/+o4Sk/f9S+NL5cD6cD+fD/1a44/9JeOx8OB/+ PwwvJ99IofPhfDgfzofz4Xw4H86H8+F8OB/Oh/PhfDgfzofz4T9qUH9dGL9KPL7xPsSjDsSi 2PQBoPXTvwTaSGkTpS3TjyMHcsDVGGIprZ/eArRx6iOgTdMBoC3TC4FeAufTkOZxoDHAOZo+ B+kXAm2ktInSFkovgas1NE0NTV8LKSeANlLaRGkLpZcArYeUvwQqwb31NH09qqZnFtIz7ZR2 UNpJz6+ieA1NuZbidZSS92ykuTVCbgTHoCyNkNtrQElujTSfRsjncaCrKF5DU66j+BKgTTSH JsjhcaAx4EMT3HsAaAelnfTqKorXULyO0ksgfQvlUgstSwvcS+hCyKEF7iW0k15dRTF54hr6 rDX0WWugpAR3ULqK0guhRtegS7Sfv7uAfRuRXyIjf5dRytIaD9IjghkkYJuGWTRIfzuPYA6E 4/caJhv5SzXMo3LcqWE92jWbj4Aq0Xc1bEDX4cs1bGa+iaeIjNG/Wu4ODWNk5f5ZwwzidGEN s6hOJ2iYQw5diYZ1yKRLaJhHLl2rhvWoeTYfAXm4dzRsQAt0qzVsxst1t0POmGPhWRY9p2EO VfCnKNbBeaO+WsMcKtPbKObhPK+/RMMcSuhbKNYTvumv1jDwSn8pxQKcN+kf0jCHyvU3UmzQ +K9ilf8qVvmvYpX/Klb5r2KV/ypW+a9ilf8qVvmvYpX/Klb5T7CRlv1VDUPZ9UcpFuG8TeA0 zKFqvcoTE3k3oU7D8D6Ci2IL+eURYYuGOVQpdFAs0XzqNAz5aOnthIfCHRoGHgrquznI+wj/ qGF4H+E/UeyE8w7h3zXMobzwMsUukt4gaxjSG1R+ekl6wwoNQ3pDBcXkyyhGw9Uahjo1qHUU oHV6tYZJnarnQzT9wxom6b9KcYzUqeFVDUOdGlS+lRH+GBkNA38Mv6E4S/IxlmkY8jEaCRbm 8F+Yw39hTrmEOeUyzUlvmpPeNKdeTDP18iCSUTVIQBX8y2g12oL6IV6OhtB2+B9FY2iYnlkA R0XAhPbA+QGaogKutIHsDUK8Cs5thvtH0Q561A9xP/2F1H7UBylXw/Vt9KyMVkC8m6YagnM9 kJMMV8mVHvgfpc/ogzTkWhFthXNDaNP/0fv9Zcqmc77HfMCD8PQmtJa+/w4tLxnGkArgUj2g FOQ7gHrh6hBcJ+82CuPV2ZzVfM/m2oUuQNnZnJdDyk+XYPUsWkjLsBty2w4cldFKyH8TfR65 moX/C+A+ku8gnBnT+FGkHCS5lsOZtTT9KD0vo07KR8LR7XBOhtpuhPGyGq2H6zvhmLwlyWcn rTNSA1u0+thEcxylNUOOhylPyC+LjkIgNSujS+m9o1rdLIJRpBOkQr23OOfKMOVXHzyll+Y4 QLm6mz6rF+hnP1c9Jml7obw7aSn6aNohoH30+jBcUUtAuNKnPWtAy6FXy0stPZFZ+VMlH6Lc HKN1OwB1KVPpu3T2WZ/1Xts/lffn59LZ3Ptm67lIZWeUvnnvrAx/dunVp3/6vZrn8ICURC3L KH3eTOsg+atl7YMzu2nJh2iL++ySqpzu+QRX+2nNDmlULZWKd8LRMKUyfdtds5Kr5kNSDkKK v1lHD8rVlVWV8uot/fLyoe1Do2PD/fKCoeLwULFndGBoe4XcNjgorxrYvGV0h7yqf0d/cVd/ X8XqgW39O+QV/bvlVUPberbLAzvkHnm02NPXv62nuFUe2vTX85s52fSXecwfGuxrWttf3AGp 5NqKyno5tXygtzi0Y2jTaJomhrQ0adcFWZJ4+erZB6wmZGGxZ/fA9s3yyk2bBnr75ax8wWjP 9sH+MXiP4sCOoe3l8tqB3tGhotzZU+zr3z4qVzXWVK8f2ilv6xmTd+7ol0e3QDk2DcGVnh3y cH9x28DoaH+ffOkYXOmXF63pbIOrRXowXBzq29k7Kg9sl3dvGejdMudeiAe29w7u7INbR4fk voEdw4PwgJ7tfXDXACTohVTw+ApZnnn40PbBMTk1kJb7t11K7jqb1/aZ1J/5SjR5HylzsX/H aBFKB7yb83i4fTavZvoGqQF4ymj/NlIdxQF4at/Q7u2DQz1zHwov3aO+an9RhvIOwaOA7hwd 3jkq9/XvIsyFNFv6B4f/okTn7PHJuc209ZFe9VypR9FObAb01jlTbqJt9Vyp2ulzR8+Vjv0y +332OfZpoI9+7hINfK4SdcL1LYB3wTlyx85z3rGY9iM76GgxStv1uUv5FrT6rehDeMpbcPe5 0q+lOZ8rVQfEg5Djps+Vugsw4cpO6HnVvvXcvJnLyXOWkgtxrVwzt4Cr4xo4hZvHLeMaz/mE 1Z9bnpaR0uIqwOdOSaR5GPh9znfGJeg3bBSOzi0lQ3Ss6pm1C9F0GD2LPvuPRcSiMSM8PU30 TYSWM2+0g8p7P0LzdTqwA5fLalc7v0+mf9PwhwrTU6uXr5hfWcmi67QZBkR+8vhl/FOycxEM vq8izHyNuROxzDeZbwI+xBwC/C3mW4DvYsAOYO5m3gX8HvMR4D+yYAWyNhbsJNbOtgNezC4D 3Ml+CfBedi9i2H3sGcAfsH8GPMntAN17lBtFLLeTGwO8h9sD+AruFsC3cl8H/A3uG4Bv424D fFBXjrAuqwP7T1ejqwGc1zUDbuEXIswv4uFZfCe/HPAK/kLA6/h1gNfzFwO+hB8FvJPfCXgX vxvw5fy1iOGv468H/GX+BsA36v8BYf29+nsRq79P/wTgo0IbYoT5wrcQK9wl/A40/3eEM4A/ MEDOhvWG3Yg1XC6CpSgaRTNiRYuYApwWawDnxfsBPyAeAfyo+AzgH4jPAX5e/CfAL4v/jBjx R+KbgN8SwYoST4u/B/y++AHgD8UPAf9B/APgj8Q/Av6TCDVrQqYfgDXxrOkFwC+a3gP8e9P7 iDGdMVsRNktmD2LNXvNaqElOq08GhSmHVd6qXNX4CeVaBSVaLQCvhHUClEi4SPgi4B6hF+gm YRjoLmEM6B7h7+DqXuEqoFcLYJMJ+4X9gK8RrgN8vXAD4BuFrwC+GXhFuPR7jScMcCMDuFzM QVkqxUpa3rcB/1b8LS3Lc0CfNz0PJXoBykVK4QTqMoNVanab3YA9pFxaeYzoIP4vSNdT7LkU yb1jxUHUurnYvxWt2NJ/aRF9cbBndDvY2kaE16xaKCMHtJppMm+BRA3pkOl/8fY1UFFl15rn XqCKf2naqE3bNrFpojahCdKEJjxDCE2wUtC0QSyqKkhomqaRnxLq79Z/3foBjSE+4zAulnE5 jsMjLp/jYniOj+VyGaMun63G2LZt27bLZ9Q4PhdjeDzGGB813zn33rIkdnfWzKxZd31373Pu +dln7332ued6CpluCJsp9BtFWkyaw149PZrmMKvQkra+OpsskEvw2LXPk/k4PM0gz214r7eb tLN7N7ub2d1BX4OIj90H2H0ruw+x+z52P8/uN7s2dCFWs/ssvXMqdk9n9wXsvoSNP/6Zdz5q a4lyGBX9ykJ/qqCGvMkYfSr9O5NUWpJJnodevoYRLSSLyAski7xIFhP6S9SXEXeeXe9ZeTz9 u8JP0Xn0fzr9Akr3a0ZEtE5EdhcJki1kO9lJ9pL9ZJwcISfIWXKJXCO3yH0yTR5z8Vwql8Ut 44q5Sk7L1XNGrpcb4nZxI9wB7hB3lDvFnecuY+wc4bjNkA00xQwJQdNOSHTeKN1/Ey6jWtJU 9gqJFu2V6BtWiRZfkui3xyT61k6JVgUl+oN2idaeIvFQMPd2HVFBydyPlxIVhs2t3yzJ8ZNK 2hvhWhZJ6ZZKmTbJ9JJEW4+wcvFtl9rutj1+P0NKve95f9v7I+9PSKn2Ze1l7XXtrVLqg9wP Sj+o/aBFqt+RI9ENGTK9x0oldp7ovNI52RXfldVV0FXVZWS587oruhu6O7o93du6R7onus93 3+ye6UnuWdJT2FPVo5ckNtHvdZRqpRZN9RLdmC/R3laJ9l2Rylm0Mq2HhinFKpFUliTS7y/k Ov1/DJx5QCHhnMdBS4BV4E8T4q4FXwlaD4r1xVkHNABGOd0iox3lz4N2A2YZDpn6ZGDJcm6R QfltqHMJdIecDhPOuliizqugu2TsBfYBB5F/A/SQnD5CiNgqo4NwognUStP8QtsVoUooFdbY eQvPkCW0MqwSRBkDDD5hjCEsDFJY8iw8hf2gjLBwVygSJm3XBa3tlrDGdg/0gbBGWCaMUdhm BJ3tsdBEywHT9mzbKQrka5Ef238HQyF42n6ijFyUp0gHT5EHniIqp/mWhKjcgwyV4CUMMnQL IwxmGWE2pjH7Fhm8cJhhB8pSKOld4HfFpGU9/EV671egG7LsAI6Yz9qPA/vAHwROgz8PXDVf ZKBjuwEcEY4y3AFfCMyijdkn+heSzbcoLNAlhbBAuCzBfJ1hsXCTgtWlyKI6Rr2loMct6UI+ 7JPPdMDsBzrJqGIHySYm+33UnZLkUWwbpbJtFVtG21R0CnuzNuejrfkxtptryyc+YGX4ItuX gC/50vouBg30StECnVHUgadoB9/O/EPxle0ylPQwQwN44zPL72ZwwH8csj9J2M/gkKH4mJxv axNGngX7Nuho21P6+nIo5ZQ5GfVRjJ0i6sPgd8Sk5z7/Kh8+hLE6gEvwy0uop/gmxX3zjH0K iPor+BtP0hZqr4dAtDxiyhQQ698PY/xbwS42RwbnxhkhXhiksO+DHPti0kr8mRVOUFjyHPUU 0bE8iU9SWq5vD7M8LZ6lM7DntCzqHoypr/QnzzMmMyBkIJ0Rk577PFk4A1ywZAutFJiDuxke CR0U0PdNCscSCU+eoy7gyEE+EBO/BigcBPIgNjpWSPOYzWV5vkWx7Gk4ymRUSIjmV0uImfs0 Nk86iNBBEeOPk7GxQSjCWIvMDxy1Ev0q/3KkSjHOkSloHYuEE4hP1zA/jzpWPNGz7aJQ7lAJ IxRKv44CS7qjWJ7TbF7bjjE8mffHGObOezlu+PcJLoonadsxir9Ya548P8UAWWUMUijz3n/I /IDhiP84hb3bWcigzEt53P7TqHea+g7GrEI9xHX/JSnW+68CN5C+A9zH89Qn6SdzBTJOAXPm Dmw3SOG/ClmBZ6fpfJHmgH9KuCzBfJ1CWOB/KMFSybDY/IBC0Yt/VrhJIcbbTjEkg09+kp67 1ogZwhjF3LVTGT/emlLY/pmwnXMi2zMnYWdbRNITSrC/ncd2ts9jT/sjkqVqwM42m+1pl7K9 5atsZ5hP/02P/5/Yi5O4l+OWYm/9jbgCvJ+ujCsmGXF+7LnnJyzD7nkgoSzhI/KzhI8TPuZe TfhE9R0uV7VK9X3up9gfv8/9reoD1QfcL1UbVJ3cLlWvqo/bnZKUksTtwf51nPvPKYdS/jv3 d6lcajf3K7x3P+CLn7zxbSwFyvHOeAG0CsA74sbLhPThzW7jGlC81W3UAU0A3rA2dshpkwwr yl8DdQGijAGZDsrYDgzLoPxu1LkJOiKntxOuc4VEN94F3S9jDDgMHEX+JOgJOX2GEHuvDDvh 7B7QIEt/jeTRswGkluhIC/vm5SObsWPZRUbJGPYrp8gFchV7lVkukcRtXLWxcGPlxpKNmi7s OUx3TZMd0z0t4O6ZbnU86DGBu2G6arrTUwvusumC6VqPEdxZ06mekQ5a47jpSM9O0yVwh01j Pdt6csEdMI32DPQUgTto2tXj6ckEN2La3mPuyQa307S5p6N7Ftw2k6+nuScV3IDJ2tPQfQ+c x9TZo+1+CK4dTyu6J8E14WlJ9y0Sbxo37TFtNY2ahtDHzs5HyBk1NYNvw5POrtGORShdYFrR k9y9C1yuKdu2uPPs/zMvTWDfgQj7AsSpPKoQSWLfQp5jXzKeh18t4kTsKlLJUdiAdMO+3bAl xkC6p2Ez7MW6H4EmE9KDbVkPdroYPYF+pPQiGdgv9+QAK2QUyLRYRhlQIYPy1UCtzCuol6EH moE2oFPm4TPWLBnYNVvzGJ+3oWxDxYbqDRWmpg21ptYN9bj0DM140ryhbUMnrl5QO+4egF6d G4LgNzOOXltZOcAy9UGi5aFl9gP6de856H8K2+lp/t8Iz/8v2CKe2ULFbKFmtkiFLd4kaQnf iVokAxZ5hyxU/Qh2eZHZZbFKr9KTJbDLfvJyygFYJwfWeUy+kTILG634/9gTR8qJmdk6HztR 0oWdXNc2ADu4LuzU3r8Dit1aF3Zn5lKS2FHaUf6+Cfeqjqr3x8xsf8//K/+vkHSGnyFcQmlC KeFVa1RrSBx8r5HEqwzwwISUv0/5e6JK+feUfyfq/6M6XPoE+wbQSi5y8VwyV8BVcM1cLzfA XeQzeA0/wA/y4+w6yp/gL+K6G5cclx2Xj6sorimuPe5A3LW4mfiiuOR4TXxrfEf8g4SmhPaE bQk7E6ZUJao2lT0uX7WHlc9XXVDdwXVfXay2q8cScxJXJVYnWhN3JF5MvJvEJxUlbUs6m1yR fC2FT8lOyU3JSylOMaUMp5xOuZ6amlqR2pranTqQOpJ6NvVRWmJacVp9miPtYNpUemJ6aXp5 uia9PX0wfSc0Ts+O0ZNj9NwYPTVWFhnn/hj5Ofcn4M+Rn/MckBT5jE+OjPPzIuOwEj1PlsTO ftHTZPQsGT1JRs+FNSKtB+gprUMR+r2EnpWahyfP0VNmyFHL9SrZmTJ6oozWo6fJDkUqWfmf P1U+gZ0ro6fK6JkyeqKMnifLZGeq5uF5BivbTl4CltCzbQA9WUZPgtFTZfQsGD3NRc+B0VNg 9CwZPZWlSDlPagljoKfJngN9CU+X0N7B01NlldFWxqOt6JjMlSRdlqOSne6iMr8E+ZfQk3bQ CD1RRs+TSf3/nJ0ko+fI6CmyeVHNZMijjfYL0PNk9DSZ1OdL5EfIqwfVMR2/BBscIhuZDZ7u nZ4uq2a9fYbyn6EU/f9G56Hv5wCO/EOEngKKY3oYZxZK4L8ZWckXA1rgnVkvXx9ZiTkoSZeI eoncQ/JT7k+zU/CGVJ6bneKzIhMkAf7RgZwJ+EcHfOND+MaHJA65tUjdRuo24ficyB9IMrUp lxfZxH0TJRMim+BNb/LJs4/4ecCCiJeH3VDyICKM0s5zXH7kZe514FvASuAh6YIMk+gxEzJM 8hmRl/nMyCj/PLxyEWgW8CLwEtrOxrPlkZdJCvMmjPKv6l0ly/khSv0WpTZCmm9Dmm+Tecgd RX0jpPoUUn0KqT6FVJ+i5Cgk+ZRfCLwAvAxkA7nAcuC1yKfQFHqf27PUGzRcBQ1XYWQfYWSv Y2QfYd0rjOwiX4/x8KpYD0drn0GWzyBLFWQxcgWg3wJWAg+JDRZ4E211wS5votfP+DQAbfDo B+Nth7aGoK3PoKkhNvZs5L8S+QV00M6/irxlwHLkrYgMkReZhJIEVZCgChJUQYJDkGD0K22U EDmE3j98ylYLYAXJXuN/YS+e6Y3qLBltb0Lbm9D2JrS9CW1sYhrOBs0FlgOvRTYxn5G87Wv/ V3J9kQ9RT5xAaxNobQKWsaDFCdScQM2TGM0m1DwJySZQ+7eo/VvodBNqT0DKCbQwASknSApa OYlWTqKVk2jhJFqgtX6Pkif5pUAusBx4LXKSxPPz8eQVYBmwIvJ7po9R1B9F/VHUp143Cgk+ Yp63CDQb6eWR0S/o6eXIb57ZUwIi321EvdvkVxEv2Rc5R8Yi9GzmocgwYuyhiJb/XuQcXx0Z 5leD/hBUi7waoBYz553Zf+LXIV8PCxgiO/j14NtBN4B2omwX0B0ZIxl8KUqsiozx5XjyFmtx Cq1NobXbaO0wWvtn/m3kv4Ma9SjXGDnCNyH9Hp53QaJ0tOCNaWFMrqmPqfUL1BpmtbrwrAfY iJqL4cEvwHtfiB0hWvs6WsPoyEr+rdkP+SqUrmYjvI1W2jAiLW9EL03g10da+Rbw70Ve4NtA 3wfa8bwDEnWBt4BaATt6FyJtRMVarSEvYFS3+XXg14P/CVkJX/0euLfgqymyXmmP5zCWzzGW 32MM99HzOehyGL3uQC9t6KEV7ymrIgGM/DbqjqAkHTHV0ZiiI+hHaasm8gn6bUcJ2vcLzDbr UfInoO1oV7IN1dE53oaaCUxKAys1hRLsCcZQy3JondtMnxvRho28QFKhu2HIMyxbYpj/IXqp ifyMrwV9O9KMns/JlrjNN6PGQliAwAKEYD0jS4B90Ekp4uCqyKto5bCkldlzsMKnGMc0a1HL Wj0HOT5Hq4ptx2SZIDvaELBSpEfleYuN/jZKf8hkqKfjQitU+xuATsmXMJLbbCQvQa6VkGsl PGMYnvGh3JKXjUryiNvo/yOmaWoXI7PLGLzhHN/KND8Mj6A+v5f/APkdwAaA+n0P0Me8YzjG O8ZILmbcGGbcGKLpGKLpGHqHRuCbzC9nBUjwLXgHbI2Vls48as11zC+1sNMYpNDxPwaaIt+B NK/wzWj9J0i3AO/ieSuo5Ks6+KoO0r0C6XSQTgfpXoFkOt4E9AJ9gB0QIt8hSfIc02L8bXw1 tQHTaCu06WX6x3iJWvbcHfC2Mci2kcnWHvk1nQtY8avZut9F6BnfQ6xeCG9JlCtFhFqF6F8O /nuo+1bkALR8IGYWtMF2XejtRXm8vyDJqFHPPE2aOV4mVy3y34YEjWhNmQEpaH8MpdtQeiOz oDKCt7GWvSPPFfgjK53Av0cyoZXb8IoPIfkOeMUBtEHLUA9rZq2egw4/kWfAGPQ2xmaBGfkC 5kgamzWsVURTGqna4KvtmEWSt9GZNIH4Nx1T6zberOR4hJrDrK/30Hub7NW0XR6x4gXq35iF dA7R1qjfdoP2QB4a1dTyjL3NytKaG7Ci4wn6uQ1LNiHVDNCnbYgs7ZCiK/IxpJlCqU9Q6nO8 Hf0KY9cj8hrYqM/JMeI2ixFdqNXNZstBFifiUHKKPaVzJwVeeA69nJQ1Rcf+qTzDqKZovQ9p SYzoU0jbJEsq6fSf5ZJShE7i9XiizFTESfakOxrDP2E9pkFvbdBbGystx5Zom1SuDnmedzEZ VzJtZ0Tn+EtILQFo7NHLEa8J/rQentvMrHAuaoUNyOuWrZEge9g5OXb8E2s3VW5jLEZvdO6f lO0+Rtc9lB6GpseY/jgqK2zbyfJbmU6G0PPP0PZn6HmSeUoPtC3IFvxpjBeifTmCKaXgU3iT V0a3D22rkXoDqTcw1nMY6zk5soyxNZ0nheycAqG/B8IKn0PoKfnl9Dc/5HVc8fC3lXgfeAOX inwbl5q8SbDXJmW4kslqXClkLa5U0kj0sIcR1zzyD9hjZJDfkBMkk3uN+yaZz73OvU4Wciu5 lWQR90fuj+QF7t+4GZLF/Yn7E1nM/Zn7M3mJJzxHlvAJfALJ5tV8Gvk6P4+fR5bxC/mFZDn/ Ir+YrOBf5rNJHp/D55B8PpfPJa/zy/nlpIB/jX+NfIvP5/NJIV/Ev0HXEkSHN/hKvor8DV+N eV+OnXgd+R7/I76eVPMNvI5oeD30X8O38q1kLd/Gt5EGvh06Xcd38Cai4628naznw3yYtGAP P0DeJVzm5PNroJtU7ijpJMTcAZgAK+Ai/IZroCIhxmlCNhwlpOOhBJo2DwCDwHakT8h5w8Bu KW0eiYJzhQm/rl7ChpvAXeTvB518kh+L2PwN0zJ99OzyDRek/MC1p54zORj2y7JRWcYI36ki pOHMk7KgbEzmw6wc64fVx3jNdBxngAvAZTl9TeZvAnQcqG+elsooukH7DB1m5D9i+XxnqjQW BtSxkCf9W1RSWYD1Tdvo2PVMsOe0vXX1/Od9esdVsaCv2XFDLO5rc9wRy/o6HffFir5ex5RY 3WcHX4v8h8hvc8yK9X0eZ7yo72t2JovNfUHktPVtdmaInX1bnQvE3r4252KUGXIuFe19ducy 1AX/XjvK54uevp3OIjHYt8dZKm7uCzrLUWYUPW7tO+CsendN36hTC34U+Z6+cecacahvwqkT d/YdczaJe/pOOVvF0b6zzg7xAHgT+ItOqzjed8XpEif6rjtF8VjfLV2zeKrvnnNAPItag+LF vlvO7ch54BwWr/TNOHejzBXnCNp87NwvXjfzzjHxljnReVi8Z053HhUfrK1wnhBnkH9GfIwy FwK8eb7zciBxbYHzWiAd+TdRPst5NzDfnO2cFAvMufRO9fbeQXOec1qsRs4j5Be6iGg3l7hU uPtcBeLOp+5hV3H07qN3OrpArnmLq0wcfeq+zVUWyDPvcFWIp8y7XNWBQpnfy+77XLXiMfNB Vz3aib0firkfcenFx+bj7C7xp13NgRLzeVdbYJV5lSs1kNU3xKS95OoMVPZdobWsFW5zcIG5 0pWpjFEe0X3X5kCLeT5KtpuvunoDGvOUSxXoNmtYGUkDEl/H+AbndCDbbHQtEvXyvUXml+De 7spBm7H3btcK3M0x94eurbCg5GPMmuZZ15AYtMS7dooPLMmuPWKxJcM1GjBLfmu+4bIH6swO 1PVgvL2w1x2XJ9CA8QYDRssC14GAw7LYNS5OWJa6JgI+6pOBMLX+2k70fiywxbIMtshTeNep QJ7kdfK4mAXprGnPpf4Z2GbJd53FfDmL3g88mTuBHdRLA7sg4UVIuIza0VJER2EpdV2hI3Jd pyNy3XoyOtc98ZSlHP5Tb6liltVQX5L5dqZ/Zl+L1vVA9FjWuGbEexYd45soL2umlWqGzrLA XurPgX2WDtdjcbPF5ObFGYuVafWIqxme0M38k/EWFzQ5ZBGhyfmWAfCbLYOM3+5ODBy0DLvT A4csu93zA0csI0wPYaoHy35oqR2+ekoctYy5jolllsOMP+rOChy3HHZnw4fz3FnwBMmf62hU QRnwki0wImqLE+Db4bGUP+N4GDhtueDOBV/uzoM2LrsLxWOWa+4SY6LlpnuVMdtyl3qRZdJV EThvmWb8I8pLfmUlmCmXaKQKXLWqdM2BG5Zkd6XYbE11axAZELXeO0/jw3sN1kx3nTGb6r9t gHrX2mYawd47SGNF4A6LZmWMv29dxPQvzSnJFj7K08jWJtIYEpiK9UzrEndD4KE1x20MzJpz qZ6tK5ieR57wZs0T/dN4GIynkScQtha4W4LJ1mJ3u7hV8mTYGnPNWubuDmbYO9wtoQd2E31q t7pb3l1jd7nbA4l2Efkz9gGWP+haEXpsEX2VYb5vyO1ApL3i9kHaoEeLHnnPGvQIHw4nwkt1 gV2QJFPxbft2x1Q4XfJecx68txr5ZRh1HbWjbFOmZ3hsNbyX6ZnG3lAxjfbBeBpjw/Mt5ZjR ZZLH0tGFsxBFz4Sz4b1RD6TRPpwrxVUqMx2prxL8MDTjse9m85fJJuhdBeFZoZna2qqCrS/J EYNZgWlJbtNa7Q4HF9vme4aDR6217i2BVdZ697bgUqvevSO4DDm7kKN372U8fdrs3hfMt7a5 DwaLrJ3uQ8FSa6/7iFhhtbuPt15HydOs5HmU9LgvBcutQWbZze6rwSrzHfeNdyetW913glrr kPt+cI11p3sKUfSW+6F4yrrHPRvUWUc98cZE83lPsjHbesCTEWyyjnsWBNKtE57FwVZrr2dp sMN6zLMsYETJ/KDJespTFLRaz3pKgy7rRU95UETdqoCRxrHggLSGSquV9YpHFxy0Xvc0Bbdb b7mNwWFr0NMK2e55OgKzlA/utj7wmOBvMx5rcMT62OMK7rfxHjE41jfuGRCHpLXMlugZDB62 pXu2Bw8Lbb5L/fFCp+9qf7LQ67vRnyHYfXf6Fwge3/3+xULQN9W/VNjse9i/TNjqm+3PF4b8 8f1Fwk5/cn+psMef0V8ujPoX9FdJa7RwwL+4XyuM+5cG8+W3CLZey3F4GZ3vwoQ7r3+NcMzX 0q+L9R864zAjMOPC84VTeB+4jsh8NxTsu0dnsXDWv6y/Sbjoz+9vFa74i/qXxsYT4bq/tL9D uOUv7zdZdDSiIh9RVLhHYxeiHF2FY+K5uYH6tvCAxajYeAU/77dSP+93xfo8fBgRAO08iQZS ZE6m0ViYcc30i8LjmMhspjMd44V/ChNs1h+nq3BslHbw/qr+AUeiX9s/aG5354V99muIexcd 6f41/dsd8/26/mFHlr8peIbarn83tV3/CGJLphKNY9adXKzXOUq8EsrQYydiDmaTLcuzO1Bn y/aMBE/gvj94gnnXKmm+4D5GZ43ncMBoy/UcjebneU4Ez9gKPWeCF3C/gHuJ53Lwsm2V51rw mq3SczM4bNN47uJNjNnXVueZDN60NXimg3dtRs+j4KQ100vgw+fpexq9o/0WryrYZGt3bQ1O 27q9qYFLNrM3M/jIegD3JnoPEZvDuyiksvm8S0Kp7J5J3+VwZzFZutvC3pzQInlcW7wrQkts 27wFoRxrr7c4tMK2w1sG+Xd5K3Df4a0OFdjme2tDxexeZtvrrQ8U2vZ59aEK20Fvc6ga97ZQ NZ1f707aDnk7Q7W2I97eUL3tuNce0ttOez2hZtt5bzDUJlkN49oMLV3ybg112q56h0K9tizv zpDddsO7x/DYfMM7Cv6O90DIQ+0VCrL75hg+aLvvHTcW4j6B+5T3GOR86D0V2iq9RdtmvWdD Q5Ke7fHei6Gd9mTvlQBvz/Beb7yK3m8FjPYF3nuhPfbF3gfQ6n3vjNKafan3cWjUvszHhw7Y 832JoXF7kS89NGEv9c0PHbOX+7JCp+xVvuzQWbvWlxu6aF/jywtdset8haHr9iZfSegWWyPS 6XtOOM8+4tOEC/uO+erwNo79AtYOvJmHS7Be3Aivsu8HX2kfc50Na6T3Jfthx/1wnf2osyM8 H2Xuh1fR/HADfUcKGykfuC+VYfktyJ9CPlt3qCeH2yXefgJtdtvP+BrEcfsFnxFzfJtrPGy2 jNF3Azt7N6B7k7CD7gIC982FdO7oOqP5YZof3kJ5rOy0zJ3YNcvcjXba7Nd8LeJF+02Uz0KZ Qch2F+V30PeE8Db7YWcG5MQbQqjYctTXHq5rNLquhIpZ/g6aH95F3yLCe6Uy9klft9hrn/aZ xSv2R5QXCOXpLknxYewgHgW6MStrw/v69M7F4YOyV1P+EOWhq5h8c4PPIdYKKp9PvA5bOMKF QqrP9/64kEnjDHSCOEPfRsJZ9G0kfITxxxl/WljkC9M3E98WvBliBQmXUA8PnzfP+raJQd0x 3w7xQSxPy4dLaHmUqcN+rVpY4tslzsTGK8qHL1F+7c6n8ulaf5Wt9TcYn8v2U7diefuwb6+4 Vcjx7QvwdA8YzqW7rXC29A4jrHC3h+8IBc6q8H26/8KIsn0HA91Cse+QUSOU+Q4ixlb4joSn ENnoe/4hvDNM4E04+gZL94/hRLa67WP8Q8qvrWee0CBU+46LM0Kt73T4DuJ2rzghrQJCve98 sGmgbKBioNqxzT8ZbHJs8d8Vz1pr/a1YnQ/4O0LEesxvChgd2X5r/357q29V6J50d+T6Xf1j jjy/2H+4T+8f6D/qKPQP9p9wlPi395+R3/D3+If7L0ixRZr7jlX+3UaNvMOV9rbSrjZ2xyrt Vdku1VHpH5mzV2UruEPj399/2VHnHwu1ORr8h4PlDqP/aP81R4v/RPCRo91/Bu9prB1Ht/9C /02H2X851CnNX2km0n7778q7aerzJZInPxVvo5L0T8ZGSGo78TrdI4ezpXGxiDFf2l9LcUma y3QF6Z+mK0j/tDzT2Rx0OJyt/Y8cPv+1ASJ5iCPsvzmgcuzwTw+kyl8n2BcDxy7H1YFM6euE Y6//EXQrfYtgu37HPpEMLHIcFFXokX1zkPQmfVWQ3jMd58WcgeLYHaXMS98r2AxyHBJTB5Y4 joiZAzmO4+KigRWO0+KSgQL690HYb8NIzG/DePbbsPjEikQdSWC/B1vMfg/2dfZ7sJxEa6KL vJ7oTfwpKWa/9fo++61XXcrylAJSn/I/Uv6FGNnv09azX6O9y75A5pC/IYRUkh+TLNJC/KSI bMJVT7aSvyVryW7yn8g6MoKrkewnB4me/COZIOvJKfIx+Qm5QW6TjeQP5D6xkRkSIW76v6mQ fm4zt4Uc5Ia4j8l/4z7nbpF/je+I7yJ/jt8b/3ckEn8k/tdcXPzZ+I+4pPi78f/CPRc/kxDH fS0hJ+FV7hXVZtUR7lXVMdWvOZ3qN6rfcHrVadXvOIPqE7WKe0+dpF7I/Qf1S+ol3F7119Ve biTJmxTmE5I2JW3j05L+Y9IwvzDpl0n7+ReT/mvSGf61pI+SrvI/SPo8aYZ/O+nPyfP5D+iZ ST6Qkp4yjw+mZKYs5MMp11P+wG9J7Un9JT+UOp3G8SfTstKy+I/SFqct5S+lLU9bzn+WlpeW x18jHPTSwc5ELaFnjjSLgaXAMiCfZGmWapZp8jVFmlJNuaZKo9Ws0eg0TZpWTYfGpLFqXBoR 3IBmULNdM6zZrRnR7NeY6O+zmG1J4vcTv0/4RE2ihv2SLZPP4/MI4Uv4EsLxpXwp4fnv8t8l cXwF/30Sz76qqvgavoao+bX8WpLIr+P1JIlfz68naXwL/y5JZ99TM/guvos8x1t4C9q08Q7y PPuquhD6ziGLVL9T/Y68gDFdIdfZyDLpr9S0m0mLdrN2q3ZIu1O7RzuqPaCZr8nSjmsntMe0 p7RntRe1V7TXVz/W3tLeQ+qs9oF2RjujcWgfQ6DEmvSa+TVZNdk1uTV5NYU1JTWraiprNDV1 NQ01xpqWmvaa7hpzjaPGVxOu2VKzTfv4yYV60pUnX3XRyyxfO2p2AVtq9gL7ag7WHKo5UnMc 1+ma8zWXaq7W3Ki5gxL3a6ZqHtbQv5nEqf8LtLngKT+nf2mhiJjgtaVEgM9XMD//Ifz7IKmB h/8jqYV/f0zeJvdw1TEdvaN+Rf0qWaP+hvobZK36NfVrpEH9TXU+WacuUBeQRnWxupjo1aXq UmJQl6nLiFH9A3U1+bHaoDaS9eomdRPmC0d2YiZRLS8lCYSsPgIcl3Ga0bLVh1cfXX1i9Rnc L6y+vPra6pur766eXD29+pGGaFSaVE2mZpFmyeqjmhzNCk2BplhTpqnQVGtqNfUavaZZ06bp 1PRq7BqPJqjZrNmqGdLs1OzRjGoOaMY1E0gd05zSnNVc1FzRXNfc0tzTPNDMaB7/kP8hPcPI JW5MtLDfBCY/pS0BVxH5La43yO9xFWPW3ybfJndxlajr1HXkTfVa9VpSqm5Vt5LvEA6zKJmd Pl5B1ISsKwJKCaentByoItx3bxKuvDOucF2+fvG6Iv1SRhW+VL9sXbk+n6FKX7ROqy9lPH22 Rl/OytG0Uo6mdfqqp9pp0mufapO2Qcu06tdEaYdeF8036ZtYWuGt+lbGK8+VOlQepRx9Rtun lII+dyHtiumX8iJkdMWUmwtaby6oDLFQ+psLRbZY0LErelHKKXJRWRTdKPLT/AFZVkopBjHO WNB6CpS2KKhsdJyUbkffVD+0Ph2D0ocydmovKh9tg6ZpWZ1ch5ZV9KfYKFZGpZ1hfUdUt7Tc QAxVZNmtNzE6oreyOrQthSp9u+b0p8hO61H70vb2611/UX9gTr9jenHdYf3AuqP6wafkjG37 WbJSqsii0PKYNJWHphX90LEpdHBOmtahMivllblAnylz44R+O6Plc/rK/4LxK+PNnzN+Ja34 kGJb9NVYKOXNpdEytM8z+mHdEv2kLkc//Rf+8SW0seSve/5Uubn6/ito46qY9Fw9l8+x15dQ JkdsPsb9hVTWy1xdN1ZKevoq+pV6VMYR6/u0nwv63dG5dlk/su6afj/jFarET2Uu39SPRZ/d 1R9mvjKpP/pUHJ7Wn1j3SH+G6UzxR/StI/oLOpX+cnSMeKZL1V/TZepv6hbp77I8JT6grm6F /pGuwECYLyo+CaorNqh0ZYZUXYUhk41Fnlu6asMiisYWw+PGdiNPyzd2GxMbzcb0RodxPvXX Rp8xi/kt+mkMG7MbtxhzG7cZ82j9qK8+y8bbY+aNnN+4A/2dNexk/ex60kf0+V5jYeM+Y8lT 8UP7Jb45OGduz/WpuTFlblxSdAQ/ajxoXKXI3XjIWNl4xKhpPG6si8YhRYaiOXEoZo3S1RqW UETXPcVP5LSu3pCj0xtWMDQbCnRthmLav67TUMbQa6hg7dgN1U+tTdQXPIZaXdBQH7u+6TYb 9GzNVSCX1201NLN2hgxtup2Gzqg/zoFuj6GXQZGb+tCowc5kOmDw6MYNQaYfee3WTRg2K20r 80d3zLCVtXXKMERty+wb28dFwx7mt1cMo3S8dIy664YD0TZvGcZj9aW7Z5jQPTAc080YTuke G8428oaLjYmGK43phuuN8w23GrPW2BuzDfcacw0PonOY+oNiz1g61+75X0Hn+lfRHCrnN2ow F+ogf6y/KeuEsl7GrkVz1yT4a2OD7K/PKqesQzS2NsS8K8i00Yj3Odhboez9jtKvGueXxVo6 /zRSLFFoVH9z3zPmrn/K2Gh6cA5V3m3mxKSn6BfJGztft8fEA9nu0fgzd139orgx1560baV/ eQ5TffeW9pb/b/K+P66q49p39uwfnMOvIKIlhCAxlBjDj4NVkVP3+XWptUatJcpVS4klxhLi pUSt8VpjrM/H8/mUWqvWWEtsQo0x1Pp8xlpDjTGEUGsNzxBriLFGLbVcaqwhxlIDb63v3gc2 iDHt7es/9zOf9d3rrFmzZs3Mmtkz+xzYN+xtuV8aiwpnZXz1KhP2MEzh9T68NjBxmzlOjhcV 9cxhtuWYo+H517M3Zn/CexK6T8xqLirh+c7zHnW3FJXy/HPam3W2qPyGvbdjzz2rtWhRn/2y vUb11G+vRT17Z/a5vWgp5iXN41lXilaEzwezrhVV9vSb7eesrqK1PePl2LvOjiuq7hOzfI8K 9xGVm60VbZgdWbSFT/Guda7vChGVg/8v1B7VLvj/3qb/c5+v6KroxnOUB/Ec5evGYeNVZSOe oGzBE5Rn8ATlBJ6gvIcnKOfdT0YmyBCei5zCc5G38VzkHTwXeQ/PRf6Dn4uoSfxcRB3Bz0XU e/m5iOrh5yJqDp1oa8Su3qcHebViYl5t3t68A3mH8urzjuY15Z3MO513Lu9i3qW8jrxOr/Aa 3mhvvDfRm+JN8470erxjKY33hrwTvVO9072zvXO887zzvQu8S7zLvau8a7zrvZu927zPeHd6 d3v3eQ96D3sbvMe8J7ynSM7pICWBlIbEnzaDmCfiJwGuWfyXkv3OtktpRJ4QT9KpdjelPJxz veL/ihN0km2mZCq/Uo4Kn9akvSkC/LyKSipipijuba/nqBiem5ibkpuWOzLXkzuWruOJG58b yp1I0qm50ynNzp2TOw8033Mxd0Huktzl9GkO4fLcVaSVkjsHPs4lHz+D3wIKih7+7y/8L8Yl naX5v+FmUNJElsgWusgRo+h8PUaME27yKV/EiAmUYsVESreJSZTixGRKg8RU8WXy9CuiQCRQ zM0UQ/Gf6pLEYkp3iOWUksUKSneKY5RSqO1vimFKrBIr7sL/4lre29acSHWUGTAnmJPNAnOm Z4NZbM41yzyFZoW52FxmrjRXe0rNKnOjudXcbu4wh5q15l7zgHnI057jNetBWeZRs8nTbJ40 TxOeM5tI66J5ydPq2WJ2UE7p2EbPNbPTc4XqCZDuTLZq7vC09yafYdZbydPsafZF++JhJZya rORL9AlztS/FHOp7BrZW+0b6PGYn+RMgq0wzzTI7rUbawYm8Wky0lfw5RF4UeKqpRKcZ50uj 1h41y3xjfeOp/fVM1KIA+RPyTTQLiC/wTfVNJ6v1sBCmleQN02rybaOnFUTWfbN9c6iXOqjO JhDXxhQY0+Cbx3bDtcBimNgHIt98us6lUkxlVItNvgW+JTQeJ82KsdI87UvxLTdX+lb51vjW o374kL0TrXPWTeTb7Ntm1o5t5NZSjzIXJm4/l2TNgH8UfLuBBpL7R/nW+GUf/x2EPPLZP873 jN/nz+/x0EEDyVnmn4TxaupPLPdPwyhbxH5w39j++3Z6tuR4fbt9+wiZDlI/1dPIHc6ZTJ8a fMdoPE+Yxb5TvjNmHEVGBeK0yXeBxvASxVCb77Knxrzou4o+nOm7Tm2gnvS7/LH+BH8S1Uhj 6E/1pwc3B7f5M4LPBHcGdwf3BQ8GDwcbgseCJ4Kzg6cQifZIcg3BM8ELTP7UYJt50irBecHL wauInXCPhnuvzBfd0ypnXNm9ELwekiFXKJajI5SQM8FzZWx7KAmxuiaUihLUNzmjcyaYB3K8 ni2BrYHtOd7AjsAOTw3SlUAttSE1sDdwwFPjTzebxjTQXCvl+eZpDhwK1AeOBpoCJ82mwGla DYZSX630rfdUe6op51xgMs3mtYGLZOVSoCNQ66kJdGZfDwryrSBoBKOD8USJwRRPO1k6RFa3 BNOCI83VQU9wrLk9OD4YCk7MGRGcipzp1F9zgvOC881AcEFwSXB5cBWtPRxtE3K8/kJ/kb/E X0rzweAZSJ/L/Yv8S/0r6FrpX9sTaQ3+Df4t/mqKuA2eDbQGFYdnj78mPIv8u/x7/Pv9ddS3 8TwmZoX/iL/Rf9zfTNHJ1OI/62/1t9M6d66HMLf9V/zX/F0BLRDZP1JpNbzIxGMTiAsMBSUH hnPsBEYEshBDYZ6iKDA64A0EAhMCkwMFvtmBmYHiwFzyfW1PhJPFQFmggmdlYHGgzNxLayXT ASvuAssCKwOrA1WBjWYHzdtOWi0nlWzm1TaUHsogGhVcE1wfiKNIDpiTQ+No1d4emDymIXgq x0spK+SjOi56Wn3xvBp7roTyQ5NC00KFNOobzIsUKe2holBJiPo7VO4bH1rkO2Ve9G8ILQ10 kGRFqDK0NrQhcDq0JVQdqvFU0jo2PvuZ0K7QntB+ipIdWHPreXUK1YWOIF4PYKW3VspSkrSb HaHG0HHcCx/+L7SDKhUVeGbO/8leZPuEQpSQ7aUUoDQhe8KIxhGN2ZMpFVCaSak4u3jE2RFn s+dSYllZ9sbsiuyt95bdW5a9mNIySispraZUlV11r/deL9UjXQ+65uB/LX5BfJH69UviftpX TKHdgSEeoN6Lon7+Gv+vh+iL0VfgEb7rGn9EKP4iujbStUQdNb7OXzj+CFGdTcw3Eh23qZmo xeY576ytd9yhx59b+9lp72ezxda54rhec8i77M82b2o2H84Pl2l26LXY9ltsuuKo09mu4/30 +tOVAairH7XepGzrANQ+QJ1hn447+sYpP+K4HrHb6aTjDnK2scvWD/vYbH++0q+OFnu8Wm0b LbZuuEydo0x4jPqXp6sZ6fDzSr+r7YsZZ1+H+ntjo65f3QPVF/b9ml0+eYDy/eo1hxONIMrq 56/T9kC+XnH4MtC11XFtttt2s2uL7XNYP+xnV6/f5uh+7e/fD/3b37/d/a/O+dVi1xWW9b/W 9dZp0p3VrCLaOPD4/kOvN+v3T3vt38+fNF63uHK7b3nt18fhfrrV9Zb90N//sP1A79ibE4gm 2/xkhx+OWDYLHDozrX4yi/191mHaBxWaZf7eNSO8nlYQLXa0kdu8jGgl0WpbFl4fqKy5lWi7 v2cu9szJHUS1RHv7jrF5wCLaXRX6dlr6vt1E+4gOWrHoO2zHJNVDe6FC3zGiE3b7wrH6SXPR IUdd4+16HHWE832niM70G9NPis1bxVr/NWWgdemaFUe+C71++9qILhNd9d+4Lvdfhxz3C/OQ RT33vfAaYX8264mO2tREdNKu/7RN52w7Fx3lwrFwiajD3+f+ZnZa99wwhfV9wu5Pgyja0f5+ 5Iu3qMdv6kdfoj0+KURpdgzZ927fyF7b4Xb7PLatsdbYYnyddYSsvvJNtNrLbfRNddic3re/ fLOJ5hDNI5pPtIBoCdFyolVEa4jWE23uNyatA1xvNu43u37aNa7R33vvGOjec7PrQPE6kJ7j vjzg9aw93v2vt2rfrdbc8FrS6L+x/wa6htt0q6tjLRrw+mnHp/96cLN75qe9p7U66g/v+ah/ Z6/137C3RaxeJ9pmEfYww/vV69wHkn2/9PfO4Wt952h4/vXsja/4e/YkfJ/wu6z5zvOe9f2x 1vxz2vMn9PrX3zbb9Sc52mXbd65P4bWoZ+/MPqfabaV57E/39+xx/RmOfrP99I8aIE4oz5/v 7xuzjY4+4nLjiHz+Qv7dE/4Xvvivc9ZU1vP/ShfRSqwICJHpIoolSiBKIkoV4q4SuqYTZVg0 bDFdRxGNI/JZnyHLp+tqW39SL92+kq7TLGI+nM+6mYX2tciWM5USlRMtIlpqf15h85VEa4k2 EG2xdcI+FdrEdVXbdmuIdvXzvfAmtEcEMvZlHMw4nNGQcSzjRMapjDMZFyi1ZVzOuJpxndLl O0pJhpQpM12ZsZkJmUn06XJmamb6HdMyMzJHZY7L9GXmZ06i67TMwsyizJLM0szyzPyUtZmL ErsSuzKXZrRlrshou6M0szKzkqTOtJR/63njL33x/gcNb34Ygjc8DMUbHm7Hux2S8VaHO/Eb 31T8xjcTb3LIwTscRuPtDWPw9oaxeG/DOLy3IQ9vbPD/0+tTlHjF+tXsQXGfEBlpQnxmm0UZ I4k8RGN7ZU5yyjPG29fQTfQTLXnGxH7lpvZ+Rn7I5qdbNkFjb6yP6L77au/b2y8dcPCHHHz9 TeQDJH4nIX7JLfB+D+vNHjp+yR2JX3LH4M0eiXibRzLe43En3uCRijd1DMc7OtLxXo4ReBfH vXgLx8j/b3YVsVvs6/0OKLlKTBnSHE53e3p5+jTS+WngZJW4eyTr3j3WohvzP8meQ+Naf01+ cig38/sp5Xb5S1rWX5GviRT5umwVdxuPG4+Lf+HVU+RH/SLqsPgC3iuSSBRvv5/jrp7yGpWn tUTukAeFLuvIVhLKJJPGUKDdHwlHhZJQj3I/wtsu+O2k44TPobFTxCccHiJT9yVdTr2QsDth H6VTlHYmHEw4nNCQcAzpBGzwt8mR8jn5HNX9U/lTkvxM/kxIuVfuFap8Ub5Inr1E3ujUpkbh QmsiybNfiqiol8m/OJpxq5VGPLsrEIOodppldyXcgpJumqckJIopCZMotSa0DimmNHfIXPBl Q8oGXxh8gfmE0oRS/sx5yJeU8q2U2pLa0qMnPyG1U1pKKb83cdk+NsN6zjSJZGFqJc1iqwzr prantg++kHqF/JPsH8qPS71m+ycpryXslaMGifLwZ0gFyrWGvSA5+3WWUmsq2p3golRqp3Ab riRcwTjyW5kE3m2kuGe7vyak+0H3HGG457rnCpd7nvsbwu1+xP2IiHJ/0/1NEe1e4F4oYtyL 3Y+L2z51DCtKrXIN472Y9i0i3vvpKaWM7pCziebcSJzHNHg+fZ5uXemzMmwVrlPixw66FH9i 8LTBk1Ia4qcPnjbo0qBL9KlwUFPKmfgT8Z746ZRbOLgw5frgafFpKRfir1PyxEfHewZdGiZT GgY1DWoiPUpcjkuTvVP2lWTxE4nriD8VP29wEV09YRo8LaVhWAKVaCK710nvuqXnJPgWpht8 TDkFH6cTT/4NnkQ68I+u5BvlNTh96vWHJLY/3E62G59mEfsVPy/lWMqJ+FPDXGS5gyTTKVEt VOLUsNj4efFnhqXyKMl1ktZo+QP5A+GWT8mnRKR7lnsWRUCxu5gi4CH3QxQBZe5yEet+zP2Y GIx3UyVEfRD1gfhM1IdRH4pEvH3q9r9pjZtJNI2oHKvccPyNyWz8lmG8vfINh95S/OJAERMc eqPEPP4fsz16Cq1GP6SIlrQeoX7UloLa+A3ALkS6QKRriHQDkR6BSHcj0iMR6VEU6YtFDCxx GwTaoKMNn0Xd/DYi9tyq+274uAReK6KiRyZFke25U8/yWhETbdnf49mt2jqw34rYbPd3LepO g2yl7fdhh+y43d9OvYO23xW2jP+/938mZjhaEm/aAgOWBCwpsCRhSYUlF2zwO7b1G31ALVGw H/sJY7hZHHCMoSU7KGocsWfJyu3ecMo22L0Rlv2j+uLTtOY/01sD9QX/j+Bj2BUk8f/9io0W InoDaEqMK/pC9O5YDfRM9G6+xmoxlbGR0btjXMRZ+XGxcTF7YipJtidmD33SkIYCk2OTSdoF cnHqazFsz8qBJYed6Av06QJrc22EVs17Yvgvg1T3191fpzZXuCki3d9yfwvvFfuU9yaxFyNo f7MZVQ2aEjMqZlyMLyafcFLMtJhCSkVEJSQbFVMaU07SUspdFLM0ZgVRZcxako+K2YA0Cfo+ 6DpTX4the6X0eRQssZ1C4gtJMo7ylpKttTFbSLIlphpYE8O/Y5PuEveiv7eFkXWgKVHXo2XU HKLrUYejXdGSkis6lhNJGqKi6ezUENXAcvuaEJ1EZVI5UYlYOyVZicpch8V5KGFZDNtrYFuW JcJYaI8HJ8mapPLpIAuT0MKH3aV/w/1D0v7/JFYpax6m83+uU0Yp48QR+rylj3SEkoXVbGUf aYqShjVxfh9pgpIkVtDnwj7SSCUOf2cZ6CMViiGm0+eRDqkUV7HPTuiR9Y7erWd4vHxGPksa P5E7aJV/Xj5PO+taWUsl98g91DcH5AERQX3zinDJeuoht3xDNtH6c0K+KWLkW/ItcZs8JU+J ONkiW8QgeVaeJZvn5Xlacw5GHaQ155e0Kx9Cu/KXKTZ4b/894DrgUzfw33PwGxz8Rge/yeap 7cp0ZTbt/TLstt8D2WSlgN/T0EeWr0wimdZHNl4J0afLfWSjFf6FwOk+sgxlFH1q7CNLU/hM uK+PLFnhfcH2PjIeXYXu305ZtBKPO7hTpimR9GmuUyauK9Jxz7BkHaLTcc+wZO3iiuOeYcku iDZHTNyDOOfxF1i7FazdEmu3Smv3fNoJlNMKHtF/JNxlN4zEBof8++BLHHyxY7S+5+DX3cBv cuhscpTd5LC5yVGXxT/aJwIsnts7HL8Q5TOp1eIRvdrUOus8y7iXMJL/wzS/OdOW9lm7DNrl R4wSU4wSY5pRSlROmErXRcZS4lcY6UYl8WuNDRFZxhaSVxs1JCmhvF3GHmM/Uil9KifNdJJZ qQTJabHX3iJjA1lgS712WG8FSfZTbh0RpyOUthh1onc/9mlX53PKULSQfxsr9BARnXd0Ot/o 82ye1iR9gX1dYvPLbVqF6xR9mu7TC4mKCGPpWqKXEl+uJ+iLiF+qr6BrJcnX6huIm0Z5W/Rq vQapkD4VkWYCyaw0DclpsddeCWyxpV47rFdOkhrK3UXEaQ+lSn3X37nf/rQny1hlOnpvAZ03 hE47FvVsL/FnPaUvheW3XSPqsiiO1p64SEsWF0c0lIiiVU/rJdvmFLVVbdUWEzaru7Q4wmuE 7ZR2aZGUs0xbqUVSWk2pSm3WAtpGLUsbrXk5qbssTdLNshJb62+x1x5skaVeO1S2VW0nmZfq DWhb1Wt0nUBpuxb4h+09/66+l1upfzy9xJ/lub4EOa3f6lgiWidVinZ1ok3MTyWiOa5S1MtL vcSfKX+KLKPUSTRTZsmNhMsIKyhlySpZRjdhg65VajSleMqtVxPlXrpLHkLKsjWz+EkVUpmd nBZ77LEttuSwk8X/+5Ukh6jeejWFcJk8Ko+qabL+n933ePtqp2M3wc8IXV0VXdFdPlAFke9v uLPweU7BaPKa3Ng9rmeNFto2xm5a6ZUD3cQrrYwyXVvO39VAcoT1lfW0OhHfxTueVkiOdDUT pkAno6sCvMGa4DsYRauxHthBkmIjlusyOK4E7AhjAfSbcecQHHV8biXrAjiXJMO7+MS6GbnY bVh7CWUZo3ThrmPtBrYCTyB3MHjc1ZUO8NYuohWlPJCvBx6DZCZysSNRjkCC+5m1l1GwF5T5 4M+CXwFcA0wHYm8pLwDr7BpHYFcyAj6PgP0U1DsCnoxAixhroI/9C806xgOM6ipYuwZ+IvAi NLGroX6x/LxN8BMTllRA5yhwHuycBI/3P6ujGbU9wCzgZFiz9i/YFXWfAo9dWPdq2LyOsqnd zdw6RqUD/EzwNcAMRlWCX4DcamAdMBm5teBXAHcCN0I+FVgBvAhcBURdWhyj6IxIBvJzpE5E VKMlcaVCXgdcgYjqYISm0C+Dt+TrIRkBSTKQS7Ui9hDzFJMV3C7E+Xod/RDBM3Ef8DRs7gOe NjKYZ5TpOmKAS8l0o5gR+q2w0MpyQv7/La2WHPHfapzkntQRnywhzGCM8ADzOQ6BHdwKZT2X VYp1nhHF0Cm2dIwDjLBzBJpHbE0BXIIes2afhevRV1x2GawlQnMZchONZYycK/M5l/w8ADyL VjQCIbdq19fy6Bs1bFnjVaWTUVnGSH1i2Z8LzUZGDesJNPdRLCvyG4jS59H/p4H7bD4LfBbG yFpzDOAeSLC2dBVRWdE1kWvpegYrlbVexWF1qgCyTjHkxd1piFVeoxKBKSiVgtUsxVrBur7O cxySs5YFaLZayJ4odswgBlrR58UYhWL0/DLwidzPFA8dQIw4eiYR+ono1U703hH0Z6c1dhyf 5AO3t5t2V7Qesg7lWjzvmV/FmH4I+WXIB4NvBZ7AGvseMEV7mHA8ensEMAEobEwCPgw0MDv2 Ae8H4hms/j3gXOikYQWbBnyQPRF0Ous+J6CP7+gEn7LVCh5rmtHbGK1e4lmjVjAqxV2Y79y3 rlTuf2M9oz6Be1jbhlLRjNo47hM12rqDcOToay051r2dzOuN3Leui5xrYM5q59DbjewJrTbH Cc93/5nwBaxjycwrWBtlh53LmAeddYhG2FcaIBGIH9wLSOc4Vj+2UAGcAc0a8FX2ylyO9Z/u uHIZ94z6Lq/w8ljXKvCsPwMtjWNex0qrPi5+Qrjfum/ijnCEUd2PenGm0qKgWcr9rL6L+O/G iHcjHi5j3evm9bCrmfu/6wpmq6CVXun+M4+vfMH4iPD9iBxutcFnsBf0c9wnFkbEMxqprMO5 6p9YLvezRPsO5OchERqPY4NGJ0U5VRvJqJdBTnNHHcYS5SD4WEY50tLXA6xD5x7qebYmUuj8 Q/p6Kdk/rO2n3nhIX0P8b5jX9uiTCVcz6ptZU3+Wefk/GNXlOu1e9FcgMRkjoqD5ZciF9isq +yhsvqLlEv8L5tV39f9FkjholsPm46wfcRylvowam2H/frWS0FT/J+Fw9TGUJT9VXf0OYUAP EpapjHtU8lmpVp8lvKbSGV39g3qI+L2o5aqaSZJfAVPVb7Ed1QcJz4KH1JXk/w/VX5N+nfYH krym1hK+qL5IZbeqtNapP1CrCd9Wf0b4FZXP+kJWA/lELZTdZKFE4T3bC3IH6XyV9paKqjAv H4NkomzgkWVeqYJ8iyT7yne4FmU9dKohf4PlpEkW5HdViz/EcuZlHuTn5X4gSbQURuK57HmF Z9y/gxdKGusrT/O4K78Hf4H4S5KfDy2UHCFXJd9nc9W/EN6lbCd8RPk3ws/Bq3R4NUN5D2Xf g833wdO9Ro5W2ninxHKliuVKUGokj4TmR8AE5U1G2p2xD2/Cwk/RogsotQ/yWsh3Ej8a1sbI dwjfov2jIm5Hvw3h2ND2YP2Zq/sJR2mSVypEyzqM8hKWq7XMGxGIyR8gJh9G7ibg8yj1JGLy CMckRRTL06B5HPzTiL15KvWPpsufE5+jPsARxWuyWsSeq8W6TnhOpf25+mP1a7xWqDz6gmNP 01VasRXMC/0Uou5lYJX8gPBNxN67iLF1LJe/UH9MuBbRflitIgu3szX9aUaKQ8bzwG9Cvgk+ bGFryiusT+cj9nObyrPjiPpLshCj3sOjwKjmqZ8h/gPw/wq8rvIq96z6HOHPYfMJdQtqJ9QO qTRDZab6Mq1a27ALjePVrzsJOI73z7QnIOyqhSQLaNi7681Y8Y4D38X96FXcvxbifl2MXRbj emsvxDtDuh9hh4D77zLkJgKLeZeoLIvwYkeUDIkXu6bL2Bs0Y6fnxd1tBfhk7L6gibvebfrP sPP8AnabYxi7TXjO+2rs57vb7VMP4wJIsD+nOw3fTfAEsgv7eapvBHbj3FI8haQzG98d8NsR PkfzigrNWsF7rWLohGA5B/xB3HFwzlJxUtBgQcWdi857OBHwvUzHaUKOgT7OBRrGwsAJSztl nSBYU93fzZE2CnaKgD7gn2AHpzbtKiRLwb8Iy69Y+nwXU3GKUbaCb0aN1insad7XqYcZpde6 z7JOhHXaug/3yt1WWVgrgP1ztiaVihgGSZt1XoP+SUY9pWsp6T/HqG1jlH8EXkMkvMRI85k9 Wck7HDmVc5VjwLFsQUvi1mn11jmL9dU/weYZ6NTwfkbFOKofAj8PxA5E+yz4aJw1hsDb3bBw Hb7NRj+vZ4yYz63Q5zJqp7rzsUMgTbmY7WuTmddCGIVaoHVSG42ePArNsZA08/fpMh1e7WeU a8B/C7gUOBHyC+ALENsfM2qYa6oPezYJycvYWZ23zkpAF/rEoDhlnaOIIt5RfAxr2OPJBpbL icjNR2xctM6VsByEZi2eJ9RAMhTjNR32G5BbD3kSMBXyB9Fj06xZgD3kru6rVOoA/G9Bvcko 6wOfALyKWv7D1qmAfgVGmfvzNrTiYeA86Fejt7cBW1DXINgMwkIR8EPLGsb3OHoe3z8pldj1 3W7NUNRSh9G5CM/xLELHKUbfjj48Z/vDnqgoVQLJd9iOMhyWm2CnCb2HJxI6ZjftCbj2Hci1 ZqKE/svItWb6WWv/ac01RN27jAaeqxixLDd+Bjv4Toyigv08bY0v5HfA2p+sJwnwfBdqaYB8 Cux3dP0foUQ+yLxrjxXJQDwVMTrs2gldWJ0iFsPnxdaqgplYByzhyDdO2qvB0xj3Isxi9DDO bkcxLh/jDPh7OxLYfhVyF1iIfXg0+qoT7RqJGj0yBb3ErcZMpBWAWxpn5YIfh1w83ZIbYbkW mIyeGQ9shOYe4AaM14uQrwQPucSKbdRgZOvRio/gCVZd2qtvJ4zWD/HqzdidxEh3MQX3r+2M /F707qt8Cus+CP7PdCbg8x3ObhQRrB8H3EMYyXLlPqWL0M0oXgT/WeAU4FTgR8htBL4NySjw t7E1qsWyOQc+XOR7UMSj7G3EfYTP0Ngq3V9kJD/PAHNw16sCvx/4LPAi8DXgKeBvofkm8G7g QuA3kPsT8GvB425u/JJbpPE+1s0oXuSeUT4LyRTgVJyIpwA/gk4j8G08hRgFXuAcLfSPYPN/ g0dvG0OFch3P4rpxUuv5Fi8FyKfdPyP3HPYh9XbuBC7Vhd/52IjnmRx7hPtxSuJz03zsIV+P oJHSCxm184xGHqN6JySCMWId+IWMLkhUSOQuIPQN8PoZ5B4GjkSp+5C7Cfyj0HkLknsgKYfk j5BEgp8EfjVyLR3LfhB1LYLlS/CqEv7AKwN16VXgi1HqN5B8HnwS5KWQ5IJ/APLngE9BrsEy PNQOgd8J/hHgS8A0+PBt4BRI3gF6YHMw7LyNsmOgA2vyDSB80y4D84F3QPMF4F8hKQBuA8bC pjUinWjvY7Cfjdz7wT+P3F9D8hdgPfB22IQn+gxI3JAkgH+NMQrj654OxOi7EQku1BKB3IhX YQF9K7vA/w5o9YkKOTzUQvAE+tqDQGiq8FC2gj+IsnXQRJ+r70MTllVERfc5jszueutbAJQt 4ZlOsVoGjOOVmXY6FLf8lE8vZNTOMxp5jOqdkAjGiHXgFzK6IFEhkbuA0DfA0yyYj8ifj7kw H/E/HzHPkjMoexg4EjbvQ9lN4B+FhbcguQeSckj+CEkk+EngVyPX0rFqD8KTRbB8CT5Xwlv4 bKAuvQp8MUr9BpLPg0+CvBSSXPAPQP4c8CnINViGh9oh8DvBPwJ8CZgGH74NnALJO0APbA6G nbdRdgx0YE2+AYRv2mVgPvAOaL4A/CskBcBtwFjYtMarE+19DPazkXs/+OeR+2tI/gKsB94O m/BEn2GNKcYISCvSfMz9+VjH5mN1mo/VaT5WMJa7YSEB1l5jjMIou6cz70YsuRFXLngVYcXS c6wTBT7iVdSOcZFd4H8HtPpThRyt00JoBfS1B4HQVNE62Qr+IMrWQRPjpb4PTVhWEVHKl7FP eB17m0Lcr89jj5SH/dKdkOCpYMQ68AsZXZCokEhrRwR9A7x+BrmHgSNR6j7kbgL/KHTeguQe SMoh+SMkkeAngV+NXEvHsh9EXYtg+RK8qoQ/8MpAXXoVeJxztd9A8nnwSZCXQpIL/gHInwM+ BbkGy/BQOwR+J/hHgDgraWnw4dvAKZC8A/TA5mDYeRtlx0AH1uQbQPimXQbmA++A5gvAv0JS ANwGjIVNa0Q60d7HYD8bufeDfx65v4bkL8DbYQ0+6DMgcUOSAP41xiiMrHs6EOPuRgy4YD8C uRGvwgJ6VXaB/x3Q6g0V8vPWuQw+QF97EAhNFb5J7PnVgyhbB030tvo+NGFZRTzQzpD2Kl1D +ck87Qz3YWe4Dzuxj7AbTMJu8CLvTFgixvPOkHKvYE9Yh53ban7OAEkkI+0J27AnbMOesA17 wjbsCduwJ2zDnrANe8I27AnbsCdk/jZr52nVok3mPTN/tyWrGdWh4JuAe4FrGJVK5PogaQFf BRwJiRe4E5JoRi0LkgaU7eJvouVM2rkrSht4F/NUijEeknzkZgCLGdWJlhw4FegFeqzvtRnV 0eDPQn6Bv1OT14B7Ix7CbsrD/jBqhfDnAstJ5yHosOYa5pVK4Hroj0RZH1ACo5HbpZ8APsGt AN8BPoN3ucpwYAadZbktT3C7WIfwCbSU+XQbn8CddAifhuB5MiSCJfIxnc6/2mT0pMS3hBna V9iC5SEsVIM/xrxaAP738Ge98Q68Yp0mtLEFuRkRU3lkIclH7iXwyeAboHMSFmog2WnXRTtw +QE0G+DJWTvX4slnPY+9Vf+Fd90anrLKa+yDOhr9NhSabWhdnS3nHi7AWMQbvDPJh2/JbEfm 6T/GWHApjWeNUokWadyrSiJiKRERMgmRk8c9Q7sL0pEvoOwMvQC9/QSfdq2xQ7v2Qv8YsAP9 bHmuo96fAM9jRB436JQq79K6WAKdWuQO1v4NtTCfDM2XWFM1oZPKqFSBTzbcxFstSofmq1br 2IJmjfsQWHsd8h+h7CTji/Cfn6nOgM5I5P4C/FK2Keehh7+E3vs2eqMBdgRwMjAPOgrzyovA ncBm4AzE0mjofA36mZDEIzdZf4XwTpYoicB0tOgePNO2ykKuPqTxt+TtsJAPeT5asRV2ltn+ sIWF7L/yFHAYcDVwhr6FdJbYNln/PHA4SjWgDxtg82PI74XmSYzLVOg8jnGMgPwFfPtzD8eA ngscw6hu53hQFf0w4VXmtVfAfxu5hYwyGrW0o7d3cV3qa9bc4cjRshBFo8HHWesJ4vl30FmB sfgdVpIYyFeA9yDS/jv4OmsNhGQ+JF7+llktQNwuZl7O5FkgL2HWp1qrK+r9PuZ4Feqdh9k3 FViCuqptazxfxsLOXSxXpRX/qLdDfxrz3QMf+NucUtQuYScZ9bqs1QMt0tAba9CrJdwbLngS Uc06BnxwSdYxXkJk/pTRtZAlEZ9nXv8DcARadx7+pMJyCeqayjtD1xqjkp8a8XflZJO/J01C T25CnNdh/TkCr56Hn4thIReR8yTi4X1o7gMqkD/Gc0fFyqBOwt1hqHEP1p8l6Bl+ntCO9VZo szAXtmJem9jV8+/l0pmn9ZZQZgOXQNKAu8xvUctbkBQjApOB77I1eQC93aZ/l+qdjG9m81Cq iyW0ln4XTzO49idRexvb6T4oWzDK5KG2iFFfCf448CAku4CX0Yo6RvUicpczRpQg9xAwAfLJ wG3AOMgnANdCfyf4cuSeg7WJvANRv64n8F2PeS0N8lTIz1g1gl/FOhI1qtfB+2HtNHJfAhYA DwOvAKsYZQvwS1xKM1BLFqOhQec6JOPA14LfYAznHmDUDwG/z2hEMUbsgP8m87QOM86DziPA 9yD5EZ95yQfGbzHKJu3feeVk1OIgf46R/GH8KnAhVpLX4cM6SAS+PTyv8VPKhRqtkBE/sH4p xDso7WHUlY3zdS58VsB3gzdRywIjhyS/heb3kXs3/LyNUW4EX4hePQzLz6J1f4b+eehPAP+v /IzL2IQdwqO8VutvsZ96HnKfhrcz9NtJ5wuQvM36+gVe5chz9v8bqPHn/P0aSSh6ddw3ad37 mNr1MXpYg8+f43VS4980K8YqtKURdW3U+V6fwtb0c7rC5xp8ixoJ/BDyBaxjXOP7o9apP8AS jXa2xucY9actf7ACn1DL+Z5o9TBLIuK4lJGMNbydrclh0LyT0RjEO2fNuqegXWo+RuQ70H/f sqy+ilZHkvxX3ArqpUTsVSbD81f4CTb6fCxGuRV2UvWJGAXmZ3EpoxQ27wa/k+vVX7d+mYDR wXhpGzBq47gV6gtoSz7XpeWzD+rDkKSg3oU6STQdmgXAocCXgQ8wyl2IqEegOY8taHhirKXB 5hPMKx/o/G3sFOZphfmIT2qYR1ZZD6P+W41WRX0V26Se52861rFcXYfWjbN4tqmuAY5BXfkq 3x+fguVH2Qe5CziRR1NWWRLtKW4RavkC7LwDC4Xo4Tvhp0CE5Ns10iioi4Dj4Mlfof8x16U/ zHdzbRtqnIFSC9GKWHiSpL/BpbiscR5t7ARiburZGLv7Mb7TNYoxYzGPrPYXyOuB5ej5LHyT Pg2+jcMcWWStG1jxziDm70WEf4Xni/YmVpgSRMhp6P8YuUPAx2EGtYB/2DjGc1/nsavG3FSg +d8wZ19FLdeh+RWsP43QmQX+vPFDyt2HXcfLPBO113gUIvdxKfd01nFlMroRaREvIt72M7pf Z3TlM/6/9r4Dqopka3efrlN9DtAEARWVLCqZA4KAGAiiiBIUzBEJiiIgIGYJImB2UDGMAXWM GFAQzDmLccSMOWLOWV/1Pu0ZZ+7c//7/eu/du95ab1yza3f17qrqr+v7uqq7T8Hfwr3F2NoU MV67DGMiRQRYCcwqUO2pPe2HmDCciS72jcliDrtrMEs2IAfxPs7mLO9Qx8T7bLg4aqJPRKwY H+vj3Urk11jRki20Dd5fDuA4WSzHA5EHou4tYeKzDnHGytfG+0WI6HN4n5Ubi778BeacxhKK 0cdxpuwujjOTkEfTxC/c+FDxTYTcVq7HcmaIOVw/rPE51jgI24Z35++38XutD/j112J8r1rn +wNR/zFnM9rJUr743Vcu2o+Y0wr3XkF/Olp7PPYZ5g9AfzXmC5iD35jJvmF+d9HKatBvg/4g jDHEN+D4zlTmKFo4hzndsZwgjAlVvyXHt2C+GPkbljATS2uONhTj3TG+Mcbsx7fYXTFnNubU qL9Aw2OtpUjxWG/REkv0TbEuQH8YxnjjG+qOGOOO+XextEqssbPUkpfYwmREScz5hu/FNmON NVjmamz/TCxtNpZzAr8ByMBjd6pLwxg5lm+ixl/6/hNRwjLbqHFAv1j9nR62zR5L5jHHCG1T PArPl1CsZQXWewdzRqBvhdYII00xfwfallgLXmUZflVIDkhHiT5GyhEZUhuPPYLlD/vOZmrc IvTTsYQuuLcY7TYsYTTujcOcwxhzGNuACHMyRG8L2tVoz2N+H7ROeJQh5pth29TXGq8aaYJW jUYQRiKGJBqPfaI+d6zxCFpHtEMwUomtwu9D4D3mG6CdgnVR9blgzEgsxwQtYI61ur9hOboi AjJ8Y8vZ4d4LGKnA3ngO7W388sFDjCRF2EIZtvwdoroP/TF4Furei2ySPUF/Le59iOUYYM4N 3HsTa1yMNhNb+w39Z2gbo72L+RfUMXhsdyn+PIhvhEU7Ud0bpf4m5pxBX4V2M9oErPENtqQO Wnu1YuAXBW3Qdsdjd+LXCI7S1wjIYiz/A/ofcO9YqZ1qX7QLJL6cxzYnY/tFZnF41rz67NQK hjFKRFiOV2oy+ni9lNh7FahyfBz6KnEvjywjyCO2V8xBzaHjkUGxeC6Wkqa9FGdkeGw65uO3 MZwNtmEB4hCMNhLzPTE/A9v/HG0ZtqcY39Tjlx6yYXhlg9VWjcP3lai3C1ErlqGK4neG2J4d WLKLWjMl7ot2i5o7aHuhrUJbjfFbsbUdpZ6wDJVHtO9xb4akxqLfX36X1ZIuF2eg/dU9EN8a 7MOntfvUb10BpLfB2rBYthZoVErUALCMHpWSAJEDU2KHQN9BsQNSYHBCVFoijBR/A9mlcxtL 8Yut79/Fv1QJWqADtcAIdMUtlqcUn9eCAPpgCMagx7bF372Ie0DjycSVgiSfAx6IWG7HyCBL cUUh3C+X9lEwgNrR0UOTIRNtLtqpaAvRLka7OiYhfiBsjotPjIKtaHfHJ8anwUG0x+NTkxLg DNoLLDAKrqG9nZAUnQAP0T4bGhsTD2/Qfkphu2WAFr8fgT8sft8i/u4Tz4H+KecPTwa6aLV+ sjo/WeVPVu8nq0CrLkf7JytIthbYgCO4QwtoAx0hEnpDDCRAGozFNT9mw0L4DXjx81rIB/Xv jQzVKf49EpYqxZXJ2QxGaQPi9xcyrePqbW2VaFlahO2VaW+X0qPq1MBYnRrNZPEsrWujPs4k WL1tIv6qmpVvslnKPyydhSH73xrr1scVEDpCCAD+zVfu37+qGh0s9iiZNedO2sq7gyk0B38I hs7QEwbAYEiB0ZDNkJsJ86AIVkMJlMNuOAyn4AJch7vwBN7AFzZIFBTlQBTrFOsVFZhuUGzF dKNiG6Yliu0sXc+8HZiuV+zEdINiF6YbFbsxLVHsAY6le9nWBha9D9P1iv2YblAcwHSj4iCm JYpDLHqDgiHL8tYpjmC6XnEU0w2KY5huVBzHtERxgkVvVFSyrRIWfRLT9YpTmG5QnMZ0I1MB MS1RnGXRJX9BRFxffyRk/rcQOYdnvk7xu4TMeQmZKgmZCxIyF1k96xSXJHwuS7hckXC5KuFy TUKkWkLkuoTIDQmRmxIitxCR2xIidyRE7kqI3JMQuS8h8gAReSgh8khCpEZC5LGEyBMJkaf/ ApFCWAwrYcM/ReSZhMhzCZEXEiIvJUReSYi8RkTeSIi8lXrMOwmZ9xIyHyRkPmKP+STh81nC 54uEy1cJl28SIt/ViDChQUSUMjUiSk6NiJKIiCjlakSUVI2IklcjolSoEVEq1Ygotf4HiByE SjgP13BdgVfwiQ0AtZXaakSUOmpElIIaEaWuGhGlnhoRpb6IiNJAjYiylhoRpaEaEaWRGhGl sRoRZW0REWUdNSLKumpElCbqHqOsp0ZGWV+NjLKB2GOUpmp8lGYSPuYSPhYSLo3EM1VaSrhY SbhYS7g0lHCxUePyP0bkiQaRxhIiTSREbCVE7CRE7CVEHBARRwkRJwkRZwkRFwkRlYSIKyLi JiHSVELEXULEQ0KkmYSIJyLiJSHiLSHSXELER+oxLSRkWmKPaSUh01pCxldCxk+NjLhCrNhu vAMVsDuBAInsFqBkdwNTaAwqhlcbCIXuwjmm9AHKTvIC4XfJmyWcR68zy6uSvFnCBeYFYtxF yZslXEJPjLssebNwlSAbcAYvdj06Qlfoz1Q9DcZDvnBFU9NVTU3XNDVVa2q6rqnphqamm5qa bv2oSahhXjtlAMt7LHmzhCfoBbK8p5L3X7XotqZFdzQtuqtp0T1Ni+5rWvRA06KHmhY90rTo maZFzzUteqFp0UtNixj3Zc4yZzaAqc+Jz6cbcg3xXsxGbrpNcRSQxq5aJtT7xzbDAja+2ABb 4Rzrxx9k4sokdWSWMnuZu6yVLEiWLo7cdPYDhyttyHUOaLyDPzzuJPPmoXdK453WeGc03ln0 xNGhwJ0Tfe4Os4W473dN1HmNV4UeYWehB8bcBTxCbMk0TmzFHIy5+FNMHfH38VwhdwgIiyzk LmlKuqzxrmi8qxrvmsar1njXNd4NjXcTPcquvzHr89Zgy7H7M7eI1cXuz9xilh5hEYu4o8wu 5m5pjrstnbeCm87NZNeoiFvJ4ldz60Cb28BtAH2uhNsEBlwpVwaGXDm3nZVPcDRqDOIYzhfH WgbSWpxL2Y5irpiVWcbiCbeL28XGZ+xqc7NxXQBxpUXx2jOlx7GstrgKHLeAWwBm3EJuIZiz MvaABf7OvzX+zl8sP5FdlZ+ZzNpN2rEy36MXpPHaa7xgjdcBPYqrfJqweYQNHvkKj3qNR7zB 6LcY+U5UEu4V9x7PkN0v+Dw+lxNnBoTgaRNtIj5nFYiA58EiyCPejIi9XMZb8FbicbKesJbU EEtiSxyJM3EjzUg2ySG5JJ9MJtPJTDKbFJIFZDFZRlaStWQd2UBKyGZSTraT3WQ/OUyOk1Pk HLlArpDr5Da5z8p6Qp6RF+QVtaWOtCVtTf1oAA2k7Wh72oGG0Qjajfai/Wg0HUiH0CSaSkfQ MTSDZtEJdCLNo5PoFDqNzqC/0Fl0Dp1L59Nf6SLxHQFdQdfQ9XQT3UIr6Ha6k+6lB+lRWknP 0HP0PL1Ir9Gb9C59SJ/QF/QN/UC/8MDLeSUv8Aa8IW/Mm/D1eXO+Id+Ib8Lb8Q68E+/Cu/JN eQ/em/fhW/N+fADfh4/iY/lUnc06ZTrlAifwgragJxgKdYT6grlgLTQWbAV7wVFQCe6Cl9BC 8BXaCEFCRyFciBS6C72F/kKMMEgYLCQwjNcQJREHFxbEQnxOQ5oARxyIA7sKTsSJXW1X4gqU eBAP4EkWyQIFmUAmgJJMJBNBi+SRPNAmk8gk0CHTyDQQyAwyA3TJLHb99MgcMgf0yXwyHwzI IrIIapGlZCkYkhVkBRiRNWQNGJNiUgy1yXqyHuqQjWQj1CWbyCYwwV8i1iPbyDaoT3aRXdCA 7CP7wJQcIofAjBwjx8CcnCQnwYKcJWfBklSRKrAil8llsCbVpBoaklvkFuub98g9aEQekUfQ mDwmj6EJeUqegi15Tp6DHXlJXoI96wO24MD6gSM40ha0BTjRVrQVOFNf6gsu1J/6g4q2oW3A lbalbcGNBtEgaEqDaTC401AaCh60M+0MzWhX2hU8aU/aE7xoX9oXvMUVa6A5jaNx4EMHs7lL C5pIE6ElTaEp0Iqm03RoTUfT0eBLx9Px4EczaSb402yaDQE0h+ZAG5pLcyGQ5tN8aEsn08nQ jk6lUyGITqfToT2dSWdCMC2gBdCBzqazoSMtpIUQIq62A6F0AV0AYXQhXQjhdDFdDJ1oES2C zuLqPBBBV9PVEEnX0XXQRVxVB7rSMloG3Wg5LYfurO/ugB50D90DvegBegB60yP0CPShJ+gJ 6EtP09PQj56lZ6E//Z3+DlGsZ1+EAfQqvQrR9Aa9ATH0Dr0DsfQBfQBx9DF9DAPpc/ocBtHX 9DXE0/f0PQymn+lnGEK/0++QwBOewFBewSsgkdfhdSCJ1+f1IZmvxdeCYbwRbwQpfF2+LqTy 9fh6kMab8WYwnLfmrSGdt+FtYIS4+hKM5G15WxjF2/P2MJp35B1hDO/MO8NYXsWrYBzvxrvB eN6dd4cM3ov3gky+Od8csvhWfCvI5n15X5jA+/P+kMP35nvDRL4/3x9y+Rg+BvL4FD4F8nU2 6WyCSTqlOqUwWadCpwKmCOwmClMFKlCYJmgJWjBd0BV0YYZQS6gFM4XaQm34Ragn1IMCwUww g1mClWAFs4VGQiOYIzQRmkChYCfYwVzBQXCAeYKL4ALzhaZCU1ggeAqe8KvgI/jAQqG10BoW CQFCACwW2gntYInQQegARUKYEAZLhQghApYJ3YRusFzoJfSC34R+Qj9YIUQL0bBSGCgMhFVC vBAPq4UhwhBYw5h/H5KJNbEnKuJO3pCppIDMIwtJEfmNrCZlZCvZSfaSg+QoqSRnyHlyiVwj N8ld8lBcRYjakTfUjjqQKTSEdqJdaA/ah0bRWBpPh9JhdDgdRcfR5XQVLaYbaSndRh3obrqf HqbH6SlynqUX6BV6nd6m92kNfUZf0Xf0E/3GczzPa/N65CEN4esQa96UT+CbESu+Hx/ND9TZ KsgFpSAIBoKxYCKYCpaCjeAsuAnNhOZCK8FfaCsEC6FCZ6Gr0FPoKwwQ4oREdpZJqGyAyiZD TeNQ0whqmhy1i6Jq8ahXCtQrJeqVFuqVNuqVDuqSgLqki7qkh7qkj7pkgLpUC3XJEHXJCHXJ GHWpNupSHdSluqhLJqhL9VCX6qMuNUBFMkVFMkNFMkdFskC1sUS1sUK1sUa1aYhqY4Nq0wjV pjGqTRNUG1tUGztUG3tUGwdUG0dUGyfUAWfUARfUARXqgCvqgBsqQFNUAHdUgGaoAJ6oAF6o AN6oAM1RAXxQAVqgArREBWiFCtAaFcAXFcAPFcAfFSAAFaANKkAgKkBbVIB2qABBqADtUQGC UQE6oAJ0RAUIQQUIRQUIY6MDCwhHLndC/nZGzkYgZyORs12QoV2Rod2Qod2RoT2QoT2Rob2Q ob2RoX2QoX2Rof2Qj/2Rj1HIxwHIx2jkYwzyMRb5GId8HIh8HIR8jEc+DkY+DkE+JiAfhyIf E5GDSbiOXyqxInbEhTQlr8kU8guZS34lS8hysoqUkgqyg+xh/esQOUFOk9/JRXKV3CB3yAOx xzAOvmYctGcc7EjDaSTtTnvT/jSGDqIJNJmm0ZF0LF1GV9K1dAPdzLR9K7Wnu+g+eogeoyfJ 7yytopdpNb1F79FH9Cl9Sd/Sj/QrL+Mpr8Xrkge0I1+bsa8BP4RvRiOZ15cfwMfRWzpb2GBN IegI+oKRUFdoIFgIDQUnwVXwELyFloKfECi0F0KETkIXoYfQR4gSYoWh7FxT/j8T/8dMFO/I TZGP7shHD+SjJ/LRC/nojXxsjnz0QT62QD62RD62Qj62Rj76Ih/9kI/+yMcA5GMb5GMg8rEt 8rEd8jEI+dge+RiMfOyAfOyIfAxBPoYiH8OQj+HIx07Ix854V41AVkYiK7sgK7siK7vhnbQ7 crMHcrMncrMXcrM3crMPcrMvcrMfcrM/cjMKuTkAuRmN3IxBbsYiN+OQmwORm4OQm/HIzcHI zSHIzQTk5lDkZiJyMwm5mYzcHIbcTGHzZx7/Cmh/WAbroBz2wnE4D9fhIbyCL/gcBOc+YM9m UM2gBXnLenM2ec9sDvnIbD75zOx0Ph842pIfyWxrfjSzfvxYZgP+poR3WMIHLOETlvAFS5iE JYzCEsZgCeOwBDYX48eLEehlaLxMjZel8bI13gSNl6PxJv7wxL99Knmv0WOzd6Y4NwHoV/oN OKYNbFbK9IFNWphGaIOScTsO19U0BPXqcXLuAZv1rROfQnDim4hgfHbUGNzxSYCBTiVjOiuR 1PzwWJ8Rny+cZFuv2VyuGuP0SAbTBbZPnZIanC+KMwzAuYKMHXnjx3wRqnT0dfT+4d2EWLf4 9skaHBm+vtKTiBM4c67UPFG4K66sid49jXf/h8ePEKP/y5m4+t2bDN+6Cfh+iYHFvSAN5APl g+Tx0ts5mToKoO4glhpjLtTtr8qu25vXss8Nyn2vK1NwRdl1Q1hWe04mc9VRafHUQY9w9Smo onhtB14ml2V7cjJ5UYSqk8rxpxzTZeaZptAC/4XBAEhlt5YEiIU09n8r8Z/K6qfC5MYbP38e cXDdWYP0IeFRU1Z58Hr9SEpRtqGrKlvOWkQ6FhFOxnHazsW1roV/773oxN4fR5uxpiS7Oqjs eNJFrmNkHZCUPColfuCgNEvbaDtLV29vT8uQ+OiUpNSkuDTLgKSUZGdXc5WpOrj2n/ckpUSl xSclulqpLMT9xMjkj/2dk5LSLP2Gpw1KSolPG6Uyr6ur8lR5ubH/mrqq3HrW1XV1Y5seLJP9 11M1CrFihfBGXJcIVyNVLXFDaaTdLSp1UHziwDRWjYFKT8xUGCk6x8YMTUqM+dEw7X/WsIYq K3XD6v+8PybWMiJ+YCIr1TI8wE+VLbNW6WouoExGgWTL9IHla3PZMhlUjBp3oU9poPdq93Wu Vz428mg/Yu9ni8VHAoc9P9v24fmpB4Z07DzgzXzuQMil9gkuNq1i95xqWKETVJExvDpw19oZ euGHGjm8Knqg29DirJ/NpwHzT9cLXDEr2GL+yVIX6wPBTmOTLtc295nqbeBdvcvuTZyPk8zt +7cmQSu3JMjyFn7evjk6I/tj76KsnInTS15tnb38tNfK8Il1m+SFVqveQcs3hz+2zNqd+zTB e5Wz+7sy543a4wb8MjJu4bxU3dyNrw6+ttwWZjgt+oTjZbfAes92BBf6hEeYnIrrNGrt+ryj XVstyQ7PT6SbPPaNsdnVOa7l/NBKh/FNE3Pa8WcXnwnO5RJz4be9eTciOHH96uVZn1RZ71VG DE6zRnJBpc0rWdelVEGIKmuZmCuTZy1QZc3NNOh1Jvl5fMrihp3GG28Omf79xNKUf39/y9aH fTClRYv8WmdbvYt+csNXpS+20Ugm+y6nKsISlZmYoSevIzeuNDuVDsm9Nr68cjB0Qac2zsvb RL9Q6Yi79eVyRqPcn6hDxB4xpnjD+ODGr07tDE1b1r1Jmv3w0tyvxR1nj4SQR8cfm1yLP6S3 bOxrLuDw8bzKDxGV+5fs6pr0IrrNmjbwrPDogirTrTpL6unOvnjFfL3duOdPV6aum3Hde3rL eYN3eg09l7+x4dcbjy7Ea/2Sv+vbLdjh/vr92I8Ghs70sV3hLP8htsMqvGbcVOge6zPo5K5M vyFxq3dU7JjufvwVMRg7+u25m/43xny7dWvdt3c3qnRLky8U3Akr91o21ul8y6vuOgM8uSVZ gxtOetc7ekZJzx3eF/tP7ZJTv+lbn3lF2cKyflNKHSuWrjhRfMWyfI+q3kRLY137nZ3f+N3s q7pTYBufty/59utVxacy/VPS9ZjGjGYaM0DSmCjZ6Vaohfo/84gynfkPsloUHG+mMZ5ubu4q N29RcFxVTTWbqqwJ/1faposdh3VdeUhYeOcf4eSfhP9L7dmlmvQ5MGV1xJDFk8Kg4d7d581a burh6/U69ZfsxvcLDSHismm2XotTZjt2vfefNvf8F6/6d7d9vPPk9yiyp+j3C8NDerdd87Tv i3O343vVT60pNZ0mP2nXpiimh4v5vD6JR4pNvLNjD67aWTw8v15N3lzjxqUZjdN/O+/lnXOn tHGVyUeHR+eO1ekZafVq7rS8XLtvb9o73p/yQd563MmThQW5usPI7TPfBH+P7xe3tq6eHqg9 7t3FDut7vUhPMRvRcNwkj4OmfTaHkw7thipWdcmfx2euzFofGXop68KnPf57XXd30Z1fFdHe UPX43or8sX0Pju5pnKcs84wveuxmM1X5+ON54+03v5ys+a22pD0fVFlv/157/mCx10iaerSB 26/9CnK7bJy0/fD8TWnT8fKZ6YusZ0RWZKJumDWUm6jqZP497duIARbylioflXeRZ5FHbtNB aWnJzV1colMSnIf+uIbO0UlDXZKHxIu5LskpSTHDo9NSXQIiWMdzZlmqoB8tlMnkLVTNVV4/ tlVcrqNU4IgRI/6uwNiUn0pK+wuhUH1syYRiI92X32ol+adfCijeetj/k02s+4bhJcNU0wvL J3xKufvtpOeD5snzOlnqbR9WduxN1d3JD22TU6ue3to/5tnLru49M7MfG1xMITWGoU+qdaeO aRMmRA3/mrhQUX3KoaeJrndJ/69XvsvXcssvfZq+fMeufYMjfVz73XVMPPEyxN70lXn6mNyN h/MubLJ/uq5Sb+/dJRkPTz/MSYnMNkm0P7p4Tll9831Js64OWLmvw5D1x562LLiz2aV49Ajv gYNhTPYiYnA9ek77xv7X51jvy9M5Y7y837VUt5Rm5t+P2h2y6RwWF3TMzGzNocbe8eGhq57s 5xOcUxq8tLoy1CYoM6u279gllWlewWFMfRYx9ZmoVh+DwTrzw/ZCo+JaVwMtuo8euOyvGvSf Ges0Y+LTTOWqcnf3FKXHm23+B8Y6kfFDY1PTooYm/3fHOtc8Ez9vPOofPMzk6KmgVhF7PxUb b3d022EY1vnohKetml5u71pgW/5LzE2L8Jzt+zuczaAfng/fPeXI6qoN8clxI5vEPSyveD5x 28lna78a/qbTw9rO5bTv5a7yBulbhsYMDY68Wv3y+p4lE45k3sjoyHnOfrt3sbKr+aB2Jy/v Te/tMq68kbysa6/BptHfM8e2eFYlbxTiPSJN0Wd/70u5no7Dj+nVmHtrjU3/tighcfTNJ61m zF08TK+ffZjJgP5ui89NCHWw7j0ocMp1lxyD8M0ft9SflvCs0a9GH04YXJyo9yY7PbXZ4Tmj l1X255/QktymFR9m98rxy+k+cXZiiYVjUGXSwoCbgx9mNJ4+RK032TJbhojN3ymO8v+N0Y4B ryXNLGrLxCEM/CSUSQ9DW8/d5l7cIXfGzoU163z8Ag6fUdXTHGDMyQVzbYiA4WwWEgB+fx4J /cMw6m8EanZILdf9Y8N31Jq+NEoh05uaHDjteWrkrtZa1On71k4RE02fev9SsbyrzvWp5T4N zn5et+pYxaZOVg2SlPHjh5Bl1m2fJpQNHWu9te3vOa+n6e9WTG627/H4R8l9ApcUnKs8VT19 76099ifHPjm2wa0qb9uJ6IPNzppY7Um/7rOgtEHqYqv8S2VlhpFT3yzcHxu8wLbxwv6T9X2O GMWODNpxev2E5mElA7pfVz165G12Z9KrK95ZH42spsZkRvPywlcLuACXMW3zt3/nLsd+DL5+ haTNKqWJQuWia7ZRY4Ne1l1Yy8qLM81bxx8qdNt6z/dwRMtdayZdfxjnOe2NdeHCypIRkZ2a X0hps7nhOyZQa5lAFfwYHvGznXB4pPWfGx79gxCIGuXFRkMeTJrcXFGjmqo3XcVNVVbpv2N4 1ETVSL1pnhgQnzwoNsWyTUSgZWBEaHNPPy83p2ZeXn5O3m293VwbqRqqz8n0z+fkFCGelGVE bEp6fHTsv5S3OVnalv4mnUZfnvP016/X8s5+1pthVLPW09Yw/VtIeHH6XPtZ7W6u6RrP3Zs9 PmTi1Yxhz4fD1R0BCZ+T1g174XB2bMGp2XUXLT20/eP78dVRt5xU5gsbO6W3vt+2cPqGS5M8 L1U+f32614Evg26+ipnx68MDhh+X7875cmHKKdpylyw9vAn5kFNRJ3da/9197BxbnF7xdV5P D7OwOnu9LplHtW7ZrLSrce0Rc3wMPkHJrNt9PIub7Ih2DDLO6nInoWaNw5xp+Xrjl8OKETaK efbJZKu9zcwF1w8ts+6wp2MPfkRkSkBJq5jqWTnK7uXfHuW112pWWvqh6ZrxHZeNynDrYae3 eMvbmy0Wt37S1ufn4dQfgmA7J38P5/P4yuzt49rqfzrxZvyi72f/NFL6W8X43xkppaUmR0f9 Hxkp/Sgp7e/F+k/jP37v36kVPFv35fa5/Ljjdnd6bjsJ2ePr9j5k08Nwx+r3Qy7mfZt2Yku6 RQPrd+9vHS/b5ier77k+yLMw+VNl01W2U7fqlKcZ2VaUDr9lr3V7StiNea3nVrgbZtUYVJtd 2x5zOjTcp+Pkr/WqG22oKsyr6XDw3ouPfnX7yB53yx+XPvpe0rc8y3WzFk5dsKdf/aLaKpub y8ZH/WJmZ3eg/czmARMmPbteNaE6zNHD54Gfn2wtCDqvLrRvcMp/2piS107T+tjd2j0t45fa 6WX9Pxs3WZtkGO1v2735ZJ8pvncrDlUWdDNt23XIjBMFIV0pHP+g8g0MvVEvf9dbgxfV9W/Y mpd1ejXiZuM7O7SyDK+ZNz8T6IrDKfl8TiZTZeX9B6dsf5pI/vGoqyjrqHh3ki6bFnEVfn6O xur9Y0vHVU/1897aTDU0B8pdWVefF38k//pmO5MWh0YbnZ57L/3twrpWqkE/HSK49lR1L3LO dIRIiIehEAupYAmhLB3B0s6QxPKiIJH57SGNeQksKnpp40ybf9pX00YlJw1MiUoeNMryL9ok z5aBbwf//dmmFskDu5kOb23Tr5dF+bNeMw5XCHavPj90pRObnRynVdu0m2+J32Cy6elOZ8dL Y/PPvN89buOIubU2d3aYY5nSvndh1yAHPi8nf5jsBLEMaG/763OhYf6SqUUP4vs4JW1+bapo nb9icO9vzci8u/RCWUpu9fCZLzdXJ2YHWuhHa0WO/1jozSfWBJdudipfFlDo8Guhd81hx7ud Zhn3X3mi7cJz/p8L4s4M/OQWXFXTP7Gi3ePuN289/Ti3nFvVfv7o1asGHrSrMm7XJ7Rx9gar u1sCjF9GLZ2jezpJZjpj1eTSruEj9e+1f849zb4xRNd30vSXu5v7lLV9o3VwjqnTtN4VUyKf p7ovzeYsVNlcgz+uE++azQksS/lv75B/vUn+6datkDpkUR+Vyc+9UeePR78yVqdmD3XVZ/dU lcrbzd3Vy6OZh3fPf+iMVwPfti1dv6an68v77UYtz1i6fUpEzl8USuwi4yvfznV0b9E1KXrp nsg+1Gfgi2/2ly85fDx6z372r8vnmz6qcpJPWVKQvt8lvf6s3aS8dq/RafHNjlU8NvA0eeUW 8qTdynMdGg95Ri08ot98iZpcVhZwX/a+9fuUd+TmN4tHW4Yvm9LqweWa7RnvX7b7sm/2mvLh j99X3dqdZ57xskffDPteHQu+n5jZvKqeqmXO2fdmD3J9mzo/WFSv0b0Yqj1Q78qZ3+QepfLr a9a0jF85aJRBTIpJAjfMXnn0ifbrLY1yIH496V3NhX35LeNYyM1Jk5aHP97Uo9Bt07OtJ8ca Hys4MPiOfty1tTOrHfVz16Qtszp9Qafgza1rIQNHvtvq8R0senoEyQac/l81EiccDQplbmRz dHJlYW0NCmVuZG9iag0KNDE5IDAgb2JqDQpbIDBbIDc3OF0gIDNbIDI1MF0gIDExWyAzMzMg MzMzXSAgMTZbIDMzM10gIDE5WyA1MDAgNTAwIDUwMF0gIDI0WyA1MDAgNTAwXSAgMzZbIDcy MiA2NjcgNzIyIDcyMiA2NjcgNjExIDc3OCA3NzggMzg5XSAgNDdbIDY2NyA5NDQgNzIyIDc3 OCA2MTFdICA1M1sgNzIyIDU1NiA2NjcgNzIyIDcyMiAxMDAwIDcyMiA3MjJdICA2OFsgNTAw IDU1NiA0NDRdICA3MlsgNDQ0XSAgNzZbIDI3OF0gIDc5WyAyNzggODMzIDU1NiA1MDBdICA4 NVsgNDQ0IDM4OSAzMzMgNTU2XSAgOTJbIDUwMF0gIDE3N1sgNTAwXSBdIA0KZW5kb2JqDQo0 MjAgMCBvYmoNClsgMjUwIDAgMCAwIDAgMCAwIDAgMzMzIDMzMyAwIDAgMCAzMzMgMCAwIDUw MCA1MDAgNTAwIDAgMCA1MDAgNTAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNzIyIDY2NyA3MjIg NzIyIDY2NyA2MTEgNzc4IDc3OCAzODkgMCAwIDY2NyA5NDQgNzIyIDc3OCA2MTEgMCA3MjIg NTU2IDY2NyA3MjIgNzIyIDEwMDAgNzIyIDcyMiAwIDAgMCAwIDAgMCAwIDUwMCA1NTYgNDQ0 IDAgNDQ0IDAgMCAwIDI3OCAwIDAgMjc4IDgzMyA1NTYgNTAwIDAgMCA0NDQgMzg5IDMzMyA1 NTYgMCAwIDAgNTAwXSANCmVuZG9iag0KNDIxIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNv ZGUvTGVuZ3RoIDMyNz4+DQpzdHJlYW0NCnicZVLLboMwELz7K3xMDxHv0EgIKdBG4tCHSvsB xF5SS8VYhhz4+5pdkqaJJUBjz8yO2fXK6qnSauTeu+1FDSNvlZYWhv5kBfADHJVmQcylEuOC 8C26xjDPietpGKGrdNuzLOPehzscRjvx1U72B3hg3puVYJU+8tVXWTtcn4z5gQ70yH2W51xC 64xeGvPadMA9lK0r6c7VOK2d5o/xORngIeKAwohewmAaAbbRR2CZ71bOs71bOQMtb85TUh1a 8d1YZEeO7fuhnyPaEyoRRQGi+JkQMRNiRhtCEaKY0GZBj4QSTLDUis6VL0HjHdmXxE5Juz/7 4iYFSRLaTPGThosvOYW3V0rIMN2itpgvEfpBdB0muAtTUMEiJnb5r0RwW6LYEG17bTr/7Xko Lq0UJ2tdF3FysH1z45SGy3CZ3syq+fkFb1C7yQ0KZW5kc3RyZWFtDQplbmRvYmoNCjQyMiAw IG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3MDUzOC9MZW5ndGgxIDIxOTI5 Mj4+DQpzdHJlYW0NCnic7J0JYFTV2f7fe+/s+5LJJJkkM5PJZA8JQfYgk5VAkC0REoqSECK4 IKkBqxYF22I1LlClLrUK1UKtaJlM1Ab1q2i1iqiAK1rLIqCitlKttnXh/p97ZggETAGb+ef7 5PzunOds7z3nzJ07b+6b2UggoiSIipZV1o0ftyrvmc9JKvMRuZeMq6yqnmubN4nEy/5FJN49 bsrkunMOdd9G4g9vJ/rtJ+Pqzi5/zDQlkaTgDUSeSybU1VcvyDtfg/0xKKVPrK+r+XrYzvOJ howgMn9vcl1RibP+sp9iLB36m6ZUTKxvfOXqvRh/E+rDplee1TApMP9HRKFVRPZVLQua2/54 TvpeEm7ehn0mtVy6yHeoeOdBEu7/JZH2rfPa5i3447o0gYSfY72awfOa29soifQYL4zxbPMu uvy8Pb+/jEiIQO7eNH/ugsvO2V9cTDQth4TQffNbm+fuHP/gX2BwgzL/fDQ4Pk4YhvrTqGfO X7DosnOzbHrMPZ+oeNuFrZdc/OXGQ9NJvPB9tFVftLCl+cIlt9hInIr7lxJe0HxZm/OADQdT QD/5Lm5e0JpTXZBC4sWY09DUtrB9kZxJc7G+lUp/2yWtbSPffc5Mwp31RNYqUh4Ltf2j6zwJ M2ZbSz/TJSuHieievWlPKflzTw257ctFX99gI50FVT2zV0Cu9R+qohk2+nLRF7ts1NMTw2hX WswzaCZJVEwiNhsV0XQctSCbVyBJGiqsJDXp1L9QD8EAwWguraHzRIegFkWNpFapRUm1m/Lk TXRZGVsBqD+rwkch8vnS1TccqhaGaP3CYyESZFnG3qvUE5V7SirNSCFVsRYPp/tpn1RJy+kb QF890qCeOtHFqNch/5k4kiQV0QSkg0gFSHVIPqQ5SA1IE5GWIE2FbRjppm+aQ/0s2dTTKQNp AsoB1V7KU7WTH+UapY75hkhplIdyBvpytWmwfVber/TDLoPZTcd+7bQM/WeibkRyxMa2Ijm/ ad7DSDfSeBXJXyKvxlorkU/EnJNRHoNkxrpLxZFyC8p2lMdoRpIdZRNSFfb7t7IP7M1Y41z0 J6AuKraY14zco9hizNz/tAbOqYHj/jclx3GtUJJSxmPw5LcZ6/D+/w3KOfLfjsHhcDgcDofT F8J98qMDvYaTRe35v7NWDofDGUgEkh/VIdmI+00Oh8PhcDgcDofD4XA4HA6Hw+FwOBxO/FHe BzvQa+BwOJwjmGdoBUGYN59VNBoi9zm6Mek9jIt2VNVYQklzxp3Z2trSmhQKNYbyR04LVVBF KDZKyblja2r3za0fHZkz7tP6c889tyhjSH3zrJZnW+OwZB197KAdvZq+ONZmdBzm5XwnEE5s 8i1MOScAXmagl8DhcDgcTp/wv1Kc/kIiSVBQS5Ig4vonSf2RcRP9SycjhtHJh0hPBqiBqZGM 8tdkIhPUzNRCZqgV+hXZyAq1M3WQDeqEfkkJZIe6yAFNpASoG/oFJZELmkxuaApTDyXJ/6ZU SoGmMU0nD9RLqVAf9F/kpzRoBnmhAfJBM6H/pCD5oVmUAc1mmkOZ8ueUS0FoHmVB8ykbWkA5 8mdUSLnQQZQHLWJaTPnyP2gwFUBLqBA6hOkZVCR/SkOpGDqM6XAaDB1BJfInNJKGQEfRUOho pqU0DDoG+nc6k4ZDx9IIaIhGQcugB6mcRkMrqBRaSWOgVdCPqZrGQsdRCFrDdDyVyX+jCVQO raUK6ESqhJ5FVfJfaRJVQyfTOOgUplOpRv6IptEEaB3TeqqFnk0T5Q9pOp0FncG0gSZDG2kK dCZNlT+g7zGdRdOg51Ad9Fyqlw/QbDob2kTToc00AzoH+j61UAN0Ls2EttL3oOdB36N5NAs6 n86Bns/0Apotv0sXUhP0ImqGLmB6Mc2R99NCaoG20Vzo96kVegmdJ++jdpoHXcR0Mc2HXkrn Q39AF8p76TKml9NF0CtoAfSHdLH8Di1heiW1Qa+i70OXQvfQMroEejW1Q39Ei6A/psXybvoJ XQpdTj+AXkOXQX8K3UXX0uXQ6+iH0A6m19MSeSfdQFdCb6SroDcxXUHL5L/QSroa+jP6EfRm prfQj6Gr6Cfy2/RzWg69la6B3kY/xV6307XovYPpL+g66J10PfSXdANs7mJ6N90IXU03QddA /0y/opXQe+hn0HvpZuivoW/RWroFuo5WQX9Dt0Lvg75Jv6XboPfT7dD1dAfaH2D6IN2Jlt/R L6EbmIbpLmgn3S3voAithnbRGuhD9Cvow3SP/AY9QvdCf8+0m34N3Ujr5NfpUaaP0W+gj9N9 0P+h38qv0R+YPkHroZvoAeiT9KD8Kj3F9I/0O+jTFIY+A32F/kSd0GepC/ocPQTdzPR5elh+ mbbQI9AX6PfQF6kb+hJtlLfTVnoUuo3pdnoM+jI9Lm+jV+gP0FeZYhXQ12mTvJXeoCehO5i+ SX+EvkVPyy/Rn5m+Tc9A/0J/gu6kZ+UXaRc9B91Nm6F76HnoO7RFfoH2Mt1HL0D300vQd5m+ R1vlLfQ+bYMeoO3QD5h+SK/Iz9NH9Cr0r/Qa9G9MP6bXoQfpDejfaQf0E3oT+im9JW+mf9Cf oZ8x/Zzehv6TdsrP0b9oF/TfTL+g3dAvaY/8LH3F9GvaCz1E+6Ay7Zf/xH36ae7TP2Q+/UPm 0z9gPv0D5tM/YD79A+bTDzCffoD59APMpx9gPv0A8+kHmE8/wHz6AebT32c+/X3m099nPv19 5tPfYz79PebT32M+/T3m099lPv1d5tPfZT79XebT32U+fT/z6fuZT9/PfPp+5tP3MZ++j/n0 fcyn72M+fS/z6XuZT9/LfPpe5tPfYT79HebT32E+/R3m0/cwn76H+fQ9zKfvYT59N/Ppu5lP 3818+m7m03cxn76L+fRdzKfvYj59F/PpO5lP38l8+s4B9Om3x3z6m9/Kp+9gPn0H8+k7mE/f wXz6DubTdzCfvoP59DeYT3+D+fQ3mE9/g/n0N5hPf5359NeZT3+d+fTXmU9/jfn0V5lPf5X5 9FeZT3+V+fRXmE9/hfn0V5hPf4X59JeZT3+Z+fSXmU9/mfn07cynb2c+fTvz6S8zn76d+fTt zKdvZz59O/Pp25hP38Z8+jbm07cxn76V+fStzKdvZT59K/PpLzGf/hLz6S8xn/4S8+kvMZ/+ IvPpLzKf/iLz6S8wn76F+fQtzKdvYT59C/PpW5hP38J8+hbm019gPn0L8+lbmE/fwnz6FubT n2c+/Xnm059nPv155tM3M5++mfn0zcynb2Y+/bnTyKfnc5/Offpp49Pv+K98+htx8ukbuE// /+DTCR6XzLOMiXqSJJWa/ZdGpSKSVJKk6UGSWIdOq9VpNVqdSqXTGnQ6VNRQ0uli/95RK6jU MNdIeuymVqlQ06IQh/8laQjDqno1HTeNFId5Od8JxJM31cZvFacdgjFxoJfA4XA4HE6f8CtH Tj9hSjqZ2Eqv0+m1Wr1epdZrTXq9Vq/T6PQ6NMdGUWuwHYmttBqVWqXR6NVaTRyWzGMrzn/B KcRWuhObcE4S0ZQ00EvgcDgcDqdP+JUjp58wpxiU2CoaA8ViK9VRsVU0hjGw2Ep3VGyl7RVb IZpCPKXVsthKC1RKDbFVPF630iqfKuWxFefbcQqnBo+t+g/RnDLQS+BwOBwOp09UJzbhcE4G a7oJIZU6GpwomaRWqbQ9xGIro8Fg1OsMRrXGqDcbjXqjQac3GslgjI3CbNVKbKWVjKysxFYo xeN1Kx1CuWOiqeOm4bEVpw9O4dQwxG8Vpx2iNX2gl8DhcDgcTp/w2IrTT9h8x8RWKo1Kpeuh J7ZCQIVoSq0x6S0mk95kUGpk7ImtlI9gKa9bqXSIrbBfnGMrDY+tON8SHlsNCKLNN9BL4HA4 HA6nT3hsxekn7BnmI7GV8gsOiK3U+h7UsdjKaEQ4ZTKptSaD1WQymBBpmYxkOhJbAQ1CKrVO bdbpUdaqdVqj8n0X/Y/+JF63isd7ETnfCU7BeRpPbMI5SUR7xkAvgcPhcDicPuFXjpx+wpll JbVaE/1kiRJbqTXqo2Kr2JdcmE1ms9FoMWu0ZqPNbEHJiBbCLYrOoDfoNDBX6VUWvcFg0Ogw iFmvj8cnVgzK57x6B23HTROP18s43wlOIbYyxW8Vpx2iM2ugl8DhcDgcTp/w2IrTT7jybEdi Ky0iFrVWrTH2EPsSdYvFYjWbrFaNzmpyWK0mq8WIGlmssVH0iK30WoRUGoPGZjAaDFqdxmiw GvT6OCzZSBi2d2x13DQ8tuL0wSnEVuYTm3BOEsmVN9BL4HA4HA6nT/iVI6efSCp2kkaji36y RPm9Ko1OozX1oInGMHabzW412+06vd3qststdpvJYrOR3R4bxWjCpjOaNBqTxqHsp9NjELvJ FI9PrJiU9yLqjmk6Bv4M4fTBKfxjynpiE85JIiUVD/QSOBwOh8PpE/6blpx+wjPMRVptLLZS XmbS6rU6Sw+xF7ScDofTbnU6dQanLcnptDodVpvTSbhFMVmw6UwWrdasS1D20xt0FpPTbI7H u6osZDId80rVcdPwZwinD04h7Laf2IRzkkieYQO9BA6Hw+Fw+oT/7gqnn0gb5T4SWxkMx8ZW uuipluB0uhy2hASDMcGe4kqwJThtDpeLcIuixFZmvRnmFl0ii62MGCTBYo7Hu6qsZDKfKLbi zxBOH5xCbOU8sQnnJFGljRroJXA4HA6H0yf8ypHTT/hCyaTTGaMxkPKd6jqDTm/rIfaBqUSX y53gcLuN5kRnqtvtcLsczkQ3ud2xUSw2bAarVa+36d1W7Gc06q1Wt9VqicOSbYRhe3+F23Fv 3orH57w43wlO4SXNhPit4rRD5QsN9BI4HA6Hw+kTfuXI6Sf85SnHx1b2HmKxlTsxMSnBkZRk NLsT0pKSHEmJDhcCK3dSbBQri62UUMyuT1ZiMqNJb7e5bbZ4xFZ2slp5bMX5lpxCbOU6sQnn JFH5ywd6CRwOh8Ph9Am/cuT0E8EJaaTXG6PBicmEc8uoNzh70EffLJicnOxxO1M8RmtKot/j cXmSE9weD+EWxebAZnI49XqHPk35cJbJYnA6PA67LQ5LdhKG7f1mw+M+GMOfIZw+OIUX/ZNO bMI5SdTBCQO9BA6Hw+Fw+iQe377GOS3Jq/eT0WiJBicWC5HRYjS5ejBFP8mU7klNT3Gnp1ls 6cnB9HR3usedkpZO6emxUZwJDpfD7Eo0GV0mf2KCy2W1mVwJaS5nPD6x4iKHk3q/IOY41ob/ MhGnD04h7Pac2IRzkqjz6gd6CRwOh8Ph9Am/cuT0E4NmZZLJZIkGJ1Yrzi2ryezuwRR9fciX 7vWnpvj9Voc/NdfvT/F7U9J8PvL7YqO43AmJTmtiosmUaMpITHQn2hxmd6LPnRiPT6y4yZVw zLsAj3vzFn+GcPrgFP4xlRa/VZx2aAbNGuglcDgcDofTJ/w3LTn9RMncbDKbbdEYSPm9KrPd bEnuwRI91QJ+f6bXk5lpdwbSCzIzUzP9qd7MTMItSmJSYnKiNTnJZEo2BZNSkpPtTtQyk9yJ cVhyMrkSydaricdWnJPlFGIrX9wWcfqhKZk70EvgcDgcDqdP4vENAZzTkmEX5ZHFYo/GQA4H zi2HxerpwRp9fSgrMzPbn56dbXdl+4qzs9OzM9P82dmEW5QkDzZHCsxTrLnKfg6X1ZOS7fHE 4xMrHuU7NHq/C9B9rA3/1VdOHxhPbHKYjPit4rRDO+yigV4Ch8PhcDh9wq8cOf3EqEWFZLXa o8GJ8vEoq9NqS+vBamMduVnZeQFvXq7TnZtxRl6eLy/bF8jLI9yipKRhc6SmYldrfir2c7pt qal5qakpcVhyGnlSjvl67OM+GMOfIZw+OIWXNIPxW8Vph3bUooFeAofD4XA4fWIb6AVwvitU XHMG2e0J0eAkMZHInmh3ZvTgiH4ZRVFhYXFuZlFxQkpRdmlxcbC4MJhTXEy4RUnPSM9IS/Rn OJ0ZjjMy/BkZiSnODH+R3xePT6xkUFo69X6z4XHT8F995fTBKbzonx+/VZx26CquGeglcDgc DofTJ/zKkdNP1N46ipzOpOgX/iUn49xKdrqyenBFP8k0tKRk2KC8ocOS04YVVgwblj+sJK9w 2HAaPiw2ij8LW1IQ5kHXSGW/5DRXVnBoMNMfhyVnkd9Pyb2ajpuG/zIRpw9sJ29aHK81nIbo a28d6CVwOBwOh9Mn/MqR00/UrSsjl8sTYJXUVJxbHpc7rwd39M2Co0cMLx0yqLQ01V9aMqG0 tKh0+KAzSksJtyjBPGye3Fx3Uq57bC72S/W5c3NH5ebE411VeZQZPOZdgJnH2hz3ASwOJ8px v4XWN0Pjt4rTDkPduoFeAofD4XA4fcKvHDn9xKzuGnK707NYxevFuZXmThnUQ0r0A1PlY8aU jxhSXp4WrBgxrbx8SPmYISPLK6iiPDZK7iBs3sJBKZ7ClGplP29myqDC8kGFOXFY8iDKzSVv r6bcY23i8TkvzneCU3jRf3T8VnHaYZrVPdBL4HA4HA6nT/iVI6efmPvcJEpO9kdjIL+fKNmf nFrSg/JKFqgpr6gZM7ymxptTM7qxpmZETcWIMTU1hFuUghJs/sEwL0mdpOznz8YgNUOKCuOw 5BIqKDjmXYDHTZMah3k53wlO4UX/UNwWcfphnvvcQC+Bw+FwOJw+4VeOnP5DiqVUElg9ghpK QjepSPmMhA+bipTvkMil0TSdGukKWkMPCoPF4dJVmpDP6Uv2pcsys8yhAiqjBmo+ziJVluW9 R20t2H6t2/HVmq/Cu+/efRf2Fv7jKpUVdNFD9DQMNUeMBVEkEo+xRaekUrOi0URktdkdzgRX ojspOcWTmhb9bFlmMCs7Jzcvv6BwUFHx4JIhZwwdNnzESBp9+G2OlVXV42rGT6ideNakyVOm TqurP3v6jIbGmd+bdc5/e7yPQWLaSV0P0SO9Op4+zvS1o8r/Sx+bUPnZ9aGxZ44pHT1q5Ijh w4aeMaRkcHHRoMKC/LzcnOysYGYgw+/zpqelelKSk9yJCU6H3Wa1mE1Gg16n1ahVkihQQVWg uskXzmoKq7ICNTWFSj3QjIbmoxqawj40Vfe2CfuamJmvt2UIlucdYxmKWoZ6LAWbr5RKCwt8 VQFf+MXKgK9bmDm1AeUbKwONvvBfWfksVl7JymaU/X7s4KtKml/pCwtNvqpw9aXzO6qaKjFc p9FQEahoNRQWUKfBiKIRpbA70NYpuM8UWEF0V43qFElnxqLCKYHKqnByoFJZQVgKVjXPDU+Z 2lBV6fH7GwsLwkJFS2BOmALlYWs+M6EKNk1YUxHWsml85yv3hq73dRZs6rih20ZzmvJNcwNz m2c1hKXmRmUOez7mrQy7r9iXdKSKwR0VDT89utcjdVQlne9Tqh0dP/WF10xtOLrXr2hjI8YI i8Hqpo5qTHwDDmFtnQ9zicsbG8LCckzoU+6Hcp+i9641UKW0NF3gC+sD5YH5HRc04YFJ6QjT tMv9kZSU0EZ5N6VU+TrqGwL+8FhPoLG5MrUzgTqmXd6VHPIl9+4pLOi02aOHtdNijRVM5qML rT19rMTMlVLttJ7jKigrCozH6RD2tfiwkoYA7tMIRVpHUEfLCJiBRgF7hefi8Tg/rK9o6rCN QrtN2T+sDtoCvo7PCI9/4K8f9W5pjrVogrbPSCkqZ0nPiYb+w+Vwfn44L085QbQVeESxxjNZ fWhhwaXdYjjQZvMhw+GjKTi2zY2jinDw/X7l4b2+O0RzUAkvm9oQrftojidCoaL8xrDYpPRs OtzjOlvpWXa4p2f3pgDO44fYs9wV1mX13Ky2RGfV/FFhIfE/dLdG+2vrArVTZzb4qjqaYse2 tr5XLdo/oqcvVhKiHTjgYVUQR2p8AKfetJkNSgNu6mB1oOr8pho81bDGsLOiQfKIjdGS6JHY UDh/Z/WMrFQaTMpYqqCGnf9zu7U6nMCsRfBVh21NNVFtNPj9J7lTt3xQ2YtlR3aL3afwqPze 9dG96r2WZ+qQsGBVllhbP7Ojw9CrrxrOqqOjOuCr7mjqaO6Wl80J+GyBjo1Sg9TQ0VbVdPjh 75Yfvd4Trr6hEXdivjAKp7ZI5Z0B4dqpnSHh2rqZDRttcPjX1jdEREGsaCpv7MxEX8NGH/wz axWVVqVRqfiUCtUKeFZERB2z92wMES1jvSrWwOot3QKxNt3hNoFausVom+1wm4g2VbQtxNoU FE9RUd9w9DnAnliNyn9FN1K99FGXlOcdW+aS9lGTdIBWS/tpF5KKbGixoTQWqQ1lGUktb5L2 dFVVlYS6kecPYnkkJ7dko9IRSUkt+R9pj/gAZZMXDbsiiR7WszNSXh4rDBsRLXTlFZbsKjNI O+ljJFHaKe3C30m2V1fOoJKDZWY0CNJVZBUE8tIa6S8URhIpJL3VlZlVsvoJ6QX0Py9tprls t80Rs70EAz4r/Z4c5JUekR6O9TzcZbGXUFm7dCMO2yboNqTdSAeRVLRQ+g0tRVqBtAFJRVao F6kIabLSIq2X1mOda7G/FVqEtBBpBZIKh/B+tF+oqHSfdAGuCLzSDdIqciG/XrqF5b9GnoL8 HrSnI/8V6kq+Ola/E7nS/4tY+x2oJyK/PZbfhnYP8ltRV/Kfx+qXSovZfoti+RqpPZLutZWl o9+HVIwkobQKpVU4dKuUix6oIP1YuojN1Im8BPmCaI7DdWXEH2CP0ZVd7uSSNTikV+LQX4kj dyWO3JWkQteSwzZLojaF0hLYLIHNEtgswVEpltoxX7tyhQi1IfmQJBz3dhx3pT0M3YS0jbX/ BLoSaY1Sk36A45iLVV0nXRDJ8eIkm9c1MlQy9jHpPBzqkHReV3JayYojNb1BORGRW2K5VbFt Zb2tXXqT0tralZIWzWF1YZlFaqEfIomUAM1EOgOpEkkltUQyi7yPSpNogY5CFu9Scam0VLVU rSquFBxPSCU0RUc4JR1SIZXCINc7u1QY3qRv0y/TSza9T1+sD+mn6NULpaXSCknySkXSWGmy NFtSd8ubItpRQ5CFxmlGDVlpXGMMGzcZtxnVYc0mzTbNbs1BjdqnKdaENFM0TZo2zTLNSs0a jX6lZqVWbDK2GZcZJZvRZyw2hoxTjGqvVlhTtlyaw6665+AYz8HzdA6O4hwc/4PSbLT7pHOR ZuPRmI1Dca5yvQgl1GxI21DejVyNmhV2VthZ0WpFqxWtBFV6piA1IbXFejU9PYf3UewPKj1I 2ei1oNWCY7sbelApIU1AzYyaGTUzrLaJX2GFNqgPaQqSxNp2IymhxVc9fcWx/iYkDes/yGwO 94WUfcWvQs3Zm3KFcK6wJldYmSuESseWlYQyIA6HY3ZgdnB2zuy1qoWBhcGFOQvXqiYHJgcn 50xeqxobGBscmzN2raooUBQsyilaq/IGvEFvjnetasXEDROfmLh1omr2xIUTl06UhuOh64rk F5ewPCOo5A9HklNKhlvLRosbcHdmQ1cj7UKSyAstQhqLtBBJJW6AesUH0fogWh+kyUizkdTY 40HFvUC9sT6lfTXrU0pKv9irX8IdfyAyasjksglwubORViNJGPsB9D/ArKOlDaw9DN3N2ifH 7Newdi/08D4SHNxM5uZm4uk3E85/Js1GakNS01ZpBv44zFBGhnqR2pA2IKmkmdhmSDPEB7E9 ID4gFYTMg11e9i2N5LDrbGU20YRzwCzcx/R2ptcxHcs0M2SZYP58gvkPE8zXTDBnoyDmIGwy C6uY+kPGMvNDZebJZebcMjNGc5OfzKKLqUZR4UOmk5gWhBL85n/7zZ/6zX/3m+/ym7/vN4/x K/ul4rlrFhOYGhUVbmU6gWlWyOg1/8lrnuE1D/eay8zC3QJmp3Km6Uw9igqfPGSttJL+MeET qsRIQqQ014s/ySwT5EhpGbJDkdJxyL6OlN6N7ItI6S3ex4V/C+xPmvB5JHOft8wl/EMYr1Lq n8byvwvjaT3yg8jnIV9HpUIQ+a8jpVcr9vdi/1+gfg9l6BT7X9EUtt9qYTxrvyu23y8jBXMw 652Rgssx6y+ogM16W6RgH1pviRRch+zmSMFFyFZEgsoCL4iU5nnL7MI8yhQV2xYKispKJsZm rMHIFyEfF925KlKg7FWpTNAtVEQCg5FlK6t8XAjQFDadNxJgdzKNAmyIVAqwRXsoyHKLYGWL N1MGy3WRwNUYRfNQcJ/3n6WPKXecPhOskbu9ex/H/ZuO6jvC+Mh67/aNyuGKeLcWdAvBR7wv BR7zPpPZLUyPeDcVdOvQ8URBtyg87O3EQQ7DVhQe8W4omOd9MMB61wbQi4d6dWmh987ATO8d QdQj3qsLHleWQQtwj6eju7HgTO/E0vXe6mC3gO5QKSYLGbyjApd4R6J5RLcwvmu9d3Bmt7KU Yoyx/hFvHmbMCrClnD38UXEoaYXFoQLtIu0c7XTtVO1o7RBtodanTdOmahN0Dp1NZ9GZdAad TqfRqXSijnQJ3fLuUL4S+idobEqmUSmqYmWbqKgY/c+AKOhEPHfCTqlWrK0rF8KOWqqtLw8P z6/t1srTwiPya8O6Kd9r6BSEmxpRC4vX4kqyvgEnqNK03KPEnxtJEIqW3+hR8iXLb2xsFGrD m1qodo4v/Hkd7ocB19HqQHkSJV46Nmms40z7yOrKb5CmmOYfISn/aJLSwrfW1jWE709rDJco BTmtsTY8TolcN4rfFxdWVW4U25SssWGjcIX4/appSrtwRWVjjxlliG0wo1IlU8y6KEMxowyh i5lNZGY4TTOqKjszMqJGTwnjFSOcPk8xo3nRsTIxBcaaomQwE9Mpk42VKaYrZjgfooNZjx7M RIKVDWY1ERssVTHqDAZhUhBUTDqHB2HQGRzOutcf6Q4Eo8tppCCbJyg0snkE4YhNTtQGZ0HM RtTBJr8/aS0/BWOhq/ntuS3K/w+aAlWtSE3h6y+dnxReNsfn65z7duwfC1lNc1rmK3lza/jt QGtleG6g0tfZ3PIN3S1Kd3OgspNaquobOltCrZWR5lBzVaC5srFr3dKK2l5zXdczV8XSbxhs qTJYhTLXutpv6K5Vutcpc9Uqc9Uqc60LrWNz1U4rF2qnNHTqqLwRASjLu0SjAc+HJo+/sTzR 1nYme3KM9idd5XlURfizZUTwbgqUh81ISldhWWGZ0oVnp9JlUf5DFOtKumq03/OocF+sy4Zm e6Cc8imp6vzKnlt7e/siJS1enA9dtDiJtS3Ck9ZfVxuuVuLZ0nBpVTjUVNkoKA/H4hgVDSHb E6VbS8WFpUtLV5SuLt1Qql68uBHNjicytmaIszMWZizNWJGxOmNDhkbpmNXwSKh0dcbHGdJi nE3CIlBVyeZcjBw3pbpocbsCYYJ2pOh0+YvzKxrKMqgFV7sCrswLyYkUQBqCVIekpj9CX0Ha i/Qpkop+DL0F6V6kLqVFKpQKq5LOr1RmbMxXnE6SVNJVPLRkRDfy5vOied3MaF41KZqXlpUk IY+MHWIos+LCW6BHoc8jvYX0AdIXSGqpRCphgy+OnrWN7dSeL2D5hMoiRdrzFwn5KAjK4V7U np9PSlJOcDwCMM0Xep/3JLQvJhwKPCDIYMRa25XdFiv5YZQOuGL1TUgTyYuUyiI0kvcg7UN6 /9AE+Sv1hRQ4dIG8W1Leuv9gLCm/hnIrraZMOigMpqdoEzz5OlzqTKFVNI620gay0OXCFhzN AK4w7oO/8MLvV5NbUNMd9CbNoktoP+1G1FxLOwUHxqmiNkSLI+UD0Fq6Vt4IKwNV0O/oUeEi oY6KUK4RC3AkgrRC3kRuypFflHegdhftFzLlTqpB6V2y4+p8Kf0MYfQF9Lz8FSkf/Z9DvxGW CAdwbdVE16vOUHXIF9JoepheE2pROosuV+/QP4yrg5/RvYJb2CTvkt+jP+BvaStG+hFdixVH aJM4SKpQryEfZdEYmkTN6P0hvSk4hcFSSM6Wy+U70Pob+kTMF/8kabGOfBpPs+lG+hWOxuu0 D5cCRmEornDWY9su/E29A2urpcV0BS3Dytdh3wdoozBYGCy6cX0o4h7m0tnoW0FrMX8XbRNq hUZhk/CktFZdfGisnCC75PdkmfKoAStcTU9ijn8IxbDBDFKGtEiVrlqkLvn6atzDufRL2kbb sY6dOO6f0b+EPGx7xKvEpfIM+T55P9aiw7XDCJpKM2khXUo/oHvwqD5FT9PfhS9FPSy3qp5R X6E+KN+MY5tF5Vj7ZFjXYezr8ShFqBvb67iXdsGHezFCmCRME+YJK4RbhW7hTeFNUSP68afy AyksbZHeVg1Tq+VRGClRieRxlsyg+XgErsLRvhn39z56hjYLLiFLKMQ9eh37fy6OFiux3Stu FXdKy6UVqq/U1xzafejDQ1/KHaTFWTYOx2Ex3Y+j8LGQiDXkChcI7cJerHyl+JBkkWxSQBoq lUn1UqN0rbRKek56SXWJar3qLfV4dbN6vbb50MWHtsu18k/Y9YkG68qmAjqDhuP8OQ9n04VY Xxu2S2gJXU0ddBPOl5tpDa53u+kJ2kyv0V/oIzwCJPix5vMx+wKcdcuFm7DdITwgPCk8I2wW 9gifK5uYgS1HHCaOFSvEanGeuBzbqv9H15WAR1Fl63tvLV29V3en97W6u7o76STdSXcHEiOp gOxblEVgjISAgIKSBGVTHhHRsDkwjiK4hDjKuMA8gbA0wUH0qeM66rg7CxkHFdTM880wbpDO O7cSlZn5JmXde3N7ya3zn/Of/9wqPskb5F1yhvEx86H+boejkznCfAAszbIDXCUc47gt3KP8 K5qEZpymWXj1Ql9/Sf/s/j8VUMFT+ElhR+GZwqcDMwdWw/plVIbKYaUdsMpd4IN74HgCPPEI egG9it5T1/o3TDAHHu/CEfCGUkCtDo8FqTEeT8aXwzEDjivxHDjm4Wa8GI51uB2vx7fhDfhO fI967IRr24Mfx0fgOIp74HgHn8Kf4M/w3wg4MWHAm2USJylSDVc6iowlU8kVcCwiy+BoIW1k BSD0KOkmx8i7jI2RgW3nMa3MLua/mWeZt5lvWcKWsim2lp3JLmJvY19n32TfZ89zQW40t5jr 5J7lvXyWn8Ffx+/kn+TP8Bc0vKYB5Ootmrc1A4IMbPUbuO7D/3TnKcW/jpdzRewqcgriwsW0 cB14BliMJ9OZpcxPmd9xC/GXTAh/iDcz1zJLBh5mxpBvmGV4Jnkah5kgV8MsRFvRAN5L/kzO kU9ZO55OzuIE+zN8lCxjRkFFR3n1LdbO3sadAaX7Hqoha/FJ8jxzG3PbwK9RDdeJT3Gd5E0U YnuJDZ2CqO4g98KHfkuuJVvQLDbLnUfXgt0f51aBvUeQjbiEeZvtRB8zEfJ3qK52AGu8hiew UXI1qcZ7gXH7cQD14VbUgu9BCj6O/4jzoIkfYx7Fk4gB0NpPjHgYyO7XGAm/zejQbLpGHCN2 3EC+JDOYp/g3mByUPW+g36E1mMFp8J3vfwroBoiAu0kcOG00sMlbuBK50L3A9+cKT1HG5t7n toCfPcSUoitQGjWSV1ANxMbHcMxCd6BK1AM+uBGlyU50y0A7XgC8Pxn4kyCo21AK64EtnbC2 dZAvHCQMXDgX/uo3wP8vA+tPxH9FK3EIIuskSrD0la3saGCmJuDfLXAsQI3w2wPoLv4w9xaa ip0IsaFCJ3j5H9DVkHP+An/fg2phfXPQQyy9mxkCZm6FTzxQGIcUOO5Ar2CC1sKaR0CcN7Dj gHl3DFwHV3gt5KhJkBNfQtcO3ItGAXZXDNw2sAXNHXho4CqoVKcNPAb8u2LgIKpCHdxsMpNL slng2Jfwc5CPfo+3AG+PQx8CH8nYhT6D479h/SO442gz+x5wZ93A1oF3kB3sEQYLNUMWPY2u R38Fu41jTqJMYQo5MDCGaYEMdQpdPvDoQBDr0OKBpcC8T6E9Gg64px0FuD3gu1vYhSQN6y1G DpyC2au43YgWWT7wRB/dDgOOnHyA4OPkBHCbhjx9EHFsnpw4xCCdhg4OY+QWeO5peJ0gBhcj LV6Cr0aupPhVbX/tFPFc7eT+WlQHY/ECNBVpySJZZGiwj0UXQszJCwqHzoNHn4TPnx44jV8A 5WAAP1l8nDyB3Eg7cFLRVg3PIkWpzwp0H7EoIGV1nm9Mi6qQUpLLPoqOwnrzzPijRg1jVGx6 GOcUI0I6VlQcWZ3CfuMWv+o712exVqf6UF1fnfhJRRq3qponicdchiNMLJetylQ67EUahrZ8 JExn8OLYLH5UKlXP3lBeX18OJ17ElOQ8dZMmTXQlL6Try+h0WT19JuB2iLCnYOVG8JkHjubd L7q/NjCG/MA33RE5q/Zl6SzOD5zphiWj/MCLih8Gbhc0nuHQfG3AGoPTQHS+2+HCjODh07s1 jMcE/cEiBsElHTIadayJXpvD43FadNez/+O8Hlmw5Xav727pujVQeX7V2P/V4GUOXWt/bR01 eRK3Ng4VN22YiV90tdLFl06UKgcZXp6stlUXmoc5cmWlNZ4qJoKjq93uupqaihnzC7/HiTWl Ss0lFfGfFj6g+W56YQK5BbSgDdUokR2WRy3kDsMmC9Ht1FrQTlA5AIP2MVO4gcd8e9H0q6lb NPb119aKtRSJvgqIetyI7bF4jORENMzO88Re5AwQcsu912x/AFd+dXPnFMkzYW1hmTxp4c/w 5rdxFR64oeSyLwo7nn/3yc2P3gdrKIc1zFTXUK1Ei9kSYRzHwB+3wCJsQGZaHSxgcIuZ4dvt sx7590XgRlvO4XRY7SLS5KqqrLlsvJyU77xm2wOF17++efdkyT3xFm5BycSFdxVWvlN4uYBv kEd/jpc8/87+zb+kK7ihsBfvRC+C9pqmxGeT2c7nHIzW2eR+w81oMdKwrFmwoiNWxaBna8z2 oL3dztjzuETRB81zzcTsdj0Ai4JYaZzc30hd9LS1Gluszmq6MtxqgyXBimKRsGbIM1XA+BsW tWo1Gr1sLaqomVg1ctG2wt7S8LYGm1FbpK3JVIxZPnfRAYrRNNxOZoE2ZFCdEiJcu39B1ToO Y/V+BIOIiBtwE96Ou/AbmAfRlT2M2tnpc6iV+hupjVJ90NKlJG2SXZpGuP7zxHkv/eafQbwu AxbVo6TiQwqvZxStUpPTKnW5uVq8W/uklmhvN1DfFL9qbUsm6bVVpOWLYwylFDW0nlXb8pRC v5cZOE1GAKIMukLRIu6VIMQ6hriOK0bCFBECy4aY10OUBJWiEJNmmpgWpovpZXjmOP4VeYXN 42UHTtG/2neOGrS2rraDK0+uFZ+jwQCyhYwo2Bvw59xPv5vJPUHjd8LAGeYotxiJoPt7Ds4T QnnMH+Q4O+2MRk8emxWr1oNiSowosaZYV6w3xsYsdNo0F4TvOpDbXVAWuuUeHADTDqHZN0Vs bP1qct+Qm41arUzC0Ug0HAVVC8mS8BrZ5/V7A16Gt8XMsj7mcjvdhJdYSzMK8p5mXGSCkcMA oygONWOvAI1VtDcjtw4aNaJpU6KeJSW32rLWYeAdToeliICF47FhotORqawaVmUBBxp0ITJh 641zmh645f6NbzU/e+v1z42ubq26MVCejlYX11yWG5clnWfw1Cvqdz9fePKLwpF7Pn7m68KZ A/fMa9uHq8/cvzwtXTqt8ABg9CUkBx4s5kD3KkWKq8nV5ep1sciluMgKSI3EVG8DNVsP+aAL shSjjgUYRwDgb5AZXwsZB6gT/00xYbMZSgXMaQUDYaBw+xrePl6xmkxmxZJLm9eZt5u7zKzZ 7ewhUXx6yLjJ2sli32kawoCuhQZMNfpH3wX8j2RSZZXWRpucsRQ5HE67lBtBctQA9Pq/xBMk W+1VBdI03KHTyB55JPubh853tA0PEFkm/oo15A93l4QCQeqHpXCNe+EaA3ixsl7j0lc7Xb5L sy4FGjdtzAGHo1hTqxmveVzDK6GfsHOEnzjnuJYIN1putD6gf9C0y7JPv8/0EveS80XXB84P XL2hb9lvnXY79rNuzmt3O9xOv0ujdepden/WPda9ybktpHG5CXF63AY3b2TchONdTkrPNtaY h2VotUqRoa5di7V5JqMYRM6zzY13u590E3cPkwHD3dmNiSGQx3dCDuQ/mmqba1tmW2djbXms UWz0LroHhZRQe4hpCnWFSMh9HH8LcWbEilI0F6T1OrKNPA3F0inyv0Qg7mAPlCE/+PPp2kGP bpwMYSXSwOrrb2yFJNN6gKe33I9u0+Knta9rCWpsnZ08TSlMRcZaXU3EwbccWuu+0w2vzzbV dojc2udMz9Fk3NYIiA0mZEbKIZTLAlS8JlI1lJt4DdFIlVVVw5i9cy/0Ql0R6rxhwe6Y7H79 /j1/TE/45bcjcPPSK8d4MFc4L+OReOfjt/7yptZjL7y9fdGiXxwufDlcrKB7OdMgymcCnpV4 0jGkG+g9aKjWUklRa6iu147WjdFPDLOva3Fx8fBiJduUfT3bm/1ap0FZXK9dF1lT/kT0WLSn /KXyU5FT8u/LPwuflQ3jheI83tqdSIgoT053v5HG6TyTPcxwogM78nj3Yb+STGX9eTyqWzQW J47jxagIaclfFH0DYEC2qxgAkt37DdiQx9thvqy9jGwv6yojZTB/eK5mHVx7nnys6JQs7sqe zBLQD3jEUcX2tI3Y3BlKOGd+AEhFp6+x9RxtToP6AupJ9rXV9TX2UUmgclBVeSoQ05lZPixF pKgkSyzPyaZYTAfkkmLLmnHADCNJH2/GOm05n27GQaOfso1YO7RpVHIr/Kgx1oZASNmqVM4B nBwqWNJQknJC8FH2yancE4tEaBxSZDWLaw5sePjKkT1r21vuKny+aX5Kcnssq5xyycJ7I55g cseU0NTd425tun8xO2HTPddNnXN3Z8WRm/ff+thlcX+pwNXx+s6lUycO9yfqA7qrN0xdtO6X lMNDEK3HAF0dqLD3lITDiM1otFExM4oZlxiwXQOEixktx2PWoDci1mBkeYMRosqnWDVCkUYj CAyr4Q0CChqx8Th+ABSvHu9WjBzmtQLPCxxrMLDH8XiIFwEvVPRarZnBu5knGcLk8deKC9ep 4WXGTcBXvWbGzCsarHGbLoqh1loVoVoIIBh+IlJtXFedEiHDin1if1utpdqiBkxHeZKFfEWH ZrMZGK0NhFJrG7ZHLBGLlMMZ6DBz7Mie/mfJTTfsKUTxuZ8W7sML25n1F7aSh/rnUv5qBn9f zU1CEg4oox5hsXV24NrAOm4dv86/lb3Tr8mRnDSDmRG6UlriW8Gt9nWQzZ7NvoeZx7Rdkd6I GUWw+jir3eEUiiDzMtRUlpAEKZcNSR6vj9G4WA5md3eHQpKtB5jExdgUsCn+CJGPJAkKsx48 Annx2MPtmi7qx/gf4McRrESaIiQCAfLtEZF0SViiX6JoQ4rYJRLRHe7B9+CzqsVONwLNi43U OqprnwbSgTHkU9WhgfUpy3QI5UkOzIXoL4NEoxjbcBtpC63H68n6EA+MQ4kGeGbUVbMU/RJ2 mXVBoIVr8XONs0FkaSQNSz2Y5y/SWEPOC74bx8zqKYXFs7H2/tuv3HD58tVrlpVHPPHUxMk3 Hejccv1TmOUmPXEk3rkxv+RIe3zYtEpfUpSyB9bd/E5NmYaYqXfOAiwOgHe6oGq7oJTcpF2h W2lar/1APivzPIPXMmvYNY7bnWytkOA5JuJOuHkmNFfAAnDHkVAMx2JmEGd3drsQR8VJt9mI wbgKxUix6j2oRCkhSklTSVdJbwlb4h60O7yEbKItZEvbFNt2W5dNY3MX/yhRLoDgPD2kUVSq AEIHqzb2tYEZ8Y+2PKTnvTxRTQj8UeqTtVa/L+AjvEU2xmRtBBhC9DYjyQSjqC7WjH3WUDMK G6BB32sUShoqZWC7idF8z+tUo1iy1mhVBvP2oh8sDuTP7Njw6MNLott/tuXVRbe8umXeibuw +Zsl/a9ax47JjL9y08a1sSu5xbJx6i9+s2l+7/4ntj5xVTf2H8HjCrP6L+uY1vTnkalHdu79 LgRRMGngNLMHokCPnjmG2IHebpt3BKfecISBW8AcU6IdiRRjk7HL+DJ+ibyP3ye9RjAp1mNk VIwM4VhQlD9XPAwpYhjCMkZOGZvjPsI8dPxHGNw8j3cd6dJjvdvA9ZAziCGfKgbEiqzCNrBd LMc+RT5BhiG70+rjtErX52gGTYp9yUF92mFa+9yQ82pv5G7kN3AbeHbIcSFDtoEdQYGDfJVA xmnivyXvFWpb8D2FLa3p6Rk/Nyn23Qn2eW95k57W7beAv20Gf3OjGMrgNUrPbCiFMsFMSXxZ Zk24Xd9uaPe0e9fL7bHNmcddezyPyt2GQ56jsePx53XP698zOjRIh3kj8WjjDqPTIxtl00S8 Fd9mvN30ODJdgmrwRDQRj0/MxT+JX5W5Dl2HryWLYtfFF2duxrfEV5TektnGbuPaNe3Cest6 67aibY6d7A7hbssO6/2OX8Z+Ff9VJs8eEc7qPzOcNZ2Nn60s1hi18RpUjYdXcpcJyOCJs2oj OlUtznNltLMZ/fVa4HUteD490zAWgYtFlFNyRMk15bpyvTk2F3kKXmAgBkogBnRpp+Lc7mSc 7mwP/usQsVB5fk4llb7T5wYVOnV4TKsucPLKZCoQtjhYwS5LXATkuMbfjEuLSppRuRUyYpiF FBmgcjzpKGtGKUvZoKsP+TrNj5RsWilqsR9LNo3DOVj7qEW4XDXk69TzbTzthrIl3vRQ46uP P/Li0r37qyd9eOCZpTNX44pVyoqFC9tzFVXTGu68fun62Fiyd0PXzA1PH2yb1Llk45SFrdte WT1v+ZwD7y5dO/XalSumZhenCp+O2dN06/1rrhxXfR1w0OUQCY+BTzhRHBuUzM3xD7j3wh/E 2cXsam6tsEa70rDKuNq2MrRFuM2m0wrbisklAhd3SXEXxwRkFmm4HjwfubByKN4AmQ2YSdGm 5GUyKGcUoPCYOOCorYecTmR0UQbyYPNRZBWtIStjzeNrgI2KleL2YkYpbiruKu4tZosx5TAJ 3qbontYRnTvxT3qmb1DQ9A+yft0QOYnqZo5lkKOqB/Eq8UYFiyEmyr5YJBY0Ss3Ib6ZlkwCj kD4AtZMFmrBWvpiSKFBqTnDSqn/YIPMPGxIzBNgJU4AGEVKpaen63jeLH1y37dWFN7/w6Mq7 /vTCQydIxjpy9eTZd8yun1v+Xz6Z3ISjT17zx6MHtzy+ee/5jwqrb72OHFs/Zd6fV3V1vrVy ZimtuqFq3s7sBz5yopEHGDd9wMJvXFS13d0FxZ+CNAYgdLNih2I6u93eZSf2p7AMeeN3GA2y xzlVew/tXCTxReW07eLSWhratSpN1Y+kPbN/sMYur++3jRwcjaSZ6aeFvVBbH4D1RNB8xSvJ z1gWVb1gfi5MDEavzS5qDUdcBrquojwzRQkGFBfU+WZtEIr7Kq9YY5aCUrvESC963VFa6gNw dBtDVCvvflhlSjyt4qRChVv/acHMf9jbwJ6hxV/9r5sczAFlcO3Kd9/9+3YHof+LG24/twT5 UJC4DhCVTa04GCABP4KchfxBDJmr6ATzEXLCqYFTx3ykOAXiCzBmwefwo2ALbscEY8FMBJSq o0732huvpVLU48S+vr9+gVODP+LajueeE+GsSHsVr2Aym42iLqANNki83WwTPRaP1+tz+XmJ PgYp52jXnZ6VVftkudofLB6cDsUGpz2BwWmnOn3QrnbKvaItazTr4curzRPMY8TxganSbPOV 4oyiWYHrzIvExYEVYjvbYdps7hA7rJsCG4P3m+8Xd1nuDxwzHxN/7TkWeMX8svii/+XA783v i5+bz4hnAt+avxG/9X8bKNWaJ3pJEHITGAn5AwGf1qTzah0+p9chEI1XsFuKvPZVAbMYEgM+ X9giFllaLJj+UxpTnrykWEigiJBA0L8HoUHD5fFhxSCIZsbucAiCVvDl8XeK1gyfIXtMiiVP 0t1TAziQJ18oppBiajB9aWJMj4aWbFa92+0B73F5qOCjFSaVxtCeAwnYX9thGtR5HY2mcley A+rHpAuJfVg8+e9th7j2uVpNLfynCr8fH/BoA8UnaVTStUu5qmFVw3AGD+4TqM6oJ8zj/X+/ KnxJc2HGDHdmBP5jBL9f3Tit/+zl1YkbPvkCv/Du1HgwpZFlsyv9c/aq8zs3Xs7JMlsulc7F RhLt/wPNv2GE2E9AdQRQEg0na5X0HDQnsAltDGzK7PI8GN/n2Rc/6/ks/mnKMBytia/O3Fe5 K7Mn+kTmfc/78fcTOrYmTz7tNi+qqqFe4Qtnaa/8xe7MZhSpFBp3IFupRBLQeP3Zy6KXyZs8 H+B3ox9mPpY1bBTLxkqRsfNeT1HAEXUk7OnyytHRCdkr8Sz3nPgOYhGRWDMDz4k21bTUtNd0 1QietKeyATGixhMNJNwplidMwBmYmtkYvS/6QUYTqlFqGmrmk/lME9fEN2ma0iv45Z7l3pbA jdHl8TWJDfwd3jsC2zLtNS+nPkx9Hv0u6p4tmINerRQWg16HFMlEEcOWolwyGGXCxcNLM0x5 OJHLaR3FCafTQcoT1FO2g86lbl+TU7uRtGvvrqvP0l+7R41Re6UI5ifN9WFdIO0jvhlsMji8 tIK+II7OWRXQWwRB08syLJ3UGS1ZxOIQi0HEvanIpbzNRmaUGsxm2hqN0IbBl80imWEO0V/N ndU1T+E3kYTmYRcwbnLKuWSydnIf+E5/Y2uysZU+y1HBlJ31ql3fbCiMa6mHtvWpDtY2mKzg VLfh1U0Q52BZ56ymu1OQrupT2UjCFcAaj9ftJTwfi0ISzcQSrlgGpzQVGRwJxDJMFldkmLi3 OIPTXHkGyf5wBgUqmVwGdCQU47UXJbLBmhxKRNzW1obaWn8QI4hurQzKDj4i5TKVw6rUvTCo xiVaocO87KC5bVCLaCxDElzdgGEO3jlmXvupj/vbMzNkpz8+OUMmPDJ/R+ct/TfLc6vv+vmU Z3sWNNzYevjEzGe3jZjlJYcCI6+6/ZpjM+SqSBuz9L+kUtkVPbpy4UNmjaZu/eSVjznOL/M+ vGrqXdPpv5jEaMLAnzkzcHUUE2WkNpDCKZJiUsEd5l2Bh80PW4+Yj1r1QgBWD+XRzfZVjjuZ zY4HmR2efcxxRmtgTCzxj2NmM1xKEC1RL4hw7jDxYtyD8szEI6H7uISPwXly6rAluV/EYp6p P7zNuNtIjHkmpaSKtGQfwhhXivuetOCgpc5CLB4FHFBbG3JhsyvoIi7VPVzj5QXz1byWbGxT 93S/amsF8dhK81vrucZzn9T1fXEOKIfqyZdUeEN2L2/QyJ6YPuaQea+2DBns0AhurgzrnMYy qkHwxQqkDeoiW0Q1OrEXWdU9WyfPRkJUKFqjVJFQ5IaxbwaDIz55qOPDtSv6dm54eXVwYeHL 44Unj20+gut+/fNtJVZvkUfPLSlkXj+yqfD2qXzhb9tbHys6/Nh3PRdewdOPj3PYvGma8yOQ JenOgAO0F6PM1nv1/jvEe8R3RG6FuKKoQ9xp22V/yfuS/21RcFmsRf4Ao7HjDs/GAEkIfNCL oAIJeo1SxCm5gwmTyUjcCYcDCb7aqVY8KPjSVsXKWfMDfzpCbWgdH6GxOKIuB9V/KIJbInSH gYlITjUanWo0OlVzO0EKGESIRl6d5D10ku8MzxvCgMZiv9qCNmxLfqWC8mPIVX8fYj5PwGwX 5aJYwOybiT12aPyW4Ezstblnfm9+WpJCxDS2Zv45MEKs1S5qeCkOVkfAlRAXkczMqMNHIyCB 0/jSZ/Y9U7jp9+tmnsGVhd9+OWe5PExazixdFyqVNxdOvFX4+MTbzT48BjuxG1/mp75eAvng EFg8g6uUOiW3yLfSd3/6cde+9PF0b06Y6W7hWzTrhHXadr5ds03YptVGg16/FJaD3qQUERRq EEEymYJar6ChppTojEYiJMh7NT7RS3AE9Ic/g/Yky1GZSLcPyVuQKkqT4FB7/N4zPp9f0O4T BH5fHd1TRBpRM1XDwHd9ojSo37WifF9pMliWgo8u9ewLgaI55WW80xpyLVBUMTkkqlCJKiqi CpUYlqMqVFF1MqpCFe3M9h7DHapUpTCpWEHMNPadazzdD3A19tWqe8fiF5DRoSuoqR2osra/ lgpFse8LJP4jiYf6of38RmyRaARkLBF1M1Gie/sZ9d7GsAwzSGw/AkhjCUZ4Hy65MZ7lZdlk sl4xo/CumBj+yfLF6RH1iZvOf55OJ0NOT3R6mrWb4/ZMZeIajvSfiZTfWEjM90UShfo5cWco NWJtYZ/sFJX5TOutgYRceG9Jg91MEZUAUfr8WxkuOZBI5XFAGSYvqNKyWt3+FLMz2ZN8IfkB 81byLHtWd549r9O2cC38OsC4nWvntwHGgkanLSEayWDI45hiFLwaf9DrlMI8gEpnijkvb1Jz ZyDojUmRZGlCJxhYjgDUYH5nGYrEUEJMkARFWo7HY8ThFOLJxD5UjFFxGkqtFqiwtvN8UIOn avDTasl2WClHJhVJkwqaSUXSFA74VST96qRfRdLfWf5vQXcOYq4WVFqrWpMBen9t/AE8tShT a7LkEHr93/cAYSvdwExiC4UMQCwnkYgFqiogtoz9orz0PX7wOn746xlTjbKM46Mv+9qoC5Wm K/p70tNjLqMuCE7B/J8x4hl9zXUA2ucTlxVyUyfIhZmLJLfVJcsVoTXM0sFx4d25sxMUr3GQ bZ6AbJPFjcp0HTumnLjjngQRXaKbhKqUqqaqVUKLq8W9qmS7a7t7v2u/W1+WWqHv0DOuqnJP Q1VL1Vb2V2xvFWtg7tCfrGLGCYCL6+9hK0UtklXzT7eaf3A3KMCJyqiK+0qdLleYT5QypkRY i5PBgIFaPqAaOcBTIwfCFkuDdbuVmK1TrYRy5zrrgJW1shQNKxDo6UMqgebJN4peV9sQw+ZY MEZACH2piPRrYiJ9PTY+t2DzEFZAiBBnqaQKlYraabVcpCiJ32eqIZbMhpIaUZAT8eJ4SZzh DSBEzJLlEhwKihZNUleGjBFoxJDpEqSN82VYL5vKhgpoqszVG49qCkuqMUqlB01kgGKISuzB TGahciIn2WmVZ7eADlHTGgTuD7usw9izAPv01ScK/R2tO/7ePnFrfbD+CmJ0T/EXLe/dVFj5 6q6ZCw/e88qE1cuG22xeBlLc9K7Lb3rtV//7bOHkPTEZb1xYJ8ViWfn6wrwRNRd+/XX3I/9z 7ZWuYnskA8jTbPcgROpovHKwIjw6VqFGQ3J+4KvDFBE5mx+4oFjpMKv6flaFKGuDNyg2Om3D YRW7sBov4fzAGUUNmLD6xrCnXoRK0g9nKZwpOMuRAVotnHVw1kKNqb8URaPll5Jyn46gupRa Wb4GBeUXX6gNTtGUdPK1JO3/mDxZkU56ldaWsV1j3xjbO5a1je30KVUNMCTgcXopHA56fVI4 G/SWS+HRQe8IKUyCXp0UsQW9XikCiaNMiuSC3kulCFggEo16R1x6qV6vI+VlZT6fV7DawkQJ 41NhHAqnwy3hrvAb4d4wH86TkOIRxzaNPTmWCY3FY0fL4VxDtilLsp1j5v3BlZwsnmujD/WI rW0qGaiP9wxVaXAMUsH3qnRwh4IWXD/GtuoG4Af/GvzSf6aDoY/gPWQF8EAynSaXqeQNRFCa Tvc/lZ4Wc/dvVl+q6D8+RBHwChkNRgQh9x7esHiQGJxi/YIL9/zIEvjBwvyLOGPJRW+jnJEB sbSKPueMnlGWSWoWllTXkZREzi3NsyyoEoJeIoVdQa9VCruDXixFtEGvRYpYLUDUgstNqNe4 BeolbpZ+1B3WtgjtQq/ADAg4LTQITQIzVzgpvCEwAkvfJqgeKOQHvjlEPwuDguJXBcC8UIvU LvVKTFpqkJok5qT0hkQoKFMACZWmIehb24a4WiXoQRRoK/8Hu36PBFn1L6YDo6omlf+JT+n4 wt3qWNU1A39mLGChCDqrXDLaiufa5haRBc4W5+2GveaTMmd14bSsyMQjDBrKr5rI4fKJDjfB JF2kFJGGIlyUZ3SH3Qmj1u/LD3ynXjcMzh2i9qADRaI28YW12rSgCNuE3cKTAve0cEoYAKuR ITN9phSpZnKo9vPIp0D190blPKnolnp/QSu5042qKGlsBfU4ZKO+vsbWutrBu27fa0fR49UZ PAbfJViv8+rdlyDIY7Uqz9E71a22Hy3H/7hpOHT3Ysi6r6oGdI165Marl7ql0lAm7ox6U6o9 ubhqxP5rd524s7G2wh0s+UnVyOlM5w82DQNfvQ82HUX2K/mbTSdMZCnC69BN5GbTivTq3Jqq p3U9RuF6hK3s6HJwwSoyg1xD2skmZTvZpXQbD5l6Mj2j3jG+V2m06jFjIjzhKregjspOtA93 md6sFPSIPgDEGYLagLEEyf9P2LeAR1Ge+3/fN7szs/fZ2d3Z2fvsZfaSze4MyW7IJoGdGO6g REEgSCRWithqSSJSwXpIq5iCHqW29cJpxSsF5V8jAga1NbbipZWntMf2oK1H+n/QerQ5xZZ6 2mLC//u+3QD2ac9/eXa+b2ZnNjsz7+X3/t73HaBmqVoWW+4Er5TeAn8suSy2gE2HZdRsXGR0 z94NH0WPG4fQIevIRUfBb8Ax+Cb6FfMR+Aiegn+2nrL/0SFLzVKp1KSXlsIHwLcc9zZ9u2Sp ZzLimisR7YjOnuUDPh05dcBkZCkQklmZz6VDmfYMIuZj4ghdkAh5gN4IbaIjZFRYBxdiiZeN J7RYKBtPdHTOCHWYTaaQ2UW9biwWysST7aW2UDsEIOF0eHEw0gkAIaaW6iWvrpcAdJQ6zbN1 0FkytTkgIo9/4Thnv/NFJ3KmORPHSVJgn9zR3p7NZma0teVy6X0Z2e9nWXMGmfmOb5qcuq6Z hsyw3wzNo6jVsBuObgcacsARB3SMor8ajZqLIioX9QUu6iFcCezsiTTWnT3V6eiDs2a/ADso tRCYohamoBUGVYOknIImg7HHrgq16USHcP5fbQVfoV4NXytCgZP0p5MWNw0TUgyPdUoMe+jz bFh9heSScLgDBga7VhgWrbnQqV1U6DL19vTmSV7U2iJLjqpV8VaaRs+eOCRUDMFZIWWL+50V gLfsp2tj+wWyNvY0HuqcWj7fU8t3wDqTVkucwv+vSXe3TAfTKfVAtjkRKfVYA0/f/P3lEze3 NXvKk41UZYoTP7zANF1U1BpjsvdGmJsZamiKwT82zlu3SDqITk26bu7BYD8jy+kS/Nnkws+g wYRcs+zGmsmrPNdB4Yps1J/E6FKqzvEexlqXw3j+Wax1ChgxQgIQoAIUaCSWo2vQl9F25QFl r3JYscPEKLzLaHauabkcrYoibOuZeEKaHnLPSFhjISGeVGIK0IEBGPC7sFtA4SRieKx216FR 9LKhSf8o4LVYrFRUrHSrlYqK9cH4Vb3nwXfNWp0+TYtusK6c7CXGivjXQexfoZ/5O2rHl667 WBojtZjujW84837zMtVHQ9i11y1XBHvTrVd/51/WwS9zkzvUVmUD80USvqqwwdj06b4lMZ+3 eGPNFrF/xFdFh68bH7hk6AS83xlwZF05V4NJ58QZcIbWI6+H6+TrtU3yfXCn9lP5bfkD+JHs cMjQ6mf1OTrTIrfoc2VG0jNyWmdY2az7/Uwe5PBaO2jzV+RyoKxXmxY3rQObwUZ5U2CDvh1s k7fqD4D79L1gt/5Q00jTG/7X5bGm3/jfko81jfs/lD8MnGj6BPzN/z+6Og/O98/RVsIe/zLt C/6bAq/IR/Rfyb/S35Pf0501FlKJhYLxRJFaEYyT+HiyxkvGqQUhMB1AL5ADAAZkmZiPmbrm 1WW/rska1PBv9wcDAT+y8DwAup7J8voVGBsEtGJCUeIPxUfixBefiLPxB40m2AQR+QqH4FJc bsIoTqNOGt9LgpwuJtEwmWCvo03iG1pX7hqAIlmtcwUNeJTpRD6Pp7CHH8AaTAsZQprgtVdh bSFUZNldkQWxAni54h89e+ygv+LXvZVaaRV990DswOJULz+rlQSgQ3gBIrjgY8jMmTgdUrv1 yay+LCV5nQuXwCH4e3gSDmnLU1JY7dYmxvTlSWniz6YbP914S6xBVUvKILNxZTaSUc/82kRX P91+7oPtZ+7Afu7se2c/xBHZIpCBLxkLt4tQvBtCZCwu342gGEEwgwqeVs9NnvvRu+gs4jyJ hCgQhJuIE4SbYMh9TXrJfU2KohsilBATXlFMYA19xHBl9kGrxQJRKMiLFobeD7u4xO1WBF0w BEbA5uyAG98cYQpmkAklq4QHc5RNrpaNHFTIwxVO5FDO4yVf4YvH9QQcS+BogKJ/GoIlSDBm pXFBIHvVI1NaW0MZ53gqvAHP36clP7V7PT4+XK9bwWFzhd5ijpTagl5inrMWMSDmYBVUxMVg gbgarBTXgy+Im8V/g3vh8/Cg+FP4Nyj+AUESefUAHFsPdJEuX3R2zzNRsYoIZY6tOQ4hPziE hcoIV8h0f30I0eFQoIIxKpkeN1xiRZTEChJ8+B2o4NDn+H5bBX/Nsdrwl4PeCjLcUzb/HPVM pAr0MlioSp9Blcm/lzJKyYRgPzODSAw8TmQp9enXQunFWLCIILXPaI+0mxd9yjHOKVE5s800 69MfnBOcp2Y3eiwA0Vj+JtopEAJPG9PuE/dwe617BdOX4SZuGH6dM3XxjixgfFnWIneQ55Eg wAgMKRU2GDMzP0Lub7BaViJGBEXcHeQZJqiW0pwfrpO9hFa8WBjIf1LjF6cqeJtgiFTqBtOe tNPuLoAQlAvQy+GZZMYzweoowADCC5H3FYDf5CuACy9W/qtYgbFncQsgTpbTWwjf6aZluqJb yKTROOThrZObJz+a/GDy1t+8+D+HvrTtruufefGv276Eg971k29O/nRyHbwLdsCuN56eP7xn 8oXJA898HTbATrjqya8TbpdknvI0ZmmENx0GRXyq32wra8Ub5Q2hDeGvZPuL3w5zm+RnU89l fx36dfjtFBvICMVsuqJWMu1Zvbgyc22mvzhUtL0CYDCcCy8M/0fg1yHzniz8Seot/9uptzLH sx+l2LCRjGR5JzGlCRgLcfEkNrS+eBJElMaGSLaaXJxEySTna8hKkg/xHC+CoBDUg0awP2gO zi/W+WBQhEZxpIh2FceKx4pMsRFSBwmpK4TUQcKEy0m1rc5YUf/ofLBQHIVffiZOKKrP4Ki6 vvVeTPI06VqeJk3yNDXCimZlSDlkRax5UMIVp3L+sKxm0zl/uhmmwniRCTQ0QzWUbL6AK56/ FIcGUWx+ku2mRFRpx7cwBiDlQUC+VvAxCAeJOub/gYWlGRepnvvOSOfzLBx8LJy+uDTxPPbP 3hD2z/DjQ7/Y8evXpg12li+LrLtv3m1Lm7vRzZM3DsWwf26NbWCuI7OF+zfvPuaca7U+PLTi voUeohWT682bsFb4QBpMGLnZcAX3bciwTrgcz9bCjfB2uAPcy7/qeg9YTC4DXASZZTxzn2kU HTM0XsoKDIju43mCX/rBEDCBy3jeweQTHTGP5kHnK8nMnvnZKQ3KGlmUDXYIDsWBXI6YAznm Z/6RBp0kubBerEcd1XHhdE2XDEtaUcNpm91qR6ysppJqErExX6IAI5YgVh4XXqTdeDXujRbw WYXseLDwAadUgEkRL2hN6lRZagOpg6+X3ZgJCk2nUpl6ZwnRNS+A51StVhCfZm5fO37f9slX Jn+3dsfSzcNwO8SQBW7Furf50Po77/rSwRduGF5Q+YFrZLddMX/+mc+3dV4FQy9BHd4zef3k 0b9Oft304dcenRyZfHb/tm2PwI4/7R7aNJVdWYc1MAtKCBn7UzIRW5UK73ACilvTR5JHCsz8 1PcKSI75i2tTjAVa1LQ6F6yA69H61M3wZnRD7AZlY+ImdTscVu4vPAmfVJ9Nv1A4m/Kxym3w ztRtmZ2px+FjaHfqqcKLheP6HwpnCw4RSDCIxCzWsmltxTZ9bepazdrAo3AY+mIhVzwB1GwI 4DjciSNwwh4lDdSoplIJBL0IwdQ+pCCuIfc4TTD4yc/lBK6b6+OYHbR8E4T2hUuj8BuGqykb iYSRy+nEYSQv0lKFFbVShdmLyyD+VBwtxqAIxQ8KLdBo6W851sK0lHiq2Ty9DjzVbD4h+ahm ++hGH9Vs34Plqw7T8OgzzLPQS/imPO2k12pardW1ug6exscFrNa9g1qeREmBoDA+FRFBsRKU 6yFQntadT9NloveFadFkTC0ktWY4LYoXxURjM0imdKWpGYIpycJx/2AtR0f9q0oLx3EcdGq/ t5IlcZKXOkw8PXVQqOiCC7tIWPOMGG7l8/E4pCr/v5kEjsRNsOlc/SNnXjd572S5WXFEhXB6 UZkaBwre4X8fP3r3o09CuW/7+k9neMKWHx3ZdWvb1WgzgnBy42dNRHXvjbeMpidvvn2FHX0L 7vnall0ewi8Mnf2tyYztRCtabgTEbzdCF3QhGwNcpizImfOL4WJkcbeNwjnGsZbWliATMq2W VwdWB1eHWLPD7AQNY22mDbYNjg3Oja7+aH+sX+vXt/G324Ydw87bXMP5PaY9zYLoaHaUHOVI c6QUKZPUbsGkRJVYLldonglnoqpJD+hRPabHZ5RmlOc55jUstS1zLBeW5ZblIzEYQ6HmWDnU slReGlga7Gla1byqtKq8qmXldCdjs+U8tlAuaVPa2nN626A46NmWup+7X3tA36ONZV9qeCU/ 1naqzXsJ3xoC61HoKfgziOAWWM8MG47yzmnhUGR9LBSNPhchW0qBnV5sPDrsTq/d7szbG5ym tIUObBJO4AgoO41JZknGGBrRRAnCGClUgElD0NwvutG7bqi4n3K/62bco2j42di+aF4gHRp4 h9iuInyx+IfiWezajLllo/gzvMKAolLUscMzFV+Ac0AFzqGFBsRk9uYHsLEcPE0aKwYnBita voY9qN+qF+WScN9Zi/On2Hw664XCwHjdtLakdM6TTdsaLc0g5yJOzYMXnI5XrQV7M7DZG/MZ Abs4lzPXoIrYzfEaS2S+RuvTxVQtIw4ZBnsJX3C1ba3jGuHqPOELIPaxYKBWTm23ya6KSXdV mnUXhYc9kCZ4anVz/iiq1zzWmjrczVE0VVidSk+1CpAkAPOkKvbuW7Xu6/mZ//XDOxb+4YX2 UuzHwUCEU9XgioPX3fKN6W2Zyce+uejE/7luU6s/GLdiRJQffujKLZfObF54y9rrv3Xpznct 5mpUgz+/5xt9t61sWtsY/fGGO5fe8+/lQEwjkj8TY6MRio0+NtpWwpVoZWRl9Ivwi+iLkS9G eS1ejS+O32++L7THvDvEIRiJSiSmT1iI9UxychLEkODi46NozPBYYB4YfmdVdOGv6wZPkTJg lDWCvIXaOQs1aRZq5ywJvxTLR4l9dJIjQFSIro4+FDVFn0NZIJ39vWEjVlCi9k/C3/6Msqa3 lkA93UsMXhQbWFuZfMF+m6uEL3D+pNBRT8iROwMMWxm/pz56n0IdQsND4XVSk0CivlpeJl1L u11ghygRwyU9poddaZsnds3SFzEi1yZeIvD80dXZ0gIuLZgXTf5oaapt+pnTU1DcZHd6rlsF Z5Krajt7wvw0vqpFeOthoOOwo0Er6bSqLUVHY6kULmXZNnYRu8llUpNqpinZlJmdnJ15PMPl MpUM6tY32G527cy8mPlLmu1w1qjiWCwUiCcaKGHsISRgEofm2E8hNeuwNOAY7eMD5Krhyfs0 gKMTcgVzJFITLBbesFd4A4MUXucRT1hkt9dLfA/1QyzliknQVyPd6S+dVS0LOuzXH9JH9BO6 SY8p9GYq9GYq9GYqCVHc4oHrPdBDfZfHST7zRMlnnoB2+nz81zvF25AaexoB5nvPkzm03r6e RMMwdOGlm56ezmPVTcezVjfpzUGsS82oKadSAII7bc8VoM0aF9QCyNpUElXAGvihtT+wF+si GCAqC/+Onc6ksa/5DN1P9a/ugZifwxPN3XnfpeNv/Of7ujKblPiUlqYCkUV3r9v6i4uxxyF0 dVdsYOLtN3778M6v9fwZibdcoqrl1ODE04vfGFyw4eBxpG5RGrEciDgq+z7RLiQesLrYGKpl 2w5IMCo4Rpn/+6wzhiTOiYEEyX1VhYljx8agRoon7aIQhxJvq+yVIEUTcq0ssrlcK4ts1Oho 3KokS38Sz8ROxZnn/Ifl54Mj8b9y5r2BfcEXzIfYw5z5CfP32L3cE77vSeZ/43a4dog7pR1x 87W+Nf4Npk3Wobh5pbTc3x3/PHstZ76C6+GvsF7p7PGZjXg3WMosNy9hzUq8ZGr1zQHznWaV zXFZPuvLSmaMION6vC9+LG6uE9th4IwrVikoNUiMxDnIKYac2I9zfMxJOO1qrzBx5MgRQtVS RjtkeIEZhoDLJ4RcTh7vHPNHQ7HRs8OGW+JYhec4jIa8GA2YWZYIcFnyk/bFmAvDLIA41nLG D/2/0yVD2iGdkkzSB7rP8HX7RnynfGbF1+fr9w35TL5R9NEhJX5vnFRTYuPRGzjde7IXyHXG gfYZEN+BR5lO/nkBZa1h5vyLIhoc2QwSk2+xymLFZYgVE2ERhArPeyoYNh4/5KlYsx6y9fjT rspU1NtDemx8LIcvTxISI5TBwkgK3v0Q1jtsyubvz1PLucmMOmnKCIH5M1HDla1F2AMNrW22 2W5epDri0z5/5l9M31jpjSXNqmopppq+8Ol7jHtDIVK2YaNALJELI++nsARWmca67LlNnBzC sneAbZueVfHEENLuOCia0oFWlEYBnuVBFb9ocS8RSOHTc1IpbHJDR8CSboM3gS/HzWKMdI04 XRVN8FaETiNvdDKdRCrvjiVLG8FN7s2J/vzmws7EA8ndcLewN743sTe5u7BXez75vPp8+rnW Q9XXhCOhI8prlbHOX4q/VP5qO9UZFjVBERNKKp8tatoMQRd1pT3ektHzcwEG9J1Kp955rNP0 SgFuKHxF25rfppm68j32njhjSQaS0sxq58JgV4YVvUWYKn4+/nj88aKpLqEJU7DTyLnTReQG 8aIppJJLEQqyQZ5cilC6NV3PvRw5Uh/IRZiS1oVFRYOFuKIJCbeQEKsAFsQqK3AhNqjgb8kU sqFMpdoWqpihKWQOiHIokE6Qb9Wmh1oLCUFIwIIXwgJWdZHyqYrmVRStGHcDE13ARKW1lVSt BAMBljXz66qwmgcQg1EFR1irYB/shyNwDJ6Ap3BQNor+ZrhmKUuUNQqjNIHEQwmUGEU/PmR0 1mX9k97TvRg0YWG/MB1d7+kgkIm019CAgEz+qdT/s6ULv3oINYf97X58ZUjbGH7Bga4VhzSY S2gzGYyKiC++Nr4mv17r66RZFYhREk2tuNZmrm1FDSS/khQchE/7wPDYK0nZVinid3KeVEnr Etk+dkiqJLIS0aET+6UKeTbiIRuldRHhGW1ipcCLlYQiVloJkeeqZGoDIfHwoNSGfG2Y+VlF PPeqkXj0LABeTNU/T6+V42cYyF5QIN0yHcILdNbjqe1V20LAAzMLJjfduHLiubawL2Th9Pcn TxbElkWTsWZ1Zv88aEz++fr7r0Y3dLfrxz5u8NhdxXnwt5VUy8rL0B8mLzmwGmsztFlUj9/v ngtXTX6rLeNTGhhVNQvBFVfAb8HhXVfjNaYYVudOvg6ntWR9PsHnhniTy3/JtUTvcVhj3ksR yC8PmAEUqS/fUy0b+pXylYFu3dTov9m/Kb0pc4d/W4YNmAMsArqP82UVvVs3m834LLI+ZIoD Baa4bCaVVYu6Pgca+qVwBbcyuiLbrd/A3sDdkL2hoV8fgkPsbdxt2aGGIX1Xw6PwUfSQ/nLk l5ETurKVHeaGswzkUAjWoGMsrYRiIFsMgRqIjMqRUDSVlv1+DIi9WPw5nifqkchk8VpWTvu1 LKfzWS6Tls0xAQIQi0UJ6PRLU4lxaYqxJhPDRTFjwuAtiAJOvO1Zijn3KRlyFURHWcnoGSPT nenPDGV2ZLjMKLr/GY0oTYA00gcxGukIyudLBs7pDTEE5D1sqjsNU91p4Hh6Ksl4YY6RLust g23ptkytZZBmLEioAAdhnkbQZmJGsSLArGirArKQiQjbiQchAxHop+2VqUYd4jwIdsGC9ve0 GqScMkU2570JBjXH4FvB4JrLOiYPh9OXNU6MESw7eedF2gJvGs2KaotnwBC0dkRaWrBfKS67 amJict8UsIWdqHVNU9Kqqo2NqSsnF8JHriyGGwOE15l/dpzZxjwFmsAMZn69t0Sp0nqQqkHu jC/EFVXeZiNsD9mqAntzTWdFdHmzRHbB6/9JYWszuXk+csua6b7NFY6OXIFSo4oFH1JsBlFT rlEv2Q0L/lK7EYmQpRt/ZB89+6YRJTvZ7aYtMpTpVpnuIQtqlOtoNAENR44vY9ApVmht0VFt gtzON/NHoYZXqAkYG3snn39ZePMoKRIJGett4e3NSFzSAkUlVhmq7rEcsjJiXrwF3NJ8O7jD dkeZjYhSm1Adqpos4UXmRexsZXZiUZtR3RbhrU5OAYn5cKF1vm1+eeH0rrb5M5bbrrFttdxm vc3mWirdKqFYdXUV9fHNoNRRzBVKz2NEZAd2bPQsFXvWVrFTXrGtLNi77cjAiz47o9Bho91k 75BJoiJnqyyWV8vrZUaTt8hI/hesJuSM9Q6jA+HT7ict9IUyvm6jzBzDbbIVxwqw0KeCZofd XirhC/8pvgPs5c3Pk+f+ApX8RWcFqDF1SN2hmgz1lIqGVKgKZCf1edQFOODDmDRW8Y3Ca4xo SKtM4wxnReG6uSGOETh4ioOkIa5rZteXamH8wOBgnvQX5jHUJ2w0jtWmMvif9GItOz1xslcY H6iOk4x/3l0h++TzWk139jN2iDWn1uRW72+bW24PJ82e6a0trYi18FYesfGEkkBs2VZRgDvi CQPR44o5wjCRbDdXwqCVLymwXLKJYSEMnQm8aGM7woAyaSS0r8cODQ2kcQBrJtZQHNID4t2q IvULeUCQ3oFp+EyLxBUJdDjkrExXnMTLEE1VCCKyYe+k2Cp+/A4TaQ/aMAa0VaZnyWjFoxWP FjxazuWOpl49+DzVqZ5r4mhq5Bfr83vP9YORCgIfrfYl9b++GpVG3A7tl0Rz/zXVMmP1zdHc T3+/fElVTSMtrWojuzZf0h4WrX6XYPd19K+d1gbva1w8a1nrotuudwe+9oWuabNuWpbatjaR aGwrNpUKy3bkYhflt06+fmu7l3N0tN4765uwtyPQ2FeZtxpr/tkzZ08yh813AQmk4C9qmv90 1Ew0WCC6bPbagUwTgLKdBKFE0e1EzMgmOiF6bif7O8j+drvsByZk8RA86vYaFryb1wdCqsUW 78HhEWF8qu/ka5QP1dN38mPCK1hpMSytozvsQgCDvwIfR44hx0bN5rQKSNcCe7mMiPSSn/OX A2QdT/77WbLJbk+rbmoQsOKPkdnR+t87WnvmUMjYJKThY+wh9iD3YcxkTnc5eluU9I3MRtPt zLBpN/Mkz83lYBvvzTg6PVHvLNlvB6aQBHAId+6XTIuZd5hRn3kIw3HG/JFdAkBO2e2Co9vR 79jhMA3hxYiDAQ6SONDxdMxxzME5sPY/21F29Kk/WljvuCDVbLWql4newRoXNlh1+yv0WS9U NbIBhbFxaYWJKjBolcMgINvsYR6vxUxxBQZsoTCIsCGl3vhZj7i/+lUs8LRqdRBHJ+f70bFs 1ZIyGbXZ7ZbOE7IsbN+6819/8cgdT3Y/vsylyOEGJ/QUmq+vXPHd764pl7Pok8Mf//z0t4fa 2piD35kXFJL9E9mJ3zQ1v/biyA9CXoxR5mAZWoC9Rxz+eT9vglP+AwU/0+5AfQArqS4L1xfv jyMS9tIS1XgEW/wDHi+6HE9+coh4lMg0Bpt4bL7zvdWXx6mgHCW9iE+LtNvihoZCCSTJ3fM7 lptR2LPUtARHuEu5FaEVYe4a80bzEBiKH8AByTHlBHjPbJkO58Jl8uXh1ck+uS+8UR4Mbxfv 8uxw75B3w8fQU8ln4EvwVe7VwH/xJ8MfKqehzKIF4nLxjtgdylDyVJJzK/CFsyeAgt8xbDBA BBADrGO56IsPxRGICziKJoWL/fEdF9RMnIo74msj77qg61VJtXARgly9FTIYrWIFn6Qt/kbM Dhfb77YjuybQ6po+0A92gBEwBk4AC9mAwBM3BG8Nou4g3BWEwVFoN8RTLASswNYe/mVmuxJd h9E3akQr6eDpHRyYGOg9OUDFKp+vjo8PUNN9UqyrmHVJ5OrIDRHmmxFInmiDdaO1tRW20pZh UuqcJ3DmABDkSgjbPRz6mgVhqkBKuaBACpIAeAASNgaVS6C5aaoJvP5IJmrIsG1jFqjHb/3O BxAeGP7+tMb2qNuWTM5cM+PSh7d97pLpJbjq4I8h++5x6Lz74rSW9m2MRRd87uHHznQVN+Gz n3X2pMmMLVQMFNDCumylNVqxmmNlKlR8TcCosAElIlGDJdkUSowReVIoMabQvfHWvxg11ksm Ryjh50iBM3HUpE0gJtJQ2mNYnOhyjxfgeJxrbGQo4iCWS8NvWEcY72B8MUaFk5Q016/tZSI+ Cig2hiGHhvsj0Ij0RVAkZsNfY5OoDZNMxGDhX+glo2JyufASkU9IIJmj+9CTYy9nWa1IrdrR fM24kULqPDEX7/T2Hq2SLjxs4LBuHAba2bFn5s4taURFLsoXS33aV0xfMW83DWlPaWMaZ2hD GgKa1ODLX26+nF+av5fj5nFQ0aZb51qXWe83fa/hIY0b007lkaIAJf4clnYb9oKzO5TFypXK Wut1ymZlF9ilPMEd5l5psKV5T8beKUY9s3yRjNQZjkZmxfBhNlOjj161WCNsbIwxthiwxe0K ARiir08akp6SmJi0Q0LSR7lulnBg2WKJjM/OLbNdxa4tdZbx4vGJwd6OiQ7yIrVhg/iUsXkU qH0EwnkzGUznTXxGTfM5BeRNeJHlVAU2mBuVqW400g3VSiScpFBJyosQN2q9wlXEjrh83jLW 3LHfnCy7CdFfl2H0atfQgntP/OXHmxZjCxnMO6C74IpLoYJt8lSR7bhaWzH7ipHrrrhmzowz R47AuRfv/S41lGfeeXhu2J0ceB0en9VfWbzutZ/8B5Zo8tyOJcwI8IIIc0tdorO8hP2dnTRr Aicd6v0rPt0AkCSuEQACeUTo2TFqK8nEcJM6HwBsIdXNkb4nRBKcB8jRHLWueD8OR9u/okfg yU+eJdpgmmazUcNAEDTtniCUbi8Va+yOtaNj551xxDcEHsLmiJmq/aM/ovYXa/1aKSLCAqdw IxwDuD6OPBDHxN1jesS038SQP8XhUyOamCbi7PXGovg8yRSfLRZ7crZ4wFET3uR0xqKfdeH5 o8eIF+99ubc331R7TgIWe+LLA+JquTfQB/q8v2LMASWMYVq4IhnhSow2x3YtKPEx4iJiVMSy Jbp5SUOxFGIDlhWeK6XV/pXyFUEOMhaWs/B2s28+uw3dyQ7btwtbI4+iJ+WDnjfRW663hdPo T4xH7OP6+H58dtssL3GvuU5x2NNxjtsQYyF6wmI9WdBimYPmWhbHlqKlls+hQbTNsy3wgOcx y2PWUf6gZcT6KvodOmE/bfXyxzgIuGMcGiAjuXYkDT3CsdwtJi/QJR/5qR6xIq72bfHt8r3r M/l8oX8nfb5nj2EHQpjJ/TUq0pgnVsg1XhWC5I5wb/BSNlRxSXC9tEW6W2Kk017vECnG38Ej nb+bf5dnBN7g8ZnwI/wJnuWfcPpMYBuRK6bREHUn6VpngFNwKk7mlBM6yS+x4Gvp7Ip21ZEL DgEunhggsGWAFPWOY5xPH9swSEQqP+jGtwhj7fU+jLXz5PGop3GYPEgf+QhaW0klbdeKAyz5 P0cHemhwQFmbQRo/c/iv2ZIVu1GoOPCbPBZ1f5YEz2QgNmJ/qLYWqn1WX7PW1qy1NQtdM5yW ik8IVAKKu+JQaHEXzH8Gpff09HhYf70jtebBROLB1Hi6ltF7G65ZM7xyayHm+8n9j3/08aGd r0wMwz1mIXB1y5JbUfsbGzZcfZN3228hfOsjyP30ibYVqVbjqxgPLQaA2Wy+E+QRX9dutUD9 VcEgbqdA4+pQHgpOFvLOHORpLZDoJHX+IlFQp0hVv1YUxD5X67YxrHxKjfoBcOVcozC0X2TJ MxzGx4Sx6tFxYbzmlMYInH5ZeIX8e5l2R9QV+TBw0WMAPtSI5NgU/iY+B6kiQpZoIKS4mv6M 44aNaiPdjtffpvja6Sw0Trmgd8gC//mjR2v1YyFj5h3KA74H0swsZpZ9XmArs9Vu3mmCWmFL nPyXV7v4XZYHhQfdIwWLwGI7tbphdR6FeeeBKH9PAh6IcqMMb8SS0V3RF6Mo6k6pfpjvxsGv 3pAT3SzPWQUs4KPwsmfuxgHvKPpkP2zIj0LBcGRzUHS5hXtcLpgiwvpMX1+Jjm1ttbFarY2p aXQ0pHC8tMMJiYivdvY7x5zHnKwz0PgcwzJcPVVdE8qLx7Ho0si2Aw/v954cpBxSR8fEYEd1 Ake2Wr3GSlQzXimt+tKqlA2DjDcVhn9XXYFB0gX0DklQJcvNOASsP5CF+CEKmHDk52v2wd1h deaSiXdy2YsC+/evODhw7Yq2UtTfvCAWSxeN8O+ZRRO7hxKNqVR21ufQynkd235446xC6/9j 7Evg46jOPOtV9VFdfVRVn1XVV7W6qw/1KalbUsuCLvmQbR1I4FN2hAU4yXBkLIs1N1ghAUOS wcrJGLLIm9kENvllfMSADEMQjIclmxg8M4QZskvCZr0EBivxsIRNApLnfa+qZTm78/tFdtV7 /frV66ru733f/zve92K1xGd8vrZPv756A2RpuGypn/nvGJOvojZSY8zD+r3e4OjD6UOdDFUU dtK3tN6yiaZabSXbVV9ULY2ukZ17uvalJ3dCZqPPhT4vHax94fLPrTs4eP/I10Nflw6NzFlO Wk+ETkg/qv5ocH7nmZ1v7Ty/M6yogQ6h5u+M77Q+zg50NsJUkOlMDIQpec3F/WgdPp/fwU5r yKuBfciL5ZAGP4ff1YBSd3qdjVntiPa8xmhz6LEnt+enE+Ao+7nuhr7e2cSRxPMJJmFeQ0p8 SQL31aWZATQAWSMHdNw0UICpM0CW3CBW9+1h0X4WV0RwjNZsh9agNXNMm+6SB7iyjEblaZmW n6P/gbLhyTVM9eK3OJtdvhJdWSjwwz9kKljexfC5Tg0zFT0uVNCeysHKbIWpSCBfKy6YEpVa vcRMb0ab4dnceLbiyn87IfhJ5efEFrPZCKHFE2mzFs8iEl4WDCnVg1k0kp3MzmfPZC1ZD/TM Nq2fuPJr3QsMI7tP3VnZqe88jL9z6064NOJ0VXd6Dn6jH/UTK05/mxpEfHAy+Cpm9nMX3tdF 4m93ATAIknsMztHP6b5DDdRoqzCjDD3KIAgZpRn4KuVolZR4VAY+HmAyVJ6GZ2Su37HzGXQb 1uu4Yw+CI4L4ebFWMbVIKgv5qbNCfq+x7ihvJInYK5wlCzUXhAVTKCy+DSKiIUB6I1gjPSVA f9wZS4kTryZ+kaCxnJj6YAHccNCi/ULDLVNNW61pqr2YaAfPuDsGt/WsS9Ui0ZCErGmtva2j rdrG2PrSI+mS1preqm2OoMiqWIQarA2r1GrUUKnLrI0INVocjlBX5TeraK3UH0FbMtsiaOu2 aE8Ydw+voobaBlQ0OFDr1Ok1kF/tcktvBF1RvjJCbcpdqVLrQmsiRi6sZhyJebp0x5FWkiQL Jj9ZNrKXiDadKwmYRmuCF2xN5495zWiSZpQIWWQFerotmTR1KMNPQf4tZ5Qz1pZ2kavQcvIm kljLtvIVfl3bvOP04c9NvJj3MDYrw+dv7T717bXrC/FEJTL5ymXje2745kcv3DfoFGv2XdV8 HQUGdq+tjg5du65j6XflSs/u5058r6P6yP9EV+S+OvbAKd1qc4QUzmrbMDn9lD9d94uq3cJY He7Jq/Ze95Vt7Z2SpK12XBdviyevpg/ccsdj21ZP3TG7Y/XHn+3YrlVSl+/fUA0GLVjoU27M nP4P1uY66YOmbIx26zBxBU7kiCDkpBS8lkjIiARWHpgTEtjjiIYneYBIpTRIyzg0pBPVWqaI EhaXi96SIGMkihKMUQTHArTiyofEZFVszjFcOafzRCiT8YoIa2F9HBa1Xnxo+MjiI0NVseDl a8SOVeukMmK0YAErVrkMuiBZ3YqJ0tQHCWgVTr3ULpzKGy2nsYJ4aoVuuL3qhSlZI2f8iZkq HhSGFDMcEb8cEbkcEcucaekiTabtS+ruQgnSnCDNCdKcwE9znnAbXHn/BLyBKx8/De8Vi91d ptQmQtusnwbQhZ/CsI6RBFZgJS936601rnsC42Ze49PT3TPdlqPd891nupm8DY12T3RPQpPe jVRWysXEOYbXxZZiLpYZaOFyMWEgmcjF0nOMRy8la5lSXzVWW4vUTCdFnhLDKlEUOFlKOWY4 dJRDPDfJzXKvchYOmJRWpBKpUrw4WpwoThYt08WZIn20iCDpw3zxTNFSnOj6zn6SSslYngsI dOUy3QVY7Vg3cyWbwtmvRKysTQunI1Y5guysYo+CeDYtZcQwDKv3wY4hdhprHc3VRYasJvGM RnwXUQ1hBZiRj8HUGNHwnnv7rpgM+zxcRV+6PKC3c0x8baXthoFAvX+p57KkX+LjSqDsQV7r Q4vX3rFu6yf07y79zTZVikAUr3AFWvuNq8vVkaXI1aV4KuXjurcylxnaI3hmevHJjueLk2qh Tc/MSSqFBUGULJ53E3J3J4glI0HCcRM+iXFgCUJ4uQMWgxCnGWiBphvtlaegt8MtNTk+rvzy hDnd3mpOt9efJLNNBXNIaCSxJ7Efi+GWPXgOT9iQjSBZorXDALYWmw+jwdcxUz89Lrw5blpI DE/MaTwlMM/MQ0Lk5ZngVskcSJAzjHNicNCs9PUZFV3u6rJt0cHUddhGw4dSlJposfvg8T7U I3Clw5FKusl8cNNA9m4yH+DJjPkgwcQn8we3PG1MoVRyxRwwdEx872+ebpw2nBXmVJBnUmgi NZmaSR1OnU9Z1dRoitbhlAKB2d5eJWV3j1EWK0aZ1Eipl2SliieIb6DFnYt58bTIyH1qLLHW Jbt8M/hR6hTV4rL7vNyMAznqIIOPr6lBofONGnOjy+WW3SlJz9cl4jfq7KnOSGhUQhPSpDQj HZbOS1bpePL4X5HpQFLQwxzAonfBgKlY8kLGkeXE4ch0i+81zMIrU+st03Vn53IycUzXudZV q1pbe1fdI7f1La1ZUwo77DElkvUgv/UheKO3tXXVUmJR3VrHhKz0bkHXfL2gynxqkqIvXLfU jw5aD2KqzaFTJp93Zn1ECfLF4ff74AQwaFIxyfOtJnn+s+4z6NOgbQ6a3Vh7XyKX4Mo5cgmu /A9ySRwuccAlccqWywC9urI6GPOyuWD4FYEqL5wGq53w+mmTLPP5JmHmX8K6y1PfVJBNRnn4 phtdNXf+OGZ/en40P5N/wvNE9HDepuIX03lGwC1n8ozCZjNqXyaWXSvDI9m2+BRHqxxWcy57 cA55dLdAUS47/mR+1od8YPjqbTV+Zn19jSnlQyEF/74G1RLTHzwpPqfi8RkV8SqCDObnVUZV iXVw7sJvscYItsHjrfm/T8BvTpaFmB6EPAnDW/fJtW8Pf4B/fYGsRWg0jHl21HY6fILQ28LU GCQSMrMwe/NmUnljVXgk5uGjWoSPR1DMEwaUg5r6CxYTWIH5I4JZ4cIKdvwR3WTzvb15TB7T Lx/eub0toYTFaxJSKXiReg6St1vzvUvqx5967+zqZLLdbd+mbfsy/aWH8wlCQYgSKcriwnyv i3nepJ+8QsS/TM5GwKJorKIxghddbqCAIJwxNniH0AhU9LwBEjozpTgy4QHJRpCwEcBQIvK/ FATiKjVxQqmJE0rASWGAEiQrIIviSgIS45Y0F1K0LPkggOzPYrSQpmqY9rydBC10dlFp2eUy /GTML59yuNyEvJlfHuNsJHl53gQRi/n5+fmLDjFTTr+EuSamT8gRZExd4Ekn+Xq8TnttAsL/ v+r4OjfjnHE9yj8iPup9JD5b/wHH1eW6skvYJe6K3yTsEffEH6Ud78UW4vS047Oel5iX+Hfp d/kF8TdetiE2pEa8W23U+/kpbh/PlulWQdXUdLnejboFe0DYgq4SNquWpLANbePfFn4rWDeK G+IvOl7k/hdnDTmCQjwaj6+jV/M2p8j73Iorysc8cdsmZotlk3VM2Cxu9tlkPhqNxTfRzcit cqdEaBoJDJep4e/oLhdy3YnnBmeTMy4X/mgT3RCjYKIEPkd4DaCZ8HFc+QPh46VSvfsiriGw BvDMaSyAlh1+WNzoWwQe0aLX5xPkuBKTSxiqZFo42hHjAKlkkp2Zcl8t1rmWKlNOzHdSatyv IlqNY2xYQbQfIRqWS8d9yJKheU4QJK6LokJz6Jw+JLl+4nRyNkz5sixxzopr2kWfd6Ezrrdc 9KRrHnw6odCshCQlXkd1DG2oVLlMlYTSUbIkzDpaQtOlmRJdmuiuz6HbfpD4zp+Tqb13CuJr Mbq8QpiC9bRgQRvfuyIbCaQJ75XhkUEpwoQj9PaSADBPc2Wtx8gZXpdMCbAijOUAvHfKbicr 5qf2gstnChmBkNReylhpKeBp48f6SjyLNS98RHVMeFmeBHEdd9adUIh13igcRgEBDsfEOloR hAUBLhhXgc4CsZAkzMpu9xGdpqOZlRI197Jo77qItoCRjLw74GITafTQVZ/pe++9a1sqKfny pTXpcHbpV3JpeKnUnww4eY+qBFpFJFgf+njva2u9Lpc/SqsqXVr1xtI/3Zkoe7hUCgV8oQ70 6aUzY90SSqVEZyhxJbN6dn1YTAKnuQwjLB5zmgD6chNfhTC8IPjK77Ihu2mfIzwDEZ6BXACz TV/4vxANw9WEUC4AWsQVPnfh508S77j1OcwcWMjJSvkgW45v2S8O8cJv5tuXzXcGJjkFFrwV WkPGR1CSnziLwC1OUXbTcmfY7IgQgZsyQI/LYF6kYoAelysUvAT4N4jPCHjK0zOh+dD5EBMi xrL+KpR6T31VFYWOu3d3joaQHhoNTYQmQzOhw7ij3ZWL2QdaUC5myySbjnJ8S3YbR6GU22UO Y4S71FZVZ1xo1IUmXJOuGddh13mX1XU8uAK2GPC90XsRqGCVmdjPCE65FJs0KeNOubp+qdEo KZ64pGRFJFof+qhva3eU4BBGf3S9gZ6JFLFVmCPUNuYfTSkSGiPa5hixwYZE8tOKW4YqTX5f gR8Ufr4KCUGD37iSJ73ybV39zV79zV79JIML9OrvW99H+vURQukjhNI35IdPG2peN9SUL0PN AXDlD7oMfYc4GGYoTy7Pk8vzXSTGChq6SDKsLoiNIisquiIwcBdRgqFrF03eJwljukQyhkjG ECGgxRhDrZj+zxeNMdRW4hudu/Az3QldVdp8/2NMo+AvDcrl9nUbAFCp6zdv0aFPeQsa2bJn y/4tzJattvVtklZw2nsLViOyowwSbXwcA6vFefhrCrRlxHVJ1SR1sKecEvKkfIloCctGa70X D49Hd9qt9s1bttqltvUioXhRJQ5UNU+U4Dxpy3f1kVd95FXfEH6Of3nacKlu7wIzAjR3GfYE UnmfvNvVtX0IZDw0DjVnEK78jrw7NDS23Zw44vJZwHdODvwIFHnm040GMGVMvUfdg5u3P0/1 X3iHWoePMj4qF955UpFkCSvvxt9YWI9U7WfGfhNkpjGJj4G2nXejmTGsVKu5mDRHf3yipSsX a8MV3dkylIutH2gRc7EQ1qtPJPO5WGWOcZ9I9uVi/biiX57ckhnu2xzbspbNdQ3r9VyWpeza +q3b4IfRCi7OabdZrPb1/W0VKcSNYfQpiKlERUWT6lHYpAXVdL4rV8qnuitdaLLraBfdBW3B 4W19qaGh+PDoMD09PDNMU8PCMD0MYbz+YHV4YvvYHL0Dy6z90hzafR+BpMsxLR+AXn7WKHqv AGwKySDwX4P8HyYCrBmJSS1r7E2dvSXl4t1aMp1yJSLIw7d4tJU6+xTE6hOjOkTwgsr+/1Hc TVlCrOp2e+giH1lutq/Q6C9BsB1odLe3+GcdW+8KfPqhwY17E0E313nZUq9vVSLEWcKZrbUb h2g60NO/1DZUd1oThZHO2qai3Da4tKrRrhCcm+GRP0+f282nW3fvum1wcEvPXUu3bFWDWMEP CUlxFH1hsqTXNjjzS4NE68dS6Src1qZHC11LgR2d4VQqvGoLuvrhQhMPuyiK+b+Yk3XQy5ys RjhZheDhNmMZOcsHk8ASSvAqGU3lWMKSzOxbhB+wQWJeM1dkuf447NYI4QyCBToN3YNUlFwc JQNFyRDRHLGu5QhwzjUBcs6AaKTyoblaCfM2Dq7IURE6VQFG4mgjmllbuxsSlUNquRbD3qY7 Unyq3a4UjCixctnIH0dixeqXQuMV/EMABiIYRraLbOPqcpBY54n9u43UyQ20GePzKZZIT5Zw CpZwDTZIwi+CpCnIQlMwWKtSUdIzShqi5M0oeVASodFkFzlgJtAjl6tV/1RjG8amPTW9tcbW YP5XaqO1idpkbaZmLVqQTurT+NXRmu1o7UyNPlpDE7hhvsZE2WAuxhuGt1wulhpoYXMxz0Ay moslDcNbW6a1rxJrWxuhku0d5IlTySTPe7hQMGWfYdFRFvHsJDvLvspaWDC8hXMd0VRrPDea m4DMmtO5mdzRHEPlhBxNEoY48ITPTVQN41v+Tze+eSWZsVk0mQlFkNUmWZXmNDYSOo+T0Gli e/t3LW+QuHlF40UQ0IEG/9NXBm9Sgx5n2+qlVT69g7P0Dd96i9MDE9Hf38bHm/Nw4cXBrb13 Ld2+LS4Tmxs/gm69e++9S9HxYBTPtPW70eZvb1CI5QIz7bPMSTzPeCpKu8yZFsEw0AhuJHDO 0OkECIZ2KRaYO/AmVHQfNFpIN0tIY52CRhmS0QhhM6wOF4MrHPA+9FPg4jDQlGLxE4rzuwSC 4AQC3ywEB0DVYom5XEaQBBFFQFxYFlFNN+w673QAPR58Kvh36EeOU9E3HDbvrzi0wbEuuC1w H/qS40H+jbA9rrfXLCQ4YjaOXgr8SKH1ONrINu/GS9KL5zH+H8GkaEFn4DxqmbBMWmYsRy02 yznYyKGhu2axirMcFwBxwWCYzQ8ezW4aPDp65Y5jrtjGY3HLxqt2bH8OIqEpCz7iF+ZBBK7Z /jeUwrRTFsrPtL8rvBte8RJLh7GLeUk6UdSredK0Fklzmi0t8n6ViiJFRUEHrkl2XPO5BRWF GXwKOEMqJVvxydSZm38kEhjTGqY6tGa7Lu6j99nu4O7w3OG9LbhP2hdhx8fMLZQcEUGsh/ER AEeN03DUgMnMTDVubHHSGQJvrd9rOlxo6sw9N97y6v5X7/j03T/ZVLtx9ey919xz/XrmyGMH jtz58fS3v/j9e35/a1/jsbteXvr54b/94EsTEHv7+6UB5hlMaxmqTreYtJZbReLt27lWKMAd AB4Rn0ypTM5HeLBPJeH2Kvg2mniN8F11OQpXZbJ5r8VjU54xNoPQnRh+lDRP55jNTuxjDopw YQph6sQcFiO3BcJwLwnLnRdewoy1fEl020mq/cLHTwIhtnNAkyREjeNW9eC7I3TrIzzSpxoy gFivfq2HCVhTca+szZOhkOzBN+OEu4EbIDG6gsEZ0XL0zxkz/CcPVH0PtwqotS5sFHYKD4qW +wtoVaGxarCws3CDeEPhZvZ28fbC59lv299lf+9wV1Zt7xir3lS16KtQmWWyOa8Pwyr5/hYf BleZJJVJjGRi1Fram88ylpLQieBOaDvckyx52tvi3AxHT3DT3BGO4d5TaWLCC6vqKIStTicQ hHsaIZ7WxEQPBPQSZYbksDNieYEdggU2tGyBZTyQS7/XSKJertndrFZNu9IVrWZvV1HZjU8d jk4VtTlL6h8lUSd+REyCjNYRWN6QjtBhpglgOoIrfBJWg2HCMhIT6NBISa8/OPKFT+x9YPK7 A53Z9lB9cEmVuzK+gJCMSRqqOjyf2bT78is/oW+vlFNMfer126+56fOvLTy6P8AXl969uiMG 6eScbbuZa8cqkmf/0nf3JHu2X/Gpk/+w9wrJC36KtUsDFgrTcpTKo9dMWlbShFWmAyRtZQCr 0jFTl/aATkIiM82cNwSHeMAITHAM5GQiwS/WZwzVWRfsURsf8yY1yZYb8zrtHoNuMMk0VirP 84RiDaKZD7cCCw23Ah2GW4EGFV6JbRUYVCSQW5Uyo0VaL04X/3P2cNFSUSqJRmt3fkTQFT0x 0rohv50fVcZio4kdrbvye4RrlWsTe1rvEvYq+2N7E/vz9yl/kf8m/w3lm7FvJP6y9bH8E8Hv KN+LfD9/MvhDfAc/y5/Lf5RvVYs3azdnD/oe9j3sny/aN/lQC+vBGnTG1KDDEh+LM0klh+Cx klpUstttnnCYisc9QHZlKo5mED2BptERxCCW6PvvpduEwGiAfj7wauA3ASZAIgECawrN2EnI tLCYH58yUleXiYK90FgEevQ2M4FKqawvlAqlVSrrwyctmFRRxg8hlE3bL8QC753qzkM4cP6i Km7mIzejJymCv7sYsbmdENiDmRuljoGldl931C/tfGDjfX+P/H9bn0j31D6X2d2YPPxXN6/6 BHPko09tb49omuCsY+h708j7P34XaaoaSS2W0V9jef3DF07Od1CGx5h+GlNWFj3ZjJVsJTzS Fg+JGQJOM1Icmar8Ss033sS18SYijQM3IhEScaKYxwmEjRONl3REAiMFZTDmSlQak51nJLMn sz/DZLJ2ycVgZnUaNNwFrN/+P6gUvFzCpe7eJAyXxtfucex30A48gGTDd0oYpUg0WLjHPxBG GQeLANArVEi8VTzemlth4RROkXir8WUMGdb3YPWNb6fbeZ3W+Xstdr0V7WpFceByRF+8P5nJ qH3pWGYtxTlbRb8qIIsEW6zWBRdyjTEMZcca4S4b0m3IVoq3olZKTMXjcRVNqzMqTakC1hDn 1TOqVZ3IfWd5BZCh402d3TtlJp6aWhgXzVV11AqX0xTGd1hwBjqbceFNrSu07Ei9xOA3dPPt XRuqqeS2gDdQrPjcqy9fyve3yJzVnVTiGQ4FmCOvvLKmkOlc589dvbRxKIPBWypI9KnrDl8W AQCH6WX3hbP0TzG9tFmqJr1kOgi9dOiAzmhEfKWI+EoRH1bYjAvaMwm+yX54EKTtJONpm53N 8AmLN29Ft1vRTVZk1coIoVa7fGsMXRdDMU1V0IQyqdCK10k1To2PYwxUxiUuxiE0G0gE477T r50WXjMk6TJ1tCf4DGtpDca8JSvd2mY3hpG9g1Z0o/VOK23VWu1rY2h37D/E6JjmdSK4w/d1 BaiF5zvaFdZDtJiMF4pMpqPdlJinjPIUxM2OwyGcOjXeEE6RVVfmSpicoyAXaK+3pDvrhayz LvnHXDvSjwpfS1k5O5flchMdkx3THTa+Yw6p+gHMLn/s/rHnVOqU9k/J11NvFN62vJ18O/Vu weltFMYLf168u3AQHaQPMtMB2H1vOvJg8WDJDdl3OMbhskW4wsstP0qyESbo90aCUTkXLhxy HOIeVb+a/GrK6c27s4WBwkjHro7bcrcV7vc8kTzS8Q7zdsSVY9ti1HN0DMVRmWzAlD9OPVea Q4outkox+blwTIkrSFBU/M3Bm/JzQXizxetNJd1OC58hhTWG/itVKre2URR8qco9sizBAg5/ sAxfLP0TL0JeCEX6DUSaMX7dOQl7nU7yMzzDz6FOXc4ocinOIrYwm0ETZLkpA2tP6cwzSKXa kXpssDk5IMcNUY4WIQr2QgKNj9XLGFcev4BwlWyC/gHZ8o0kw12R/AajUg7raSm30+92O5up cMaMXDjjU5dkw8FVczVqSXW4q1Te2MAyks3FVUG02eNiIoJsOTZCwdZWlD1rjaAmYwfdC1Zz f2T/UPhQ/ChrGR9DUyThzXZdnkWz9Cwz63zEPROYUWbCM5FDLQ8nZ4susuR7L1kZsl13lpPl 1BcLj6YeLVjHxwA0i1lVrjuych3pXJ3GR9gIyFWIH5+rl3BTgRyOukuIeRseFU6QaipcJ4Vc TxlhzUmjcEH6BV+9IPmMsbzGWLwXf4QXf4S3XlC9cM15nedxN77OCG78OW4Y4LzudePPceM+ +JBEcvzxEr1L/5CxZg8S/CxvjBda3tQQ9kkRO5qLplKZlcl96JlE+tZP9G9V47u+8uPn9m2+ KREIuROJyGPXrtt2zdLPi8VH7+wc7hAFr4s5svTyV28YKHZnc6X1133r7kMxTkHrv/TQlfV1 V8/01Lft/csQ75EwD/Nf+Fe61/ICFUaLzQjiqO7FPCxKXOhOFzHAuAI+ZPWRqo8IMl8zWsrX 9Kv74Lswkrk42QIf9FsgdJhCNizJFs+cLi+cMmXYm81VeBf5kxwy4gfJObCiHgavJ4FTzYoM eI64JyadyMmHUeB6P9roR+TjdEyK+LOdYWQlyoGVGFOsRApafYb5yEbulMg/X9PD5/NFIyuM KWQdQGPxzPj4vHBaODXejGnAP2v4JOXGN9Dnqu9Cu2i6ET0kHpKfDzwfnJPfke2zUfSggkZc I+5drl3u30pWmxSQMhITDEiywiA4+cOHEROomHfLVGga2Vw1uOngq4FfEIz1SX/4J5QT/H4F FQvPUjl6NEpHKYQsFmvKP+pD0z4EiQSP+uZ9Z3xv+Wy+icj3HmyqBmaq63GyvTjs+UY1Fs8a njz81lmExSdF0JmxnwjZFZXEJHUEkiLBVF0dBHGlIXa4k+ztNvD66x3ZxOViJjm9trS99ctd NxdDOcsLS//Yv/jXY5fnstde17HrOvrPEsHrN6Q/CZKRvnCWWWS+Rml0xaSqYIbYEFkTljvV rOkRMPGQGjM1zLNGTIaqkI6Kl3gfvE1y8zZ1UVz5gIQNeVNN1dMjaTan6pFs0YLHaYfI/CdB 9WQ5qvxmHqLHDQh/rhmaYewV8WZ+JY7aZjeWLDAs51SdkielhfCoxpBOExNzhg+MeMVUhXjE FAKxFI7YVbwsm1YJ5ak2wyuQ9oIXD7p4m1FCUCG05/Vm0ivt/vgkEHsjnOZJgAUmQgLEMB4k 61FqKANahZoB+XA0Y6k6u+I96ob4BtWqsL4R0DwTIzEtk2QzqM8eY9eqTi3KzqF1uo+jNA2L JHgeD+fknM4EWS7loY5C0pBJNIteRRZEQuS8spLyekd9Mz56Gp+O+hgje6VBdpjo0i/uvxSn Qeb1RcjE3NxKiiTohTtfRmoQAhKO8GKEVyKUIIaFaKS5MQDJ+dl0xBnropp0iHGbvZYwqVME /y5zHZ8IxjOepV8Xb7lr3fDeQqRrA+oba+Q/M1jfwXxt8aezZDXUi9Orx740jQ71tYeRtvjo 9GjnEG2/oovWwGOHaXQB06hKv2DQ6FMOB6V4bWRfSxEfKj5o5pfHKAiiWDh3rlHGEqF80abW JnGOMOtwtCTwdU4/Mf76fTaR6H+i10aTFjy/VVJRYZzT+Yv/jVDj8punBbKqTnd4N3HbpZ0y I5O0wbUWkELXBGp+2a8kHS1cQlS9KUmVVaXHUed6vJDyu0cZYDc61nLrpHXyRuV69pvsIcd/ VB4Jz7b8F+oJ9tuOb8nfUp4I/5B90vEU95T0tPyM8mx4vuWn0ofch9JHSnHWgVpIjNlElZT5 NqOM5Yxy/XqjzGSMMpk0SlEkpa7LkSrfchcF+4RPWu9SP2u9TzzY4uhhq1xVqodfss0n/lmx P8A9KB2QmS7vBon2Sf6YjwqrMcrLiTE8C+7XCw5FViVZrjg4v8PBhRUl5WBxjbXbrBYLiyGZ z4thE2VTZKc0h7B42sUhgUtxs9xT3GuclbvbEQYiFnRb+TB7kn0Fz967HfI+BRIjqJQD3y/v rTrMIHQSQ9Beg+JpV41yzGN1aQ49/5TQgqZbjG8D94LyKd5XTQBjlYV8HnZqAX6hLEpvQ8oP 6QNlAcopaWE54YewANz1wJ+QHYpk9IBgUOOPkL6RFepJTg26G5h5vfM0Lh0pJ4TlvYVRCgdh yZyvzqoYpuDDjH5AxuqiZvYOn89IK5M00sqQXFGQGkpERyKZXOCnr4dYZ0sV5av+ZGTp2dzS yWA2LrYzX9PSarKyZKPd3VGPg3dqmkWM9X/8a8baWRYcLOjGF85aT+DZUmBOm7MlnYiJHroA Rj4P5UhLrCWrxW28Dci80SiXjVxQzURQTaNeGkvPtSQ6MkJUCnKWiFmBNc5S2mGhsmTw2wuo QO3TkObcl0VZpzF6oVBMJEpF0y5NEk+NNyAUlHyYEY5DvtXwMS9JAxJp1IIZrGCKWkYt7Spd 75gsvau9m/2d9rusCzoc99VIv5fD8WqiVMrt7ozKcjycFEoWLh1NF9L19JbQ46HHpcfTrFPr SnVlRqghNGzfyK5P9WeGs8O5B+zTwrT4F9oD2Qdy06VHhK9BZ+1Z4aR2Mvt86WXt5ewb2hvZ M6U4ZbXYbQFLyKHZM46sLVcLrRHWiKPWq+xbpatyDzoPCg9ID8oPJh/QHkhPl0IHHPeHDqQZ t2MM3SrcKlrwnMC/pqZxyI5nhRASY4KaTMRUKleIUTznifFxORbDav39P4DAwbkLd+u6pKVU 1s467Klc1p/LZTE1aJkK6/CzrAOjEzmQ4jQ/x2nJVKoiyX5JknPppIyVdTz/OPw7PIvO4UkU Q+d+EEe8CK8EyoOxCZaCgoAVeJWioRFRBdwFT1LpWXQDpVEs+o7OZ3V8s6lU1ql+zH+SwzrV sRPz1CdzSVg1E9DD5VEZHZbRc/Kr8i8w1/tKqoynd/hpldeQgH90c7WI9iwSqDQVwDPcpXPl XWmkp6dh9y507oTj7kyZfQZPcxbDKU6lsmg6ex52c8OyH1+aPWwnBtXRHJqG/dyEnJrTc0dz 87kzOXtuoriMmhbAoywrC4tnsdKz15zbuEnBDfht6ayCoRQcze10FSMyCiBWMymJUV8w9Kzl HHEQK8U22QG7siX/76eNW3m2C2wv22ukACIpKMFGhsheI0+mYdMCUExgwZIP+EQU9ixYLvxQ nD8eqmtQBMirY4GLmawMzmEmpMqQFHKEbTQZifkaJRmDj7jRNBbDp/6uKmWCvejEhpifPfOC P1NHiW25pVdy/3vpt9rSz6LdvZifWGKReGHxX9H3D/SGPJB5KiQk/YHF99FHnaovRmua+/qP 36M3Lj7N0Bs73IAZwxTF/ApzmG7mfRMzutKcVE1bihQeqgz554o+ge6GEEeqGBMNRlMuGxnn Fs25b2SdO+Bdx6GD7oOeg+KB9IHq687XQz/L/KzDwZfSnOZMuaa4fc632+2RnhK/o9NSalgb QkPsTjey9WqlZ6NzRBgR+2Mb00PZwares1Xeqo327LPvd+4X9ov7g/tDX7fPCrPi49Kz6ZjH ygu8yBfiQlyMF3JcLlTu4YSeLY4dnaM9zVjEFL7v27tRNzzILWVULqWrEmehSvAMsVI0Wi+V eupNhlYum5n0gKPNG2d4pm+l8dwMBYOZarXGOV2uDgk24ZHT1Vr139j7GvioinPvmTn7/Z2Q j92EJAskEPJNQoIJAQJGREwiQkAI+YRsskuSTbK7fCQKrBaRWqvWUi9vLkXr7bXotUhjmnKp 9VpFrlXx5afWWj+oWuK1FlOkiEoh+/5nztnNgljb/u77/u77+4XhP/OcOc8888wzz8yZMzln T1FxRuw9CfkxNKYYy9IEU8pWx7JUmpqf0T1t+zQ27Z5pdJojIy+vtCj3zMyZM4qWwdpbi2mx Wq3NcGi16cUZccXFGaaEGTMKikxxRUUm9Lxdb0osmpHhMF6VP91ukEyztcXWyXRyGnoiP493 Ay7gMTH8qpynyqW5uampKQYTlpg/7U6gCXkZh6jlCaeDOvi8arIVVzgOOt51nHaoeAa/Gjt+ zkpIEdHS9sHivBmYD54gRbTo5+yXpJSUseonphwTr4E18O/BXsxuyO79+Gz4U9YN4astf2Hf Jtab4vf2xI1N7BV+p47aY0u35ttP2U42cBufFIbmX/9pQI5NHNpuOQVKq7OVW8rvsNjKtx45 wpMjuiNaJDrkyl/9ET92En500YgxZeBPKH7+M31pIt9lAP0h/25EPL9J1U+OWWCuSLaJH+Z6 Agd28Xt1iZYFav43Ta0dUQmn+Gepf4Z0ZqaVSzs9bC3NcFr5BZ//+pyWD2Sr/DEhM06YRQ7f nZju5IhBXgwvx780wRcJg7FyEiMvGZLNpTYYIAZIrIgttdmspTFATkU8/zwFnxUS5CSWXwrj +d7H6YpJ8aUluvjSzIK40plAjC6BP3sJYQmlMytigPjSQg7UnMhrB2KjHsr88r/Ld0ToJSfE NBTeCJE/ZaSsX7STIk9sYl0z45JPjs/h65xk+vjMKdOMCQuvXzJ1Oi2ZlT5r5daTtUtKx5bl OiZV7PxuZW7u2K/Tk6fXPX1g6Y3zMDFNTrQX2qa63euT4lMwLdmn+n40dqhvlpSeHmdJTGw4 cmRtjH0GS09Xx6VsDl3onMOfiBlbLJ3FzFQY+dspVqfZWRLZMoPOSMEdg9jnjeMTU4wgYzjJ BMk4WSjIwkPhm4nsj7NPISzIP9YQnrKUmSJVn01S4mJYfyEtJLGYHqb18zqscXFFhMwuiix6 3mk4gvtCMTfIW/QHbdfXrv4FSQ59Thyh0yQJE73BpjwC9m96/kagJft7M9mk2XkJrSXfUN+u YXq9Olbn0CXps+OSpuvTY9OTpmdfRUtii5OvjXXr3QaPoy1pfbI7Z4uuz9Dn2JwUSN6S803D Nx17yB79PyXdn/1zcnz2iGYa1iTZ2TlZWQYqVuoOvrzPKVSW99N1TkdSUkGWIQ4MOdnZYmGf nYUiWUl6lUGXg9SBlYZumrLEFz+3Z4G2M/KnlaZYZycmJjn4aiH5HgP9neE0/2Npj+FPBsmw lX9srUkv6bfq+IsQKdmvW/kLDQ84mfOephyan7Mgh+U4imY/wh8b44+MNfiqTzb0nrx4toH/ SsBF5VGx6osns5WPLoZ/GVwXdeXmv9MXE/mhvr92caa9fGrI/qqluFiLa6JeZuB3snP477gi mOi/xefmTvndsRitbmo2zcrItOsdY98qefzGuVVzCqaUZhpSr01fOPYz6xSHLbEIPjwjZcY1 Y4X0/MzMWL3RjMW6fYplwQXv7bsqc7KKEqzz1zzAnkjLm2aymeRvckmd8N54+khFfqxOZVc9 oHrA/IDlEdUhlfaBRGpO3GieVbKMrLYui5eSVYmWSdZG1XLr71THrVrFKzOplJggWZlFbbpe TW9W02XqZjVTF5g0lVYasNIma7eVWQuYgSy4iElSRONfsi3FrS05Z7MtjE/l21rpFYVq9ZAh 1aiyWK3pkipOklSSkams1GRJNPNaVMvUVF1gNmlsTVZqLaDMYP05m08sRMXmV+RINO8BNCtv mZkWmCvMPWbJnJSfuCDxhkQp0ZRnLCaMMkdC4g/kS0jN2d7qsyf5B8fhAGcbTtpO8u/CiTfr eRTWUXn3F/dud2w9Yle+m6wkYuonvmzcpIl53xI6XqHHLC8VIBIPsJhBWCv4UXoCf1b97eGE UlVmHCffGI4rVfXEcvLe4dhSlT2ekx8Ox4O0CvLynxYVX5iSphTTKVO510ybMyWeThHfaJbq jRfeYM1jr7WUT0pWZWokcnGA1niuT7QZqWPsv9KlLMe0wqVjGRdem5bjbOdfhxqlz6limIVI JOXfCZNmVBgISVLTdtW1S7DyHamxnSP51fxh0inFU1Qxf3lHNY0+dx1h5GqpXVqh7iAJJJfc hu4nFpU9MSM5LXOqLsaYWTF1ODGmwjhMEiUi5WOIWsXv/vHX6rMqrMllD2J6f9ZqSbMELZKF 5+lVZY/H0ThHXv4hGnhiSm2dPCKrP77Iv2l9sUEZjAuqscDG/yjXUZ5hi4+8c1wU9XpQxpWz 6eLVVQa92ZwTO3Pe0jlXd97O1roqjEaTMSdh5rzqqxZt2KnumJnXOnea2WKdl1NwTWBl64+n Ty+rnz/ZYrHNzZ61xLfS82MSCoWtQCVyhBDVvxC0uWdWcBYjlGVJM3Hv3cDXrb+UXPQMbJVE bqhI0Tswi6lt+jgybK6IkybDOOoya2JaYpA/906znrA5kic/SbPIFPIKnSd/vrD6YsPH49OR 0nA+p0wqLhl/smL8G5n8mYzR9owko8lijE2KyZyfllV2dceauZIrf17x9OI0q1WrL88tnDy9 t3ZTC/9Vr6vHjkgryPMkkeSTb1XM25u8N++R/EP5z+f/IV/Tb9mYeKfl9kSV3TF5BqEq6xRd lsk+nFWRbiTDsRUm46wFk8uW5VJrblpuMFfKFV38IK5Jz6rKrPFp8cF4KZ63y+oomBXdubxR 5xr4Myr8w8kn8T/80E24T3t5+y5tntKN6q/I97sWGIxmQ0JCQlZ59ZxFHXfQ9TdVGwwmc0Ji DLq6pLLz9rEjWaUN89CROl15dsES302eA+lZua650yxmnW5+dsHijehs3mvibVfpcZJAneHt vDjx7kO8iBPi4hO0ap3OrkvRrNRp7YnK+w8sau83+i2Ic5e/BWFPvOTVT5JflB1TtOCdYzb5 XYgn7rVT8b6lo7Bwdo/9cftpu+S0L7OzCkTN9nvtKrvyzqddeefTrrzzKUplOJJmj78dsXRa /AzzwrjU+EqzNoFoxfsRZpouXoxw8Pc5xYsR95pOmxh/O4KZBhOV9yL4Q3Qfyxu2C8pjSy99 h5O/wsnfjaBf8drmzUmXv64pPX6llzQxDx2mGXQ/fRXzkP0XmId+RqjEv+996Cdqms/nY2UK ovvHYukozTiglFEnf30ZdfL5B9Qt42Uo+aoyI+P1kLHDdPF4Gd3fUEZHPjusiypj+xvK2Mif DtvCZfibqtvgcWmkpsI8ObUipTJVS4w0ReJr94o0Q8xsY4zKmjKDpMfHT3Gm8Sdn6Q26Jl23 LqRT6fLRVdyjPsYs8c6RbNLU2GBfUP1pEmrKiPxkg/JLn+PfxpEfX91W0/jkvMLKgqn2lPjc Wc55cUa9qUh0WHb8f/bdE59cPLXIrJ+Zc2POvfzFyDLRaWSuEvbQuKiwiv6TCB+wSWwB2yLF SN9Qdajr1L/XPKJt076n+6P+gP6coWE8GH9gLjKftjxivc+2IaY9dsek+En/Ed+foE4sgqef cLyV9EDyn1I6UxPTkp31zvqpq6d969KQsWv6ozN+O3NRdmFOIO/pgtWznih8rVhf/NlV9WW2 uYvLH5v32/mfLFyxaNvVx69pv3bPdSPXV1Yt+v8kNCK8V3W26mz1NX8l/O+vCzU7J8JEmAgT 4e8KD/5fCYcnwkT4Hxheqxm9QTcRJsJEmAgTYSJMhIkwESbCRJgIE+HvDs0TYSJMhInwPyMQ /jddwhYhbqRBoiFDRCLpoXsQzwm9hbhUxOWhIRJH4hCnEwln03E2BXHp2OeIy0OViNeE3Ijr BF0v4mHwzCTWUD3iGBGngycfEoYQzwnxX3QsFXF5qAhxPSTno1QlKRI8RSibgjhGxOnIL0ap 2xGXQloxSt2DuD50gMwB/1uIrZA/h9jAOQelOJ0SGkCcCs45kFCPuFBwVoZ6ES8W8RIRV4UO IV4u6JWCXiXo1YKuE3Q94lJRVymxou2loq5SEiPoFNRYirp4nC5yKqF5KeTzuAqal5LlIn+l oFeLuB5ny0V7y4XMcsjkOTGCToH8csjkcbrIr4StyiGTx1VoVzl05vQKwVMreFaLeA3yryPX QdvryDDpJSthnwOIbaHfII5B2ZVkKc6uxNkqsgZnb0Ycg7hO0HWCrhd0vaCHoacb8SqUHSY3 oeww+stN+L8y9hTh37Xg/zaIWBLelSqOOM2IhcYqtER85F2FVkXxqImdTlVoDZlKlyu0lmyK 8OhIATmg0HqykwYU2swG6Hnuz+JfsWq3QlNiVf1KoRnRqlMUGt6tVim0KopHTUzqDIXWkBj1 PIXWkrkRHh2xq/6o0HpytbpGoc20Wv0dSKYqCXWZNCcErQZt04wKWiPyxwSt5flag6B1gk4S tF6xoUzLNpRp2YYyLdtQplVRPLINZVq2oUzLNpRp2YYyLdtQpmUbctoQpb9R6JYlaFNUvoXT 2jJB869OWbRLBT0JdKx2taDjovjjhR1kOiEq3yHKyroli7pkmSlRPGlRdLrg3yLoLEHvFHSu oHdzWhelvy6qLlNUvinclkeIkxTCIrMAJ6klbuJCWk26iRcIkD7SI3KuxpEPNI9bkO8RHHk4 s5B0IjjJcuS1o3yA+MWRC6kL3JsQt4KzFue7RK6T1CDdLLi6kdcCSU6c5WdagICooxU8/JyP dCCvm7T9Q/pdzln2tXpwzdvJRrSJ111GVolW+BWJTsy7ebDVHFCZkO4h63G2G+e5hgHM9OPy ZenjspeRFShRewXtayNUpdB/M2R4oYWT3ACpbaIWfjYXWIFyXFoncvoUW/iE9bjUHOSsEvwB ke/E/Mbbwa3pRZ4TPV2Ka0oh5rtutNIpdONyNor+4tZ3K33RJiQGRK/w4x5hiS6cDSDwXnWS daJsQOmXazCjVsEj5LK+qDM9wkqtqGW9kOgRttws6lqP+Mr1ysecdz3au1G0olXwdiNuFed7 RE/1CS294myPsIcsYb0iS24991fnl1reLazZJ3rUgx50Cs9bF6nrSnp5vyT7b7fSuPTWSD/7 hMcEhObrI/575dbLtX9Zr7lRNuAtkdsSEPWFRwaXL7e1FTmbRcu7xWi7cktlS7dcYlWX6Nlu JZZbJdMbcdQjYqfQdlPEc2U5nLMTHH+1jx5xFhbMKnDWul3O6m5vd6Cvx+W8utvX0+1rCXi6 vXnOhZ2dzuWednfA71zu8rt8m1ytebWeLpffWePa7Fze3dXidXr8zhZnwNfS6upq8XU4u9u+ Wl44s+xyGctd7Rs7W3xlq1w+PxidxXkFc5yZ1Z71vm5/d1tgpuAHu+BetqK6NiK+lkeVvpbN Hm+784a2Ns96lzPXuSLQ4u109UELn8ff7c1xrvKsD3T7nFUtvlaXN+CcVVpUuKZ7o7Orpc+5 0e9yBtxoRVs3zrT4nT0uX5cnEHC1Otf14YzLec3KqoU46xMHPb7u1o3rA06P17nZ7VnvjiqL 1ONd37mxFUUD3c5Wj7+nExW0eFtRygOG9eBC9XlOZ7jybm9nnzPTM9Pp6lrHS43L8oa5r6iS YG/lbfa5/AEfWgezRVWP4hFZc4UGmR7UEnB18c7weVBra/dmb2d3S3SlULpFVtXlc6K93agK 8cZAz8aAs9W1iRsXPG5XZ89lLcIM3C3GYgu8zguv7+YjkZrhaRtw/AcxC4fPh+fVVnm+lAak n0i/kP4D+HfpsPRYlCzO7Ykcvydkuy6py3WJNCFPlaqapbpeda1qHuJScLdgdPBxJ18J3PQg /QGWcnw2WAh+H0aRV8iQ15UkNAW8V/4nEb6CiiE0FOLXdkKq2QeFjEi7CVmkVlfh2Cm7dvhf CP/IgtBYbXXN8oICQnbKa0XCf8mVvkRfg7SlWDDeRSj7NvtfRGIDbAD0P7N/Br2X7QX9fbYP 9APsNOhP2Oegv5CggRQrYY0mTZIWg75Wuh50lbQN9HZpO2FSUDoL+lPpAuiLKj/WLQEV1l+q jao+0P2qftA3q74D+j7Vd0Hv5itZ1fdU3wN9vzqHUHWuupBI6iJ1EejZ6rmgyzWVhGqu0aAu TZWmGnSN5ibQqzWrQa/RrAVdrwmA3qjZCHqTZjPoLZrbCdPs1NwBepfmm6Dv1P6QUO2/av+V SNqHtT8FPaxbSJhukW4vkXTf141iNfUn3VnQn+ohWb9Gv5lI+i1GrFKNBqOZSEaLMRP0TCPu 4YyzjT8Cvd94EPRPjL8E/YzxCOjnjC+Cfsl4jDDjy8YPQf/BeAr5HxvPgP6z8VPQ54znQH9m /Az058YvQJ83omdNxPQMVm7Pmo6C/k/TJ6DPmP5MmOms2Uqo2Wa2E8nsMK9CT6qU/mRkirCw bFvZqoo90a7laFGtDrbSrdahRbo6XSPoFt16xG26HsSbdH2I+3W34Ox23a2Ib9Pdhpxv6L4B eocOa0/dHbpvgr5T9y3Q98JW3EpnFJswWCMbdI4R977GAmOBaO9HoP9o/KNoyxHEz5meQ4uO ol28FfGIE8wJaEuiORG0nbdLaY+B3E+fJOoWX8s64lzf5+sk89t9rg5S43at85HGzpaAFyPb QOjK5ZVO3LfzZ/IZrGFUKNzfCNsQMVL4PY456pjiPsESOaYYVZBUVbvESRIUDoY7BqtCSzhr IzEdLp+XuEXsFXFAxP38skOCIt4l4ntFfL+IHxXxyyJ+v6ujq4OcE/EYj6lGxBYRJ4g4VWn/ lWLGfz0lKqVoFb9LUyPVQl8DWm9Cu/jXcWNILJkEu8SjRYnEThwkiSSTySQF91BpuBJfudyV 8jC9CEuNp1bI/6qUr4rrMX91Yka7hewgd5HdZC/5IXmMDJEnyRHyEnmNvE1OklPkLLlAVdRE k2gmLaGVtIrW0nrqo/fTffRheoAO06foUfoyfR2SdYTSOwm/j6UxNdARafJVhH/JjabsktO0 TnksOOV+p7N3ymnxajktGZbTObvl9Jptcrq4TU6vXSqnNfuJCsalNxQSDcxOG1REAweiTZ1y /S3TuTZIz8vH66YraYWSDstp6z7Bp2obbnuh7UTbGfmovbk90L6rfa985Da4U92F7sXykUfn mewp8FTK5TdolPSMnHa8JLh0nQ93Hu483vlB54Wu2K7Mrvki1+pN917lrfI2ewPeXd693oPe I943vKe6SXdcd2Z3uaxxj4iR5skSe0rktNcmp77Fcuo/LPNtzFPSEuFxdKOXUMthYaVm8gJ6 j4meq6Vt9BZ6lBFWxraw29geER5i+9lhhONsVFJJsYjLpfukPdJR6W1VAhtVFagWq6pUL6sr 1EvVAfU29RvqE5p0zXLM1g9pXtK8j/ChNk/bo31UN1lXqCvXbdDdpTuqe1t3Ru/U9+uHDFmG I4aPjDpjrNFunGqsN+40DhlfMJ41FZpqTY2mHaaHTM+bzptV5hLzavM285D5jMVkmW+ptNRY Oi13W/bCt/kOIN//47t/ZUB5aIh+ErqHfgH8JXQPo4A+9BYzhIaYNTQkfg9rCCNDEuVSxL5g Wahe7AzyfUG+K8j3BPmOoCR2BPl+IN8N1IqdL74XyHcCy5DD9wL5TiDfB1SJs3wXkO8B8h1A tdgB5Pt/ZXzvC+D7f7FiT47v/vH9OL7zx/f9+K4f3/PjO358v4/v9vG9Pr7Tx/f5+C4f3+Pj O3x8f4/v7llkSdBfSELKd/X4nh7f0eP7eXw3j+/l8Z08vo/Hd/H4Hp5SEqVsqDcGaQp0T+V7 pjhbCT2WAFXQdjnSlUhXA/UobZVbKepMUeqsFHt+cskisdvH9/r4Th/f5+O7fHyPj+/wMbHD x/f31GJ/j+/u8b29pSK3is89oZvF7h0lP0U7VGIPj+/gif070GqWGypiJUAVcOPYdlYLuVqU M6CcgX5OqugXY8+i5y2Mjj3LkmAvNXxhH3KOwRf2wQ8G4AcDROK5OGrDURvmSfgDzQk9RnND jzE1oA+lMcPYr5gVSAj5GezK0kN+Eg+upeBKpHmhIpofWkVnhZJpEegvxg6iFoJ6D0LCUmYG bNAyFh44CbADSUByqJGlAE6cm4HjmWgB5XphrpaEN6X9TZqoOTc43gKHH+UXoSWLiAVl/Sjr h35D0G8I+g1BvyFw+sH5MHQaYomAA0gDpgPZ6FUN5L3Ia768VtFbabBvGmy2GG1shiWxXqTc W51R/rxY8ee98Ii9kPQW9HgLevihh58WALOAIkD0U6gesmoha5pohRmwQccYIAG9ZIde6D/Y aghtPgR7+dHuQywDx5nATBxnQe/Jik+ehwZcSwYNFkODxf9wTyWEZv3V3mKw2VOw2VPEANlb IXsrZG+F7K2QsxWWfQv8W8G1FfxbwbkVZcKel8D1VXRb+t/rRbDxOyQGMochcxgyh9FHGyB3 GDKGIeMg2jYMGQeh4zDk3AE5z8G6w5DDPWEYcoah7zAxQsoopLwKKa9CwigkjMJfXgXnq2wq MB3HM5Fmh0aJHrJHWRzabUeaFPovyB2F3N+yacjLBLLgJYYv+WTYF7kfcg2min4dEpyvRtX+ Kjija35VqflV7ptjI5iJRsgjoe3k0dAxMghQjKIBrJ6GQ1VsIUb+Etj+eqAKx9VATWg7Zo9f sZtwri40wtaG9rAm0G6kHUg7wdsFeEODxMbKwDE/NMgqcOYaIe0MpJ2BtBFIOwRp77EbkH8j StSCb03oSdaIYxfOd0EbCyRsj5IwqJSsiyr1XZQaEKW6cK4b6EXJyRhZDvi0I7p1kDYF0tAy UgRpbWwxuJcg/3qka3BcB7oetTSCbgq1snWgXaDbkLYDbpTdAI26QG9EugnYgtr7MBOqhdRq 4mA3IW1C2kK4xy8EdU1ohBgVe/LajqEd76Adv4f+p0StayGlCTbkduzCPKCDnt9Aq0dQ9mFw 8tZy+wyG7QPbhGVVh34DSz4MjhHU7RD90gTOFqRuyJX7ZRBy29hmlFSDm/cc5zoDjmPC1nJu kygjcmDHQWhdBgnzAbkH4A2ooTr0bVaD9AbMaDcif02oC3qNYIRaQwRWJ1hnV2GlXUUehS3K xs5DQhskHFKs0caWIOWSqoS0Y6j7HUjrhqTtkDQY0WMzyvdBD0tEj2tEi0fA/aKou5a3BVK4 xTuATtl3oP0ISjugiTXE/75YBE8YgCe8qEjaLloje8AI6n9VWFf2gAFhv3WgW4W1B+AB3Mfb mAf5G4AOYc8B+NsA8wtvGIjyhkEyHaNrEKNrEHPqIObUQdQOa8AXhR+O9UGDWfAI3r8OMcpq cHW6SfihA32zHVo4WAP8rXHsPWhjYM2gW4B1wHrwtyJ1gacNaTvgBu0R/lkF7QzQrIj1gPYB fmAL0IfxoFfGVFWkH6qERVthze2onUsdIFrFW/fAwwahW5XQzS18H+sNYTM3epyyLsL/sjMs yt6OFRKnykL7UcMG9Ph2yBlETQdg6QNR3t+G/utCjclKm79LDChRK7xM9pHtQrca5N8ALdaE vhPxfO6Tg4pH9YpeDLfihtBiMU44ZzPyXMLbXSQWlhmBZ7wI7ffAMw5AKufhXtYspB6DHU+J cd0NwPNZAHl9GBdWZZ4bUUqcRYnnxAzVBp91YwR1IK9TjJnDmPdGokqP4M5DmYdQekDU54IG bYp3c/kM84SD+znW1rwddYTzjojcDng/92Uv6PDMplVGrszBpXTgKoEzqHMEvduIo2aAn23D DOOGdl2hX0OzM+D6Dbjewer/EdiiDrPvWtGmY8pcEZ7D+Qj6PUrwUXRQzBkM3GfEeDKhhufE aGtWZuo2XK24pnI5bkFe7kXOjRb+FnNZuD0y93sKp2iP3HLR6vAobhGtHolq9W9EzWbCV5wx fJ5WbNQsuB2i/+CNbIMyB3SJsV8kesAaGf8pOEoF+Jw03qfbFS/gPfNwpGe8Su9oFK+TZ0Qv bNkb+pWQa1JkDEbZj88Lzym+MMivgeAegMUHhQ0p1xWW7BT5rejJxtD9qHkI8t9CzaNCfjcs LjwHZ/dEeeeIsFqYg8/NUqRlj0IuX8sX46gY7TyGdh5TZpxBcV1nJFfs5BD+jAeu8umE/311 JoJE8hFU6IUirAmKETRkDoKW/9wU/LccwcCfMcAqeyWCiawhdeiLev7UAPkp7j9s5FlyhMTS bJpL4ugn9BOSSD+lnxE7/YJ+QZLpX+hfyGTcH1OSwtRMTdKYlpmJk1mZlcxgCSyRZLJkNplk sTSWRnJYOksnuSyP5ZE8NpsVk3zcWS8ks1glW0xK2RKM9nK2lC0j89gKVksq2Sq2mixmdbDu dayVtZIbGa7YZDlzMzdZwTawHlLLNrEtZC3byXaSRraL7SJNhOrL9bfxvw2TE2Q2IRs2AbcQ 2mFHehuwC3QqIb3NoO8W58iG3cAA8CDwMPAYMAgcAp4CfzrSI8ALCo4r6esK3gbeV8DpD1Em C+mocvw2oW31ctpRgPSsgvOEdKDrOjTIL0FqAmLlMoKWQXv3h2mW2P6h+7T7pPuCO9aVJZDl sQiUuGpkeJwCda4CgRLPdA5XpyuLw12joMTT7z7hCbaPus+1n3VfaD/vPucmkDvkCQhoPMxt 8ugEX4kn6C5of11AAz5TdP3txwUKQD8E2BWE+VNBA67a9tc5xvV0EQVhvYWe7nLQApwGlniu EqhRUMLbBJQriPVUCrSBlyN83Am6M3K8NCKf01HHrWf/OtxLoEsbsK31bfcOYAtoH3AnaI69 re8LPIS2cWzzLBMIHw9BxlCU/ZV2R+xx1OOW0Toq8JIrVSBsv1e4jYH9oq/r3W+gbziU/kO6 E+nOSD/IPhHn3o+y+2V9wn0b6eNw34b7Miwz3Pdh2emQBbiaoWvzFfrych/8ur7/6vJJApf3 /SLQApzm/RXxnVQFYd/JEfhKfk+hQC38p1bxJ4HWDwVqFYR9bIlnvkCY/3I0w++ao3yw5GsQ 5lukjMmwj/rQdo6ID4Nuizrm/sIRC/+KdZWM+/ClxxFfrUVba4B7UeZ+IOybHPtddoGIv4J+ KOr4APqDI8LvWSVw+fmwf4dRLvv3l+aZOhxzPA2a4zDow0LHLIEh+DLg6vTs4Yi0bXx+ko/D /CUc8NcaV7mAOM95UbYmqvw4vzy/hPX+2mPPOg5XrWcVB8bgDoECPreJcZUqkK7gJc8+AcXX Pfe5UjmifNgpwOdFjvA45giPt8vHXRjlCi7Pr1MwPvbDc7Os4/j4leeEcHoC7TzhihXt5emX /Mt1p4BiQ89d4TkO7ec46vFifC5zvzJu5/b33R+5t2AscIT9uwB9WqCM6ehrgzLue95uP84x fr7nfYHIvAG6IPo4Yvsw/4cCl88zl88b4XG/CPYHetN7szjcS3oLBMLj8rJrRaTdGJM9o8BZ 0Jjve867snrJl4/Hxwp05Lh87Ci26oWf9paM+3RvOY7Lx48jY2AHrgMc23Ad4Djau0iGSyPw EvqOQ7FL7xJXqoCm/XWOsG/2mnBsGvfxyHwbXhNcfu1U2o9Vk1H8LZyIv4LrxN+/9erZ6tnE or5KPZdYxV+pJ2lqNCtIkmaV5ibiFH+fnir+Tpwh/sqbx58fZH9ipyElTZrKf4JNKiAaqUgq ITbpVuksiVNnqnPILnW5+lXybfWv1b+mGerfaObS6Zr5mqvptzT1mnb6HY1H46Hf13RoOuk+ jU/jpw8a9UY9fcj4E+MQ/RfjsPFn9EcmavLSRwilp1nJ+IqveQdwp/iLFmm+F7gfdA4h7V7Q e8U50vwQgFVV8wFgCDgMPA0cBV4CfyHSV4A3FJxQ0pMKPgJOK+D0OZS5CukF5fgjQus3yGnL fEJamAIdYAGwVm+pRJoEOOUygpZB24cjdDzJwXq9ktSQ1WQd6SSbSJDcSXaTfWQ/GSRPkqPk OHmTnCJjVEek5l3NtzTf3Xxb8+6GQ4Q1z2+uXDu78Tyo2c1la7OasFhvzmouaPQ2fgDK2Ty9 sbVxFFRC8+TmqXUvgDI1xzbbG98FxZp1zZbGpwhr+rxprFnVeBR5pOls0/nGR5F3rumjptON g6BONb3b9EHj/aDeb3q96e3GfaDeaHqp6ZVGrMKbXm56pun5xjtBDTa90PRUYxDU/qanm4Ya NxEVJJ9qenPtYUg40/RBgwE5p5oeBX0QZ4YbVteVgbu/Kdi0sxH929TTtKnplsb5/21eqhbP dBDxNAfVbNPcTvTiuYYY8VTCJPiVnd4mvg78FPqANHLALxrRz9CCuBKQVip5S4FlwCoAK/3G dYAbgM81BoB+IKhgp5LepeA+YI8CTu8DfqjQYTyq4CAA32h8EngGeF45/8yXkLN2kwi3tG5Y u6m1Z+1ta3etvUXBJuDutbsRBpDejfhBYEAccZrHu5XAzyNnTU3rhwija2r5kzqw/xlC2Fn2 Ke57P0NfqERfaERfaEVfmNAXpcSsnhvpERt65EaSqFmBfkkW/TJZU6epI6nol8dImvEAeicd vXOBzDCOoY+y/h/WREkFCYi+zsO9ManHnVz9hwDu4Opxp7Yac0k97tYacLe23kd0dUvrlt10 H+JVdatuOrV+D/9bPvsz+zM0PccwF6jL1PBdzXLNciLB99YQlWYtPFBt/LHxx0RjvGi8SLT/ UBkaOzqJPxNuok9hLiB+9L0ffrP+hABz2XAM//HDf/zwFz/8xQ9/8cNfWuGjfviGHz7TWinD /7KSz/lei4DenErYTdtkwM+ZazLy30Q6dTz/q+DKBPL+Br7ZAFrsqhDHQi+BdxXduC6Yp9Zj Xl71wiVlZb5T6BMVyi9W8s78/ai3CdkRhOX6Pyfs1guE3cYibeZ2Ha9/DDpeJSCOW3O+EuI8 6kHK3vEt7/MFV/lW920J1vsa+7YF1/la+3YE3b4NfXcGvb6evnuDAeTfj/zGvr3B/pVtfQ8F g75NffuDO3239B0I3uW7rW8oeJ9vV9/h4B7f3X1PB/eBcwf4e/qOirI7gj+E/JfAubvvleCj oN9AXQN9J8DzYN/J4EHfw30fBYfBeTrYj/gE4sf6zgWf9A32XQg+4zvUz4LPr9zbrwu+7Huq 3xJ8zXekPy74pu8F1Bv0He9PCr7re73fGfzA93b/9OAp3/v9OcEzvg/7C4OfKzmj/VehlrP9 85FzHPHLiCtR6nj/UsTn+5cFx/ykf9WtKr+mv/5WA+Qvhfzj/euCH/hN/e7gPn9sv/dWm9/e H7g1wZ/a33/rZH96fzC4So653bre8Gdxi/kL+neCv6T/ruA6f3n/fYh9/c8Hn7kk3tL/ciT2 8Zi37tZM/7b+14JvXhLvEPGd/W8GTyF+V8Rv3pr3f8j72qiosmvBU5eiqOKraSxpmtA0IXQ1 ITwbWTSWJc+wCNz64CNQFIYmBokhPOPYhEBRFFDUN47PIY5hbGMc43IYnjEsn2E5PJdxiM8Q n8OwXD5jE4fh8VzE+HiOcbkcQ1guw6Jn733vLW6V2tqdTP48ztr77LvPOfvss88++5x7qarb eZA4h3sXvY87jwG+FoaHe+8TfgTY3fuYpK3hIOFTvau+ws7S3iO+rI4m0vZMn9JngFGDhK6s viXf5U5T73EYYzWNVBjRlb50H9/xoC/LV9k53hcL1iiCMfZCTayT2zsCFhBoW+8o0AKnsXfM 6xVxs0ifA9zaOwEy5XhP72QEvtqXAzMo+BjNZueNvg3e0c7ZvkKYr1t9Bq+9vrqvxJcu+K04 rlZo29t5gTS81Je0A/h9Kb6Szjt9vM/a6e6r9C503uuzgv+AT/oacPb3+Dtb+xqgx4foaZ3L RK/0NXmnBK+zczguuxpnEFfN+1fQP99vtSeC5rs6Lva1gGeG1o6vCb20fr9gAbsW59GehqOw Z/btxhH1teOI+hxro2vIhtHdQf+x63Bm7XlEF9Ast5L9aX7t+j6Xd9Cu7vN7V+1biS4j2oKW sdegZXCV+VrIn3eDlfZ5t9u39R3wxdq3o1XtO8kH9pB/klfYd4ElJzofoiXtbWhVu53o3r5D vna7t++oz2Hf23fC57IPkh2G0A72I2glsH8TaHUcafsI0aM0+86+k9BLLtEd5Mk2WiNOopf7 eOyd5qKI6CDSGG3en7WP9Z0GfmvfWW+v/Vzfee9ic0PfxR3b7BN9KTsGBS8Cf4BVYJ8kjxJW BPkV8GGlYKRqm0CfeW+nfarvsnev/VrfNEQGiFo+P8aHtjT7TN/1HRTBfPuEmhjBfAcwVrSl idEMaN8h+1zvoO+ofYHWF82FfRFpjGwgDWKI74T9Ptn/Edrf/rjvpu+kfbVv3nea1shOYd11 KWV07Jr9MR6+P4uRx3e2K6nvtvdcV0rfXYgka558viu974HvYrcaS7sTsbRbS3Qa0ZlE6+St 3H5fSkdT3xOItNddDLQ96roA9GXXJegRfDiwF304MCiudIpOgvd25/VqA0PdBb0jgSNiLBJW dJDmlOzcrZfs/P4pst7e7q09wcBxjLGBEXFFk8fi6IBPo4O+JkOjhmgfGBXjqkxnMaoIEYZ0 gxWEkbNxbd6dKWvyneko05mFMpsrXSrfdNdN17K/o/OUK95X2JXjSvZd79rwtRTfza5CVypw NrgyfDfFUoMr22foKnHl+ua7eFe+73Zzg6vIu6ur0lXsuws1S6mVCWpaXdW+B81WnNmuBpfN t9R5ydXoe9LV5Gr2s64WV6tf1bXbtccf3zHv6vDe72p3Of3JoI97x7Yuhyu4Y7DL5drvT+3y uw76M7r2uQ77s6GvVn9u1wHXMV+JqPkh17A/v+uo65S/qOuE64y/GNqOQ+yCOOYvdeb03Aie EHarrpOuK35T12nXVX9119m+eb+t2Qranuw677rhO420v7HromvWuxMk3wLJl113/M1d0657 /lZhhxX2sq7rrof+PSIu9GT7Ch2pnlx/B2oVPOnc4MkPnnYWeoqCZ50GT3HwvLPEUxq86OQ9 puBlZ6WnOjjttHpswevOBuDfdDZ5GoPzwh7tbPE0B287d3taYWcRThG0Xzvb+/jgXWcWrf1c 90nvoNPhPg27M5wWAqOC/8BKGQTfGO5dDIw4XT3L/kv11b29AbXTj6vYuc+zJ/jAecDTAVod 8jiDSygT/QFlOo/23PNdd57wuINPwIdDEVXYm5wnyZeEfUrYkSlGOU+jn0P90ZDPy+KJ3Oed Z9cigDwyO89jNHZepGhMUdp5GWkx0nZQpM2TrXpZlHZOe4IDzHnds39AJY97zpuegwPxznnP 4YHkLofnmK8Q524gFeduIANOILg6RnqnBrJx5QYei/tOEa2OIGg1J19NXfOuFZjZ2/2c3wlY DRi9q1DkE+481Z/oK+m6268FPq2jrgf9ab6lrqX+TL9bxE/6df6gg/Xn+fc7VP0FsAqgPp2p YH4d8f16/0FHcv9W/2FHan+Zv8M+028BmQ48pyH2lTgy+mv8qY7s/m1eryO3fzusC1f/zjBs c+T37/IfcxT1t/mHCZ/CsxxgiskCdhT32/1nug7094LflvZ7/eMOU/9e/wVHdf+g/5LD1l/g v+Jo7B8CbOs/4r/qaO4/7r8RwiP+WUdr/6j/lmNP/5j/DuBz/ju4vvz3HB39E/6HInb2T/qX RdrdP+VPFWYNxnUN+k3un/GvOIL9cwHOsb9/Yceg42D/4o5tjsP994E+1v8ITo8Z6L2EE2W0 2jHc/3iHHfAqYrcSZ8EdG9AKp2jHKXdSIE208xl3SiCz+ZA7PaBzjLuzAnnQ+1aw5AV3TqCg a9q9AWhRDuFL7sKA3nHFbQhsBbokUOa46uYDFscNd2WgxjHrtga2OW65GwLbHXfcTYGdjnvu lsAux0P37kCbY9ndHrDjHuFz0B4x1l3mhlME7Jucd6bb0uMMnMOTeWAI7x0CE0RPdtfgWah7 G53SXT3BtuPd23sTA1N4LgrQ6T0w070T6DmkfYe6dwG9AG0TA4vkvfe722DfeST3ZHub+4DX 3m13H/J6u5Tuo+DVw+KZAdZIdy+uEbw3gbgBdwGBVZHvdZ8Q+LCrAj+oRDoYS3cKC/KzQfde jD/dgxR/4GwAOg/1FvjOEj2KdDAJTwjBFHGPO+I+G0zpPu4+/95e4qcjP5hFdA7RG7pH3Be9 R7pH3Ze9Y91jRJ9DGu+SgoXdE736oKF7ku4U6AyPJ422GvTnYAnSQR7pwAzRlYKfd95yT3vt ncfc170LYBOkh5HuLsM40z2FcQZPI23H8TQStBI9SnRD9zX3TTyZuOfhZAgn3mATeniwpXvG fds72j3nvgsnFgvRC0hj/WAT1oc6ZXi/1r3ofgB3RhCvgrvR89vwnnE2MIF0sF0ex2ivHxX2 +rVTTf1+pIN0bxV0dN93L3nHQP8nMEdwD/j+LbzbCqx2P1o7w+BdYdCF919tNZ1FHgZz+tij gnUk0Kue+KAfIhueGcbxzOBUrp1gMUIG9+H6Ch4g+hDS9c3kCUedsZ5kX2x3micV7H+Mzhi0 CziTPBm+iwNXBm4MXO3JdcQPHEbsfdR5yjMMscvlOeW3dR3wnPGVOG97xgdyHStuR6C3m3O7 Al7nXc+FgXznA8+lgaIOq+fKQLFzyXN1oLS+2HMjMCKe8Bs8swMmtPxANerznt35xHNrwCbc 4Yr3tsJdbfgda5l0l9rDPHfC71XFHZzODz0qz72Bxp54z0Pfg55kz/JAsxBXO696VuAug+Q4 kr2cf6Un1aseaKU1uyisROx3YI94Nw1nY+CQJ6MmAx1ivA1pMuCUR0i6U17Ae+QBtxDTMGIM BIX7ayEu4VoOOnDvGNgvYIEj9NKT0asOaHuyvYkDBwUPwV0DOPle7cAx8ekEPTHoKerpGBgW nk70FHvTwMeEZxF0199T6s0cONVj8uqgR+GZA9lNeKognDN7Wr1lAxfkd5QiLTyvgFYDZ3qq vXnvt/bYvAV7HvQ0evWBtJ5m79aBcfw1Afr2F5N9+4ujb38p1aXqBhZN3/hKp298fZa+8ZWt dqhd7B21R/0fWBF9m+tL9G2umrjPx+UzW9z/ifst207fQNtB3zf7BvRRwLLZXzLGytjXWBrb yXyskP01JBs7yL7H6tkJ9l/YV9hJSO+x02yMNbKfsgtsB7vCfsW+zhbYv7DvsH9l91k3W2Yf sX4Fp8hl/16xXzHIxhSHFb9i/03xz4o77HfK3cr32R+UI8ofsY+UE8qfK6KUV5UfKjTKu8rf Kl5VLkdHKdZHZ0e/pficar9qQvGW6pLq54oG1S9Uv1A0qqZUv1R8VfW/YlSKb8ZoYl5TfBDz RkyGYiTmszEexUmNR7OXi9b8tWaIS9B8X3OUe03zQ81p7jOan2imuS9oPtTMcUbNP2uWuS9r /hCr5b6F/0nhAnGJca9wwbjkuNe4vXG34v6VG4z/dvwPucPxSwkK7h8S0hLSuA8T0hOyuJmE zyd8nvunhLyEPG6eKcAuu+lJaQZ+Z6aqRYTdjBkPsLSqpqqWqt1V7VWOKleVv2pf1YGqQ1VH q05Unaw6XXW26nzVxarLVdNV16tuVs1X3a66C3VO43ewaG6Z+kvqLzFObVFb6LtqyVwel8cY p+f0TMEZOAPjuC9yX2RRXCn3JaakzwypuCquisVw9Vw9U3Nf4RqZhtvB7WAJ3E7uGyyRPi2U xL3Pvc9e5bq4LpDZzfWydfSZodfA3tksVfVL1S/Z6zCmWXaLRpaM30wzTbOdpidmZlaZ483J 5lRzhjnbnGvONxeZi82lZhNwq802c6O52dxq3mPuMDvNbnPQvN80bT5oPmw+ZrpuHjafMp8x 3TSPmy+YL5mvmK+a5s03zLPmW+Y75num2+aH5mXziumuhTNNy9J1Md0U03wo3RaSRW16YEk0 LVm0AHpLmiXTorPkWQosWy1lFoulzVJj2Waat2yHmjstu/A7TjF/A9ZMCfNz/O56IWsHrzWw HvD5UvLzCvDvMVYFHv5TVg3+/Sv2ZXYPUg3ZqDbmczFvMWvM2zFvs/qYL8R8gW2L+YuYDewr Mfkx+ey9mKKYItYYY4gxsK/GFMcUs+0xxhgT+1rMV2O2sx0xTTFNsF4U7BisJLRyFotmjE8E 0IqQBpDJivkkPoVP57P4HH4DX8gb+BKe5yt5K9/ANwG/hd/Nt/MOKHXxfn4f1DsA9CH+KH+C P8mf5s/y5/mL/GV+mr/O3+Tn+dv8Xf4Bv8Q/MTKjyhhvTDamGjOM2cZco8lYCrxc/qgx31hk LMbvg6m/o+6ib/3FhlmrB1Ih+0dI77LfQCqCVf8vbBO7C0kfUxNTwzbH1MfUM0NMS0wL28IU sIro10pYLothrMYCUMMUdTrItwFsZ4qSDoA9UQU1ZXWJNZY6LQHSNXVpNdvqMolG2F6nq9lZ lxcq21VXECqT6mFbpLFcKmur04do5Nvrttb01pWF5SgbaQRvnYVAovfW1YTKJJB0keohoHyJ RpmDcD0o6oT9StcIWP6yIOkj1+tlQbIR6iDx5HpI5ZL+yBsSdcUc4QiMVQ7y9nJA3XCcmB+H OUD7DIn2lvoYFHOcI/k12nOb2AZ1xTYjYi7pJsmRbDtaty1sTodkuaTLWN12ys/V7Qz1FZlj P9i/lEu6S2NBeRN1u55qNxTR72RdW81Unb3mWl1vSM+RiLE8S1dpPHLZcnvNyK5RP9RJyo9E XEs+KfdFaRwSb67OW7NQtzds3jG3PGf8z9JJfi2tL4kPbay5Ai8yD2u7WDdYW1g3V2uoWwib 1xfk1vyXKw+rF2nvl8ipvXQdaedIW3xcPhNxDeN+bl4my2VyrEWCnV6Uf6xe8nE8y9+ktXa/ bqjmUd0RoqVcisvSGnxcdzxUtlo3gr5Sq6wblcfr2ti6sdqkunNkM0kv6Ls2pW6iNr1uUu5/ tVl1U7U5dddqN9TNhOKDGA9qS+oWaf3K4wv2x9fdp7aVdY9Cfg761VrrHiOQ3apt12sb6laJ ttluWhtt8+iv1mbbbWur7a51j+2BtcO2hNcU56G9tRRiorQHPWsuI+fGCX2JcdrqXusjVB60 PbHur2dPzcXzfPNIxNp+UbyKLBdtZD1Yr7Iero+X9EbbWo/VJ8ttFdKh5jlxCO3ZZFMihPY1 yU+k8hZbbO1uWxJBuy2l1mFLl++ntS5bVth+K9tna/22nMj9rXafbQPNhQSSnAO2QsoP2Qy1 R20ltSdsPPXzHKg9aatEoFgm8U7brKE1LO6ltWdtDbXnbU3ymFZ70dZCY7ts2/3cfRl9b9rW juPFMdZetzlCMm/aXHJ71c7b/LW3bftq79oO1D6wHapdsh2tfWI7YWW2k1aV7bQ13nbWmmw7 b021XQzbO6S1J8+lvSQyDj8vj/Svmohc4mPcP/IMf3reXhS5J0Fba7Hor8+qJ9tPqZ5sLZO/ 4rqD+ZZyOptg/qJxflysxfy4eNaQcmndWCLWUeT+J51H4NpqCs9DZxvv0+N4ar99WX3F8tBe GbmvPu/8ETmf4toK9YcxDez97cvfnn7qbIv9DdenWjNsl63ZtmnrqfoM65n67LAzI8pFwDGj rPH63NAaRnvJz8fS+pPOIaI+1gv1+bhPWC/VF4XWPfKv1Bfj+pO3t16tLw3pFykb5Fpv1Juo 7axsfcnikxSLQmdn1PlWfXXIFnfqbVJ8t96rbwzZTdTZ+rC+Oew8JNqxjqvvCJtj9A9pT8R2 y/Wt1pX6PXgXr/6u+j8yFreRfkHoftx9hr+YqfvzPl+JjmIf0XOUHfQc5euqS6pfKA7RE5Qj 9ARlmJ6g3KAnKL+mJyi/0XhitVwpPReZpeci/5uei/wTPRf5NT0X+S0+F4lKw+ciUTn4XCTq 8/hcJCofn4tEbYQ72hE2uvb0wFDMTAabodHQbGg17DF0GJz6RYPbEDTsNxw0HDYcMxQbhgFO Gc4Yxg0mwwXDJf0i1LhiuGq4YZg13DLcMdwzPDQsG1a2cFvUWxK3aLekGUq3ZG7RbcnbUrBF b6jesnVL2RbLlprNlw2llKohFVMyUcKrUgKkAfBJgPo9/PxkxL1tL8xIP/PAXe0ZSJvpPtfA fsluwJ3sDKS/VPxPxTTbqryu/JCV4PMqaKlgDaxpbbz5SyxLGimMsxXyVqBwvMjBMeOoh2HE w+KoYcww3mEY8RVIbqjlNAyTji2g42v0XTYG3qMDXg4kDu6l8XdM8yAp2Qb2DotmG1kB3F+/ y/RMAzqVsQTGQ0pkJkivMAukJFYJ6VVWzb4MmtYyK9OCzzWwFPp1wzTmgPQZ5oaUzryQ3mBX IWXA2D9kbyoSFYnss/RrW+61sW5MiSoonyyfKr9WPlM+l68vXyhfzB/KHyq/X/6o/DGUrObr eSUfu7GETypfxWcZ5ZNrTzM2lmw0bGzgS8qnNo/wfPkUPtkon9rYRE83hGcbKfmPeEf+Y3y+ AdIm+X3lcygVZG1YS+9cAjmUNo9sHtlYyB9CKVKCXqV0ANod3dhkzEZZIOUxfxokZwE9RzCH upP+q2tp80j5o42FMILdoLe/fIY/ASNwwbhOli/wJflD+JSl/BpvQNhYAjpuwGcu5TNAz+CT l/K5jYbyR3xl+SOUBID2QlgF3WJhnAAkHZ/QJPHtaCeyFfSGkL/Kl/C3Ua7UC0mUAHRA4O9C vghSAfKHNo+AXpWY4/MeoPny+/jUZyP/zq3ySaOKv22Mx/4FHYzJ1H9SvlfqGwGfDfHpvING W0CUBMARWkPNSeMV0u0peBbfeMV41XgjTH8ZYBnqbJw13jLeMd6TNJTDs/jIMz40Lsu1D40C +MaHOMsCoB5oG0l/Y665kC8snzPm84UERcZisPCMsdRo4jcYq402Y6OxuXzB2GrcY+wgzwY/ NTqNbpAEEoxB4/7N9/kG40G0Icg5bDyGljQOG08ZzxhzoVeYQ+O48YLloOWw8ZLlmGXYcspy xjJuuWC5ZLliuWq5YZm13LLckWYSezCmWu4hWB5alnleaIFllpUKTvAf0aKi5YQZB98Kzang VyFfAt+qUFckondUaCvS+BP5jysyUYLxqqmGWqB9ksrnzAa+0Fxi5s2VG0vMVt5gbjA3QWox Zpt3Q2o3VpsLzY7yKbMLetwJ/lW5ecTsN+8zHzAfMh8F/gnzyY1N5tPms+bz5ouQLpunzdf5 FvNN87z5tvmuMRskPTAvbT5nfsKnQFhSWeItyZZ4frcl1ZJhybZkm29aYE7M58tXLfmWIkux pdRiMjss1WWNWGKxWRotzZZWy578VUuHxWlx5y9C7EFvm4LZWzHeMHEmtSnxnUu4Ak1aU5op 06Qz5ZnSjOOmAsleJr1pq6nMZMHR5+s3NpDdafWYtkmryLTdtNO0y9RGdoU5Kb9vspt6TV7T XtMgwZDpiOm4MRmiiDUENDfGe6YR06hpzHQu0lMhajQgCPNjvIVgmjBNou+YpkzXMJdojAWm GdOcacG0aLpveoT6mx6bVmkc0rxCfDQrzbG4Ks1Jxjvlk/mPEWg2we/MKeZ0c5Y5x+Sl58Qu foN5Q3MmRtsKXUVeRUGF3hK07K/YWlEGml8riIc4lVRhqaip2MZDxNvYULEdrNoAugrR2M+X VOys2FXRBhLa+YYKu4VV9FZ4K/YC31sxWDFUcQS4xytGKkYrxirOgX+nVkxUTFZMVVyrmNlo qJirWKhYrLj/zoWKRxj/MOai74I2jytWySagd2WSEC3BTrEQS9srlZWxtBd+89/QCWoXa6dn 5vib36xgL1MAaAv8kPZBOgDpEKSjkE5AOgnpNKSzkM5DugjpcsGTgmlI1yHdhDQP6Taku5Ae QFoqWMJfGVTvUDfTrymWMyPY1cwq4FxRBacDFasD68WBnb+G3wCJvxv/iDSi/3W9u8IU+j2M FXGQd0QVvLusb313RQSgizgAtUDTdSKAVlaWJiuT6q0INJaHyjJlNLbTAeRF5IkijVAggkTr ZWUSiLqE6uWJ8vPWZEp9kk4yfaie7hNAQQRE6vJxkCbTQaZnSI+0Nb3lNgrZihPHKgN5+zBZ BWL9AnEOtGv2lvdBeqgjrhPX2pCuurU8VE8XkW+NmFN5LulSJuaWp3UI5SviuFbC9QiTU/OM MUT2uw1gO8BOmZ6RY3mWrs+wz/Ny0q/gY3LRJ8N8kYvg7QJoe74dIsf/Qp3k60taM5nhay+y DuV2gEmAqefM758wf57dXzqPsPPLztczc/tL5nIbi3Z6Uf6x/epeoL+41op6Abwi7V3zjZAv Y929sjqDop2G9OHx+gjAcX0oZoR8YwRgNKLvMYBzABP6tfgg+eE1Pa3fsPiC+YzYdk4fvh4X RADepvOQL4r0RYDLgi9umga4DnATYF64pjiP7dNke9DLrMkFfShOy/uQyjfdBrj7tK2f65sv 8rWIePXMuIS6PABYkvHBtpuehNsqUoenZGHZfRGka8lPpOtHAI9FWIU+lPqw/XRTrKyufG9C HZP0T+1vm1LEuZBAkpMu5lkAOQAb9E/tTXLYVCgA+ZDEM8jsK+6lm0oA+PBxb6oU9N1klY05 ArDupgZhvDjGTU0ymS3h9tq0G6AdwAHgAvAD7AM4AHAI4CjACYCTEXtH3nPyZ8zVc/3zZWOc +tn+9En3pI/VI3INy/M0cb4j8j8q1kqxRJY/tX6et/+/KH/BeD61vh+3Z77MvOaF9y/FpoaU cL+Xcj0DvzsNcBZoFUC82O+KrB9OHDPI0ifr19Zwoj78fCytP+lsLOqjT9XTPqHP0K+te+Rn C+tP3l6fK9MvUjbI1efLeNJ6lMcnKRbp1nTQF62V64vX4ru+VGY3UWe9KcJPRDvq90TMsXpt LVK7agCbvhU/90S/ds/+7dxrKg7ir6GzeEUiK2FMdxjgGGPZxwXQDUM+AvkpgDMA4wAXAC4B XGEsYwryqyLcEPlQL2NiDV73C/Wo7qxQF/m6WwB3RP49gIcAy58CVgQ5Ekjy3uYE/d9Wi7IB 3k4MrxvRrkSXrEvVZeiydbm6fF2RrlhXCsmkq4ZrG6RqXSPwmim16vboOnROnRvoal1Qt193 UHf4rdtv3dYdQ4y5QOmGCZ/6TNvrOa/n6M6AvEad6TN23TikC7pLsnQGP+v59Cd96Q0PSnq3 w3p6h0MKvcPhdXp7Qzq9t+EN+oxvJn3G9y/oXQ0b6S0NhfR+hnfp/QxF9GYGPb2ZYTO9k+GL f/b+FIpkhfCp2QvsC4y91cDYa1cEeKsJoAVg9xrvefBWO4DjJeq5AMD/3tonXGerI8oPvFiG CF/IXsy+H5Eevb47RD+W87NXJVpW45kJ3/ZGn+Rm9AYP4d0d0fRJ7lj6JHcCvbsjld7XkU5v 6niD3tGRSe/iyKK3cOjozRs59LaNz9N7NnL/v8lVsDNsfO1/QG8eYlVZhetXhZRlBTCErkqy eJGiGkJJVqVULrUA3JDVEOIUYgovl+RJslCSJEeUAJwUg9RO6hmfHHKHwRYq7gT3MwjrP+f+ gWVw/4NbZJ9Tdau62ZcwerKyuJ/GXWLl9OaQVIBk8Z0cnw21V0J7iIPcSe4Ci+YmQFYatUmH GimERXtol5hC+4Da/RAxvlWG6dlWWY0bLHn9tfUF2tn1BZnJ2lntLe2t9dx6TntDe0d7T/tQ u0xphWTgL2rEcj/ifgR9/y33t8D5CfcTxnFnubMsivs77u9As/8O2kTDmKaYmkYTC5r9jMXF /T3olwQrbp9iip7dWdmr0LuNscxsgNyPgfznlim0xaxqfbqQtInaRIlev2/9PrpOWp+kzdPm 4bVY6z7iNx+++VBr19rfXH5zGevhdaitPEF7alWgLVjv19bIE7aNrI/15CmyPJPL5OQ6Zqoz 1RItaCfop7XjeDJBL6H/5+mzNi6xf9Rr5c0VrUVrWe+HGhasJyTtVuA51jsg30rziO9dYvT2 IoWmUfM1xml2aJqZStOiaWFqTavmr5hG8y3Nt1ic5tuab7N4TYemkyVoHJpu9spL+7BCcVrx mObbAecWltzy8pABUTUDompGzjOgXYB1eyDfLebtTJGB76ZqYFXJzevUmF598saDdW0CnZGc kfzG7TeWkleSi5NTgWNfZ0+eXadOtiXPAtjemH9jHtslq6DWA0hwLcgQ2idni3kzSNhDeca6 NpDVvAbYQ0YG9JVBciEJ9cJhnRolU19QnpEt6Ji8gjqus5OOon7rtq/pR+0evPEEtFyRdHqW PiiD+LZQeXFyxht3k4uSizJSoUYR1oP8BkBuctG6tHU7IXfjLHHf5SBGc9/nvs803A+4H7BY zXua98ADmjRN4AHf0HwDPGC3po0lar6j+Q5bR2+f0sb9Lu537LW438f9nqXS+6Ve/0QxrgGg BqCNolwWfcekkT7LUCxGPnr3KuulTxwoGC+rV8Ba8V0poXoKiEb/GTyag3hE/VNvGdQbvu9U TZ7OyNOV5Okq8vQY8nQNeXoseXoceLqDJZAkHAOjMUTTGN6ivvF9Q6i50PfnSEcnaa1g7SEe x7aLmsvrCVormEnkfRrNXjTWZ+utYIdFe5+mvrOJ5xf1viTjXRPtLa93QdS7XeThr379MT6D 3pL63BGoSBIjSQqSxJGkKJKkJhn4Bt/op3WgXuJIfuLHzOFhdl42hwLvAhuR+Z7AaxOtIecN idaQeH8qW7zMaP4Yaz3LFgp2jl2lUwG+L5klZjAWP0FQFT+boE1MSZhAiL+amII5XKXHn0lM gbIJoTwxKzErYSwxHUrHIM/COlArh/CGxA3IxRQ/iylcoiRPLAFJYXK0iekJWqyNvUFP1DNK wrFovq75Ooy5XQMeqenS4Gp46b2JnaUZFP+zGTdFUJVQlmBJqEnYBnh7ws6EXZDaAOzAK0vo TfACtxdK9yYMJgwBHEk4DvyyhBFK26l+DdWVp3CJkrxeuC4DepDk7CJ6O9Syw/UIyB0FzijY AfG5hAlc8ZqdGvunHWHsIkEVvgkwriNuJW45notXA70SnwigJU4a3LUXx6dBvgI8Kc+EEh0l Dq+JtxCfiUDSlqH1msSQPGhdLEkKySmIuxSvj1+M1wGdGZ9HgBgSjfCbml2fYP/g4Px/k6KU sA51+MvrigKFnk3C9ZEwbo5iA0Uzfxg3Q5FNMXFPGFerSGNeuN4Wxo1VJNH3LEvCuEyhYja4 zpVxObZM52xtiLc2ey9e4cncMPdfocbfcCchyv+Y+zGcrE9zp6HlGDcGtjnPnWcxYJufMzV3 GSyk4f6Ruw7x5wb3IUvgfsX9ir3CzXKzLImb4+bYq9wCtwAyf8P9BmLOhbgLEHN+Bqfy9XAq /3vwDTzbf4/wdwn/4Cn6ezJ6SEYfktEfiDSMXWFTNMLZL08c+9vEq1RY8dcbw3hlCgvwlGG8 YkUpXD0M4xUqDHA1H8bLUxTA1VQYL1uB94TjYbx0BZ4LToTxcHYVsH/LefGKZNrB5TylAj/v 0SLn4bvoZHuGwFtiT2R7hsC7zx7J9gyBd4fdk/nE2+TnOP+MYreCYjdHsTsKYvceOAm0QQSP iZwJze6nZmJIxv9PRO+U0U2y2fqejP7uU/QHsjofyNp+IJP5gawvgf53YR4g0DjeLPqEKN6T CiPOWasNoxPuZxGfBRzLouHkGBvihsUuVZCxmAJWpRqCdIRwmWq7ygvJAvQ21XGgkDeiGgV6 VDUGMAqcUdU5KJmgVEbtjkM6J6YhMcklSvKGQJZXlISl56gGlo2BrHOqSZLgVU0BdU2F0UY6 j71sdL6tSKER4mdjWTSMMHo/wEGAwyJ9DGBYzE+J9BkRximvivZC2ku4INoS3QZJD3RZ9CBQ yBuKPgL0kejjAEeAcyR6BEpGKRVQu0FII2LyUpoESWsS9WItL8kSJAlyvCShDDijcDVGEtqi zwE1ET32Kc/bL3tnmaiwkfU6wGtYNMQVZewa0PXdCBD5r+TJoEAEPcBWgDIAC9TLWINXrlHb KmUKpHSlErBLmaTEv9ioOUgzxPMrc5RZyqyoOWWhcp9yA8AB5SGl+Bc1JdSEugYxpYgpHXHU FEmU5KWArBSQUQiAdQwoAWqhbCVc8cqjyIOcV55Q8n+ys+ensn0U7HsJI2sQ5QbIDgfkcw+A NolQDWATAelGgGaBThhdg8QG4lfhu6JBt33cUQgrh/CtItwBrglSA/FUsDuehNTEnY+K585G xUclR6VSLUyVYs0G7qKYjorpBGJR4gGgsdZRkLWPOwt77FmlHvKLJAHLzgN1kZuOyiDeNFDZ 3PSf2/b0ftUnstMEPiNUr7avxq9uJaD0CXYWvJ9T0GxiTJ76SB+K0Ux5DOb6/EeIFwk3Yani INLsiQrukxST0VrEIl9PnFHEq3j6WRQ4qzPYNnoecAbJyVttR5mrmcRRYVviLBFmq/HYVnUQ 2yrdRC8BbaHSJlUi6kbyWTS+RY+pOlAO9sLwD/wT73Chb0a4BTmreG97mEqFMwidMMCPER8k LJxXhNPDUcI3iL+OaDoFKJaIFk4di8S5SphOhIoFwlmEzxMeQcw1EFYT9hKm0yZXJkooJpk5 pEMO6ZZBWuXQXCPfRT3SCYO7gzgqnmgd0SbEShqvcKqB0TLpNANWwzqthOldzoq9hG8S7iA5 x6k0k+RUEj1N+C7VIWvALs2kE414ZhNOVXQu+2iMcLMg56MZ1BOxYonoBqJHCOchjuKI7qDS 44QniHOeSk3E8RI+RfgQ8asJtxO+SzhImPpSJhHeR9rOibbNIF89SBg/Z/okxku4gTwHOUyg ox8SB2suki+Rz4OntaP+0U6cEVwRbD4G1+A44XlqO054ntqOI+Z00TQ7KJPTqWyE8VnDYjR5 DvJhpTDCRJO3N0W3kIcTjTKBbyO8RKWMSjVEPyQaS13UykWlLuK7qL6LNCnDUlhBNuqXaEEy tZokukmor9STzlRHSSuXIsAk0mwcfEHB/dVH/xc4P/7oOI6X7DNOeH4V/0cwTngRLQbWGyN6 O644WrmTtPYnBZr4TUJUofiQujpMq5hiAtLQdivFBz1xsNUC0QtE51F9minAAo3180RrH6RW GCUe0mx+FI3rKFH5B5x9ilGJGLvYL5S3Af+e+A8pmq1TLpMFkPN7bMVuqN5GHI3PyX4djdE3 Q/lNXI9kmRzCWsJMwGgroL9JWEV+lUo+VkGcPxD9PaKv/T/2zjs+q6Lb9/Ps2bOfh2TTQqQZ OtKFhCYB6VW6NFF6CwRCC4iCoIJIB30FEXwBERWREhAEsQtCsCIqRVBQioKIqICKiMmZ9d3b vJ577jn3vv/cv658/O2VNWvWrFkza03ZT55AxxH1FcABYpWcSXNPKeR5x6WEo8d5NZj/KxhT aBlBPU58EisrfvAeFTRtJK+6K0RS+4JuA5kb2g9muIysWSB8G19Cvyt+i50TvveozCX3FHNG OavAZwQjh6EPSGxGTlvcYE+oEeeAXbOsZujxYCr4uvDtudPSkRHg1852ybpa8B7h6EVInnZe lFrCt9o+EM3QqdK6LurskIwhdfV1m/MiztXIUonHiJ0t9ji2zdLZkW+g/xDaaUuLMluuOGPF q241ycwRGfdmkbuFo639kSRnn9WZFDlC3QADPavA0yIp/Mgi6bs9EV6A/7nkcydBeh3JEjry vmQJp4z0UWgrKbV6OhI182QNsv36grovWJ0lnGzJUTZzR3RdLXM+U9sVSk8RWqfpZZKB9VyL a0RSb4RTxth12Z3J2/HFpqkdtS6uVeh2Mh0tlgCPwE8R2kkElxobBSagixl7avbeEdr0N22s fFl3sqWruJ0snepKK0+bzpZehsx8oc1UY+2MdjZWxow21rfmSdPLykwRGf2E87LFIrq7xT5m msWpxljcY3duEd1Y97O9e0bb3YIeqf9p6eHmAathvG4DR3AOvR6pxSf/1LdYnK3F/zfqRZa/ Xcv8fEE/LW3plRZv1/bM6p6TWmYI3huuN1t+RT3CYj/9hsV12sas8xt4UdDu1sTOwrqY5WRr O4t0LcHIJP08ForOp8XPbkE938oU1G9Zmb5aslmiZEX3lPse42Xnj5lg0i19N6NWxsiIpLl2 trhv25NbxP3W3YF/7CnZrWL6MC79GJE+0jtjs59xpdTm2z6MyEhGxJ6w9VumkMU/wC1o20Hp kzL60duZA8uoe1bPwsMyT8rr8RY7SmbTRk+3ONo0ZxQWCl9bPZGZ+ozFJfpr+G9K381rVvMk PQGZCYxCsoxjOBYzGAsbj5He7lnG4i2xRG9hLOy5XR/Vr0j85u6XmJXVwRnP+nualaIn9AZK U+H0Z13ORlKxCnA74ChklPDVBWQWIT8cOgu6IfuNrkRTZ2pNlQypJ8sOyklB54eS/fTTyKfk 2t2jXgv9jKDZJKifB+tJXtVrc+zcjswI7KGtZ2TPoOegM07e6biFBPUNgX7h55wz79r8/LO7 Rfrr/WbxUDRFeu3J/cV4c0roAKMJ8CVTHZJSPQ3+s8Jxk+BvEE4k2+0N2jngVJR85VRklJU7 CLSlzhby2Mtw/hSMHAlqmWYiY+TNUq57QZA165dohuRh+rWbHVpF2U/addT2MbeQ0Dk7Qo5g SfacC+ze1vbOrkKyyrBvES/ZNV326sXZKV2LJgktpRbZXUhbFpNY7yqDvwvm9mE/8yBrfbDu e3CS0NOQld2TWBAZu4eowi5dbDvIDpbb3Rx2uWo9vdgT7vOF/hzcDzJzct4PawUagreGMluC z1KUBhNDmXc5+wjHoGEtdGGwKK2Ugr8B+XPGzpmcVEE7+p6gRJxdxyvCsflQFQxROPvl79jY 0pqyWwhokc+9EOwKZP5YSeig1MF7bkn4haAHgq+KZ8TDOalRm8FynhY6t230PnSyQzBL8HlP 6OXgTPAL8BXwCDItoM9DfwZWANPZD+ejdBmcBdCcrTz0ePfC+RLkbazEgsXT4JvIuGBRFbnO mSj3LP4sARZkT66UXYlyf6X0Z2bjryE/EY7lX2dfZ3fgvCe181Qw4MiJoLPs3JzB7mM2rvdF 7Xphegm6p8EJgs56QV1KMBrgQjigq5BJFfRAU4PSZvDfhh4FfwPy0O4hOCsp/QVOIzQkQi+D fpjSvXAcOFXRGYV/Es4c7ElDG7SpA78etYK+rIN/CX5TOF3RMBC6FqUunL5wXoKeD66mxcrw n4JzDfk4sBX80fDPgtPgDIXeDf4M/gbiYbcd9DjswRsekt5nlAa9zkJ/CvxO8GeDU0BGQR+F zgV/gLNAMI7xytdDMMboRJOQyYRzBs5yOPeB06mLb92D9Hcu7Qat14TfGv5SOOXgdASzqTsM nAkibz4CV8FBxoXOPSXzLXePzDeFbbonmgfLHYXT2547BW2kOw0lrs0+uSExvQTd0+AEQWe9 oC4lGA1wIRzQVcikCnqgndsZzOoM5nMGczuD2S5Yg7rNqPU29ChqbUAbtHso0Iz8SmR+gdOI VhKhl0E/TOleOA6cqmiOwj8JZw42p9EKtKkDvx61gv6ug38JflM4XdEwELoWpS6cvnBegp4P rqbFyvCfgsNdk4kDW8EfDf8sOA3OUOjd4M/gbyCj4LaDHoc9+MRD0vuM0qDXWehPgd8J/mxw CshI6aPQueAPwdiJVzVoIzeDfJJBtskg8wguEMk4xi5fD6FjjHI0CT2ZcM4EXhKZOGZIdDmc +8DptM5YuAfxz1zsDKytCb81/KVwysHpCGZTdxj05XxHZLbDoZb5CFwFB0k3oHtyv9dF8rDZ J6u26SXongYnCDrrBXUpwWiAC+GALrs7J1XQA00NSpvBfxt6FPwNyEO7h+CspPQXOI3QkAi9 DPphSvfCceBURWcU/kk4c7AnDW3Qpg78etQK+rIO/iX4TeF0RcNA6FqUunD6wnkJej64mhYr w38KzjXk48BW8EfDPwtOgzMUmtsP/TP4G4iH3XbQ47AHb3hIep9RGvQ6C/0p8DvBnw1OARkF fRQ6F/wBzgLBOMYrXw/BGKMTTUImE84ZOMvh3AdOpy6+dQ/S37m0G7ReE35r+EvhlIPTEcym 7jBwJoi8+QhcBQcZN6B7Qp/i/rAbeIJd+iLo69xMFhKOy97PZefgyn4h4nFzq9cgPzPX7r7c bez3suGzizPsPTTv6N2q0HWRWQcuCe5Uubn6ifulEdTiswKRFNmB6G6cFOojz0kkch5tHvR0 7gkvUvqn0F5wJ3wnMtyLOsFdcQ3R4x6HM5i2dgq6p3KmiFXgdUFnFXiAPfN4/FMTq4zsnSLP SqndUYv8CewP/MDJy8G3kfqiWa9Bpijy7TkfraH1wNvN8dsRfFsBzj+CG1Rs+wLOzVgeY6Te x9pvgnMcpezPzVzGYji9+xDcltvKlhL7kcPSrtsADcdocTJ2nsZC5qRDu3qKfMbPbYENydzs PQv2x/K6gk5n6Grg+5zUrkJ3Y2e4DryIZh/+Ds506fAPCdoVeikn0HHIj8NCkV+U8z51BWNw duSeEqTdY+B4SlsJak5Vhtt15zXRrB2szaTdUdxPjqDd19G2B/okkuh3kvBnjt3/ynhJ6RI0 HKWtbOidIS3atiLzYPA2BJ3XsaQo2B3JDLxdEgxOyoWxJ0rdvuhpD78veBWcBD7PjP2cEZkO Jx18BPwA3IXlixmvMkiehHMg9KFFw1sP05t4T6SP+ymlRfk9D4tD0EaeiexF2zD6VT9cX4T+ Hv7tSM4N7ERPbWYg+dZ5AQ5vapx7kOfdikmhlVcoTQ3bwufQk8E+4IvUmhmcK5F5Gw28xzHb iOhkZN5Cvjx9rI1m/Ka/oq3S9PddrOqA5Oow6h+3uZd3N7EtRMpP4Hz0H0IPMyHKGxyP2ehe w5LucHj7Y/eaonMrEZ2P0voSa96AMFPZVpz5zJmvGP2B5C7e0Tj5sXMUpQuZD/dA95BbFJd3 W3alayejjD3MLqctFvLuzEniW99X0nd8paMgcaTfRr4So7YPmSAGt8NZTenscHyl9daUbkSy D/39HLwfbIFkFjJ1obPBe5CvAs37KY8dhZ1dMotOY08jrH0rPLPP4My+Ws6V+hLn9BWc3Jdy si4EpwEn7gac2bm9F0l7Zg9ozr+yw+fTGfb8TmlBUDkx6OvIdJRoktOxMwm8CL4OzgMH8yb0 PHQ2uFVQp4EOnATooqAPHoS/irqH5cRhNVyTmxPwCmeQSUI7CdAJ8IuDNeDHBLVPaQwNWeBU sL284dIOdA4yDaG/hr4qb7ucedF6kgOhLwrqouAibLtKaXYoGeOGpx4YyNdDXjiHef9y2AwQ y6GvQBc3m8GhWDuAXqwHhVZeRYsbAtvgNKQ0VW7P9Ak8U9xtbTmaVuZTOph2qwWWyOd0rMeE fwDOF9DZ0FnQj0Dvw6pPoItHW2GP3Kw6cM4jOYn+NoTTI7AT+gXqtpf31NqHc0VuRZxV+GEw nvla7HfnYHld7yaLg+Re17nqvSHZnt7tQv8B5HfDmSelToJXjrbkPYgyR6V1ap2nrRqMheL+ 8Az8HHybg4XJyEyFHm+ekNtX48vooPkMvnqedi8G7/GZOR8yc+K4t+wIKnAD95l15Hv4nHKu 9a1+hJvMU4xChNJ7pFQ3pqeJMoKRnoEGr7y0Ducn6ZFuFfClrt7GPeoe9CyH3wPNJYJa5g7q lsdO0dwXmTSzwGJ1ZkK22wYUDcWEtjZLaQR+lvAjz4F7wZ7crF5EvhJ0NpiEh11kkoSjlVkk uZrSP/HzV67djzlrqNuKHgX3tFuC/lK3BHgZ/nJ6UTXsi3wG8iR1FXaeDq09QyRiCZKnaauG +DnSQOZMZKdw3PeMXfeNJ6irun/Kuiy3fHqNidrSdPOppatTWl7QKYAnL+CxB2h3Oz6fEsQv 8/wgM8EJ6Ri0zKLzRN+6IC6YaWeCXMfcXhfkOmbs42QeZo5zDP53jMu+IFPJXaLTD0wAL9N6 PZnVNl6k1lZmb3F5X6kXY0877EnDHh+6qGizURkjfskYWJIRxB2301PB9pyOv6LuMuRz5F2V bWsasUnseLNkjSOy/qTFKFZp4qW32B8bKZzoVuGY44LeQfGkV4AobiMY3QnntNAmv6Dbnfja IBbqG9EZo5VWtFtA+hubI59jsZoTba0LgjbixG+NJRYiTxKPO7HkGBp6U3cI/Ez4zZBcEkQN ETTSk11BK4kXzVqgi+H/i3I/75SXeRJZTp7v4L5A5MqMau+JhtphFIj8IGZgDebwE+jfxWhe MZMt/TFtKfQcFo5dTSYzY6VuF2qtF225e+SuWy+WtcbtCP4K7gdXgL0ETWlwqaBdMe8l0oVT G5mSgl4OnPWsXOfgF4I+CH2K0gXgDMFoZ+gxlO4JdMpNu47i7SZCux4aysI/B7aTUrsGiXwl SmcyRvdS2g2cCa4RdF4HDwjaPJ8o1gptriFznVYaQG+EnigrhVkPNgGvC3ovYWdVod2z8H3W lJaCdqUQTgnwCPxUuXW0lgiO4s3UOvcJiTJBvRL+i+Br4A+CLtnM9MKSh+BM4N2lcq9aG77G Y/voUYK288ctQ1s3csNZEPo36HTsrEO7v3jFLKc5pXPRuZ/52Q+Z0/iwGb3rg0wUmVP06zKR xRsxt5Y5JjdC+OpRZDrIZyfMSWotRnKqrGKaT4U54+WG1mXtMzWF76S6u7hJK4D/pdfDZM7b Xo/ihlbsacToTDVlZacqvTbvmQgycpPQSbxh4qXUmyBrmbve5EdePvjfEMnT0paVF0um6KFy K8Vb2gnC8fpJLS9BaHNC9EdelzXFWQ9nqsHbxNdF4esO7i9y5xPolPfa3gGRMY3x/zneuW+X z6h4H2D/04xdP/p7t7zzda5LH80l9KdIXW8e9NeyAroV8X8LPQy01uoz+g9Q/LNd5oPLeyK3 AjKFkfkMbCborLdnnYjuKbZZC4VeKOh2ELS9aGnxS7HWSRWO3aG1lFsysdODo6+B20WbidNn benv+K28+Md6RvwzgLrr0fMLuJ63/Cv0bRbPBqVip7OCXqe66egUSzaj/x6ppUdK70yKoO2X tpyfA5t5P94iQPGn7YXITxX9bn1ZZ912YY/kHmMcfD4n5o2iL7vBxvj/YWZpFn771q1u+Y7o dGdTOgUcwYyqyCcr2ktbpgFj2oC53TEYTbAkM3YR83wv83wa9MdCu1uY7a+TJXKQvBcNdQIZ 5vlBZA7AL8ON7o1wqqPtEq0MI3JfodZ1JNsSv11Z11qjp63Xn1khu6zmEllxZKp8PaQ0ulAw psiuSUR0pmDsDPk5FfwUC+NFMo5cbeuWpK745D4iZTrRV5U5cA7OXHn3bdtdQHTIPmqfoF7O apItu1bzGHn4ETy/2LxDnL5DrZrkf6E3s+tbTwZb6kpf9sqYmplBVhdtboQ5M5RZkcmMOs1M Wyif4DLdJYLsvLrGrm8Y80HW8Wzsj9E6u8fcX9VdvMEsLfmZ261J4MXcszJe0PPAwSGfT0SA jwa3duBW7sfSQCeQzLEnTaeh6NE+/IPwe1P3sPAj58Ec2opBX4FO4ESfgGRxPl9xL5wY9Pdh 6yLfPtQgmhty27k7uINFJic4uQeflEDzBpD3s/pEaJtgNfidOe/P4z5qEtraI3mQ0lXY8G14 VymSWznpO9AxSs+IpPoeznhsSAr6hc6G2FMAfh3kT9N6HDo7QtehrXLQjyB5CskIenpizz2U NoZODPhhW4I/4YFWyNwDvQ0Ne8DltJUqn3BweiAffJ4kidLx6OyLTBqc3pRmY1Ux2soCnwP3 gsFsqUTdwLf0WqMz8ifavkJmDdgKfk/q9uBd+U/gNex5FrwcjDKShcDNQSvUOgnuhv8Hn9bI hg5ukmsgWZHZcgz+Tu6K3+MTNR43ve9JLV0V+cXYjG1uOnR17C9PaTBeF6AfwCfbwU3cRD0J nmd81yFzBk4OnIuhjMivC+fVQeQF+eSP8zo3nDEQa53vsPk89DzofSE9juhYA45Dfztm10Fm o/CXhJ9NDTjtoKVHadxfFUUmBu2Ed78iU4BPKXxPrYbY/Gho7Rqi4CCtEAtwrgSxDL0byd7U TQB7Mzrc8sVGimSU/GCOC3qjpNS8Q48uCEabCcd7nnH5BOzOvL1R+LE51MX/kRnUaobNS4L5 DI5kxMdjT3D/vBsbgigoDhZD8mruWvLYCnLdWnoqN5+MdaQD86Q9vauNhv702md+fk+7OeBh MAv8HKyBhieouwv8mBaZmU4XtK0XvrWviuUMdM8IMusmuZ0t7uJt5i7uBnfxHr+6UnwCRak4 tSqyXplBmYMGq7JDJmdmqB7DM4eNUv1HDBucqUZmDJo4Rt0rv43Ws1ursvKJodxc+ZuBKp+K V4VVEZVffrI8e460Ur4qqBJUoipgf5ZPxkuJyqMi8p0tIe0oT2nR27FHu7Ly3S6Uu2GZUYXU DUOGjB6nHgRngQvApeAqcN3QjPThamta+phBaif4ZvqY9IlqD/h++oSxGeoAeNgKDlJfgqcy xg7JUOfAi6OHDU1XV8BrmbY4okDeZal/oYaSD8ZJH8x/4vyLiig+iWW98y+M+xvG/ob5/4bc HYd64v+GfoiFVUVVQ9VVt6pWqqPqofqqoSpDTVRT+faFJWqFelZ58rFkNQcPRyIJwZO/DCE3 7fId0XaHHquo5DNWkXzvBz/HJSt+6yVuNfZG4l4Nn+8Gz0J+8Cyy2srbZ7Gk4Fm8RVC/+JO2 Lau/+Prw5zfDXiTY/8vTdkF+F72j6qQUf33T+X///VZ2B2VnVKS8U1e3cXurJNVQtVDtVTe7 SxmsRqpMNUXNsJ57VC1Tq9U6tUXtUG+qbLVfHVYn1Bl1QV1R1+3myI/uUDq6Mbop+jLPrOhO npujr/DcEn3VPjdZ6jWem6Kv88yKvsFzc/RNnluibynHPt+2P2VZ6V08N0V388yKvsNzc3QP zy3RvVY6K5ptf9pspffx3BR9l2dW9D2em6Pv89wS/cBKb45+aH/aYqU/4rkpup9nVvRjnpuj B3huiX5ipbf8Lx6Rbzq/Vz34f+WRT+n5xuhnoWcOhp45FHrmcOiZI7adjdHPQ/8cDf1yLPTL F6Ffvgw9cjz0yInQI1+FHvk69MhJPHIq9Mjp0CNnQo98E3rk29AjZ/HIudAj34UeOR965PvQ IxdCj/zwf/DIUrVKrVVZ/61HLoYe+TH0yE+hR34OPXIp9MhlPHIl9Mgv4Yz5NfTMb6Fnroae +Z0Zcy30zx+hf66Hfvkz9EtO6JHcwCM20eCRWCTwSMwJPBLT4pGYG3gkZgKPxLzAI7Fo4JFY LPBILN+/4ZE96kN1UH3Jb3hfUtfsBjMuFhd4JBYfeCTmBx6J5Q88EisQeCRWUDwSKxR4JFY4 8EgsIfBIrEjgkVhi4JHYDeKRWNHAI7FigUdixYMZEysReCZWMvBM7EaZMbGkwD+xUqF/Sof+ KRP65Sbpaaxs6JdyoV/Kh36pEPqlYuCXf9sjF/I8Uin0SOXQI1VCj1QNPVIt9Eh1PFIj9MjN oUdqhh6pFXokOfRICh6pHXqkTuiRuqFH6oUeqR965BY80iD0SGrokYahRxqFM+bW0DONmTFN Qs80DT3TLPRM88Az8l2dYjcr0GN2JfDVGLsExOxqkKQqqWTrr1aqs+rtf2ozfcvY7e5j/mch tdg/CNXN8g6F1GL/sKVaI3ckpBb7n0OJ3NGQWsz3tVRUNVUDOx4dVS810Gb1iep+Ncc/ltfS F3ktfZnX0vG8lk7ktfRVXktf57V08q+W/POWahtraXnfh9Ri/wJUa8v7IaT+J4tO5Vl0Os+i M3kWfZNn0bd5Fp3Ns+hcnkXf5Vl0Mc+iH/Ms+inPop/zLLKxH6kZqWk3MCUduQOo4FRgLbY7 t/x12AVMtKP2oCrxX21WT9r9RZbaqT618/hqRL4jomikbKRapG6kSaRdZJLs3OJ3K4fvPHDj 38mj9vxFOR9ZahnU/jzq4zzqQB71CZTsDn3nU6Gd0xaXUvZZntTBPOoQlLa9KKASncPUEEsW OmLF48gc+ZtMUUdsWursVdpKLnU+z9N0NI86lkd9kUd9mUcdz6NO5FFf5VFfQxk7/ol2zpdX VRy7PjsrbVt2fXZW2ec+K7HSedfiKudkXr1TYb+jziLnUTtGq521Vn6ds1HFOVlOlirobHFe VIWcbc5LKsHZ4bxq9Wt2o4lK9nDN2GsVCr8V8WlbsMHZYHW+ZOW184bzht2f2dF2lvAb2vKd dzL2NtOzl42T7+OS3wFXpZwVzgpV2up4S5XhN66b8hvXon+MHZW/R7K1W7e1On+DapdH3ZZH tc+jOkAZvm+xuD1HVKTmJWpdpsYVpH9B8lfJJM4lW0PxrXnam+3NcuRkoDXd1nE6Ts5P2qcf VkJ/55XSMssjXhmvnNSL9FYv6PO6rK6ia+iauraur2fomXqWnqPn6UX6Ub1EL9VP6lV6jV6r 1+uNOktv0Vv1Dv2qflPv1tn6fb1ff6oP62P6hD6lv7W6LuiL+id9yVQxNUxj09Q0Ny1Na9PW 3GY6mC6mu7nD9DEDzBAz3IwyY80Ec4+5zzxgppuHzMNmtplr5puF5hHzD7PYPG6eMMvNP81K 85R52jxnXjCbzItmu3nZvGpeN2+bPeZd86E5YD41B80R86X52pwx58wF85O5Yq6a657yXC/m +V4hL8FL9Ip7Jb3SXgXvJq+yV9Wr7t3s1fJSvDpePS/Va+Q19Zp7Lb1+3iBvmDchfmv8S/E7 fMf3/Di/gJ/gF/VL+qX98n4lv4pfw0/26/oN/Fv9Zn4rv53f0e/q9/B7+339gf5Qf4Q/0pe/ pLhOx7RsLcroMnYMKuvKytHVdXU7Bjfrm+1Yp+gUZXQ9XU95erqerqL6If2QiumH9cMqn56t Z6s4PVfPVfF6oV6ofP2IfkTl14vt6BXQj+vHVUG9XC9XhfRKvVIV1k/rp1WCfk4/p4roF/QL KlFv0BvUDXqT3qSK6s16syqmX9QvquJ6u96uSuhX9CuqpH5Dv6Fu1Lv0LpWk9+q9qpR+T7+n SuuP9EeqjP5Ef6LK6kP6kCqnj+qjqrw+ro+rCvqkPmln5jf6G3WT/k5/pyrp7/X3qrL+Qf+g qugf9Y+qqv5Z/6yq2RlQRVW3s6CGqmFuNbeqm00T00TVNM1MM1XLtDAtVLJpZVqpFNPGtFG1 TTvTTtUx7U17Vdd0Np1VPdPNdFP1TS/TS91i7jJ3qQamv+mvUs1gM1g1NGkmTTUyI+3J5Vb5 LhPV2GSaTNXETDKTVFMzxUxRzcz95n7VXL6TRLUwM8wM1dLMNDNVKzPLzFKtzRwzR7Ux88w8 1Va+2US1M4vMInWbedQ8qtqbx8xjqoNZYpaojmapWao6yTeaqM7mSfOk6mJWmBWqq1llVqnb zWqzWnWTbzRR3c06s071MBvNRtXTbDFbVC/zknlJ3WF2mB2qt525r6k7zVvmLdXHvGPeUX3N PrNP9TMfmA9Uf/Ox+VgNMJ+YT9RA85n5TA2y8/qIGmy+MF+oIeYr85Uaak6b02qYOWvOqjTz vfleDTc/mh/VCHPZXFbp5jfzmxpp/jB/qFEm1+SqDE97Wo32ol5UjfHivXg11ivoFVTjvMJe YTXeK+IVUZleMa+YmuCV8EqoiV4pr5S62yvvlVeTvIpeRXWPV8mrpO71qnhV1GSvmldNTfFq eDXUfV5Nr6aa6iV7yWqaV9urre736np11QNeA6+BetBr6DVU070mXhM1w2vmNVMPeS28Fmqm 19frqx72BnoD1SxvqDdUzfYyvUw1J/7F+BfV3Pht8dvUvPiX419W8327hKoFvvGNWujn8/Op RX5+P796xC/sF1aP+jf4N6h/+CX8Euoxv5RfSi32y/nl1BL/Jv8m9bhf2a+slvrV/erqCb+W X0st8+v4ddRy/xb/FvWk38hvpP7pN/WbqhV+S7+lWum39duqVX4Hv4N6yu/id1Gr/e5+d/W0 f4d/h1rj9/H7qGf8Af4A9aw/xB+invOH+8PVWj/dT1fP+6P8Ufb8J9/iNEGX01V1LV1HX9bz 9T/0E/qf+in9jH5eb9Mv69f0Wzba9uoP9Mf6M31Ef6G/0qf1WYkfU1VfNlVNNT3fdDRdTQ/T 2/Q1A81QM8JkmHFmornXTDVrzFqz3mSZrXZG7TTVzBtml9lr3jMf6c/s85A5ao6bk+Yb8535 wfxsfjG/mz+9iGe8fF5+fdZ09G7Q5bwbvVFefdPDUv29wV6aORm/3S4QUT/eL+gX8Yv5N/pl /Ar+zX6KX89P9Rv7zf3W/m1+J/92v6d/p9/PH+QP80fbvmaS2RSZLUJOc8hpmpzmkrsMWcsj X0XJVzHyVT7yVRz5Kp685JOX8pOXCpCXCpKXCpGXCpOXEshLRchLieSlG8hLRclLxchLxclL JchLJclLN5KRkshIpchIpclIZcg2Zck25cg25ck2Fcg2Fck2N5FtKpFtKpNtqpBtqpJtqpFt qpNtapBtbiYP1CQP1CIPJJMHUsgDtckDdcgDdckD9cgDt5AHGpAHUskDDckDjcgDt5IHGpMH mpAHmpIHmpEHmpMHWpAHWpIHWpEHWpMH2pAH2pIH2pEHbiMPtCcPdCAPdCQPdCIPdCYPdCEP dLU7hDLqdiK6G7HcnVjuQfz2JH57Eb93EL+9idk7idm7iNk+xGxfYrYfMdufmB1AzA4kZgcR s4OJ0yHE6VDidBhxmkacDidORxCn6cTpSOJ0FHGaQZyOJk7HEKdjidNxxOl4YjPTztdv1Thd XlfTybquvqIX6Mf0Mr1Cr9bP6nX6Jb1Tv67f1nv0u/pDfUAf1J/rL/XX+ow+Z3czF2xsXrGx Wd3GZidzu+lp7jT9zCAzzKSb0Wa8udtMNtPMM+Z5s8FsNtvMK6a6edPsNtnmfbNfH7TPw+aY OWFOmW/NeXPRXDK/mmsmx3M8z4vzCuhzppNXVJf3krwMr76NywHeEG94/E7f9WO+7xfyE/3i fpJf1q/o1/Rr+/X9hn4Tv4Xfxm/vd/a7+b38u/z+/mA/zR9jezn2/0flvx2VEo91iMe6xGN9 4vEW4rEB8ZhKPDYkHhsRj7cSj42JxybEY1PisRnx2Jx4bEE8tiQeWxGPrYnHNsRjW+KxHfF4 G/HYnnjsQDx2JB47EY+diccuxGNX4vF2IrEbkdidSOxBJPYkBnsRg3cQg72JwTuJwbuIwT7E YF9isB8x2J8YHEAMDiQGBxGDg4nBIcTgUGJwGDGYRgwOJwZHEIPpxOBIYnAUMZhBDI4mBscQ g2Ptudnj7zAOVGvURrVDva3eVwfVCXVOXVLXuf/gzKOq2ZNTfXWr/sXO3Rn6N4sz9e8W5+g/ LC7y5ijHNPbutdjUm2KxuTfVYsv/jYZf0XAVDdfQcB0Nc9EwGQ33oWEaGuwZzLtfJKAeyKMe zKOm51Ez8qiH8qiZedTDf1Hy1ydD6jKUPbXbVf9rpcyfJkc5dn22p1G7RtvDil2n41TMrq9p fLNhe+6GKqm6nPQLxX9o49fW1Of/oux8kPuDj+xPl+1Z7ThyBfQDNtptWfDU5zkPyhlCcRqI 2JpfyQmQtw8xztVn7Wlyo9xuOKuDc6I6FF8wvsB/eSchNslbp/KqhvVvs/AG4gNOzB/m3SSc ke82hPomj/r2L8q7R6T/xxN48M4twts2n/dK1lnOT/pGd7g7wk0P38pFAimlisnvXiXCVcUG Js8o1tfLV21Wu1m/5Y9EndUzinWyrNucSCQlPjmfZ6oX0E5Jo5IHeXHVvYgbmXGLE3FXd0++ PbnG3zhJa0o/mKRu5V8XNVhNsNM3Qw1TE+3/TeRfcrm/KXMTFxWtObPj7pyEujmJNRucmjhl 5ufe/tUzElKSZ7jWIt1xtXYijhNXc0PhL7vm9l35wdt/1S5lTRmXUj25qqd7uvFFyrccO25y ZvrwERPLVhlStWxKauotZTulD8kcO2Fs2sSyLcdmjquZUjo5KRC+4T+XjM0cNDF97JiUcsll pFwXKf6v8m5jx04s2/zuiSPGZqZPnJxculj+5FuSG9S2/9VJSa59V7H8KbXtj/Us0/53V/Jk fGWVeEWcnt1TiiQXlh9iReLuGDRhRPqY4RNtM4WSCwgzWiTabdjQ0WPHDP3LsLj/zrAKyeUC w0r+vXzosLLd04ePsVrLdm3ZPHlGpHxy/rwBjESM0jMiBZXlxzkzIhH18uRph/tta526ru7G lGO/31Tvtnve/qPMqn2tx//4SZtzBxe8M6pjt8FXljvvdPr8toxaFZsMe2t/hZfj2738wN3H W7+x/pECXffeVP3S6rP5K5T5pHnFa4OXf1yi9XOL25dZ/tG2WuXfaX/z1LFHbyjdaEFqodTj b1S9ktbo5kjt3JzK7dZuz4jMXvHHq1uHPDDj976rp898eNGWSzuXPPNxg7VdHy5WeXbn48m/ qsZXsn9vPP3NWT9kpD5fs+6vL9XcHDdt8D/uTVuxbEL+WZsv7blc9pUuCQuHfFDjaO3WJS6+ 1n5po67di+9Pu33y+k2z3+3V5KkZXeeMMS/W23VfxTe6pTVe3vnD6vfXGTOzrffJqgPtZzn/ Uc15RjWxrX08pFCE0FFEOkoTyCS0hKp0UUAEeRXkIFUiLYQAHoqSgPRyRQVROigiVUBAEAmo FKnSiyCIelBApChN4E4sR/R4171r3fc9rvfTzLP3nj2zZ/+f3/7v+TDuoZBsatgzMyjtD8JZ 5FWAvARwga9TYA+cBdhGzwhKF4FggMEAciatlA5OvgqQE4PYrToJs3hiqpjpWe4So9jNlgzi 3683ChukDhKlphbO8UTjg/30s30AG+0ZuejoNuEIAAYeAAFaASt8O5y7VaDdB0KwKpobemh8 1VRHLkvH/h3ATKtmg8PBNArdkjowmiL88wrPGorPt98zJmUekyBJe5eGrucdunQGYvT68RTv U/wj1syABah2w+Ow1mWz1vq0GguPd/Y6uTqQtwlNV3v5K5nTdiIv9Q8JFkgFzs7c8MqPG8XF ql85fQ/r1hVeJLb+7HUfnulCeM3GOKRaYWEpYIWdUw4xJZVwUctF0rMCGzfGgGy2dm6rCdrv 4nSzuqI6VuHxPIw9wO9915jWM/+N8fH8jQ/PepGlhL74CZNybGaAbI/6sAKznTI0jXxaLOLD Cfu4YstqXP/J6KMhfPLvVa+kU1gybaJKZSoyrrfkDQmX1wI7zwtzI6XvHVncP/YbMBEviQ+r IzxfyMlrD9Ii+rCCjPEDGWP3hTG2dB0an1jItjWPECBnfmFW04CDAxmjjMEoABgcDThoQP7P ECAH/588G/KTcEDpwo1MDh/52hz2L5r/W/bUABFrusSbZi6pESYQMer9HgH128f3YRe8LlDE XyVwQswG+Smsau0C1TVLWjGJPR+xfC/urkxMd9vCatO7+7yNTujlzvz2rus53orP600pfwy8 TUon3eE4SvCKtXtjHi+O4vgw516ed/jON2GJ3OKl58R9snuwuJCJUvFe3pW9r7uat1uai8wn xoSFSm0sHpB5FbUM1wxsa0uID0V6wp53brBoKW72V2qOxOpuC/zQf7DA6p0PUcBXLDBC8SG/ dclh2EF9N4aco+FX6INukAvMjQfIfau1WlT0/aPIpF6zA5zA1Mvr4QG/PfSz5A5jLFPGp09h dkczTq30cFeNfWx7k83zhT3LAPn9z9nzLYuxZxBeTbsw12ziQ48WRVQ1JN0mxX6aPgE2WtaD icwQ9IkbAmJwXmB70M/TXofWQAiuDqgCuHTldMVQeWcSiaCCQtkTXeXcvs6hnL2HG4rggqeV oghEDwdve5IXStsMFJ4cWAQYfH1COjq4GqACYL/GADRU5kuHvr6+P+vQkbilJ9IPCfWJPpKw 4Dwu5NwGh4eWz4B2XmWD1upuR4VC72JPIDahPHiV+GKjTfkPFcIVU2HWKs+y5sXeF5GTkgSv 3pnxev+3cxYKlkGUKfZ+IuwNp/H0CDLaX8eExdZ73T2ZYaR9ryUvEld8cn1oE34LmjWwGptV XVN32lwVbfNCxr1lzkiaf17Qxz+0qCGs77b0TH4rK/VF2rnJjskQojmF1126KfVyGZ9gncfF YbsbdQddCppn1OMnSlB5fr64U6ch/pQUGPuo/eUD4lqjl0Xrwpg7ubNsnnphiEqCm01Sj3Yf MXEyaBYQyH0kjsMfNs6Zrqd3lSPumhMZctttEETm2ReQ1krCGpqA9EkB6XP+M33YTzMnmVAh e/I4hnWFjvmdyvyRQb/G6yiB8FEC0ICCgjINPTgw/AVexxzv5uhFsnUj/Kde56my+1pRk5ah J29Tu4GGGXU1j7tKBlPNaXKkKXhGQ37wADpesvyCw5jQ4ZCq+oNPziGWZ73vRzXe7C3EE5zO SDhNllfMnr/b9vbWOmc283FRKVTHvkEL+C6fO24ObobmwyNzo7VpwY1Bz84dgipfek9NZbQQ dNZvG6T6nEAFlu+Bl1lYnea33wwKUHvbC99jhPMlMVjXnxgIVZbxbmZ9I4hjCvDZSHF19xub 1ohLTPVktZE24bU7iUntCjbeK3rCWTdqFBXCfrhk5Q5fjOvbPde4llvY+8+zLlJ8vJQaLvtl tp6kn0YUh8pXLF+yCtkfcuz8JfdiIRmDVo9k7bHTk+fEY10+84ZCJwm+kd0/Iw7j/w+3w07P 9GVnwUNHszCQLaD0mDTWTLyrkHcwNO5e8pt81f3aDZ3Azj8v4IbCWQS3Qcwg3uAuRBuy/3sn 9Bcb9RNAXTLiQNcHHK7miM2wZaBjjSboxsx6mddoMiFkNytNzc7zz+AuVGRZMI9Gl6vuerKW n9NccdtUZJcHI/6sCyxTVG/GtcwtQLRSrztkIYbtPkOkUt3U2dcEa920+K7W9pFY6nitdFvA dHMhpjfsbov9Q6UnvCK1PqOqV0t3eaWKhA+UlXGaRy8m1zsaXpUUTz4ZyabayOV4xqC6oyBY xaTY7tgo8Po1TmAiYn4IR17hEol2CLKnhyfMX4Vqo/z1wqs2oYOOK4ajQzDSxVKEO0trylNJ 2wCDuR3JHCJYKH9YPv2jBEzly30NZuo1uRGjk07KMYuiCcmtxb7mpip9RJ0SsQ8goG6BgIr/ ao8QmcAne8T46+zRX0BAYxQWdEOKIJrQaEUao+Q/h2haCJBL/w57JAHs+RwKumvjCc6ORGEd M11hXTNjFayijrysPKCoLauopa2H3gOIfR4T//djkjWjDUrYzJHog7d3/Ld4eweXLUmg8pFP 7bktblfKdbAdqKJyYj+SHRUYHiqV7Hb+wACnMiQuVsz5C9rJ6A0ezDZVqOh2nbFULQvO0Ffn YJRTdNF9Va8WDXWC5vLipwxnJGTeqvlaZfcQkg7+Twh7Z5HscoTAqzdSZX90pNLb5RDN61Ub OjQrx4uPsbu+vN7/oN5buWbx/Dh5UnJg19x84Rwlq68flpnGE7Kmvpo3Xo5pSoc6LLza5BP3 ZDSL5IHOB0v4HKB45swWYM409LtuNxF1TLQz0kNtihWdn75BqIG1DA1gEI/2/mNfeWqvTKhr RQsXJjCm4WzhDhTmo1O1QLHu0eWCVdlTwaekLoZ0WWaIbbVT34AwmfhhaTZ67hV+4riz8dKV SL+Ra3LfOaWfEuO/cUokL4K97f+KU/raE+nnsP7O/9FTf0YrpKavzQW1+9cVs4cRiBAhi/nZ pBuNjDGo0jZNz97QAF+hkakdJTUBEytJ89t0DQq4q/Ey8xqn7Mzn356T4IjHTbcPhhmHL53U F/OX4NnHmFaLRMMpA4rlLMmQ7qhbZ2wf3Qnfn6Kh9PRYtsQ1laEaemvuGyVsh+pi1aLm7ZKW nWZ6F/glizHDj9FM99ZEnfUOrXZ7if4hFSsKWbOopS8kp/NUKaxIxgoZ2iEyIt6T9V8jLzD2 H1ONE3RhwudSDQKOUjRtIFjtZPpWzQFUrYkXk/p61W+LjdPK9Q626UY96oRWq2Iucl1PFpqv xqEvoctPU9pKz4xJrQ22onkc0hphZov+ZKfgSVA6OoAc9gu3bN9tJL996konN9FWpy/TxgRD s2z9jgbe91vEjGYFttbygNT480I4GpR6geHvLxviqgx32jFIjL2SSZJn4p0BnLdcwoK2BI6l ywXJQMwheIgbxBHiBRGGGINHX/B4BOIBltlC3MHzAxASeOYKtrLPEA/a/S+1Svqd4HGKaEtw /l34BzbBKaD6nPcWLesNoCLflSPsk0UYDOs1WgYe6nZiKIqMCXTb5ruu26CLGNt4jHDrc3ph nuvmadjJ908nC2zX6mavnrvjbnNt7oELS9KSZsw9rseeO9XDKYv5pmImXSmd6pI5z0286r13 EC9O/OEb7HMvU0gY+nQvi7WXUGdQwazh5R7oLLuT7vP89lHKmtt6oMDCXYv9uWwHHDo+5syP x1/wFRMeduZHi7o63ygvflbWNxHZ+qIlpVuz2i0j7FWzslwUlnNoP7LRB678hGN475OmSjxM PrlK38jlJel94Jp6kQkdUm17Ia8GrJruRPDw3GojXQQiA59goyDpMk0Qb+7Tr5YlaaZkUKBC AAW669s80aMpUBawiPFvF+SPi+R3SzfDF0GmWwO8W9XI/O3TLx14zz9rEGg2cE0FABxGAY1V VFLEWv5FjFduzqg/ld79PqR39BDDzZBOhztZl34gFE0ihHT1UtsH7S0ReUt3ZpcfMN5inV0p 1WqN24zm//iPR5a5RarRl59FPm+KrxmvrBNhlhvJNj2BErszeHIpTPYJmozCOfVcL5s50jhY wRBRHIdhyOCn6h9FndCw4ogckwzsbnSYRVYf7XM3jVIYOTut9CQ4F17sqe8sALOTFFyy92m3 rEatPujo0egu3Avziwyzda+CdOe86Q/tWAGyFDtf8hL4mwL4AlDbHzEF7SjGHZATGhKkL7qs G/3irpK5psrGh5SNZrWJ8Gv5Ou2irCkIzelGb8xz0tkHNcJvi1oW9J4TBDWAwxrssSr3T1Ej F7xlibeoVOSdGGilpH/xEd9hZ2u3fwLYXQGnDQplbmRzdHJlYW0NCmVuZG9iag0KNDIzIDAg b2JqDQpbIDBbIDc3OF0gIDNbIDI1MF0gIDExWyAzMzMgMzMzXSAgMTVbIDI1MCAzMzMgMjUw IDI3OCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgMjc4IDI3OF0g IDM2WyA3MjIgNjY3IDY2NyA3MjIgNjExIDU1NiA3MjIgNzIyIDMzMyAzODkgNzIyIDYxMSA4 ODkgNzIyIDcyMiA1NTYgNzIyIDY2NyA1NTYgNjExIDcyMiA3MjJdICA1OVsgNzIyIDcyMl0g IDY4WyA0NDQgNTAwIDQ0NCA1MDAgNDQ0IDMzMyA1MDAgNTAwIDI3OCAyNzggNTAwIDI3OCA3 NzggNTAwIDUwMCA1MDAgNTAwIDMzMyAzODkgMjc4IDUwMCA1MDAgNzIyIDUwMCA1MDAgNDQ0 XSAgMTc3WyA1MDBdICAxNzlbIDQ0NCA0NDRdICAxODJbIDMzM10gXSANCmVuZG9iag0KNDI0 IDAgb2JqDQpbIDI1MCAwIDAgMCAwIDAgMCAwIDMzMyAzMzMgMCAwIDI1MCAzMzMgMjUwIDI3 OCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgMjc4IDI3OCAwIDAg MCAwIDAgNzIyIDY2NyA2NjcgNzIyIDYxMSA1NTYgNzIyIDcyMiAzMzMgMzg5IDcyMiA2MTEg ODg5IDcyMiA3MjIgNTU2IDcyMiA2NjcgNTU2IDYxMSA3MjIgNzIyIDAgNzIyIDcyMiAwIDAg MCAwIDAgMCAwIDQ0NCA1MDAgNDQ0IDUwMCA0NDQgMzMzIDUwMCA1MDAgMjc4IDI3OCA1MDAg Mjc4IDc3OCA1MDAgNTAwIDUwMCA1MDAgMzMzIDM4OSAyNzggNTAwIDUwMCA3MjIgNTAwIDUw MCA0NDRdIA0KZW5kb2JqDQo0MjUgMCBvYmoNClsgMzQwIDAgMCAwIDAgMCAwIDAgMzIwIDMy MCA0NjAgMCAwIDM2MCAzNDAgMCA2NjAgNjYwIDY2MCAwIDAgNjYwIDY2MCA2NjAgNjYwIDY2 MCAwIDAgMCAwIDAgMCA4MjAgNzIwIDAgNzQwIDAgMCA2ODAgMCAwIDAgMCAwIDAgOTQwIDc0 MCAwIDAgMCA3ODAgNjYwIDAgMCAwIDAgMCA3MDAgMCAwIDAgMCAwIDAgMCA1ODAgMCA1ODAg NjQwIDU4MCAwIDU4MCAwIDM2MCAwIDAgMzQwIDAgNjgwIDYyMCAwIDAgNDYwIDUyMCA0NjAg NjYwIDYwMCAwIDAgNjIwXSANCmVuZG9iag0KNDI2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVE ZWNvZGUvTGVuZ3RoIDIwNzYzL0xlbmd0aDEgNTQ2ODg+Pg0Kc3RyZWFtDQp4nOx9CXgUVRbu OVW9793pJUkn6e50FshCQkIWMEtnhRADQbZEICTsaMCwiGERA7JoIhodF1RkdV87CUhHUBF1 HJ1hXEadUcSFQXRUBEdwdDRd79yqTgDHmTcj3/N9n1//RZ177lK37vLfe8+taiqAAGAhIQN3 +fiqkaXzbjABPNcMYB128YTxo+I2V7wBoPwWgNs5dnxG1pLrF90CgA/SVZMmldfUVd0y/gUA zRYA/ujMBU0txyvrjgBM/5TSvDFz2VL3NVv3NQAsbAFQXDanZe6CLwuOjwBo2k83XDO3aUkL JICa7jeV8jPNbV4+p/29e9YALH0PICVh3qwFrZOy06YAGNoAxs2bN7tp1nPW8dsp7zRKn8sC zL2q98k/i/wJ8xYsbT34qu57Kit55d82XzGzaUnD/FcAtjF/0YKm1hb516p9lP46CnAvbFow W/VS450A9/oAYr5ruWLJUoGHlVSeAhbfsnh2y4YXH50GMIfiVUOAtRVXf9cb92zMm24sOANO FTDcN+6pRcztnnX6TLC1z6ndo1pPabViegZyldcHEwG0HwVbg8u1ewZi+tHAQritMBV40c+B CTLgImpVBd1XzEOWx9WBnOpxlzyb/HdKLh6GOZwF5ZxcJZPJ5Rwno4s3npt1zdgxY8FNx2Py /cE81Cg34jtuapIP/sxiFaGicIHQ+RHs5qfCWvgJcDdBM50N/OOQNhD2Ecyg63YyXT4KSuSj MJ7cSf3xpK+gczKdtXTOp7P0p/IWy3KT8KX8ebHzQP45jBzIYxHU/rtrlOsp389hzHn5FMJo uk/FT6WX3/UvbX8eZPdCScitlrtgCrlVIX98qL5jB+oegOGh8k2RfQMX94dT+0yWDYZ8codT OXJkh0K9yvL5hno2jDDCCOP/K7ityKAVPaTQKqsBnVVHrkH0iuEaNl06JM/WSBJ2KUYTygXB YLORT0+XgTWaAvRo1cN/nmTDCOO/A4LERB3sUgtkKaqFIJFNQ1ILWqGPaKcnaQADSSPJH8AG EcL3YAcrSQfYhX9CpCijwEHSCVHCdxAD0aTHQgzpcRBL0gVxJN3gIukBt/AtDIZk4R9k56QI 30A6pApnYAikkcyAdJJDYYhwGnIgS/ia7IUC4SuyagpJlkExyXKSp8j+8JGshBLhJNkypSRH QRnJKignORoqSFaL8mIYKXwJNTCK5DioFk7ABBhDciKMFb4gW6qW5GQYR7Iexgufw6UwgeQU mEhyKkwiOQ0mC5+RFVlHsgmmkJwD04VPYS40kpwHTSTnwwySl8FMkpfDLOETaIbZJBfAHJIL YS7JK2CecBxaYD7JpdAsfAxXwgKSy2AhyavgCpKt0CIcg+WwiOQKWExyJSwhuQqWCn+Fq+FK kqthGclr4CqSbdAqHIU1olwLy0leCytIroOVJNfDKuEj2ABXk9wIq0leB9eQvB7ahA+hHdaQ 7BDlDbCW5CZYJ3wAN8J6kjeJshM2kLwZNpK8Ba4T3offwPUkb4V2krdBB8nb4QbhCNwBm0hu hhtJ3inKu+Am4T24GzpJboGbSd4Dt5DcCr8huY3kYdgOt5HcAbeT3Al3kNwFm4V34V64k+R9 sIXk/XA3yQdIfwcehG0kH4J7SD4s6o/CduEv8BjsIPk47CT5BNxP0g/3Cn+GLriPZA+F/Bl2 w4PC27AHHiG5Fx4m2QtPCG/BU/A4yf3QRfJp8AtvwrOwh+QBUb4Ae4U/wcvwtPAGHIKDwuvw GrwovAZvwkvCq/AW/I7k2/AKyXfhkPBHeA9eEw7BEXid5EfwlvAH+Cu8TfJjkr+H4/Bnkp/A uyQ/JfkKfA5HSH4B7wkvwwn4kOSX8BHJU3CU5NdwTPgdnIbjJL+Bj4WX4B/wKclv4TOS38Hf hN/C93CCZB98STIIp4QXQYCvSDK4aC3arlYqged5mRgiujwHCoUCmGAOA6VRsi1Lv4eE5FGG pgs5yBVySiBj+1nSQCaXiXn8YhNWGL9OaLQqRku56OF5Ri2eKKhkPBQdBpXIz5BHq5JCGPr5 qRApHeInu0oulyvD/AzjgqHVqUAmC/FTdGUyYp/qPH6qVUAB0kMr0KlZiBQTCmL8VDJ+ssdM IndpOlWdpXQYYfxM6Ihu5/BTIfFTxeioEh0GjZo9DD6Pn5Knn580v4pzrMhPFkd0ZU6Yn2Fc GPQGDZs2z+enWs3oqBIdBq2aPfcIeQzsEYhG8oSCiKdKFZtjf8xPFYQRxoXAYNAyY1EyFEV+ EldFYqrVZ/mpYfwMPZoT+amVYvqf1hE31T/FTzWEEcaFwGg8h5+0qRH5qdEwOmpEh0GnBe0A GY3sybNO8mhDuahFSqslfrK5lZZ75oT5GcaFwWTWESMVkqEo8lMhp/mSiKdlkBLpdaAbICNd QCGS5xx+ijYqm37ZbMv4qT075YYRxs+E2axnz4b6+cmWZgWIxDyHnwYde8+mC11Baj8/Q0Hs 1YhoA4iPlBgxablnjhbCCONCYDEbGD+ljYzoEj91Oh3b2YsOg1H/Y34aJI8+lAtxUzfAT7IG GD+ZE+ZnGBeGCJGfyn5+qsVXQ3odEU/PICUyGcAwQEa6gEIkTz8/yT4VbVRlPz9puWeODsII 40JgtRjZk/hz+akEkZjn89PIfkcjgi4Y4GcoiHioIzrqpLdMbG4lfup1YX6GcaGwWUzESJW0 0VYqNeKrS4PBwJ48iQ6D2ch+vNrPTxOEJlFgrBVB/BT3UOIjeYOevTbVMEcPYYRxIbDbzf/K T6PRyJ48iQ4DUdIE/b+vtjPXLMX085PsUwOzUUV+Gg0iP436s/NrGGH8PDiInyqVSnoQpFSy rY3qX/gZYQbzWX5aILTIDwQxfhpD/FQxa4CZo4ymYX6GcWGIdFjYm0yJnyqVVny1bjKZgAnm MFjNYBkgo4PxM0LymEO50P7JyPZQ4lt6k1HkJ6OpEcII40LgdFhBrdZID4LUap34at1iIQ5a LKLDYI8AK0DIQxcws1XUI0K50PpvZjaA+JbeQqzVGXTMTjVDGGFcCGJj7OxNprTRVqvZ1kYD ERFEvIgI0WGItIENGEUZYkgFhxQTCiIemkUbQHxlZCXu0nJPAf2UDiOMnwl3XCRotTppo63R GMWX7TYbcdBmEx2GaAdE0iwqeeLY/+aKkmJCQTSPRljplN6C2om1RrPRFnGWv2GE8fPgiYti /JQ2MlqtxE+73c529qLD4Iz8MT+jJU/oPyAyftp+zE/mhPkZxoUhMT6GPYk3iR6dzsyey0Nk JHEwMlJ0GOKc4KQ5U/LEkwqxUkx0KBda/0UbQHzkGUWspeU+0n6Wv2GE8fOQMsgNBoNRMhT1 elqTaSMeExMDTDCHIT6O/We6WMkziFTwSDGhIJpdI8U5VnzLFEusjbBHxESd5W8YYfw8DBns BZPJLG13jEYyK2kjHhcXB0wwhyHJwz6i4pI8g9n3VBKkGHcoF5pfY9kcKz4ldRFraTqNiznL 3zDC+HnIykgCs9kibXdMJgf7RRN4PB5ggjkMgxMgEaTv/ABkkArJUow3lEssxLrpZPt1M8QT kR3RDk/cAKXDCONnIjd7MFgsEZKhaDbTmhxhgYSEBGCCOQxpyTAIGEUZskmFFCkmKZSLC1xe OtnzUAskEnejYqIS3MTxX7QuYfz6MCI3DaxWm7TdiYigvY/NCklJRLykJNFhyEyBVJozJU8u qZAuxQwO5RIP8Yl0Sk9Jk4m7zjhnEk2uCb9sZcL41aGsOAscjkhpu2OzudgbT0hLSwMm0kKf K8zLhCwyVSUPXQAwTIrJCOWSDMmpdLKnUA4YkgJsOk2jeTbll61MGL86VI/Mh6gop1v0REbS nOeMgqws4mBWlugwFOZCHi3skmckqTBCiskJ5ZIGaZl0Sk+hsom13mRvVvpZ/oYRxs/D+DFF EBMTJ210nE5atmnfnZdHHMzLEx2G8gIoBMiXPGNIhRIpZkQol0zIzKETaEsUA/lE5KTUpLys AUqHEcbPxNTJFeByeSTbMjaWFmSPCwoLiYOFhaLDUF0K5bSwS57JpMIoKcYXyiUHci6ik+2H XFA8nBb2zJRCovDwX7QuYfz6MGtaNcTHJ0iGottNNmZCPJSWlgITpaFPXl8yCkYDoyjDNFJh jBRTGcplBIzw0cn2Q/FQXkS26rAhpQUARb9sZcL4NYILfZTXCjzTkH2sV3H2S73IgfTh/HNB kf0fvRN/XGIyQ4SVdu+RUdHO0EsnbwJ7/BTa4WcOJZGTK+oFoTzKoXIkI/7FAGNh3CUAEydN rqunKf3/VUX/R8ggAGyL5yZNQ+MuhXaIWbQklEAZDcwxMB7qoQlmw1yYD81wBSyD5fCYIAB7 bTEI0sncyaEFhqWtgUvEtDNDaRfCYimt8Nf/6pj5v3022Td8xPD8vGHZWUMzM4akp6WmDB6U nJSY4I33uF1xsTHO6KhIh91mjbCYTUaDXqfVqFVKhVzGcwhpFd7KRrc/qdEvS/KOGpXO/N4m Cmg6J6DR76agyvPT+N2NYjL3+Sl9lHLOj1L6pJS+gZRochdAQXqau8Lr9h8q97oDeOm4OtI3 lXvr3f4Tol4j6rIk0aMnj8dDV7grIueVu/3Y6K7wVy6b117RWE75dWk1Zd6y2Zr0NOjSaEnV kuav9LZ0YWURigpXWTGiiwOVnkrlH+0tr/BXectZEfx8YkXTLH/tuLqKcqfHU5+e5seymd4Z fvCW+o2pYhIoE2/jV5T5leJt3PNZdaDD3ZV2oP2GgAlmNKbqZnlnNU2t8/NN9ewe5lT/SG+5 f+SKY5HpaQG8f0KdX10WQJhQ1wujhbauqrby8np2N0tZ3cZzkzv59orI+W7mbW/f6PZvH1d3 bqyHyfp6yjQ9rfqSOg+V2ltxg5tV45I6sQaUKUZmUCFZGKumVOHZ3goW0niZ26/2lnrntV/W SJ0V3e6HS5Z7uqNH+3qFD2F0hbt9Qp3X4y92euubymO6rNB+yfKeKp+76vyY9LQuk1lq6S6D MaTo9OcqswfiRE1MzjQqdX9TIyuRt4oo4nfPdFNJ6rx+LjGfidn50D4z3ym+lqlHatH51H6N 7aYRrCPkiSavu/0MEBG8J744P6QpFKJINJ0BpjK6DFCO4vt1f2qqPyWFMUVZRl1LJSsS/Tnp acv81d4Wk9tfTU0GtXV0Uf2IDGpyj4f1ckfABzPI428bVyf53TDD2Q2+jNR6P9fIYg70x9gm spi2/piByxu9ROfd4kC3+VVJA/+MJntExbwRfrT/h+jZUjwNnwp3l0ye2F5bl9TU3uFMamy/ oZ66ppKGYnt7pddd2d7Y3hQQ2mZ43SZve1d1dXtLRWN/lQLCgQ6n33dD/TykRvVnS63hjyir 451cvaRxTp606vHe6nGX1rkr2htDHRcKyRd9VMheaEGTz4aw0LTQvZD/cOGphVzFuonrZq/j dwbw5W65a2eJBl8WXgc52PEJPEmLj4u5PqOSt9+2+0GHJNpfCggf9uRKrs+Za5+0uMw1afHS MvviSfeERPt3D7javwsEv/TpHjgnOICfdU8a4SLHZ5i0cYQdKpk5ZTGrfAFuzR5Q72iOcgW4 4u4dFnIKu3fYXfu5HNiBWnBx2d3b5rpKbFwWbMMa8g+FZv33pNm5TGhWATxLWhJu4XLJKLNz LtzSfTLK3stFkHKVnhQTKQt0pGhImaklRd2vqPoVIKVWTcV8sHuHiYr5QPcOKzn3d+9wukrs uAN28E/QymjHrdCsCMIDpN2NW6Je4+4i7XbcglPJHrRjJ2Vz2GHvxfWkdBhJWUvKGgMpbaHi 4DVScQJY1t1wq6vEhKXQwOqFxZRNCu157FhEmo5253a8qP+qEaGS4nBS6jWk5PUX2d7dQO1j RhtuUSwWi2al1niLVnM7UiNQ4VNJM1Pyngi6jprDp95mtp9s2OD6smEf1cAFJ3BLD5XybwFy KfNPQ+5bvZRRZ3eZ/Q0W8JDF/hq5e6kYB3cMdj3HIt/qHm0/wCKfttqfZZFUs73brnA9SZFY 1O2x72EK1+20d1PsbordviMgu7qn0b61YT/rXbiHcjHuzbXfQVneHoq7qfnpGI41LdxIsYu7 ffZ17B7UoFcyl3KZGyrhjIDU0AHO192qIO4UdbcqyRne3aoiJ09yMrpbjeSkdrcyeqV0t1Lf cu7uViIkF93dSq1n5KKgFfcTu+ywLMEiH0ZM0sJ0XCNyiu+Z/kIc3QN7pj8dSy1+n3gT3CXm jpu7WyPJuaW7Nd9VosXVMJ3rIuPCjqsog9ugkLSK7lYdJSkXy4FUVAc5Bd2tD5AT2d2qYdcZ +2+MBpiulFHj2FG/e/rXifYvevFa7q5u1+fTA/jM3jL7n1qzXK9PD3Bd3XPtPRQnH/akq5Nu sIni1+wdYb+uVeu6luKNPWPta1lYzwj7GnKX9OTbr2oNyI72PGCfT/7Cnkx7Uyh+KnN9hhH2 SndlbGXKRKfaqe58Bp8EJXTiSFFG+8qUnWeUnW8rO1cpOy9Xdl6m7Jyn7Jym7Jyi7JyoTFDF q9yqOFWMKloVqbKrrCqLyqQyqHQqjUqlUqhkKo591g79EXw1Vz2+FKv9B2ZC9Qy3/5vx3gBq xl3ql3tL0W+phuoJpZH+/NTqgAou8eelVvuVtVPquhBvpHn6OnGZDmAU8693shW6FxDz1m9y MldYv6m+Huyp/4rIcz1YXbv8WRpz91LNXLhJlJYepWulksVWj6fITjGyU4zsZJGdUmRkrP/2 6vF1/odj6/1ZTBFi66v9mePdU+t6uWu5NRXlvdxa5tTX9eJR7lpa+Skcj5JB0Z8MGii4vBeW M4clOwINLBlNBEfOTdbMrWXJdjCHknEKaBaTNXMKlizA3cXSdW1bXlHetXy5mCbGB9vENNti fGIa+TAxL9xCtyjvamgQU2W/iVtYKtyS/Salgmp/rpjT9OmUpnW6VKg5MF3MaTrOEQv1/tkk y6Qk8jf7k8jfPLdALA3xEqRU5uv7U5mvp1TYUh3Ar8fXdVd6Kis6yukq/hPmaxJ93TuaKyvm ecl0/M/Jljf8N8meoiVjC4RSwk+Q4t8B/4e0/x6zS7FiPmN6bV2XCkrry6ZKbg+n1RBvG52e +lK7qaVIJPFFnsjVzqdk7O+2ackg0ZGFq6eTRaWXpJewKBmIUQZm/IaiIldf5HE+hQ+GokwU bKZR9BPlBz9XMS/AnayY5/d1kElHJquCBZwKBcR7y5csWYpLAOT76VwCkfKttLM8zl60CZ/2 n8FS4Yz8CYBgMoh/MEveQRtSP4W1sQ8ECWe4187/UJDwb0BX1f5ftk53c6e5RUh2Alb+2zQb 2N/lgDx4ENZCOzwHf8di+AvcStrHwmohSNPwZujGzbAfXoGvsR7iYCPtnw1ku+XTcj4RXoL3 4W/wFS3fibAakf+A2thE+8sDlMNLlMfTlDodlwq7hT9RiiHwHA7GydgkvAI62jc+CL14JU0T 7MdH2bS33I6JWI4NFHatsFnYK7xKBlUE5ZZMe9Vq2qVOgulUoqvgRrgDXoTDcBp1tGpfBk5a JMbCdRT+IvwWXobvMA3v5Y4L04VdwvvCF8JpunMJ5V9FO9ZdVLLn4fdwiq6NwxSczJ3gb5V9 JL9D6AYFlWMw7XZzoYJ2xJPhUtrnNsMK2E275+fhBXgXjpCVUYUd+AkXxyVxl3HNsjb5O8JI 4ffsr7jQRKejsrAfAHrpjkOpXSdSeZdSDtdABx2dlNOf4AichG9Qiy4qZS5ejEvxKuzgmrle 3s4n8/lEU5NsvOy4cA/lqKD9twfYT7ZSafc9hmpZT3VYCjfTsYWOe2Ar3E82y16y4t6keitQ jxbKNwfLcBTW4nzciDdwFjpO8odlz8veDUYKICygluVATUyLovwTqHWLoBxGUf7jYALdoR6m wRxxb99CvcTKvxJWwdWwnnq/HTbBLfAbuA1uhzupBLvgPngYHoXHqQwHxZZ9Fd6At+Adaq0P 4EM4RsfH8AkdX8J38E/4gRqKQyWqqaR6tGMkxhMnUslAKyC7rRrHET/m42JcjtvwIdyDT+Jv 8TAGOY6L4DxcITeSq+O2cfdyL3Jf8fn8FH4Nv4F/gT8qS5AVy26VPSHzy13yYvkC+RL5Ovmz 8j7lih9eD14cXB3sDX4S7BMMQqaQLxQJncJfQPzLOzQIVeKfdjLTOPVQO2fCMOJ2PlxE7VE7 0B4NMJNaZA5cRsfl1DILqGWWQisd66hVNhD3roOb6NhOx73UHw/R8Qi1SQ/sobHDRoN0HITf wR/peA3ehj8Tg98jNpyi4zQEqTA8HUo6VGjAKIxGJ3owGQfhEDryiHmlOBJH4xi8BCfiDLwc 1+B1eCtupeMh3I178Vl8Dl/G16m9juI/sI+TcfFcGpfLzebmEL/Wceu5Du5W7g5qvfu5B+l4 lDtFc8R3vIPP4Cfxk/kGfhu/T6aVRcqGyGbLVsp+J3tDDtSeZfIORQwdpYqRiqsUjyheUbxP x3HFp4ovlRplpXKmcrbybuVDZLZ41Xb1As0c4l4T/uhvE3IBPM1dLb8bTglG2eP8RNkkrOcf kXMy4E2yi7mvuavgEPXOeP557jC/gHPxrVwMZlKdDsBRTJX1wCxUXn0/boR93CpcD618Ih/J qWUNPAcnuRVUo+exnVr3kDABi7mj8Hf4B7+FGwf3CzHcSe6F4CrowT2cKdjI3YrbQcDt3EX8 t3wMP48bwY0IZmIRv4v3cR58h7uFXKVMhnO5P8JmWQd+I9sEj3H7cSdXhdvRSXPQOngB98Fn 8AFOI+5ycLOc41MV6VyDPIuLkw/lj+N2/mGi1ygYzO3kvbJVkI/T+RvgqIyNttM4F5fKanCY 3IIeTk157+Om8B2qJfK78Rl5Ft6Pe2RJ/D34J+4xfAeruJPU89eiDD/gRnNq+XJqqfepxxZx v+PYXwTl2DZazr4my9P8U9sllwUwiaYy5T5MYo9DuTl7eB40CnkAJz3J89xotZJSTNqNUKXa 3YtjITJ1jOl0Qc2ZgjGmbwpqTGcKoLjA1FdwpoDUoZkes8ecSAJpYv/BzR/4wSeH78EtO8Ce o+4WTnFDaAWLoH1I0zMQzV0EVmQ7ZsReX5aGB1QYNji2x24wKWgqw1MK/FCBrymwU4FtCmxR YKMCaxXoU6Ciyn3bt2JJpvVj0aKa033HzMOHQ3FfwZfHhmaiNymZT8oZVoTZWXFosyo5pUKZ ZbdZFd54Cs7FNw+aNEWK7PrMzCnZmqFm3ZwxCxaMqVmwAB86NRZvGxqXVT8s59Ks5MLg+5sX v72ghmLoZPVYy4/h3qV6GCCWWtAQG8DHfBabTcFHGyMtBlDzLhdGzrAEcKHPqp7RyGMtjz4e M2m8VsVdOnOg3DV935yYZrYMH85OqRmHZkawMudms4JSeXnP+d4/FuvLMzPKVTxXjPE+XXlG JtN9/BgcWxZdfMn4Ym+8XhPsOt/HZq7mYDKXRZZEBCT5bGDSWNS4X37jFSY00b8q6+wXQ6Wq 6TtNPVpMzedQKBVmk8PuUCYlD0Eux2TJxV03jYxJGRQ76qYR8WPmJlXcKH9i5aJbDgfXBu8+ dMuSFdnp8wT09NFaVRJk92ygeyaI9xzmc2lMYBkUgag23Sjf/6EaX1Njmxpb1Kimu+882yan T5gKpokliEjOzcs1m5KTkvPsjji02Eyc4gQrwOCYUTcN99bMS6q8MZjMCoCrcXZ/AYIf9AXP BJ8N0v3TuEv5tfJNtFYt7IUUfNtnHeSzjogGvTEmblBabn6ZQZGwOjOAsb7BCt6ZjE4PWtLR mo3aZNR6UJaOsmzM5tWe/FzpmiF6R4C7dE9hVUXdzWKJa044hvcTkHh3zOIYbjpObTcEz+k0 uyM3j5FQol6yQsnYSNoQTGZ+AyfxMS8pOcRMSurIxUdSHeWZ6SVaS0pkhDpu5Bjv0LLaau9y uXb1xcVp3pLBURFqlSUmpcQ7pLhsk049K25KfcnQpLELI2TFs8a4ckaVZ8V5C6boIpTRRckl 6VnlmujIykszM0rSp7fxXNuUtOL0jNrayGjVqJz04tQZVmqvGbiea+OW0sxwURdCAI0+F8f7 5Ih/rwVsBHwCsBOwDdBEiatkA5yhsbeo5sQ0yCgQCeyxeWZwcX1HuaUnGQt20qh34CyyHgb7 HHCdQgt6VNOp4m83sd7XzXlByqfmRMO0BmrGE9SA547TaWzk0djEWQODkIMS4VO5ksagicbg UJ/B1gNyZ49an+FC8zZZgHvbp43c9iqZDFVxrxwOZd93+gTLXcpfRnRSKmTe+AQuZ5glAYlm 3njiuz07K5d78CnUb64cG/z6hWeD3911J5rw4LhRVzb/5taWRZvlHbuCr34R/KZz1/078KLT ZzDvgb4haFl5+dHgZ8HPPvqEJrN4ALLzOshCaN8HZlwFFjzTEylXagK4yqdRqXXbo7ElGi3P cHFUfhVJBDUX120EDOAW3yDTASNuN2KnEduM2GLERiPWGtFnxEwjuo1oMiIY0VgV9RT3F+4d OH8aJBTU9BWYjrGDkZL6pPg0q7LZSoPoIrR5crKzijDH7Mmh4UUH36pQDyna9MPOG6tTbMFP W32NzQXD5B3f9440RNmeey4itYLXH9TpIzyWKCrnJOFV2cdUtxTo8GkmxGAtTR/xELUPU8iU RZzYA+BMZA9blHLHPlqszWBCn88Q7dRlpGHM97zjSPw2bYA7/ORg8sD3gwN4jc/k52kFxE4e 29gUmfpoL3rhnFmS1eX0CVYfsTrHik9YhmeQF2nexGkwjSqnZExJyM6SsSFnQLmHqlhMY9eb TNVEqmbOMOpfAw08TH1Fex06H9uGuHZI9ifBnVh7SZpbqzo4ZZ3uh7m/x/ztOcm/WTllw8X8 aMuwjM63OpYfuOzyafMOvm3OKhwSxKHPrUNuXWNlTf3KslUVrEVWCJ/K/infRTuBu3bDoGil qkSHPraUUpMoaJH7iOY/Nb4Dg7DAp9dqIxQyz+cRel8qKvfj3yARbWDkPuxWfa8OcKZuPELj LtWX0OjAWgeedKDfgdsd2OnANgdmOtDtQJMDHVUphw6f1+9s9aPlr+/EMZHi1D4nPjadoIW6 r4AaaWgmmYZZuXnZZo8yN9RINLoS+iebOE6kBGuilxK5A6WJ/Ia+ZPWKmYfQsu6Zh7/eGfzh mimlGWNiB1c2jKhZUXTw9ae4ZVyfzRm8t0ff+srGz9tXXnH/hLIpwwonVA8qnF++pJOtkpNp hCrEUZAIy3wWrYNGvQxVCnWUTOGNjepRB/A2nw4/B7m7x6T3JSORf3G3d5s+wL3ni43dVmzF DCv6rXjAitusuN2KmVa0ViU9evicaWcRG9VSnWkxRXEhZaxgMwnRwmbglf3rP3jcyUnmYZY0 5EUisJFOVZYtevbjzdMtdfdMveX48uCLwdPBz7fsXUk29cxrq1qKrp93ecdGeccLyhGzrq8r zG79w4YPgh/e+ihmHELXkfl9FSXLxyy++eYrl93EZjraYcsjaBdvgyv2Wo0aA682GPcRF3iy ulKeBJlGp9mmfgazwcD9FXi8GKycyRfjt2GnDdts2GLDRhvW2tBnw0wb2qrsNBDGnT++a070 9X3TR8sj61lWXRC7NyLb4bEZUIO8Jzca8zxUQSMmv7fOwN+3fldHuTN4Z+TiH24IDp+c67ba npVvTX1uzbHgq7ROnvwH7U+v2WhNqxmXTuWcT1z+lPrMCWlQACt9Tp0R1XSqYtIThxkzLRCV n9hjlw/rUellJWqibj6mQjxaIYo7RgS3dVuO0Hpq9UXU6jBDh206bNGhSYe6qsJD5w5qtl6c 7qPjhDghs4qE6jLQdXaHyFKPxNI8tqKynpTRupCYxxZUka4Km5UsFJ71ZxxKJCZ7gd9794TS zh3Br/YEv1170+Zrrrnq+11/xKRZwYOJCTqLcdHspsvdqYvzG6cUrZ44oS03fmgrryycP651 77JrFz42tfHxwuG7my9//Iqeuy69TT84yRY7NCp3fE12ujs1I/hC1pKclPHZGRWDsjyZmYzn pdRmX4V4Xu+zyYjnWsbzKLXCGkvUlktU301M1zOK9+hjt1kZx7VeaYVKOneFMh0DxmSpTc6h siOniM8zILMacoYRlR12s5XTYUTW2Yawv33g2J0NEXVbp9zySSttkPVo27J3VfC74D1rRSZf 1rEx8nnV8FnX1xdlL//9xg/Qfetjwdf/EPzwyHxuv2/FmMWdnYzInPBlsFLxtvxyGA1ToMsX OzoPiosK80ZXj8+rz0EtzR4IlYir4f3KR6oD+LBPa+wdzDl6Pf+HvS8Bb6pK+z/n3uxJ06xN s7U3Sbc0bZa2SVdo2gKlbK20FooWmrYBIm1TkrRQESl1QRQUB0UZRHF0XAb8iwJScaOjzriM ijrO+Dk6OiM66kzVbwbxU2n4zjn3pk1Bv2Hmeeb//z/fM9wm973nnvVdfu/7nttehPs95mMw GzTDFH/ajBkeiaMaCpQwswlm+qH/uL8JNj2Bki4vaIMCv5jX6fVe2m4+KX0S8kAh9R1QQ+eR 7IZLX9jDhlbYsNH6XRPjitPt42yEhUJkBGsuxJ6J8a+Qe0tWHPQjlKP4A5bSAta6Vd4SKstm 5VE4jLUUZSG1KRYAno3JzVIqVFkWHARoKB7L01IU7grZkEOF/EVxEdKrXGRHFOmrdCaFsaLw 1NFMl63h3a0/jZ985pt49PM//w7OfQmuHLrYN+Oi+Nn4gy/Fb/gm/s238DGoexf6Dx2In7pr VmtR+iJ7ZV1BWcOKroNrZ1XV5hqlEX1tX2tWmoopubzBQe+VTGxbVWx1PQBtP3kMZu39JL7w LIjf/t6rP93RfeML8a9v/Mt/weuRPI989WD8xedeiD90IL+12LN0xDPHboj1XQWV78/Kd2cu anH9Mv5RS6FHl3P842V1dUg3KYRIY/woyressMS/JsTAVIQNFmsqY1UoGKtVyehRribaYgWQ +Q2FU6ywEC6BsB7C+ZmwWg/L1bAyE6ZRUJ8JrXKrUn4TBTUUSiIzM69WWjVKpTVTKad4CpGV gYASCFMVr1sYRghQzpjl9xr5IlG6ccRg0OuFoibBKiWVmgV5NB/lwNZMgSCLEgrler1VaTBk 2tBkmqjjFCV/knoEUNTHQEgtejSzwXaM+oi6kwWOhci/teuV5a50rBfkw52QFmD5syqC8yj8 TbQHwaSiqroKq4mufIvc6eBvVDyHzukOESJgUtjkYHVJqKiqEqJjS9VzGIYsMAOWopipFDsL F7QIsW7p0opRETK9UmihqXpYDu+xeusnevJKC9T2+JIShc6gRGFLiTtTDa+Guuv40e9ebs2D Y2PQrFWVbdpeKFcYBLyxMVWWB16KAmrkO+qRt3wZoYgFtPs1tEpuQetXS4WDmch5yAd1YvUo dZufkd79mhGeNUK/Ee4zwh1GOGyE/UbYYYTGBuuSe6dcxVoSN2FwnUISxCC0oGI1yue4WEiF FNtXqiN6z8bBSO15m2/ceqx9ceSawINdH44O9Gzp3HPbxrHx5+NjTz8Oq5/75S5+NC71HZq/ queN7b+Nv1TXvC366kUbn4ItL74AG0ZbOD8YRlrnAgf9NlpGqyhJr2sEqJ6WaZ42vZ4qe1hG yWRZgLJmj9iyREoEhg/7FWq1yq9UV6hU73ugywOpUeqQX2+2WdvMwNWWn5XdZpeYe/L99ib7 cTttHz17/JA2rYKcFUr2nCJHZ7jtkHtJd7pDcdrhcKzF0j81+dPeXu5yYO1go2KkHe0ktpw4 ybIIO1KLWuikcnMcUIm9yQxYrLQhl+KkUIFmMnz2eZUlTuiATbzNdx4paOrzO3oPLC0q1x8+ LBQzdt9CVV55+cTSwvkuVf7MQsSuuupAV61UGL8xw102b2LHslxVeoYs/jtvtmpsLLeStpZm qbj4QehDfCuCef7b+il4G9xNUythiF5H0RV0PZxL07kwjy6GtIHWGdNNtIgSmdPQlZmmqBNG g8ZIQaOBghQN3zKbNGazie9xCwX8ImVunsVq02jTUhXSHB6kaaDMGVFlmYxqfraIXzTCA5SB 1huhOYMymkrq6+dJeKo2SU+qGorRR6Rua9Sv0If1m/Q8/TE6Bxiph482mlaYwibaNErn+KUg C8V2WVCU1ZYxChWPOUB2m6Oh+Bh1E7WDs1zE/omT2JOdbp843U6oiVNVixSzg7M+ZlWT2wNB uUu1DotNx/1s4TuJqW4RIZvFxgucTqTGnNGqLSiy1WL3p8SBQFpSfgNtySLDJUiOWGjUur9+ R43MLnMIxIq0rMaJQEl5njp+YCx+VJvrqJt4vsybqxaKs3IX8KNnHqYvGnPVnPmkJEUjkiGD zS6il313BW/FmYNmRomSI3spLfcp0nD2vAhp/WNIenngc/+aExRUUNAPG9XD8Cb1Cfi+WqCA meomuELNy4RwA4T9aliihgo1hBq1+i0WVfFmNUVpxOY8mXhEKpFAymAeMZmMRrXoi3zoyoeZ +VDappS00aDNZmzTmtqsShXi+GEaDYYsZs5hjUZr06ISf/oHVthkha9Z4TNWeILQfiu0Ntix VPYmBZU4FCOY2V6VSBvZ1HESS/EJISoWUDuWxpaNz5GWSAqRtSCyVm2BHGu9WBQIWJBPOZf1 +PYiqhTuFkqsnlmU3++2K+J/mPg2NdddN/FUVVF2msaaNx9x/A34V78iXT02lpZT/d2LPN6E Z6ZVMzamzM+nGadDjSOueQAIqhGnHcAHXvaX2IFDaharnRpfr+N14BzRaFSAY5xcMaJUGlUi qUKsFgu0r5XBh8vgpjKoOEbdh7Jy6tGio4JR6m6/rwDxEnO0xwbasrI+sMEOG2yyQb8NKmwQ XZ6wweM2uMMGh22wP3HLhtGmlEWbqUQM/asioIK+qnCIi0q5TT7EUcxQlqs4R0O12NCFjeIt RRko3BAIIcrIMPOgLRl0SjHsYOwW2vhKNtZ1Qts8+tLm5+9a+uEemCkzOZ32qnhN3B9T2Lz+ idaZHruEn6pMzzSVUNRrlw/NKA+t40czVt7RedfzGfFHU60W+RjVFv9sbi7it1Yrq6aVzlyB FGbEbytsqSptzMGoNBt5Jh3yTCXgQ79LaIatKVDMM0NRXm7uTSkyTUqKLCRbmUvlpuTJeJn8 95Ei+lWaCsovklRQT9CFqJ3p7HG/FF36Tf2mgwQzCvx6Q26ulj/ooUsogyhzUCvOk+Wm8JSF BtMT1MMo/6Cohx8DmyD6h7i850iH8qCSUtaIqZtBIYDUj4AI7kG1Cs8ePyKVVxQ2eEep/Y+w /s+xsBjxfqJ9HMH78yhWfB57fuIJyb6BYrzdoRh3ONpxcfsWp0OO4wAESGQfoR0i/IeJvILP JSEoKswV2ujSNF4ixXBBJ80mJLpSXmj9sfa/XNPaVVgwCGXvr1i+4+4vwseCBbd2PVELdffP 7yqqqNz5qfdIwL/h611HfpSLHEKB9/49cxye/HzLIv9la248svH68rpuylz40/dyZmVVORz5 s1Kbl21fFH4itnwO+9wJ8G9HGl8I3vMvU4nh3Dw4R48EDsUCARTJxOKr9ekalHDo08UCsUxw kz1PY7fn2fP06TKxQGjVqlRU4QjqCEENpDKtI4xFlOqCBQ5gR7WZNoOlLVfTlq5+AuI31UMo 86cIQJtdb+hBQhbYZU9SB0A6tRsIqEcetTc4j1GfToZkKBBPhFknpw42lCrntp+wwnNBmZIN wiYBPcF8DDftZO+Q5b2R27MhmCKHQpLfTeLJDAixHUDqSEmpiTn6KyPN0+XXUwUNlfb4NqW9 yjOxNHtunja+vcCSXs+PjinVhpL467DKzpdKlQoUhjEzJv74TS3WenXhrHcob61SSvYUv+QN 03EUt1SAEb8q22wNy+DDKHv1y1IrZDINGKV+ccjtLuWjs1+mEZpXWEtX5OVZpZmjcNAv1ad+ Lt5UAiuWp+uPUc+DEljrTznogPuQy3FAR0Nl5HF4YhJ48T47Dk7GFR9jnB1XjBPtxB9H+1oC B6x9IzwV4rwP5SWl3FaGkuS6pVqil9y9mZROzqYqvlLqwbQKh8XHaI3zi/2L88t+f8MNzy6U O00m18WLLh0p6L5nwU0HZwxNHLmqx1lVbFnio9rn1RZZ0qyemb6myrqS2UuXbRyO/7g226R4 1lhVVVN692Bdf0vN7ercysw8n9WCtHE+ynnDiFPZIOQXA1uqCr6mgqpRaqZfaVwhFdrW86T+ XCjfpED2i0Izv9xeUnEcQgb2ww8gDUepJ45mDr0m/EJICfFtsVxdIWzIaf2GNWDMnPa1jgi7 rzM+jviB2aHDSwWT2wBk4SjZd1JsMIt54qPf3TkYv/mT+Is3Txx4FfLtLa6cKo3YYMkqYkpW zJg71DDnRnj55ptGoPM/dp667pnLCusLMnSSkpp8Xd11LZfuXLAA+5dL0Oq+4D8JzMAJth3N RDkMMiLLKPVzv7tJB3W6LI1+uyFmBlkrNEKhRCQV7C5YL5MedMMONzR0pAs7YPpyZGzLM4dF o9QxvzJv6KAC3qWAAQVcjJ+2uI7Bz5JUoX3h+KmTE1gHuC3biZMYq6pPEctqx99bsJ2QPVxi BXxvYieAPFfQeW1elIvQxAuzzNBhReC1ycwzXfFFy2+sj45t2PjiFf6B+h9dsWfZ+2LZxSW+ S30zXIusM/lPfjcw2ywfS11V7dl4etftX1+ZmTv+c1l21nedsLHakF1Wc233DS21OsSXBsSX 5Ujq+Ml3v1+ThUIXCLMQqmCEMvMA1FtGofewSq3mmbGJpEmFaUgTLOny1IqDNqj/XLWJwQqB eCKxbFIPCRusrVu5ZP/kqXbkKR1kI09J8ARyeT3gYo1k8WdQCJgtrMRZ+Qvpt7YOfnXjyfgL 2/5rb/e9G+bLBRMrqJtDdXduEDoa8vIXuYQwcv2WIej93Y4vtlT07F5sb9u09yIYrZptz59b BmhgjZfyHuD5QCWoB61gzG98vBU6iub7UlKbHXNNrSm1ElBVbmw10YvUEqQLR+lFm7NSazej xOwVv7Zqc7kwZ36ecW61qXV26lLYPMZsQpHFy4/OHksdpZ73F1SP+YZdeWPzh/VjChcELvil Cza54D4X3OGCwy7YTy5dDUtab0+OzSIRsimEw4hTiD/K8vJEJIFKqpF3w16MRVuyecadiS+b fObkglZhWsJgiHawjk3AbX3gR0/sJhvFbggLrYLJ/VE6sVdK8DiXbvReVlk5q8ZtsRqNpb1j W3Ib84wmP7zz8cWLr4j/6TdPnl61cP287KL29pLK7K9eaNv5R39zU/XM5sbXvOZ9Gy/Zpkut itIH5lfP9nlqkP5c0rz0vkvFYiUjzxRXGhrmrVy2u7MhXFR+SaUxt6S0KlbOzO8p3/WGfdfy pnlLL5nb1H5ms91h8JQyulSDOVeOrbURfT2OrFUKrODqx4ym7eaYFRyDs4EAfuivtQpV2u1q jcSVVZ2Fdx/ofeJhc4dR3ZGi6TDIUpYbdxjgMHkc02GAJwyQvUR0kwH6DdCANyBGk42VDfGm nrHg+I51c3Esp6rpD6/U58TBxFB9pXB4wZo1Cxas6fuzLNPnm9jlLTHLb2m8uTzbx39yzYKF 6N783njthNmbnjI2JjXkwvee5BlUMhOOBcrReu9F69WCbn+ZSq2QqLarY1ogkm4XSyTVukYd larL1Ll0tLpDKe6Akg4FgiLlPgUcVsB+BezACJR2jHqaeoYs6swPPTIim+nsc6PpiZXNi1yM jC9MT621TdyaU2VV3HLoGQQjfZVSjVgwNpZqKaev+LlsLprrJShuqUGI4QFPPw4ECOlrJSkV 1cXQud0VM633wGyeUKFMVamycrfn5GRnKyX7iuFwMWwqhi7001Go6BArd+qydzI5HQXpuuUi IIbiUepxvx0MM8sLhwtgfwHsKIA7CuCJAriPEMOkpKkA+gtgQUPRedJLiA8BzrkJz7TdIxyg V42TJ2ftwAG1k743wQyyB40gF2++ClHxuRwSr727JXDrrFSFDMUjR+pEekVqeomjs9nkZSae MM+2KG85vJeOX7OwbPGGtfEOb4aQjwITSsh4Ybhea8upjEdrMsbGZBkF8I2xtJlY0xcg/P0Z 4qYcmECD33axEaauAELdCqG0OgOCDLgvAw5nwKYMmEkuDUO8UeroUfWQtME8ibMkHcH7Q9yT UNAO2acjNoZgQJZuypkie6fW749vjZ+Ixyd237IFggfLu0t9K8qXXjlAx6/9057P4u/u3PbF 3j9u/d2sq1eGrq+9de/tu5HUlwBA/x8SHYz6JQh0rDbGYLNKR+GsQzzrbsUole+XIMmnGwN6 gwS5yBf9i2wdFn2H2tDBgGH1cks/A5sY+CUDP2DgCQbuYOAwCh0Y2EHK/aTwOAMPMnDf991l RqlTh3IwkE7lZVxmhv9FIlUTnNDHuQAVXaPIa/LxEX5ylHhsRIIsJGPheZaMZCxqGvB5FhY2 z9dkFhmUhqpUa3nBxG3FpUb5znsO0vGbW2YUtrirVwqUIkt8qChDjuVZAl8+LpmHLbns7Cf0 GcQnN3jOX1RdBLOMMCclV8YDugy9GwhoOsNpNApyc1JkPG1YAAWbnUIg0Es6MmDGZq1UOXr2 S3+WRFqhz2eb5SvpdFlKBU35NdoKyjpGKZT9yh1KWoks5pB4LN84evaTx1AFo2E4H++X2Qsr 8tnoK60iv8HTej0bfTkWnnrFoUARWNGEy/GKg6RJ2C+346CkHbub8o2TO7B470ZXDtnUqXgy d0KpE85kceZEEicSr/q4xAlvtuP9depvV130lO+eJm9JdgVUN1xbt/ryx+6Ima7Z8FT9iSW+ bFNa2vy3D20ORh/ctYb+OP7ZgiVdWXptlqbTsGjtguuWrGwshXObwpv0GqNOqzXMr76p88rW zlkEIc9+SW/kz0BWcushmU5iGoV3+U2Q1gUoKEgXSFYopIwMMjR+MKWgUcZGj1IF/hLAX56m 6+gnT+AUWnhCC49r4cHpj+Ve08J9SY/rtE9ST6EoMUK9CiZ1bVLJIieRap36mMUVlH0StGGV S2nRWgiQ4CiehHIUcQ1UKSWHtfGn9dbCilUrl2xf3H5TMHdXU2R2Cn9G/MG34vcO1mmMdb+x W1xLOtvhu8cNgetCaL1elKFn0F8AO/iFP4XxI5VwOaodFFRJRqHc70E6lKHYrjR8q7dvB6pv lUqsROm7BeszpCg3Se9QKzuk9o4s6XKVYbkKqKEaI6wXUsuzhhP7IF8mbYL0k0K/DbrJ5si+ pG0R2yj11KH8yPUJZiSZXAQzo71qnI1yyaN8HOZiAMYlJNQdVxazaKvO5lIcXym7c+TNnh75 UtyOkhe+qSy0FpWlrVBkOCrgr1PMpd54w9JHl80dWpyXkuEppT8WT6yb7TSnS2bAa4tzlGPi iZIyc8qYbLCmxtV4WTO8ozwjFZDf6wS8l+mPgQ184zeuAFChgowKNqlhkwrbpcYIZxnhGiPK Zq73zzWKRYzRZDSYxoUilAKIjEYT8r1fGIwag8FoVJoMEiFPrFYoKNt2iPBEBQRikaQ6G6Zm Q9ghBDtNqp0GZYfEVJNCvQ78QEQVACH1BjDC/YABYnRloIr8+i8l8AMJZCQQSOAXmHBL/BJa 0pB1DKVRTQmfRh6Cj5806Ccm0k8axqfcGYI2NvNOJN4qknpvEW2cev7hIME1TGznWbQCIU62 LTi9RqBH9vOEXD6OrdeBdxnVdVJltjr+ePxUfL9MnaqSzaCCTKVcnbLnbrlWUeqiPx6DND8n b6KIOqlXyXm8sTExqsfEN8BrLAqNRIT5rYi7eZ8hfpeAuL+7H8KICEZcMCKGwxCOiPCvhq1Q wiYKNkEYc0E7Co3FIrFE9IXbpXG7XXpbvjtdIhbxS5wuN2Z0yXbUqUqphAKXxBbLX29OZXa6 VR3pyp0SuFMEOtySpxGr0xGTxVQtYniRP9/thowbKtwQuOGwG/aT9M3vhqj8NTdE2dw+N9yB Lhu8x+CGKX5zWo00OoIfxo9PRRAJjZ6MIdinCiQ+T2x6QCdI8JtjevKWR2LDg5VC4nEk+yyS tYdqCFG+o6D67WVm7a69qgxfOWWslynT9PGq+paLByLbWyrzcvQGhVqMnHhOTvyA3midhSSS KpcVx2+DIbtKoURxBo+XVnQmcHNFxdCCqiWalEyNVJO5eDH1os9E/jukGdxxN/hu6kDWNkCl kKOM6kLHI3Qm/QA+eCW8h/hy/gMC5bTjtPBl4csiDzleST7EByQB9pCmS9+ZOmTbpx8pVnTc LDfLt8m3pa5Gxwf4UPjQ8Z7SQ47nVWtVn6pv0NThQ6v69/Hv49/Hv4//dwf544V6etnkeyvG QOKFIigWAIs5mgI88CZH0yiGHONoHkibpPlABn7P0QKgAZ9xtBCEQRy/sYRH47+ugjdzNA8U wV5C81G5BD7L0TzghHcRWoDKBfA/OZoH8uErhBaichFl5GgeKIBfE1qEymVUPUfzgJuyEVqM FjNCNXM0BFb6bxyN+hHt5WgaVIiGOBr1OUnzQbroEEcLQJ7oZY4Wgt+LEv2IQJH4dY4WA4OE 5mgJ7176LY6WgpUSM0fLwGrJVRydIn1V8meOloNL0x4ntATzSlfO0YhXOi2h8c6/SreGo3nA p2PXK8Nr0d3N0Wj+uo2ElqNyhe63HM0DJTp2LQrSz90cjfth66sxz9OlHI14rvsToTV4Pule jkbzSVcSWovKNemrOJoHytLrCJ1G6t/F0bj+BkLrSf3XORrXf4jQRqwDejFHIx1I/4jQZjwf TtZmogOsrDNJ/VKORvX1akJnYR3QBzka6YC+htCFpP6tHI3rr8W0KInPoiQ+i5LmL0qavyyp viypviyJ/zKO/7NCq0Kx0OXBbqY7EAswXeH+oUho1eoY07I6yCwM94VjQ/1Bpi4c6Q9HArFQ uI/xlJd7CtGX18nU9PQwpHaUiQSjwchgsNvJ1IbDa3oDfUxjTzfTHBvqCf6MCUWZABOLBLqD vYHIGia88od7X7c61LWa6Q0MMZ1B1OmqUDQWjKDZhfqYrmAkFkDnywYioWh3qAvXjzrPGw5N AJEVZJ6twUgU91rkLPZyFVE9Uq0QV/u/PFdQi2AmDNaAXhAAfSgxaQQ9oBudm0EMDCE6iOhF 5CVAEfQdQ7UupEUMDMAUdPfTC6q9En13X1DNOWQOsQupS19HP0U/Rz+Dvh8Bs0CIvJoohj6X k9EY9AmQ9TCgC/XVj9pFSK3VqJQBLeiMR1yI7vWhD+63n5TUoasIovF3gPQYJnPwgHJ0eEAh R3mBE5XWoNn0oPNU31FyFUTnIDoPktngmn93TRYrugqR9gHCYzx+N2qPW0RQSwa1X/lPzX0d ahFCfFiNaNzbEDp3khYR7gVQUVQ7SK66ySz6CN+C5E9BA9z1ZWCArDOK6uDeEv1H0foScwpz nAiR8sSML0T2PahNcHLsGNdfYm0ryeungmRWAcJzdqZsT9GkfmpQezyztWi2QVBANAFLA8+q j2vVSThQQzjGgCYyVm8SF/AoIXTuIpLwgDIk7TKiyWFyNzYpgRA3lwiRWh/pfTHHayy1bq7V ALkXIeOyK5xNuNiH5oK5inWngHCki0i0h+vNSUbBNDvjXjJWiMys75y+Q2SdrIS7yfwGSe3o pJwS8ogRfYgm8Xe6jgRJS8zHAY7bCY3B4/aS+muI7q0jswiQvqZL2fm9GnohmhBBNRL32Vl2 khFY2bEaHSTcZXUG834BqY/lx94/f+SEdGqQrs4hXAoTLvUQ/Z2yqhDR+B7CC4ZIMcqtPUh6 jpBa3cTC1k3KoIe8Qm0dkeiqJA1J1swp3gcvQHOnz2RKdheicwlkwmNh/VhFpDrdcnK/h/e5 RAcTM+zjuJzQoxindz3culiUi563silb7Udjs4gYIqgbIisMT7PvCCe50CSesCN0EQTD6BQm duPkLLaHQ6xOjmsJDmCtwbYUJSPhlusJlZjNhfnCWiJLXFqRhPmt0+yIAUWot2KECdN7ZPub 6q1wsrf/3dh//lxaCBUmUUUAUavRNdasBlSvC7Vo5KykjugnSy9BNVcTDxpDLSqACx3ryOEk tpo8gpOgZC+qgev3Ig660HeM6A5GJ3wVBStQW2zfbF3cKlH7nx9lui+JTJasIHzqJlo3NQ5+ eUMLWjV+DUUdQZ4GVLKIaMAcglq4fDZ5GeNsot/1yJJno2MhKW0BKeRFBRIi9+mIPWVlifLV nM1FSLzDym8oCTcuREpT9hTiLHeAIG/CZw4RPEmM2UVeGzmlOwMcD5J9JKtbvUk4EQAMh2pB okGsFbMRaJBICqMEtvc2bjSMa4MchnZOaiU75vm+bIozUTJiDEk3wOF2kKxrNTfHbuLlg0Sf WR+3kvM+38evhO/HHAsm9bKO6/P7xuvm7CtCEGuAcGMqAgmTVfyAhBg9WdV0TgWJxZ2vFeeP PIUmgwRRsSefwswo6S32g9qBuX8xKumZxPih82TBymk6crDoHiAz6iecDaH+WV/692XOcLrI +kEWFxLjYjzsPs9LJMfdBZO1I0l6e27E80OcwrPrJf0n9Co8rb91RP5riDST8TURE07VTERF 2Pt1kn6jZHR2Pey8krU7gcos/6fylYTGfZ8O/U8rmtKPBrL28yWXiCfZSCOatJoucmbRv+8c GUTAuXlOoucoF2f0cJ4Yx484MluXhAMXIv1Ef6xNYlsd5KQxZWNTkdW5cgxzkXuY9BYgVv19 dpyQWOAcXq/8h2Y7xeXzR0hE553cVfKM2PVgDaqY7OFihP84tikDJaAUxQ2lJOcoJC+mwf/v AEOscT76LkFHHiqxk1cNFaMPgz4+FIuUk0+ixzncGs9dRzIaJ5Aea2SAYNr59tRPECDAtR4k GhficCNhF0G0ToYrD3JrY/4hr5q45zpnvlOeFK+JId8LuBy/D313Em6yWjpAvtkYfYBb2SJi LZdz96KcXq3m5rly0mfjNs1c/hlAtVdyfUQ5dMPrXELWGeU8SPBfskL8aZrkbD9B7ShBgFwy V1Zze5PwJwrOtdkAZ0sscrOZSnjSm+OeBkhrFpeSkSw4rd252DA1EhudYl0eIPEV26IAsHnC wGR+cvlkiyjBhhhXxvIqwlnxv5qbATLbROQQ5OI25hx+Yj/1Ny6XZTnJ5v7dHBqEuQjjU1I/ RGYYTbqfmAXuJ0CQbKpVN6dFXQQlp1oNEAwrmGZXbN6V4HyE+KCp3IjhdDVIfN8SzvKCXJz/ r+FfkMORKSTrJhbIakXoHK2IgcSeQYjMjI0LEpFWiNwPTerh+esPcDwIkRWyXJ7Oh3AS5rD5 bC5nx+wIl6Mj/C/hxz+fNfz9/v+RfVqWTxfSAmMl6/VZBBi4oFb1RJKJCBFz/ML2bj9F1Bpw Go2GreRC2rSSES6k5lwi60Gyl3xhLZq4zAbHYKyuDv3DXL6glfMyeTN5lbw6no9XxvPzZvDm 88ovaKSWf2gXfT7mAPSg+xdWGyNOP6p1YdJbAMLEggLss0z2PZQAbPiBd0jiN+hRwAzg2bOk NmT/vgl/NPg/Ndaw1TRa94hGKRDnXzv32q9ToJDaN6Kh3CPqOAWhR+6WCUTsHYrPB+4OgcQh gDw4UkpB3r7F7iZ3QVKJ6ScZwyZQRY5G4ojDZOoYLmbiw81M74+n+IOyedka/h2SOx8t2e+v XVK5byS12j1CHUcfO6VRbz38+vWf3P/cU95f7tl+3UuZLzW33uxOmZwrfubq3nynJ9NtFtAX 8yTqtNZgJNQcWtXHtEQGojFmUTC2LhxZ49G5tbiCVC1PVChgGvq6nJ4Cdz57wzbVMtQbZJpj gd7+UN8qpjkYGQx1BZnF4XDMU+IuYms7FjUyCxpqahsWNLS0MTV1dbObWmbPKmDyuuzlpcz0 MdwZupTyUrfXU+QudaN/y9Bluaeo2MNd/v+/gM13JfMc8gG9eTvi+1Zq82bwppP5cvUVBYXO zaZHBI/eLz2qTFnyTvPbAx++WJz/6K9Piy8p+dunO+Ji2YnfGZc9/sqfTl/3yN7jW7L/vHGp InrZ+pfXaid+sfS0ff/S5bt4E4WdyqWbTS+tveUt61LXW7/S8K/2HbvlZ4cXzvv080rrQ627 r7Tc0XPt8Xn1t112+D7fW2fEhW8eLt9D0Uipz1EJGs2rQnnHNfyZb3w6/N2Gtx48dWDoDP/M rTPW2h505L2/TR3cGi/YAm9a9uPOl5T3D586+rTm6Outu9eIOmf/4ic/fce7iW/9faSQdy3/ /ivEaTs1dV9+nbbwN8Ib9yh6lsYl3tte2nrX+7z+O/I3Bm4c+0S69scP/HJlZ+2MW2+xFt1u 3Xr9t92irK/e+Bbp7yvo46O04Cnlj9+pG7d8N2fp1VtfmnPdjuzPNR3/+5T4gCfXnc12nPE/ TyOxUukPrvSfmmKCP5Lz+KN0p+IbQrWooS8WjPQFY+7Ne89T6RuQFLZgld4fGD/80PYd9Tve PaxcHnpXsqlzh8Dzyqtnr7t5zm8bKm759NeC6r0P/WT9sr98c6ZrduOotM/9xU98+wvF7/9n OHd/ykUdfG/jpldbGk8cLah9W3pi++jys48Nn/hw1+FN1oZaRc+btx+Erfc8+5rzropTmx5Y et9vrcGPtu1ff8eT/1Ffu/qSwo0TRyhIf49C93Z8t3vFvaFDb27od3TaMmYxFz1s0/4yRn3T 8Ndcw6UHrl3rFTlO3/T7D47s+uSG++d/GH1hrnjvwXdueEf7o5foj8TZrYI/Lbq3/qevL5nz 67LWryyvPJtTWZhd9OqePz7jr//s7d76wY+Ou+9JHX5109uVV+775tZ8j0P77Qua8fcOfnpx Tf+cwoIr3SPi+9AndR9NQYpSDK3c1XfVwROPQVXf3uOHg2uTZ0whhQ58D9d/WELFbg8r8PxJ jagL9/YGI12hQA/THF4ZWxeIBJmmgc6eUHR1MBJl6mqISpa5Szw+t3tSJfFlUbG33Fu+zD0C 2//lk/DMcc9iG81Yt26dcxA1jKKGzq5wrysS7A9HQ7FwZMhV19SMxwhH+p1M5xCzOLjSWYD1 2rmgZRbWZZ9npruK7cdLfvcCDdgwi6nrCUSjTDFTyCwMdUXCUTSFqXm0BnpC3eyvHAwWeaRu MW4vUFMXN3vUbiW+EKklSwLR1cj0YuE+j8ItZ1khXBzs7g33dXsy3CZcQmu0U90n/SZD4r70 B+4jBjPnWtEICpZQuYgagRAc3vFGzgPdH/9Z++zZ3g01jZJvwvlrX3WmN99X5Pvg16v/4J1o UL2960zwtWYN8zTvxcu/erG/95a//OrQw/nuHxctveKxB9f8d7PWHtXElcYJmQScWHFLiavi cgFdocU4EeUp6pAMMD15MTNBrNKShAlkT0ggmVARH8loqZVWqC5au4KkbtlKi11a16OePhRd Hy1We9aj1WPXLrZ112591a2Ar70TDAFaT3f/6ek588fcO9/33e+79/c97pxvWvmW/b3PXpZ8 dfXipludsontO+euqertcy7Rr3BGUcS6mDPs+WwguZjjt2/OGiebFv1t/MdgfeYy82rJscRJ d6iWt1o0m87M1RXn8HVXxswp+kvF/lzitWzl9tufNd82Hkl5Y/vBZP0nNzdeE8fVXY/J2tHX YVgtqTRfa4hem3H2Yuw49wHpgn1JB785vqH6yAfWd/xMwmlZ+fK+52tfeMuKdhQO3HXF36kv OXzzyXH/LjYlak92ZZV9Ed369NHnKjXyt3MioCNv5yWfY7zkbOB0pkQj4VgYJhNeoxBEHC5p w3xrhZEI8Xmxld7xdZu+/FR1t+KV7zJ6HNk3ZLzf8jM4Ei8J3wWrQixe0AQRie4jE7DHMKHy C1V2cnF4hDcMnjYkQREpBpWXLsB4JG0YDSqw8kginI5rS/ZOr+C4KnfWzJk/4Rh+XrzHx4t3 MRU2d6BDxma1WUwcC2wBhxHAxroFr3GxVtbFOixsCjA5yoCNcwOPmxVac9ycy2bh7LWo22P+ HWvhAOdMAVwFC0KbMCRX8BeDy2ThhIQIUxPHVrIODiRBTZLRmgedQUoFBhepMdnsJrNd0GSk tJABwMRloQ8zNFvQmphRCcVAOgBXmOFiqz2sm3MvGEnndKGQNEg48kxTwKw5manwGE0wQ+I1 LJzQOj2OQCNRkY19NgUeIcicjc1ORY00DumCvVowsCgzM9NGiQOB/ixqsD+LGurPUhEUg5M6 dCFOUbiOIQkaqElapcFJLaEGuE49LA9rSC0J07ACFah1pC4/CzAFBDDSBNDnwVeSDogj80gV zhAADmmGIlWMZhGgjblPEioGMHqBBS0iKJIm83XD6Em9DhgoXMWQKgLyQQFaQsdAtYUlSJo2 wvUAbmQK9BTUBQ0qSQctAKTWoCEf6EwUGyiCpkHIKrgJOpXGqBakhGZRqLeWoFQFcBi0Uk+B PJLRCex58B0HBhzqqDJqcAoYjJRBTxMpgUUWkhoN0OkZNJcIbJKGCDCo9DqaKDRC5UlckwJZ dCRDFj3gCSqrh1ZRQI1r8XyCVgCaIFDBTiFfCDLUBKTS0HCnVU7o+w54ZE7raCwOdZg5nA4B VlYbW0YPOgLOQc8we6ADoexSyB8Ad43J7mGBu8IEceBwckKbmsUJP5UFhJjcwGSxeFyDHmh1 uioDPoPWDKYbSAGRKmhA4gp0e5p39v/i5sF5u7PcqSi3WTHf20IkAYjvT5gX80plpfUFovo+ QhQhEsGJJGkkjCoSCYyg8tiHyoebhJmHKMOxIixGPioeYrBYEU3KCU5Odwd21hbKxEMxBdht JrMC2DnoCyOry8FbMiYfFukmI5GYFEY7+Iyqe4RKrVnzWq3xHLekYVp3O7hm3/NuXV5d67Zl +6qlBTGPsj0lyX2F2S9Ud918LGPpucadMm9aU0nB5r+GZaD0hwvS76+Lnl4Zlj/7VoFG4bpx +G8r76qdCY2fbth28fffXrofdqz7iiv27FaxY/cBS92spers1ufW3V5Tn56kuNSekT5v353v +EQlj+TCGDwPmo55fob88SPF4IhLfpuvB5s4tEtjxMrhiQWBNUZoJFOOSjtYXIgRUT6KjD9F ab3N8kV/PPvGvaXvefnlWNUw8rFKM1baluFN+z/bSKyDP0f9U70JAtoegK0yWPQE0Ma5PKzQ 6zlzVMmD8KKw1q4nOr+Wy8InrMs6fRztO5S+5XjeqkhL3F3v91925lwwLDnT8OqFYq3l+uMt cnHHcqet+d2YnPYTn3SNz0k2TBCXmqecjl/9/I3r6tfTuquKViNPzzOpD3UkW8bZlqlfeqbN f6U96g/NlkbVSn/2/sWv26W746Seg8qol5KmFze2T0mYn7dpoy4ue+1AxtiTk/ddnvobRlwC vNar91IH+HPWj3bXTm0aGLP3anfDe6XfI0Z984qPqtUnVf2T//XK0VPEsfgX5de4Nyf9PfZC /yPWp84PxNR2TNa7muc6FQsLkW7fib0L4/qv/6r91raM/Qce+efGd3rx3DbfKuS3PlNi+Mf1 b+5c80ypnxedhFVfT+ispEpe9D6c2iuA0LfnF3+/fdg1fSSQF2G/Ho5jWeinmQjCeOiLRBkl XE2USmwOhqViqbOe+gGMH7fuSD+G9dnXbp7nPrR15mejQeXzTj3c0lU1tuP05o3/sFz6QpG4 63Jhw+LwDZ/3+5rm37vy1eKD/hJZ/YTbdCfReXPV4abqiTsTmZfnOLe23Betd3z4dTS/OP48 Mi2/aceMXRHg1Ku9/Zdv3bN1H53fGtEb0fHiGH9kSewTk3Z/c6RHHLnhRGN5yX9qyv6csMWz vn/WCl1hVGkljHn/BRe/ujUNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0MjcgMCBvYmoNClsgMjkz XSANCmVuZG9iag0KNDI4IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM3 NzI4L0xlbmd0aDEgMTkyNjEyPj4NCnN0cmVhbQ0KeJzsnQl8VNX5959z752ZzJJkkgxJSCAz IYQlgYTNsBjNSEhkExEiJsqSkIUQmMkkBESrEpdaDVH5K1KLG7WtWktxSFyAWqUWq+KGWHfc cKkLKm5UUTLv7565E5IYVLT9vB/q8715fuc5555z7tnuvXOUTEgQUR+IRjMnzZ5y8p3nB88g 5Z+7iFLXnjypqPir6fQ+KVHlROr0k2eeOls5LfY9UuwbiTZuOXn26RNPHPJuBilbqoj61U0v mT25f3L2MqL+a4iiS0+dnTvqZd/8BCLxAq5SPmfSKaUr/73KT5T1LpHp9UpfRUCkKxYST67E +emVK5o8fzn7d1kk9oxBg6JqAot8Dz7xryk4v4PIfNGiimUBSiIr2jMT+Z2Llp5Ts991bTKJ 1/PRvk21Vb6Vl+ddW0004hESNwZrqyuqXh424zZcfy7y59UiIbbevBTxtYgPrPU1rRzQofqI lHHo75yl9ZUVyTcm3UbizX1EKXf4KlYG4jMtuJbYgvwef4Wv+u6Sz+eQ6LiOyLouUL+sKbSM HkV7RujnA43VgXs+Ti4h8exktPd90sfWFDv348Jb5yyIzf+CUqNIZ9Pu1/X+0kPbEqwHl3QU R1PUpciLflEYlIsSHWUYw9qDSw7OjpYp3ThDT4kuoYFGGYWc5KXTMWqLcV0dVXMo95GJokzr TaNRQWY4VDfQo8rmKExhlKaaNE3R3qCc0HYqPwtlhuoFT5nt8ZB+bDCnoQ3HRwlxm0eIkGcI aq80Pa33FJNjNEkpNex+uk59n1bRMYIlk9b/t+o2WSnvx5RTV9Kl/+m2MAzDMAzDMAzDMAzD MAzDMAzDMP+/iS4RIi0txvHDS8T0ntz9/xnaf0KTGIZhGIZhGIZhji2EfghBDvoyKkRRZA11 kFWqjWxQO9mhDnKEDlE0RUNjKBYaS06ok+KgcRQPjaeE0DeUQH2gLkqE9pGaSMnQJOob+pqS pfalFGgKpUJTKQ3aD3qQ+pMbmkYeqJvSoR4aAE2njNBXNIAGQjMoEzqQBkEzaQh0EA0NfUmD pQ6hLOhQGgbNohxoNvTfNIxyocNpBDSHRkJzaRR0BI0OHaCRNAY6io6Djqax0DE0DnocjQ99 QXlSx9IE6DjKh46XOoFODH1Ox1MBNJ+80BPoJOiJNBFaQIWhz8hLk6AnURF0Ip0MLaTJ0EnQ T6mIpkCLaRr0ZJoOnSx1Cs0IfUJT6VToNDoNOl3qKTQLOoNmh/bTqVJn0unQ0+gM6CwqDX1M s6WWUBn0dDoLOofmQs+AfkSlNB9aRgugZ1I59CyqgM6lhaF9NI8qofOpCrqAqqHltAhaQbWh D2ih1Eqqg1bREmi11BpaGnqfFpEPWksB6GKpddQAXUKNofdoKS2D+qgJ6qfl0Ho6GxqAvksN tBLaSOdCl9EvoE1Sl9N5oX/RCjofejY1Q1dKPYcuhJ5LF4XeoV/QxdDz6BLo+fRL6AX0K+gq 6NvUTJdDL6QW6EW0Gnqx1EuoNfQW/ZKuhF5KV0F/RWugl9H/QS+nq0NvUgtdA11Na6GtdC30 CloHvZJ+HdpLV9FvoGtoPfT/pF5N10OvoRtDb9Baugl6Ld0MXUcboL+m30Kvo9+FXqffSF1P v4deT3+A3iD1Rro99BrdRH+E3kx3QDdI/S39CXoL/Tn0Kv2ONkF/L/UPFITeSpuht1Fb6BW6 ndqhf6S7oHfQ3dA/Sd1IW0J76M+0FbqJtkHvlBqk+6Cb6a+hl6lNajvdD72LtkPvpgeh90Bf onvp79AttAO6lR6CbqN/QP9CD4depPvoUehfpd5PO6EP0OPQ7fRE6AX6m9QH6Uno32kXdAft hj4EfZ7+Qc9AH6Z/Qh+hZ6GP0nPQnfR86Dl6jF6EPi71CXoZ+iTtgT5Fr4SepV1Sn6ZXobvp degz9Ab0n7Q39E96lt6EPkdvQZ+nt6Ev0DvQF+lfoWfoJXoP+rLUPfQB9BXaB30Vupteow+h r9NH0DdoP3QvfQJ9kz4NPU1v0WfQt+kL6DtS/0UHoO/Sv0O76D36Evo+HYR+QF9D99E30A+h T9FHdAj6MYWg+wVBPxEC+qlQQk/SZ0KFfi406BfCBD0gzNB/C0voCfpS6lfCBj0o7NCvoY/T N8IBPSRioB0iFhqSSniOUnSp1WolVVW1H/5asPaebO4WM/341w7DMAzDMAzDMMyxhc1m430V wzAMwzAMwzDMT8But+v7KvP354xg6z3Z0i3G+yqGYRiGYRiGYX42OBwO0jTTUeyrjvALslHd YryvYhiGYRiGYRjmZ0N0dPR/Y191FPUxDMMwDMMwDMMc28TExOj7Ksv354xwhC+I7f5rV7yv YhiGYRiGYRjmZ0NsbOxR7quie0/uvq86ivoYhmEYhmEYhmGObZxOJ5lMR7OvOsJfKez+dRa8 r2IYhmEYhmEY5mdDXFwc9lXmqO/PGSG29+Tuv3bF+yqGYRiGYRiGYX42xMfH6/uqI/xRqt5w 9p7cfV91FPs0hmEYhmEYhmGYY5uEhAQymy1Hsa+K6z25+9dZ8L6KYRiGYRiGYZifDS6XS99X HeGP/fZGfO/J3b/O4ij2aQzDMAzDMAzDMMc2ffr0Ocp9VULvybyvYhiGYRiGYRjmZ0piYiL2 VVFH+GO/veHqPbn71wQexT6NYRiGYRiGYRjm2CYpKYkslqPZV/XpPZn3VQzDMAzDMAzD/ExJ Tk7W91WO788Z4Qj7qu5fv877KoZhGIZhGIZhfjakpqZSVJQ1+vtzRkjuPbn71wQexT6NYRiG YRiGYRjm2KZ///5ktdpivj9nhJTek7t/TeBR7NMYhmEYhmEYhmGObTweD/ZVducPL9G/9+Tu X2dxFPs0hmEYhmEYhmGYY5v09HSy2f4D+6ruv3bF+yqGYRiGYRiGYX42ZGZmkt0efYQ/9tsb 6b0nJ3WLOX98ixiGYRiGYRiGYY4tsrKyyOGIOcKX/PXGoN6Tu//a1VHs0xiGYRiGYRiGYY5t cnJyKDramfT9OSMM7T25+z8PPMIfD2YYhmEYhmEYhvnfY9SoURQbG3eEL0/vjeG9J7u7xRJ/ QpMYhmEYhmEYhmGOKfLy8sjpTDjCl6f3xojekwd0ix3F//9iGIZhGIZhGIY5tpkwYQLFxbn6 /fASY3pPzuwW6/sTmsQwDMMwDMMwDHNMUVhYSC5X0hG+5K838ntPzuoWO8KXsTMMwzAMwzAM w/zvMW3aNEpMTMn8/pwRCntPzu0WO4p9GsMwDMMwDMMwzLHN7NmzKTm53xG+5K83pvae3P2f Bw78CU1iGIZhGIZhGIY5ppg7dy6lpnqO8CV/vTGr9+QJ3WJDfkKTGIZhGIZhGIZhjimqqqqo f/8BI394ibLekwu6xbJ/QpMYhmEYhmEYhmGONQSpMCIHaeSVYRQp8AfQKVRFjbQhFEKq53As 9KZxVMpynXi9JZMn5B8/Yfy4sXnHjRk9auSI3Jzhw7Kzhg4ZPChzYMaAdI87rX+/1JS+yUmJ fVwJ8XHO2Jhoh91mjbKYTZqqCBomgsmFpZv7WrJT09PTy4Yb8ZTu8aCa6fw0PUjx3TKl9ijU r0e8f494Wmd8RpBcweKMwkl6xZup+J0gJQSFK0j6VUTCKbiSUaioqi6jaHGwb2FVeTlKTMpw eoLF+3ONpsi6N9tthRmF1bbhw2izzQ7XDg95A5tF8YlCOkpx0YTNCkVFDx8WjM8OKplFutUF vavL4WRMQk04k3D4zJbQ9taupwjFIl5C2BNBc2HQIq/rWRz0VgRptWfzsO0trVuctLA821GV UVUxFyNXgTZuJjWzqLZEH8ci3cprPUENlUtJRYqnqNbTkqEPR1FtOTRjEkr1mo5ka2Hpr9K3 pwbjERYF47KDJyPHyee+laq2FCUv9ujRlpZfeYIbTivtejZd17KysmQ0uKUoAxWisqK6iehK cu7wYeE+GQNQVV6nX7OuQm9nUZ2nZXW1bGurbIPMWlSLian4vlwtLUVVGUVVFVUTw7UXBr0l MqCSM0tlBzF0k8qMJCMDzmjyTPmksvTwYE+bVVqoNyyjYlJqeNo7U8qNFCQURU569BZMQQVB T6UnSLNKM5B1nC7V46ilcpxcPOllAqVmHi4VNGU6MzwtX1BQlGd8uK97SoWRYs50fkG6W5xR XN7SUpzhKW4pb6nYEmpemOFxZrRsnjatJVBUjqvOLEWpLaFtq1ODxa1lQWd5rZiAsddXQPGs 0oLU9LiySHRmJEpYUlhYdtkdjAJ+phgBRplKStM9GKjTS8tSMU6lul8CPxzqCwkLdxzm2Bg2 fYyqx3UOT6Hhpqfrq3P1Fi8tRCTYfFppOO6hhalt5M3NxnyU62e2R870OV0/0xw501m8PANX uUs+lPoEowZ1/sQ6ExOKaicEReJ3nK4Onw8mFJaqqUpZ2FNSVd2zZeNOzw8mZcMfkt2CSdiV EXRmB02l21PzyzzOODwB9NmbnTHttDNLPUUtnasgnGL0VF8HWOoZFbUtxq2kL/reU6fNjgy4 vmJxS6/GiDcvrMOiwU9Fq/74SW9xBosPpKemt8RlxHvG55aFV7VzV8ajAg8uPNacQZEvuyXk Mw1XmhJUk8bh5I++Qvcu4Tk2cXOGuOy0zV5x2ewzS7c68aq4rKS0TRFKYfnEss0Dca50qwdv B5mqdKbqMY8eo2n63dOmRMlTqVvxDmqWZzWZIOOVWwTJtKhImqDKLUo4zSnTwHCizSULTkrC mwSTLA5BnVAvbA1MpQLxBS2QdoB2wbTQdpHd5ojO2wpnWFvmUMNxpYeddqszz7tFDGlLSZEJ Q9qjo/WEzPbiYhm2uT3yRGZbaj/D6ZNoOLFxhmNzSGdA2+DBhpOWFnbabTa9mgHtDoceprcn 9dVDtS0pSWZQ2/rqF35Q9GlLcxuOzSWdhDaU3Rr6m0hsm3264cw41XCKigynsNBwhg4NO+0D B+lXSGzr21deIbEtMdFw4uIMxxoej75tI0eGnfZhw/RCfdvc6caZ/mmGYzQ0vh3VIEt8W3K4 3vi2GTMMp+hkw8kcZDjGleIjI+9us9sNJzqSYuRxtyUkGI7RULccRjFYiLZRblzS3BYfL08o bUPC8yfaBw/VG6O0o3UIRaSVA9uSkw0n1pn3VxEjTBRHboyLqT1azrTWjuvqYZvVJnNqkYHS 2vJPMJypU8NO+xllet7cNqtdDm5UmzVFOtY2b6HhyEK6kzPCcAZnGc6AgYaTEinl6iMdV9vA gYYzaHDYaXck5MWeFCNGYwmPxvIdjcXsFnEkhFPE0hj4sW3aTLfeLPK67cl5offc7vc/SHGP +EC850pxf7zP6f4IRge8BxS8HLzJB+yOvAMixf3hPrvbuf+q/Yp3X2DfA/tUPLLbDzpdeQi9 E76Kd+X9650U9zvHpbi9L6HBBS+Ip58vcD/3fIq7+VnxLILy5wPPKzsfzXLvfHT8uJ3C/sik R5TgHoHi9+zB3RPYrbveX+62JeQNbC1pbWq9pPX3rcHWHa0W79/F2K1x7sWwv8EegN0P+yvs Pthf5sS5t21Ndd8N/56tKe57YVtgW9GW/II49wmwE2GTYIWwiQV93CfBvPALjotzjxrtco8+ zuU+bozLPQbhhuNkS9KPs2OmGyZMyHutQXgbrAl5VwWCAeW1euGtR293+WWuRL/e9po1NcEa 1bvIGpt3c7UIVslTx1fpD4UNwnNt8Fql4Gqx4KpVVymeK7ZfoXiWeJcoVCvkz8za8lp1VYUY cZb3rFVnNZ+ljbshzq2X/+wGB8o/JLztYjNmJujq477TFefeBPszbKPL7v6TK8Z9Byw7K84d yBLDhse4h7ui3Td5Ct1uV5obL123x5XvvitloPvmlGp3asoo96qUq1KUFNcA98MJk919XLnu BJfHPSLeGz8zfk28Fohvjt8Vr8a7kt1xMHKJma5yV8CljogRZBaxAj+5okDUi1XiTvGAeEp8 LELCFktYXLlUQPW0iu6kB+gp+phCZLNZx7pjlVhVeUp5Sg0pIVXTU6xRWW7NlOVW1EFuR/R4 kzZeVcYLGj/TJLagtmD8NJpWMjGYIBDOnrjZOip7WrBq1sRfXnFF/+A6/fNFc/+yLVHIgw8q QXFlWTBKf0NJl7INljXhZ1lTUC0KmotqK4LmjEnL9EiMHonRIzFFwVg9EpsxSQRdRbVBF1Kb srObluvll2d31nTYW6bbMtQr0ePLkHG5LtQl37dZtkzg/DKSNWRLEXq6TMiOGK79XZX8CPS2 ZhOZ08wu037T09qlWqV6L+HNG9obeqVjZUdVR5l6PSXjFThHlIs6sUJc1LnZmy8WSef3okIs EWd32wlOp7sxyS/Rm/RJZ1pIaHjG6N/v/rZIoPNl6WfoVXqNPqevhUnEiRSR8b17zPW0yfCe E1sUi/Rs1KrcTA+LDpxdT4VUiNa8r5yn/lLVz19K5+O5doQvn/9u1GjlKjFXOZs2iN8qhUqp 8opyR9fzIoqmo++N4upvlxWJwo1bYYIoFrPEQtEiPlZGi5PoPfqMDmEkEoSbttEeeov2CUVE CZeYKi5XTlG+Fh2iztxiitM+7VbbYjEZPZkrlolaUUsH4M+Wo7EW6sdOOyXyd59x3Wz6G+Zq pHCoC5U2dbp6rvqpyaa2EZmephSzU/lcqcFNuIquwVFG2C1QOV1MF9ITGP/94hsaKsfxRuRY guM1rVI7R31YtFENzaEahM/QmWINVdLl6N8poq/yGLmoXXmbfksvirnqSXSNeo7A5wo8CurR nrUotYfa6Srt6R8zB8x/Eu0lSz/LPvozXQa7Q9yr3WN6lj6gW+lF8tFDpOhbGguZsfQR9PfG mhWNYCPISzORljvviVeeoFzIyBHpcelxmRA89+lgs4m+1kOCQwpdBxmE1abXkuvtryiqat5u ivJYC6ynWlUka5tVMjlNHpNqyp03+tCo3Nx5VPBhwfjckSOEmq4K1KsMGtqxY6ho7VghWkxP f71HG3gwFzccal+lPqzWmV2y9kLvEMVsJotwWnOtAdSNPjrJqWm0KVctUBeo9eoq1aSq2iaL /oHEGjfWkpv94ejceR/OwxVHj84drV8xQx5qXf6T+QtgZtehduUU3fDBfz2ej6vRFwd9tZVs oU3e/BjnWNNKiKKLyaaoVpuWouVqBZpXK9cCmkXTLHarKixRVptdNSkuqo6JjfHGzIxRTWjE vVaUirdURTsPfJg9DxKXNJ4K8gvy48fnzotPGo/n8mazUlhSerfNq19Fb7d+ISO06e/+aGv0 WMULMelivNVGjkj1TsPr1EQ29VTlVJOiS6PtTuVO0wabeZY6V1tgL1frtTpbvT2grtLOta2y 2+02qz3V1tc+zD5CPUEbbzvB7lVP1U61TrFFY2QwSPPmNWDbHScyRJw+2yLdvLqjteOTUMcn HRvwjp8qpog71ZcPXayc/02m6elD6cpr+hzlhd7QLsYcJVIG5mj48dHH958ePb1/IMGUkeVw jlV16UOpJ8VpIip9YpTNlSRSqD4zLdUeGIghcR46NGqUviLwM3JEdva89PTjzGaL2ZwxQIkb kzc2L2/0qMQkNCdu0KCMAeY+rsTRo/K0iztuGXBGetas8dtfn154wqaK0oZpYn7HLSklaRes qm7Imb+8n9fpcokThe2aF2ZOOT1zsHj16wHK4Oi44E23rh2Iub4UC3+ltoj6UOXdDms81pI+ 2A5MmDYp3mQzWaNIT4jDMiJKik1yJykOS4rVn+g8cGjUvLjRudlUUFBwKHtUblz8+PAkbiVH aHubNQGThPnZSjGh1/Exfyw6VSYyZOMt+rj2yYt0Sl3Z3zU9Z+w54ztuEfOTT88YVD08LitO TbZYPImHnFrlbxMLXUnpihK+oTOMYxZd/t84xMCjOlZ9x/E8H3zwwQcffPDBBx988MEHH3zw wQcffPDBBx988MEHH/87h/x/VScqH+m/IaCppFAMjrCvUT8i6ZuQbqMsw9coGWd034x0M000 fI1cNEb6FqRH0RzD1yiRJktf/60DBy01fI1SaL70rbhOFa00fIE8ewwf9YgDhq9Slvin4aNO 8a7hmyhZdBi+mRKVRMO30Jed9USh7EzDt1I/ZZjh26lYmWz40cp1ypXSt+njYBpj+BgH0yDp 25Eeb5pp+Bp5TOG+O/R2mgKGj7aZFko/BulO0xrD1yjNdJH0nbKegOHr9YTzJ+jjadpk+BhP 0wbpu2R7HjR8vT13Sb8P0l2mVw1fowGmXdJP1PObyfD1/J9Kv6+e39zP8JHfHJ7rVH1+zSca PubXPEL6/eX8zjF8fX7DY+WW+ecYvp4/nD5Qn1+z3/Axv+Zy6Wfp42O+zPAxPuZzpT9c1nOT 4ev1yLGK6jL+UV3GP6pLv6K69MvRJb+jS35Hl3lxROalhCqolurJh9BDM6iaFlEjtAnx7uea aLmIJj+91yO9BrmreqQVyxqauqeql6l/VXeoD0A30x+RaxSNwDFO/qbNYqrEdetpGawGJT1U CK+RAlIrkLIYnp9ycOYk3DNLETYibRHqb0Ipj2z1MlgjrZAtyunRpsUyVzXCJqTq+TwyvVH2 WT/bJFP1snpv9atWIaaXbqQlSKvvLNP72Zqj6oneIr+sS2+Nh05HbLFsg3792XIGmmSf9Gv6 kZprtKC+Sw8qEVuOs01yNPTcOb22oftYTIS3FDXOkbUs62zRcSg9gvK65R7emfsU2aLwtc+W /dL7Hh61WnkmQBPQylyc1Y8clO/ZkhzZYh/yNNE5ckwWyVEJoIZzqEz2xiOvew7C5XJGw2MU nr8a2dImOSZ6PCCv7pMjFxm7hbJsZFyLMLLTsWbCZRu7nAnIllXhKpWyxvB8nC2vVQnt/brh uJ63EqOyXK6C8Iqph1bJ8wGcCfcgPHPhay02aqg06qqWqq/onv3Wzy+V3hCUGirXrQ/9ilyp t1b5v1XzDx+jw7VXyZoWdd5P4XVV2blqe+/74ZXcvV3HdxkBvSfhvjTJ60XuB73+cF+rkHK2 7Hm9vLt672l4nCu6jWm1cV/0vDv0UdVX5XJZUm/tCtmb6s569JxLkeO7Z6j3p+TiXp6S05Fa C28FUvTzy3ucP1n2eZlc102yDT2fnO+hPUvoAGp4D3m7n50jS3VPmwxditw1vZybadxfyzG7 4fk75zv60qMtmls7UTteK9TytHGaVztBm6aN71G65AjvhGl6m8RInOmZrq+qAPrX41oijvaq GfB7jma9XJEV8pOXJBSgR4/wjwZV+XucThKhUOdveJIyR5mPVNSgTCGhTFXmkqrMU1rhX6H8 Bv56ZT3865Xr4d+g3AD/RgXvYOVmZT/8T5Qv4X+lOkio0aqTVDVO7Qs/RU2Bn6oWwz9ZnQZ/ unou/F+ov4B/nnoB/FXqKlLUZvVz+F+o38A/pI3Cu320NppUbYxWCb9Kq4JfrdXAX6T54Pu1 5fBXaOfDv0BbDb9VQzu19RraqV2v/QH+rdqt8G/TboN/u7YT/mPaY/Af116H/4b2Jvy3tI/g f6x9Bv9zDW3QvtD+Df9L05skTG+Z8HnR9J7pffgfmD6H/4XpC/gHTOiv6SsLrmW53vI2qZZ3 LJ+RYvncOpGEtdCKTzbWKda74N9tvRv+Pdat8LdZ/wH/Yetr8F+3fgx/vzVEwkY2fPa1Rdmi 4FttcfDjbfHwE2xT4U+zTYM/3VYG/0zbmaTazrIF4DfYGpDeaFsNv9V2B9L/ZPsTUjba7oQf tKG/tsdsz8J/zo45tU+1zyLVPtuO8bRX2WvgL7L74dfbUZu9wX45/Bb7FUi/0n4N/LX2dfB/ bf8N/PX2m+FvcFTgM9FCRzWpjhrHjfBvctxMimODYxv8vzh2IP2h6NlYUxqRXFkKDcZamooV Mk2ZRpoyXf83mHL2w3NqwmzWQZdgThXM5tnwz8WcmrRrMZsm7WZtA5kwwuiX5c+WIGmWzZbN 8Nst98LfZrkP+oDlUehTlt3QZywv4OyLlhfhv2R5Cf7Lllfgv2rBjFvesOwlDbNTbMxFZKwe sz0B/0nb06TZdtt2y3FYTZq91d4q+4sRc1Q5qkhzVKPvwnGf42/QBx0PIuXvjr/D34G+a7LH NmoVNWSqaKxYSJ7KcxqXUn5t9cJGmrq0oslPc5pqK/RniI3E6bMmefDZmHAX6v/4zyw9QRY5 duFUQVGdMSF3U2LWqaccLqViVxL2NLJ1KWfCDsXhq2hcQlOlzpJaKvU8qWuk/t63xLeE7pDa JnWb1Ael7pS6W85ieDYFaiY8ORLQgj7YnyVhT9cX+7FU7Oz6Uxq58SxKpwHIo7fbhD5FoYU2 tCb6CGlC/+0E1K/I59bhMIZiew3jKJ6yqZTK8fQLYO/XTJfRGrqONtDtFKQttJ0eoV30Ar1O 79J++lLgI79wimThETkiX0wVpaJc1IqAuFTcIdrENvGg2Cl2i5fEXvG+nD8h1qONCO33oaUI Y1zhMLYjvKadN4XDzIFGeCAcDi4Jh0NGhcO8ieFwbFY4HBcTDgvWEjbJJLxpZNZ/F3FGIplx QsxsDJ+fNQx7OYRnDCQzhl2U7gy3q7QD44bwzMZw/MybjPD+cHjWsHA4L0Xm0xYMWjBhwYwF C43YrgVvLfiy3BGOlT9Svqd8f4UWjmGlXlqxvmJTuPzCunBYOSccVo2QuaKqbdVp1WOqp1aX V6+obq2+RabG1lxWc0NNsGZHzQs1+xbRIteiIYvyF81cVLVo5aLWRRvCLa5dqivCq8M11q4P h4ubwmHd3nC4NDmcz3epEV4p7wDhw31qnWRdJ/8rwEs0mqj+VthGEoHHEbbBtpBotBGd/yD8 +2E7YDuJfDjvw/r1vYD4LthzsD2wvbB3YR/B8MQPjEB4kLCgYLgPA3gfBhphKw27AHYJ8uUh bIGtga0jUb8WId6EDR0Ib4HdDtsEuwuGJ2IjZjSwHfYPouZ3YPtgn5K4sA7hl7AOJcU3q95f f64vsb7ZN9/XzzfEN8CX45sOfxb8Fb4rZXyFr076a33rfRt8tzY4kDbAnyfTcb7+Jn+Lbr6N iG8M2PyN/oG6IZ4jrQ3put1v2Bhfjn+iz+u/xV/uv8VX59/kLw9oCLf5dujmK/VV+Xb6dvme Q9kxPi/i8/2XoFypvxx+3eH2+Mm3IWBDu4v963zFkXT/Bci/vUs+o3yXdg5BOwd0j/uGdI3X t/qG+Bt9xYEc1Ht/uH7/dvSri9Vf7dsl7TrfFmlHiKMtQ3TrjDfKuoegXd9p9a1oj26X+oYE 3kWZdf4W3QIfIV7lGxKeB19OQ7xvfiCAtDrMCeYlEscc5kiLjH94PuR4ynHcGNgCux95inWr b5Jz7Y2MX2An0i8yxva8wHNI26FbZP4Q1vkn4ppd5sE3AYa4Px7n4sNjr8+5Pxn1pOljiXUB 82ehjhGo4zLfXt8e1BHw5/sdvr3SJvon+z7yz/CN8U/2lyBEn/xnYq3UoJ6lCJfqawFrpBRr xFgTGM8d0iJrKNLGyBp4F+1o67p2wmv58JoJOP3bA4n+lahrpbFmtklfxuWYXNJt7bX4NvjX RObEfwPm54bDa0hfP9IOr6li30Z/3uF4QF9zdf4b9LLfLh++l/R+BWYFcmBjYBMCszrXYiTd izVaDOsRRu7Bnmv2iGbk/6FrOjD/W2v8oG4913xkLQdWGGv3c/gHjeeM/uxoDlzkmxW4rIEC 5/kGBM5riA9cGQgE1nY5vx7n1zaYsc6x3huSw8+pBoex1o0Q67cusDFwa89nTsNElNEtDb5u k+HrNhA+DHVvkNaGtaSbcc9E8kfi9ZPw/Jh0ON6QhmunyetG8u/SrTOehfJZh++5hhm++bDD 8RLES3o97w3fo+g3rL4psAH3Cu5J3FPbA7bADrSlyeetb2o4U56LrNt4rHfk677+kG7cs533 7v2HTb9PsF6kRdLwHpDWmc+4jwJ7ws9i2Y5LAv068+EZENgrn+nSjvgMbMT60O3wM+wgnmEH cR+0RdZyZOz8u+vn6us8MD1Q2rmO1/nzA7v0Z7zfLC3yzNHvRf2e3Omn5gu6xA/f3zLefAHi aw/HZfm1PfM3X9Il/3ykdb4z6m/S781v35/NtzTf3ryp+S60MT+Q07yt57tBv0906/HsLtbv h+Y8WD7uhX7h+6Nr3DegeTvsH1j/Nt+s5scPx/U11ry7+VVfjrS30AbdIvFb9DYdjkfWdf1N gS2w+5v3+4qlHWj+xrfxQgV13a5bfdOFUfqzv/mC8LhcGIN5WIl4i29+8xr5DJTvhuZ1GJed 336X+C9Bv7tYz/7j01O03KWT3JNHyd24Ve6HY+ROOBZ74I8pXjuA3W+C3Pf2wY53P6WYPsO+ 1yN3vAOwhzyNMuVuUP+v8MnKx9j9k2pWzdi1u1QX9vSJahI+4fbF7t+s9lP7kUVNU/EZUh2t 5lGqeiF2+W71kHqIrlFDaojWYl9+O12LHfmrtE7uv/+InXcz3WG6yHSRGG26xPSmGGP6yqyJ tWazOUpssLZZ28Xv9J2u+AP2snPErfZSe5m4A3vTaIHPhGKfcuLhT4oN2F00/D/2vj+ore2+ 80hgoYd5LI+4xCGEYB5lCQE9QoBgDFR4KSEO+nX1w8QlhMcTQhIMFSATwlLKUiwkoV9IV4Jh KctSxut6PC5xXIZ4WMZhGI/rZahL/RyWdT2MS1yGoQ5LvIRxPGS/59x7hRC8vLfZNn91znzu 9+jo3HO/v873fM9Bvk6ATAwyt9YkQCriNUD21T4O9QyACJCH0EeQvbUWAcSACoSMkEm2VgEo QDWgFqBl7m3FgFSxtQMhw1mg3SztA1gBLrYfZIc6HdBR9nMV8FEMdAIAGWzrLQBkr7ox9vtZ AGSvHZApdsDzO7YR7/vAT8cuYB/2W1moCJUjKex+6slJVi+yIxqNw87nDppDD2Dfs4a20QFP iCJaUWtzq6C1rTWmtRPxTXOtRaYFkI1vutOaY5ptLYDajdZ0093WLKiNtyaZpkEzfIjy8aZb rclQs7cKTZOtiVDrNR2YRlojodZheg1rwxv8rWnL1G/aId+um7pML6EG+QmsG8+g1mZaMulM K1BrMS2YakwPoWY0zUKMmYdajumBqRIyZL4pHb4tNd1EkSat6TH0IPfDU2A/EPrpo2nTJuL/ 8T7U40zdiH911tRsEkB+/q/h0afIaRQi51C8qO2oX6B3yPnIe+Sk43PgX/G8PvK3xnv4HdGm SoAUoAJcAfuVA60DgN1NzcwuomWN2UV8BH6l7wruJlALcN6yfLijaIHdwUfdZGeBdxUn7SjQ HycAwE+18Yc7C7wLAm0jE+xyTM8BGwiZLYB6gAMAvm42o6+aik0XQfMXTWMmqUkFlCtXTHWk 6KDUgW7bTJ1w7YTSBrQOaA+hdWDzfnKta99rf2vmm4Vm/LfKeLAC+Cj/Nf//ID7/l2CRSGIR AbFIFLFIDLHIu8QicWCRPfQesUg8WOQV+vypHbDLF4ldkk798tQvUTLYRYq+fFoO1kkD64yh 9NPjYKOv/M6fx0NiZCYWF8F+Fn0IFvkIZu1HMFs/PMvgo3mGtr1Cwg97P5r8sOujG6Tcbscn rUL+L/i/AH73+HuIF/lL8Eb+qZ+f+jmKAA/cQ5Gn9sEPT52WnZYhwek/P/3nKOq3uocXv/m5 IhSBYnjzEB1QezHi+8Hb2i8CwEvbwUvbwUvbwUvbwUPbdexnDNy/Df8xHWgnix62D6D2XhA8 VzyM28vCQoDa+2E2Pwh+JnXQBd/vONqOUWc62g8Dt3HA43LtbH/Ubmf59DC8YV7aA+x3V448 g/lujPTjxkHtMJPawW7tt1nc/S2Ax71P9HEoPwPUfigDat0OguEP63CJxeoR8P1eoM+BjvCf XXvq0Pm263sczb7da88cbb79eruj03dw7YWjx4yubTr66cj6DYedjoZ2D7S/cgTouGuv4Zpw 7Y1jzLdrQdAnySJwTNKpMMLY1TNw7fTtw73NdCSu0xlQvwHj9MBVZIlx3KbzLPEwZhE83ePb tpx13KXF8O29diO+0hWWZMeN9luWNMd9usqS6XhAF1lyHEs0ZSlwrNDVlmLHKl1rueh4bq60 VDo2aK1F6tiijRaVY4c2Wa449ugOaHkbbKlz8tsXLTqnEFqKnbFwbzNcuy2VzjNwb5szEfp0 OlPoPkuPM522Qs8s2mXphyttsTtzrxZaPB++ARk762PoUUvgw9ddKsuYsxA4J1eQsZmesEw6 S83IcsNZfvWM5bbzkm/fctcpB853nFMgxY7zJrni+p5zmlxx/a1DB1cs3Z0BvnOGroXrFLni utA5B9dY5wI9C9eHcD0DddNAonMZrinOJ7QReq6R/odX5i4hqac712nXkWuK8yVcs+Deecs9 p4a+jq1G3wItbdOLoJ9d+pHV5Fb5+y33nTUg4wNnPVxvOPW+/YFLrjj66YDclUA/q9t37tOj AxpXUrsRerZAnyWnGSzL3LXi7AJtTzphCbCsOnvpOPb63GkJ1jecDtBS6HXL6QWNhVwHalyp YB3kyqCTBupdIvrFgN5Z+gPTQIsrj94cMDtL228NdDmnulT1dueI72AgF2Sn6jud4+3GgULn AXBY6oqEerkrmn480Osqol8NWEAPWstzl5iOIz75mlh/1LLhqgAZHaB/asDrqqDfDIw4p/xo YNzR6RcMTLmqfNsDN6ElBs8afzz2T//ZgWlXhVlnKXBRdHW93VXNzB1/MvZSf9rADOjEODDn nPFnDiy4akGKhy4tlojMGpXLyEkHdRPUN1wdV8+ApdbgrmVXh44/8MS5Bjok+gH7PgGbrjlL 6ciBdVc3bQJJS0G6l64+pk6LBgpdVvBkmGX+HOzP/oKBbZcL7NLjosG3t1yjoNVd7Amshkk9 VJMD+64JqB9oTf5ia6TrervJkuy6RWut0a47/ouWMdesb9sahzUTqjHLbdc81HNdizRlTXA9 MiPwQOzDM67HIIsD6tDu7DIja5LrKbT3wtOjranYFtYM1zOoi1wvaC2ONv5Ktj3PtQk2nXG9 oo3Xnrlew8ySut7QRmuRG9FxA4luAWjsuTsGfEnljof6qvsstJ/BdRyp/AXQnuyXWsXuNL/K WuHO9F/BUctfB/Hhhl9nrXLngJeC/v3NTE8yFyZwrPDrQuuW2+4CkA7mlL/NsvEnKqhjG7kg sr31d+IY4pcGPdNKb7JRjujcSoHXFcG8wzq/C5Jy9S13MdTJrMTx0N+DI4+5zlrtvkiLrbXu yquFVq1znK5gPNlqdEtp05FvQ+q2t0MmWmznD3VcLQz1/2vP3Fd8+9YOdx3tsr5yb8HM0rl3 aBd4vg48H3w44LVqh7rpCrsQYlRf/SR4r454bw4zf+2xOCLZzwz1EZtCVAE9p9Fx9kTrdazn ISunZxLtJ3CMhXs3hly+fbgX9w9KByMTr7MTDZBo/5qJqwzPwAPwbE8fotuNEGGgznmyN95f wKwslk6I/314lgVmGD7xfAyMMLLYs1yzEJHIqoHXNRgf6v4eXDen2aBubrbnDo36DmA16cFz 1tEZGMf1wJS9EOo3cd3/PLTdCs/1v7WXQn2a1U8O8HAnlAd7+dAEHWm/NHTdXGmXu54FYu0a 5zq05w7d8h3Ya4bu0Ea8hsKY0qFZv45rd82y7XO43VwX2ifUhyEidfh2IZ6UwlwI8WFcN0/i OtzbD5Hksb3enRxYsOuBn8f2lqF5vxS3Bx7icQLL9ZPg7TpmTLt5aJFOtXcNPWpftPcOPYa6 ZegprJWwmgeeWOqGngVa7I6hF1fP2L0QV43hsyOwhuvmutB2iE4toIcRsHu3vRyki7SPw71Q H9qE+tTQK38xzgcC63jWBF7ieu2ipW3odWDbngV9RPabQ29IBLsB2pt2pgTkTGSzz3gR+GdI HfeHPtDfX2Cf8wroPPuCNwaiXIjPkHoargd2j7SH+uTxeg6s/ncsD7xnfdv2h+CrNPiYHXwM sgL/FjvXlr3JkBtA9hLYx3lC4AB8D1ZD+xNvGp10Qv0mWTGZSNsC8bMY5zmwEkFGESjFdXMz qecyngCyZNJW+5o352qhfd1bAPPipbeYrrJvey9CHOiGfIay9rl1frvV6ritS7G63M3+Nivt boPc6aK7k+6zjrp7/Mg64e6HCHDdbYf+t9wendB6xzXq91hnHZ0QJZ64A/R8/ZJ7zJ8D/Sfb 5wdK3ZCn4fzN32mdd9+GyLwI9u2GrOCuP2B9hHOqa6/c9yDqZjrGdOlMrmV95L4PXD12P4CQ 99S95B/DXuGfDHoIzFzrM/cKcPXCvUonwGg6GG3T/Zx+DO0b/ht4TfRn2ne9lcORMLOaIdrU u/f8ty097rf+u2C7Tjqv1uV+4L+H6zDrn3n4MOZrj9B/3/rGE+t/YHV5zviX2OyRydMYDZOr ddQr9SP7tFc1HG1TecYDM/Z975XhOPuBt244YTDSqxtOGoz2Ng+nDsZ524YzBhMcN4ZFg0ne zuG8wVRvz3DRYIZ7aVhsue/t920PipxTwxWWVa+djhvM83roWSbiDRbBGpHJRLlBMUSANlub N0BvDlZ4x4arwGcmIT6TjJrJXQernN5hCvKK9eFqWO86YL0jHhIaS2EOjtITgxSMnIO/pbUD Ld4bgZeD1d7bw7WDtd67w3GDWu+9Ye2g0Xt/OIlZW/HTYT21ex/4BddeeHIhUpHsAmIvZBdM njZoInnpfe8Sl9uExnzLpHcF6ilQdw12uNN0hYN5sLbODnZ7V69mDfY5F4aNR+L8hvc5V2ez lBZXt7940OrdGDYNulzdV7NC4z+zAg7SUKdsW96t4Y7BUe+OWQV8bsJaP+ndg8wn3iMc7rYu Av/p1kXv20A6tuZwH7bvsHVwwscHKa77hDAvQEugfwpnv/YsXyyZcXgF8XgS/Zk25Enxo/p7 nnR63joLfUQ2gSfLv2KLgSxu1VLgyfU/hyufrrbFQzxX2c56Cuk+W7Kn1L9qi/GUwzXZcwl6 5kDOQNnSPHL/hi3TowHvInaE8WsgI+r31Pu3LDqPHqTTuXMgnkg9LaBtuOKo6zHTJluOK9W/ YyvwdPn3bMWeXrhe9FjAV3FMvmur9Dj8b21SjzfAt9R5RgJC4Hncn8xcwW+nQCfMLqbOc7N9 0XbFMx2ItdV5ZvyVljTPnLnSpvMswLXZM9c+YSOZCXO1tHkewtM7Pcu6QluP5wnMkUrP2tVE Jvu1ZeIcz9bvWQ+cgRFeBhJBOiG02D3bgRSbx7MLuypmZ9Ts2Qcr4J1CLch7QNO2wFBkIMs2 BhkFbWt27gYS2TiGr4VsfCNX2+RQdKDcNjYUp0ux3RhKMHssnUNJOEshK3vOUFLgEmgvnXbZ bg+l+pFNNZRhRnCXKCCH9nFzHawUeZCXuoaKzJlHRrs7JA5obPeGKgI1pF5vu++5GdDbHgxV BVpsS0NUwGxbGaoOdNlW3TuBXtvzegFkTRtDtQGLbWtI297nuOJbGGnDO46Ri45kj5zusM76 ztCvrY88u37p4C2Q9/XgHbdg2GXbGTIGHLY9fB2c9SUO04PzvpTh0cFFX/rwxOAjX9bw9cHH vtzhW0yeP/jUVzh8B+vZPEb8dnbwma90eJ7d2xb4ymFXy+xnQ/eqzC6V7E8HX/guhe1SSXwb 3PTJhxcHX/k0w48GX/tqhh8PvvHVDz91IJ9++JlD4GuBu8g4jhif2d/miPd1Db/Azx3ehOf2 Dr/Czx1+HdxHvx1+g3fNIwhzMiLAnEBLkBNoBx5GYhhvwavhSDzeHY+cxfyMJOMcbCSN2Vlj G3XO4exoJBPPo5EcPI9Gctj9O/OUNsfSSAE7GnjX8BvHWZ9lpJg5kWBOCXCm2m7EudZIpSPT 54XIT84fmJ2+I8c3MiJ1FPjGR1TMOQOjMfYkgeSWDpVvbqSZ23ORMwFSZ88o4C5/p6PYNxXw Oi76bo5ccVT6pkfqHFLfzIjOkeZzmAXk1PcSX4IQ+RVZZNR/jvohOkV+D5ZEfg92jvweLC3q b6NeoA/Ib73+A/mt1zej/0f0ClKdtp92oBryG7bvxczFLKKPYMRClIZKEELl6LsoEdWj/4Ty yPvSVMiDhpAaTaD/ii6j61C+g26haXQF/RjdQ99DD9DH6EO0jn6GWtE/oW30fbSHfo3+hMfn ZaIBXiGvCE3zynl/hn7EG+R50S/4FfxvoV/xv8uvQ7/mX+V38SL41/hW3jsRVREy3rsR2ohG 3nsR5ogf8H4vMjtSxPti5E8iF3hfEnxBkMj7siBJ8D7vnCBd8AHvK4I8wTd4XxcUCb7F+4ag StDI+6bAJPg+7yNBl8DHaxKMCH7Iuxa1J8zg/RdhljCbtyL8QPgB74kwT1jO+1goEUp4L4WU 0MH7J+GQ0MtPFfqFAX6acEx4j58unBPu8/8Q/3WF3xc9Hf1D/p9F343+Mf/a6T89beUPxsTG FPP9MRMxt/iLMQ9iHvD/LuZhzDJ/JebjmI/5/zNmNWaVvxazEbPB/1+IB7ozklPTZPy7Jlk/ wA7wAAIoUXZFZpd5ZAHZmGxSdgNqt2V3Zffg033ZA9mSbEW2Knsu25BtyXagRSdrlu3J3uLf hpHfD6KosagxxI/6i6i/QPjfHsXz1nhrCPFe8l4iHm+Tt4n4vH/m/TOK4O3w/jeK5O3x9pCA 9yver1AUP4IfgYT8U3wheof/Lv9d8KU4/nsolo///U8c/4v8L6L3+O/z30fx/N/nZ6DP8fP4 eejzYIefoLNYc+gLINMqek4ki8e/iVMtoHr1hCZZk6bJ1ORoCjTFmouaSihSjUpzBep1Gp2m WdOm6dT0aPo1do1HE9CMaSZVM+rr6lvqO6oF9ax6Xr2oeqh+pH6sfqp+pn4BbZvqV+rX6jca pFrWCDQxmnjVE81ZdbW6Vl0Ld9aqtWqj2qRagJ4d6j5AN3w2qq1qF4BmimpNta56qR5VbatH 1UmqXdW+6kAdqY5Wx6kT1KlqSp2hFqnz1EVqsbpCXYV/afXOz0GbCUfmAv6ldx4ygWcXoR/A vLhI5sK3YQ5MIwnMgh8jKcyBj5EMbUGREx0pwJfGESWcEE4gtXBKOIU0wuvC/4YuC/9S+Jfo O8K/Ev4VuiL8kfBH6I+Efy38a1QjvC/8Cfqu8InwY/Q94U+FP4U5xUNjMNuwllPxbw4VTxGi kgFpgExADipW3KNuUtPUDDVHLVAPqWXqCbVGrVNT1Etqm9ql9qkDZaQyWhmnTFAmKVOVGUqR Mo/KpVKoQsUKVUqVU5coOaWhaqh6xSqlp1ooM9VF9SqeKzYUW5SFclBeaoQaV+xQWVQ6xVc8 UCwpixR7CuyHvKhHUcvk94jRR7T1Ayh56G+h5KN/hFIAkeFn6BtoE0qh8G+Ef4POC5eFy6hI +A/Cf0AXEC9m510B+WtlJopCSGsEmBBPvwK0A9AN9VXEq5yL+JpWq7+vNeofaE36JW2HfkXb rV/V9umfa636Da1Lv6Wl9TvaUf2edkL/VnvdwNfeMgi1dwyx2lnDGe28IZHQRUOK9pEhXfvY kKV9asjVPjMUal8YSsnYm4Zy7SvDJe1rg1z7xqBpQIaaBoGhviHGoG+IN7SQ+lmDuSHZ0NWQ ZuhtyDRYSD3H4CDtBQYv6YNRbBhpuGgYb6g0TJHvpIabDSrDdMMVw0xDnWGuQWdYaGjW38cg 8oAsDW2G2IZOw5mGHuAL83ACCE+Yn1BgHkLB8RIO3B6KScOThn7DQ6yXhhuGNdxHpzFWcHwR Xu4ZthvuG3Yxz1g/pN0OvHIUw6PfOQJ8HweQJQjM2wPDfsOS4aBhxZBO9LNquER0ETAsN9w2 rDeMwTOwfu4aXhI9PtdvYIpt27BRs4fvwfoiethi6Y4xktgP64ilDXv6lYa3xmg8LtEt1pOd oTq+gY95wT6iExrjCI01JhD9Y71wFPOPdXLGkILtyVGOd+xD2L66REOWLsWYRGTE93GUk42l unRjqi7LmKHLNYqCfG4dlSWc1yBl9RDUh5WhukL9lq7UYNaVG/N0l4xFRE9YNpYSe4R8xvMD +y6eI8R/AVh+8t0dRu4gnWXkD9LFk+Xn5MXzKVR+7jOeX8T3Wdvq5EZx4y2mLZwG+9QYq3T1 Rko3ZaR1N42jQX01fzptvPPZvj/SL1zfn4E2zoZ8DtczqzPOh34TbZw//Ny4yMj9SZTTS7iu Gx8xevo0SuYwnl9jRylnS8I3yMP5Iaf3xscQdyEmkvgbQoP+i+cb9suO30zD9Rh8TpjfNz7V P298BjH3+aGfE19yMZTze+5zkIb4feMLQ1fjpv5t4yvwcdbfg5T1eRwLcL/gHGBp42uDEMd1 juK1hMT5trA5EkY/ya5B+74xJGJ5OMrFFG5uhX8OzrVHbLyEz3p0lOJ2HIOI/R5/An0aNifD /AdTrE+9wFCI1yq8LmLKzcvgHMZxH69hHOX8iI1xeP0MpWRsHCPwvdjPwJf0MUYx9h2d3ljN +ZGuxVhL/AqvhVx8h9itMxu1uA/xHRyDwE90XUZjcN0HPnW9RhM394JxDfsAjiMWYwe2jc5h 7Ma+rfMa+3QjRqtu3OgifsnmA0SH08YJsv6F6U83Y7yO9aWbM97SLRjvcLLhvkGsGR/pHhpn 8Zj6+KYx/dmmSX1y0w19WtNtfWbTXawHfU7TPX1B0319cdODYNxh40bQTzh7wBzQXzQ8xOsy F+u5uRD06bAYo68E3rHOIb7rpYc8cPfpVU1L+itNK8H1LTw2hsc4z9E1JNyXj62LYeufvq5p leiJnat6XdNzfXPTBkbQP7hnc2Nz8Qi3sblUMBfj8jE2J9MtG+d1T4yLRPfrxse6l8anwTwN z61t4zOSd+E8JzTvYfMk3a7xhW7fuKk7ML4i/oP9Ds9xLp/DcTXS+JrM22jjm8a4JtSY0CQg soahMakpBgOvwRjEn7AvAT+NqU3xjRlNZ8k8YPPBRlFTcmNeUxqXFzYWNWU2iptysE4aK5oK iG4wOLlZYJs3VjUVY1mxfJi/RqrpIvb5xuqmSiI727extknaqG1SNRqbrjSamuoaO5p0jd1N zY19TW2N1qbORldTTyPd1N842mTX325O5/JafVvTlr6zaUff07Sn72962zjR5Gm83hTQ25v5 GGRNYOcoybPxXMGxCfjVe5qFxF6YD2wLTpdsTox1FMwbsHzYLwPNscR/x5rPYJsQPrCfg36w no6Mh2l43h2SbxOdY53i2ITjUIgfEZ9h/SWYN4MM5B48Du6P4xG3L+DWJjZnwjrjYgaJ0exa qr/RnBK6fpC9Bo4r+Nkgp36yORHHHPwsvIOP+seonyEU/ff43yWedp52Irz/yf4dn79Y0a8j qiJaeV8lpy0KctpymZy2fIectvyRIEnwQ953yRnKL4RZwg/46fj0hJ+J97f8C/j0hF9MTk++ T05PfkBOT/4jOT0ZJacnPyWnJ6vk9GSNnJ6sk9OTLXx6EvEFfHoSkY5PTyL+PT49iRDh05OI D/DpSUQO7Hun0M3DMwbxFKoUL4vXxOvil+Jt8a54X3xQFgkluiyuLKEsSTxSllqWUSYqyysr Ek+VicsqxA/Lqsoo8ZOy6rLaMm2ZscxU1lHWXdZXZi1zldFlo2XV4pvw3UTZ9bJbZXfE02Wz ZfNli2WPyh6Lb5IyDWWGlDlSFqB2kwDXAfi8IOoO2O502A64C2z3J+hPYe97G8p5shsuQn+H VmC/+wRKCe/7vE5Uis+8kBifecGdPFSNakPk3UWpIOlucZt4v7QDyyo+EO9iaUsSsbwgdRxI DPKWxJZulhWVJpVllHaUiUtiS2JBepC/eLV4tSSW8PjfgcfPA49pwGM6FB7KgMKHHTd+M00W wv9uToQ+QKfQ11Au7MLzUSF6B3gqR++iCiixqBLKv0OXoMShKijvISmSAacKRKEz4J3VKIH8 G/VE1AHli6gHShLqhfIltAQlGWT/e/RlXiwvFp1DPEGHoPtQVkluxNckuRe2xTGSwpI9SSnQ cnFAcgmuWxK5RCOpkdRL9ICWYpHEfGFb0vUHbyq1FyySXkmLOE1ikTgkXsmIZLxkQzIF1/5S ueSmZFoyI5kr6ZcslHZJHlZqJcuSJ5I1ybokF8pLeAqMKl6CEQ7LLoxDSskGU8goXNlnSsmS ZBv4OZBGSl+QsWqkCdIkyRo8IRdGBZTsiQNMgX41+Cm4lGyIt2DEFskC8L0uKZRMwx1r0mhp nDhGmioOSDOkInGMOA0DJMqF1jxpUWWHxFLZIRVLK2BsB4zQj0chI2mAO4wa4K1eWiWpL+m/ YCkWSSlpdbEIZDZLHmLgp2FIa6XaYrEktziDe0rJntTIAZ5mwnxIO6QmSblkXFIu7Qae+sQB eBpAapW6pLRkSjoqnZCMS69Lb0nvSGel89JF8nyA9JH0MZYOOHjKPRtD+kz6TNIlWcbSgjWg xgG3kLtxT+Dr/wUX5mSVWCMnAb6TYp5lKtkVWZ00leMwFCe14zZ8zhrKPYas7cK0rFPWI74r 68cntpVaWYC6X7IqjpHvX1imHhB+ti9Y2HNccopb2RFyirvCnOOW7Ml28BmunC8XAmIJPSNP /GavPAXrXJ4uzyI0V15YLC5OkpfKy7EcJVvis/JLcjlAI6+R18v1gBa5Wd4lNxdnyHvlFoBD 7pWPVF6Xj8unCG7Kp0v2KrXyGfmcfAbTSm3JknwB8BCwLH8iX5Ovy1/KtwG78n35gSJSvlss wnVFtGyrWKSIUyTIPLItmUeRpEhVZChEijxFkUKsqMD6EC8pqi5sy+wKSlF9YVxRq9AqjBcs YikGtJqwxymiFR2AbnkWjFWr6JNbsP9/u+KCBQroS7qJvbCyo7IDelukr8RnxWnS1+CFb2QI ex3WBVhRIIuRaGTxkhrZWVkyxIMWqZGZRbI0WaZkQZYjK4A5uCkrllbjp8ouSjOoJcwHtUKt Us+pDWqL2qH2qLdKvlII87UX6xTbG2alVBlbXKE8A/FmBAM/UZmoTCFIV2ZJppgR8HfKXGUh mW8wAsaFZfA0ADdDgp4E8xADj06eUPqNHTJuuXgJ5p5KeYmMUMPMf9A8FIVV4VLQAHylg7VR xYTiunxOcUtxp6RHMauYxzFJHFAsKh4pHiueKp4pXig2oecr+dyFacVrxRsK4bspARVDxVNn oZZcLKLSqEwqhypQxMn6YSyrgpbPUcWKWbhepCopqayfUlFXqDpKV7JHNZP726hOqgco842d 8lABaoyapG4wUZG6Td1WGXGsVcqVGmWNZIG6S91T1iv1klxli9IMNlpQdil7lRawk0XiJdF4 pqQfx2JpnGS9ZEnpUHqVI+KAclwyo5xS3lROK2eUc9C+oHyoXFY+gdY15brypXJbuavcVx6o IqFEq+JUCRKHKkmVqspQiVR5sA6YcbxVVcBKMaWqUlFY71irF3aZSCmpVxVJelXVqlqVViUm K+H8v2VaJ2Ra+D0C+AQevyUMFT5HvPMp6Ezh8vm4wrXzSXmTear85fy1wvXzqV9/dT6j8OV5 UZ7g66/yH+a/LNw+nwdtRYW758WF++crSNvB+aq8sYJHeYG8yfOR5yn8HxWejz5fjd/eEDUb 9WPyboY/RN8EC3wLfRvyDwlkEQKkBD2fBot8F/8LE+DsFeGI/OVMVYB4l+8CLQZ6L+Jrqhy1 WVUAKAZcBFQCpAAV4AqgDqADNAPaAJ2AHkA/wM5SDyAAGANMAm4AbgPw2HcB9wD3AQ8AS4AV wCrgOVvfAGwBdgB7bP0t067ms30AaiEgFnCG/S4RkAJIB2QBctln5rDyVIbwOsnycBKWWH5C sRUGlpdwEN5DoC4HFDLPVF9i+82F8IXbawD1DM9EPzksrxytZPUeiv4QTIYAeFPrAS2MDbB+ sL6xLtSlADnzDKIfDatLFUthXFJiWX0tHVJ1F8vP/RAK/qHuZcYlPK6G0DZWT0DVFpY6WP1v hNB+Vm8exp5ByvE+xtoXUy8r40YIZWULyjgCGAdMhfAZJssxXjnK6SGcXmFteRMwzep/6zdQ PD+w7+I5sseC08cnyR+uh3D5w+UOp7cZ3w/adiakLZxyfRYAD9VmTTQg7gT7/kvTT9L7Z6Xh eg7X3WeknNyfRsN1zOnp0yin32OUs2V/mFycfnDcfXAC5fwWx+OVz0A/qz5xXMcxV6U+4uef SsPtwPl5OA2JASdSvHa8PYGGz5FPmzPh1M7Kw9Hw2PJJsebTaGgsOol+2hzl6A1mrQrS8PmZ w6xhQXqX9Z+wWBekG8zzydqH+91n5z/4jnpZHfQj9RP1oT9xcR2vCWtsnxVWf+Af6nX14bqP +XwZYnPOvltsHNlmbKPeZW2wDziAuRB5qH9Oh5oEZv0L158midGPJhWQcSgb6ctCIwaImDEv xwPOApIBaYBMRg+XQWeXQZbLxerDeRUeLzg7wBzAazNel4/FfE7GMN8ivGCd7xzlgbvvMszB y1yesaH+9Bj4aTEt3FfDfOmylOWHnZuXgY/LVxgE/YN7Njcm50/31cFcKpiLLYW0AX+aPEAR q/sKQJX6ME8DaCjGh3GecyT3YfMkTTWgFqBl27Bd3qqD+RyJq0aGL40J0AHoZmQNh6aPAV6D CWIZe2B+NFaAi50HZ9hxacCoOpgXaiYA1xmdaG6x/pUbIjcH0JPmDiMrlg/zp5ll/EEzz8rO 9tUsAh4BHgOeAp4BXgA2Aa8ArwFvwB4IMKYO5rWXwd6XIU+4DH52GeLhZQEgBtDJIJiz4ufg eDnGygv8Xu5h7bXC2oLT5cqhnri5ReTDfsna/rKdsQnhY4XRD9bTkfFW1Mfy7iP59hyr03R2 /FA/Wj30l2DevMTaaYPtX6A+3Bdw84DNmbDOjsRs1lcvB9RH1w8704fEOpDzsoeJOfhZ+BdU 5M176N92pMd3pDwP7w0+H+bFIjFC+WZAF6AXYAE4AF7ACGCc/YwxBbiJUHoh0GkWM2wfQMru IfLnAAvsfQ+ZvqR9mRmb1J+wY6wB1gEvWWz/FsDj7bO8HCCUl3YI3FYQySKaRRyLBCTOT8xP yU/Pz8rPzS/MLyXXQrhypfwcDddLpMjP0fBJk59LaDm0l+bX5Nfn60lpgWIm1678Xii4ZiFX B74DenvzR6CM509BuZk/nT8DZQ6/c5C8wRKFvLsygryRknkX5e+Rd04mkLdNJpH3TH6J/Oo4 hfzqOI28W/Jr5K2SeeR9kvnkfZIF5E2SheRNkufJOyT/4Hf4JPwWC+PhWyzy6sDm5b8ZeTpA 8wntbZ/Qlg60E9Bz/Lu8/uPtn/p8O8CDvvr1za+/+hcur7/+Br9hkryhFJG3jDLvFz1Ffk8e TX5P/i55v+hZ8mbRJPJO0S+Rt4mmkLeGppL3haaTd4RmkPeCfoW8ETTzX21cXuR05AqKBgtK 8Zt8s18glE0BqoNUKLpI8I4INJ5di6KyYWZlaxFfFIMi4PtIUTI6BRBA/8JzeSeU2uMlO+N4 OVdxQjlhvGzR8XIu4XjJzjte3n94vGQXZV8n4K54RHH2LQL2KhKIBNkVJ5Sqo0UUI4rJpo4W Ubwo/qS2c6NHi+is6Oy5jOMlu/qEUnu8nKi//x+dik8ocSeUE8Z7X3+u6Fxk9tPsF9mvzkWf i/zEZ1wHm+h/f+VcX/br9/ff1+O2tLzj5VxStinlAEbcTL8EY77BbeE6xeVE/ugTyp0TSpgM omRRcrb2hHKCLdMvHS/Zxuw7BOwV6z7bdELpyJ4l4K7wjPd7j5fs7uz57MeAeahBnWgm+njJ 7steJGCvuO19zfFyEs/vtxwv56jjJdt1tJwznjNm00eL6P/ydi7gVVXXvp/ruR+JSQghhBhS hPDIPqlSLiJFStHmcCkC5SDFVDHlVUSMlkY+rscichA5miJFDIhKo02pRkRKkQIfcixSRMrl IHgoUooppQiI1CKNiBGSO8ZvLmBT7Xf6uN/J+tZ/jT3mmGOOOeaYr7VW9i65suTzT156XJm6 MvX5hz7jGPoZx2fI6X1vvu/Z8O3d+r3d003cn+HfZxJ807P+RkrM7+2PE4kJ/gRzpf8t/1vm Kv/b/t2mp/89/3vmar7Zuw/fcX2NzGATnbkmLuPf9eYyE5bWG/Ops8E4HWYbX85Azhi8lcYV 2pMzt3ROjys7DO2+p7SxdE6Hoam+HYZePFJ59lpaL8eO0h1/8XPD55IXP3fcWrqy447SN0tP dzyeyiutiY7DKTfVKTWgdGbpUjlnlp5MZaXKUuWlC+TYJKfwUr1SQzoMLe7UfWdxp46bOr7Z cYfonlm6uHRN6dbSfaVnU4WlM4s7pUanRhefSY1Jje++UUo73n1bcVxk93XfWDpJcwhvk7Wr +zbVJvKTRf6u1DSVT69Xx5Ope7Ftg5zHU/FUt9Ka1Ag5Z8k5NzUvtTC15JI2m0Kbnf927hjf y61tFv5FCVoVuRzeuejFM41C/cb5bmM4Tfctxuu+8eKh+wK+CdykUY4z1Bl18QlNx1nGKRps hqVKUiXt5188UvJXNCY16jyd6pnqeT6t64muJ1J95JC/C/L9U/0v0NfLMTg1OF1X+lWoUefT isYUjbkgNyo6/vyv5OLxF238DPvS7Uq36c/tOa+DfOdlhssRladyn1VnfQrlLs58WdvNfcb9 D3Hzq+5rpth93T1iuiTWJdaZr9C/yjNuyRhv/plfB9BvZc6Nvv+7iz5HdPWbmH3JLzsO91l3 gwncjaKrkDxFIlFoOrO2pL1KrjTma/XGaddI6fqbAaJDv6fe9DH9L74H0+GUaXN5zeU1hb0L D3U4pUdJWBJ2ONOhpdAvTBbmFOYXFhV2pnyNzIT7nPuclP+i+6JwfuL+RHSvdlcbz31ZbPGl RttMjLokxK5vmmTGOLEuW6LpIWcn0TTStJFSZxinu+ySujQY027I33UO617RvaJgasHUosVF i/XavbJ7ZYc1HdaUPFnyZGH012Frh63dJ148CrMKs1SusJMcGws3dtncZXNhmRwDoqNOjiVy iJzS7Te331y4p3CP6j9/dFjaYWm6Tj1ULv1Q284fmkfLumCj5O9a3LUY+6o7VF+iSdKLlhYt xa7zNn2GPV2mdZmGPq2TyFywbkrBlPbb2m8r7FvYV3VxTJFDru1PtT+l743xWxKGX3mwv5Lg JucnHzVe8rFkrbTdkuQSk0g+mXzKJJM/SP7AZCZ/lPyRuSz5bPI5k5Vcnlxucv7qOHacFc4J Wn26RKfp0N+YQtnLdt0q5w5Lt59rz4Jdln+e12XVxbNDrj3TP+u17aiLZ/TZ6XrYDCvY0HVA wcz80fmjC2cUNuWP7lzXtbz9+vZPtn+286yC3AKjZ/6Q9ivaN3cdUjBTzno5cts3FeR2Lb9i UkFYOLugvutdVzQUbCjIzR9dUFIws6Ck3eGCOXKdWbChfVO7s0LntmsoKNZP+aMvnOvbzy6c 3XWInqLBniqXdootA86f1saC+jQbZ7df38WP7KtAz8zzerqWF6p2seu8TZ9pz/orbla95BMZ taugRM7c/BH5A9qtzB8jUqKr886u5e0auo7oOk2uW9vt0/+pcx9xF0mbPu4+Lv38CfcJiYBH ko+YjOTC5EKJg8eTj0sc1CXrJQ5+nPyxacuvWeTxexXt/6axTZ/Lj5DzLka3Ev6b9GbeR+wf jXglyN3LDOaYQWlyvcwk+ZR3QU5Ht6c0imUMonxKK6Y0/eWzONFtiG6f6A6J7hjRnSC6k0R3 BtF9GZq0DoY6BNShK/YsiOx+lrItbwZWO7Kjv8jbFtmdLrcGqx3+O1d5/4i/F+Hvz65viA6D DgcdLjo8dMQld63RX+oLPl06+jMyFon+rL/oBdfMMfPwg20BfrvN3BN5YeoFnmvGRO2XLjcp 8sLgiPf3tM9/1+J/ye4FZnWa3d3hrTF1aVFneZOj9kvnzYva7zzvH2+9v8b//0j7fpYXHLPW 7GDu1/WgKeosp9Sz6EozLHd4Ubc2+UVluYPlTOUO5tq/qNdla4UeLrSkC1UlR/+ivkL1l6Oq qIyjl34qGlA0AK4ew/VI0zg2TR8pqkn1yGn1dBMtVSpNaYOjkkWT1iW5KCm+Si5LLpM6P598 nl8s+SvnIGn1DRfXRbkjjcncpfXNHZVdI2djbmbuzbnDuY7SI7sxpzx3bPZJwUnZjdmNbd5H alR2g0rpcV4yd9TlBdkNetr6XqrxvFROueoi3wU9lxfbkuQ4nRvKUaWY3SBl6q92uMknkkv/ 3hq2WSHnajOszcqsk23WtMnMOpld3mZD1kn5tCHreJtNbTZBb22zQ3BTmxI531Ru9pCsfdnj sxr1yC7POh7J7rNHm5V6XNSYMz/rpJyRPnSppgt6RMNJ0hrbvJntSo4xwhuv2GYfNVycbPgb 5gztqXsl34qoB/YQnuf0cvoafSN+ySXcHs6VIueY2Zdwi50Ss1g+V13CzXMKjexszOhLuEkn h3F64CVc44RGVhgmlcZ1zWkzIG1k6JFWt/++h+e69e6PROLH7rMypj3vPi8r6BXuCsm5yl0l vlnvrjcx8c2rJu5uEQ8l3DfcXbKCe9P9L3OZ+yv3Vybb3efuMznufne/aeMedA+Kzt+7v5fR ZkzGGBltvilr8HayBh8nsaFr+EfBR8AnPkU/mkYvTKNr0+hFES11d0Y5N8saryyqeym8oc5I 4RVcwit3hgjPv4TX37lePp28hNfb6SefDlzCK3N6MaOm80qcFDNqOq/I0V3KM5fwtHUdGbvT eZlOLvNVOs93kvJpYjrPnHXctNnC8ppMc9psYXknzKm02cLyDpvjaTFRSpxr+xvGboex22Xs 9mTsfkbmvXoZwWN/3hLJuk+1xMI0/mPQi9PohWmt9Wga/cin6EVpMovS8i5K07korSxLP31J BFha69uZ/+zI5xeItcapi9JSO7t3VdT5N2kC00F/USviXjJ2Zc6Rvd1ZMyxzTOJE5uasmZkD Mo5njs4coNfECeGNyRwhaacyTgo1RjnJWuH2ytycOJKp3y4jxwXJMYkj9lD6zzVelFJdSl/U Y9PgjE/mtzuSnJ85ot0JwQHJfmmrj792D5TlDKeG1VJvk7FUzno5G6JzpZwSyRkb5NwU0ZKe kP1M/lA5R0ZnRXRWyjkxoiU9Y+vFUz8X1Jlhyab4ymRzYkSGyQgzMgVzkxXxNYnRGQUZJtkU HBducUZufE1GSWJyRkl8U/ysfC6Or9QjI4yvkZQCOYrtkWzS4xKNF/Qlm1SXarqoRzSsTIzW HCKRG98Qb8gwQo/ISMUP/39YN/21c+IhJx+v638SmWQv2R1OlvMuOadZOinjVtt7o+ss8Xi1 XGXn2VbGi7YL5fMCMyyxJzYx2S/jdGJtYnxip6BcYxNjExN7EtskbUpislB7lBPPFO7yZL9Y pXD2c5yX3BOrtIfSn9J4QUp1KZ2mZ7z9LJz9sfltK+NhYlvbiYJr+Q+wv2dn83fFbDjWmPgu 653cm6PPW+yZqLKnpsenyzlDTpl54w/JOV/O2oh+Us5nbHo4SXSttVfkB5lh8YFBc3xQuDQ+ ND4yXiFYGVsWmrA+PlHogV4f4U6JV4YmPjVcI2dmOFg+Twma9YiPDPXn7SbKMSU6BupxicaL +gaqLtV0UU98pMhO1RwiURmGQVN8qNBL49PDnv+DMau/29actoLQe4Dxlqnnzlw4NrYM+Btm E91pObSjjsPbWvueH5edomC6YK9Q9mzOl4Iv66itv9lpjqiMsyCUdbZbHkwUej0cy2+Cszls Us65/SoJv1esSmlNNc2a1zGUdQqZYmQ2B2KN281qCO4BDyj6q3QNgUwBqaYlU2l/qeAo6M3w K8OBSiNZSSllVhK6mLKakClD/4KWPdijnCZPVyVNypFc9ZSie9Vt1jaVcbuhpzK2SzlgmXhb bZb9oFuDncXKcRbYsnx8orRboeh1ws6cuK4cTqE5UFo4nVQzeroFJ9UqReGcxJIB1HQAliwD dZ3ZHKvRdon0sGOO9aTuc8k7kbnWaLkt80XzZErvGNwteG24QLAk1DHwZKgz8e5Q88bDMYJf DrSsL4f/Iti29UPVE3zVOK17fL1XfY3S5lxYjXxPYuMBSf0t/AylRf5/qX9o9+KWK8AbaesN agk2t21V/2eofud55YiHtV5HotYcRXuVUd8y9bDy3fejCFEv5fvLKKuj2oaFx31dLWTE2gv9 of+EcrDKBKOUozWSKYr7RcF/UhfdHwzTurQeD3UHbKhXcesvBbuoV8XyqbRCPXQ9bTEVWqOl IIrebWozrbkZrIz1I04U19FqC8j7dqutxTfoRxpX5UTgAuq7GY/NRuc1lPJr2v0KcD1oiK4j xF4FfquwPoF/UEtx42C3qN/Rj2IVgk/ZyCSumuhBC/BwExY2hcfhHMeqalokCzqLFtHU7ugs s/2L2pURz8b8K9H4W7z3A/RUk2szsboLrMJyPNm6kBj4pbaL3ukTf65TDRonJuPcTyVu2c25 G3natEDR30I8b4LOUQxYqYfsMbw98PdBH4MuBE+AQ+Gfhb6SvLZ3zKeUXdCTbC7RIbkU3feR XANng0VkpmCVLXcOGiqg2WsG7BVkRBCMlZNagweM2OK4s/Q/jd2KcLdxzn0SyH6jpSiIkXqW yIxpreOXKyLZoOhlWlQ9XifoTaTWQh+Dnh70UHmwzqKWIn1H6SpFr7eicxDOq3BS5P0ynMtZ o7NfcW8Ff94ivcDt37pUW0TR3diqnqkFa5TjlyhGu7rF4HLwFdDusNhvR7s89nVOFvQRsBmO 3VGzw3MqwVHgQXAlqb2w6ndw4txVfBk8F6HusY8q7cyDc0rRPUyunrRRJnmXgZPtCAm9Hnow krNoR/Zozl7wDrBtVK7iWLA3OAT8sqL0W9XA0zmJbY2EhWjeDr8WJCr8mZRid7T9bewxNzWZ C/cLxLNivz+NXGfgn0bbajjHQXZW3nC0sRf2vxHcIXk/CGQPF/QP5mnpXqPwH/JLBE8HSfBR OLIL9g8hMwf8D5X09ugawN+oevx2QYXaoKn+UPCs8oMeyA+Gs0rReUcxHKUYTCT1+8G/SWoC mWx0loM7kclTjG2FNsg8An4Oax3wFh3BvF9gVe/gLeX4pYJtleO87ncRD1wrfdrx832dxZ7X sT1c5Okvi9+kHO8rKu/V+b6k7tDR0v+S1jpchJ4vgdcrxzumtET4TiI5W2Oj9QMtV9E9o3y3 wUaRpSO+oHNWV1VuDeN2C5zutM50kDtLbjfiZAcaRnJf/HZFicDbBUta/iCpnVveEdv6IDNE v4HBW8J4/oi5Ucd2+G3AFBpuNv8udL5qcN9v2SF0vdLO1a1FoqczkvVgb0qZj7YqvcvutMDn l6TdQa7O46v0ToDzpvN/NUodGZndTo7e8T7jysrBNDoPSuonmmqa9JeQnTWOPuvt4Wrp3ze6 Zvi580eNPVdH8ragccUnpsy9TmT+xdki+GtXVi9uifMzjXbpVY7bznldsJ/7T8LxHGlxt4tz TDmOWGvecXS2vdEZraOH95jYfItzi6Re53wTPZp3GJZ0cX6tPd3RVWiLjMqOJ8Os0M1qs/NH Z7Pq1+fd7oOuzFbur/SuifsW9t/iviH4f1yt+036fanub91XRX66+wuhv+n+XMd8T2S8LL07 4f7QFf+7B9zvCt7sPQgtc5xb6T2lPd39kdbXFZvdZbK2d9yHvS9K3pmu1MUdhwducIZq9Lr3 66jlaF8LvMfxmGjzv+hN0PHH+0joB/T3qP0SpcODMudIbHuSN/bPSjs7kbnCkxr5d0NP8h6S sr6hlnjnvHsF/9P7neAMby8c7YMTPPX/L1TebSFXD0/GhLAj9D2KgafoFcJ513sdC7VH53jz oBXL1U6xVufxn6uks8b7EM2C/tdIrfRkJebfiZ5e6FwSSNv5t3pPa7+TWV1HmJ8I/aVgmdJI fsPTWK3w/kDdJR6c3cFysbAFDwwl1zito/9tlfHuYJR4UfnOgeB6HSvw2NNouxKZTdC3BQnG H9l3BNn+U5T+TUYbwWCQ/4muLpT2psJvCSaLJZ7S4QxkLvdlNeXP1lk76O8vEfoFpf2FuiL1 j1o9YJ6ijHKq5wScAHqVotM7mMV6W6LaKQ31nuSpUNrObGVFeiq8DRmdtb8UdhPsFZQqh9Ws 0bV6629ZdV+vq1ynLeuutuG1wrkC/hXRylxX72W6Qpa18VnWxqPgHGFV/J7ykbxeSzTXKApn M6XsY21sV8j3iU/m6k7B7I5latzGGqBBXc16c2O1YBzUFcujiuHZUPas/m9iEkVOvX+TceI/ CtcI/1eh9Cx/V0yi1Dnsj5ddaJYnK4r4aLU2eF9TZcX4iq75jbS7t631JfVV6wyd5VuKwO7C b9TVo9fU0kt0jmmV8cHvxDrzDv2Gl/gSlQ9va50k/D6t32GFIDugRKh5Y+1bpD/6H7S8heZ/ 1xIDjeexdkdA3c9p3aVdroVj90o9aJGva+sExXoHU1tE1nLzac2e7FPU8xkqKS2i38Kcb1sE yXyNAZHR9WFZTO9S5+PbfG1faaPN7K32walWGfYvV0RWnVKMj1CM5Qh/Q+wE9LOKsnbWXaHl nKDtNsEpgR4DrZFm0DBda+fcQRzeAf31WIusZ0JZVelMrCvtucwU/ViHZLDC+SXIOiS6D2/v ntv778+QykrJbAWfBHeDrJDdL0CfA0+BR6PZSvFe1lQWN4Gs82VdpIgG8buiXUGNjmhpO2k/ wZDVVIx502ftFGMuDpn7/IfAEyrpH4o4mnebzhSy7tLVAva7u3ROcbcqeinFlpFRWbMpazZ6 ZqNhNhoOokG0tZbYtZmsYWUvhuV90VkTrQQM978N87jiWmTYs4hm7Nd1hX8anALuU3S3RisB lX/IertFWrblmK4bW3PAvqwkS5SWPLo2nmFXmHqHxGyLUPfjRnZaTutMm+qwv3bYxynfJEHD nSODnjJZj2uqjhLbkB+k8uaVSHIEkaD70wKVaaV1Wk/LmtppPUQuA96DTBl0L00V3Iw2xYl2 jY3OxZTSDD4DZ5uW2MqernWD8lu3UIud8PdZq6K9QzE7kWI4PVh1D2KHMkhzITMIDRuwdqct Hc4h6w3/Nd2hcLekN737HP3ogPZK2WXHdT2jKJIbGNVV5igj6m567inb7wLd7R6I/VT16Hho TsWr4GjPLWCHXmzvX8XqQN07F4TqGaMjoVMJfwGrzXXcj3ob+m32+FO5h7AHXA9/vfKlxUOl 7T0Wxud5jGMLKPEg/IPEFfEmu/Wp3AeQclvsqvV/E6u/B++Hw37H+Tx3unKg/2jjhz3jGGL4 /BMwfabzFeibwBtpNfbs+s6BYHvwCvT8G6k77cpZeqfT0knx3H6wNrQtcgh/EpOyalbOTnCo RrJNlX4v7R5JJsEeyA8kldnN13XgVSrjXsXdyKv0np7wV2nPQkOeLyuK1hOKsneWyHef0zds 3eeUdm70c7hbIivwc4cVW+6FrovPoawd4GRG3VroJugisIpxOBO6QUsPV4L0Eb3TIqn50MOh uesSO6y2RZrxht6rkdo1q4Xavu5z4UjuISj+ifi8UWcBt6iVd41amQtaR4PUt5UZoRWfSJ+Q +JR9ue6I9f5k0bnDyld0eiu6s+D0b9VfRF0ajWDqvRW6P5Ld007da7OHmgOnNziYfdNhm6r9 UfZcKlOv6OcgMweZnlZSZZxr7ZjZMoedl+Ydxb3NrezFaiKdtAJYgc494P3IVJGrCQ0T7Cyj dDiQvA0tS7iPpGtCcrl17ONmgCNbvqtrPzuSk1oj85JYjg0Viv63ZFbUO0ISY94ApWXPnqF2 Il+h8lL6fF3xwqkl7+FI23zsmUpd1M7JaBiOhgLwIHXpxA6uXNFzNZf44V7y4g30TMK22pbt qr9lBTIruLeQTR1V22SNAXcXpU/AtmvRsEvp4Dprs1oikb1YRwzaJR/+eLsvjmq0RBH+Lkpf Eumcz/26YsaBYkYVlZ+MtYPBFHauhq7Xu8FefsshOH9A8zRmyQzotaDsldwXkPktuEv50go7 9H6F0f/RO6ookWO1vaW0Sgq9A9pyXoVTQ7s8Q4zlc/8nA/oK7hlqa57SNxIFVecKLLkWmRrN JW3xByLnBV0jUeLXiNI49k9u9ZA5hMwO8A+02gv44RD0WyDy7N9dtcrbHsUSiMx2UntTSm+0 baUWvbF/K/YM1lSJnw9p9/tBvRswytZLc0kk7IB+AfoF6Ffpg8dp8Q/x51o88wL0C7Tvh3Be BW+kLSopvYbS1eZ6Uhuwql7LFbqSPvghLfUqflNfMXf4OXjgfqxqajlDzLwA2rZ+Bqs07+Xg /TwveF1HLdFTA2odK0HGH/e7SM5TjnOSeeR9cu3Anrc0osS3usbLo44fI/8YXi1XvneranYe 4b70QJV33lFLnBvw4T8h39PSar/zOjGwSePHeUTLlbFLS3wcfBjJCvTYe0G18N+xNWpZxLik 9HNgRyR7E2kzaP1jiv41ePU4nCwk+1FWJyP7a3cYnOXg76KWGswooeMJ92CdgpY7ZR/EffX4 ZawqO7IS3mvHNJX0pmufjXHfMnaZ0sE7aGBVH7QyZg5m/KkB3ye1QjHk7rpTxsphma4n/Yd0 dJV1mGHVqnf+f67oL1UMuQPs7aXc3q1HGdUVX9S80gv0ng/3S73PuwntWSoZ+zyl/Bf8ceAD 4MOsin+APSVgA5asItfVpL4EZyMlrraewR5S3Sr4leAcLV28p5a82/Ka3ktRdFnbOC3Q/Rn3 ftbyDfKqDHet/Wl2btLVr/RfGW/DHaozWE4puYyN9yF5A5bbu7g1wTWKPCN4WHfl7sOBjNjB vbFcwfvAmxTDbEX/BPgs/NPwOyp6jfAd+AuhaxVjXZFJgaWkXg++AbZB8gj0u+AkxfgXoW8l 9RNwO5ws6L7QCehNlI5twecU3SngUVLfxIYfQp9E8h7oYugboUmNwfH3gk+BV6Pz3nhvtR8s VQzeVYy9a72htNdI6heszchQ39j9yHwIfxD1ugH+IfhrsXOl9YPm8j8h72lFWWXheTjG+p9S aqxvKfc9amG99wYajoBNlPIg/KvAk7al0PY59FwHvx020FJBATIvQ/vQA6DxZ7gLOh/NvwHx bUDrxxch81PQA4eR+jOsPQynB0gsBQfg3w3naeieYC9Srcdy4DxAHevAx8GRpCIZEp8hsRoO J5XI8WnloBKsAPPg27K+A+cx6LfJ9Tr4AXWZDBJdiS1ofh75fdSaUmL18IfCJ6//VXA2/GuQ ybWRTItsBzeBJ/H/y+AwWuQ++M/SprSyOwX+QvhvEm9d4VwPpxh6EpJEQvItkN4Ufwd8DRvW UYs/wdkNh/rGiOGgwOYldSN1GUgt8HZAvwsmUKOX4OPDkHb36cuxF6HX472P0VMNpxmkP/qv Kjrfb72TGaed9ildvQf3gTcphtmK/gnwWfin4XdU9BrhO/AXQtcqxroikwJLSb0efANsg+QR 6HfBSYrxL0LfSuon4HY4WdB9oRPQmygd24LPse+YAh4l9U1s+CH0SSTvgS6GvhGa1Bgcfy/4 FHg1fKwKv4B+ahG7n9QP4QzC2hvgH4K/ltJXkspuKKyhrPdAauo3If8gMleB2BZeB90ODXgv KID/MrQPPQCaOoa7oPPR9huQ+ga0SHwRMj8FPXAYqT/DhsNweoC0b3AA/t1wnobuCfYi1dY3 B84D1KUOfBwcSSqSITETEj/hcFJpTR/PB5VgBZgH35b1HTiPQb9NrtfBD6jLZJAWT2xB8/PI 76PWlBKrhz8UPnn9r4Kz4V+DTK5i8i2Q2Iu/A75G6jr0/wnObjhYEt+IzoFoo9YBMRlMQPNL 8KlLiP994jz2IvR6avExeqrhNIPEqv8qbT1Z7yG7FfquiMxljYw2jcwsjcwpjcxijYw/jcw+ jcwUjcxrPA+FvxC6VlHGokbmxEbmxEbGpUbmoEbmskZmokbmykZGqkZGwkbmx0ZmukZGReVk QfeFTkBvonRsk9mqkfFQ8Sipb2LDD6FPInkPdDH0jdCkxuD4e8GnwKvhY1X4BfRTi9j9pH4I ZxDW3gD/EPy1lL5S0RhkwLCGEt8Dqa/fRK4HkbkKxMLwOuh26MGHMvY2Mgso7UMPgKam4S7o fLT9BqTWAe0SX4TMT0EPHEbqz7DhMJweIK0cHIB/N5ynoXuCvUi1tc6B8wB1qQMfB0eSimRI 5IREUTicVNrUx/9BJVgB5sG3ZX0HzmPQb5PrdfAD6jIZpN0TW9D8PPL7qDWlxOrhD4VPXv+r 4Gz41yCTqyjzoCIRGH8HfI3Udej/E5zdcLAkvhGdA9FGrQMiM5iA5pfgU5cQ//tEe+xF6PXU 4mP0VMNpBolY/1XF1lu097WO5S27dbwzk897L3XgVkXnOHScVNe+UQM9H7oKPKPoF0LXgP2C 6+B/T3AW9K3QVdDl0DXQtUo7fcCVit4eywdXg0U2l6IzhLzDlfaWwJ8O5oLruE9Yp28Kefk8 ZcuHc0bRH4tt63iPiPvDbhV0raY6x5V2jivt5cM/A/YL14PV4A5qvR6s1r2w0mK/xWpqZHE9 nsQDcMrhbIRuUPRX4bcQyzdiQx+enVXad5wovci+rQSdqxq8FHQNb5zOguPCqYDOpMQNcMaT 97CtIzgdG6ZT0z54qRP8OvhboxLX0+7KmWXzUuua2DpSq/U+BjEwMnpr62uqAT9X6b1csQ07 4dQgnxn5Vn2eC12JbbXBCFpnl8YP9iyh3NXIHKSUqfadLn3jReqrtTscvQP2PUonlnhvsCKK YSzXu75ebzjbkd9IdKWsfmK7D/zhyJyCft/WiBZpQPIMuAuZFVGqttFm3g3rBuaC5RHnOp4m XIdVUqJ5D/kd8HdgbS74PvZsR7KOeB4QvXv2PSINRGcRGkZBj7f66S+bqcVKbHsYPcPhHwTn Wv8Ev9C7CkoHBxT9pcrx9sAZoXSQB78Qe5aQqxs17QnuR/N+Ld0v1BgQGRvPu2nx3bT+LvxJ m4IbaeuNyGcSOfvRdhv6t8IpJ3UAdJX1idJOmW1f6D7IzCc29qhmbz6cPeGd9O51lHgnbbob vJMovRML7+QJDqMHkVyFziHkGk5kLkFyOtqW6BMHsUqxH5IHwSbVEJ+kGuKuPvcJ94Lr1c5w Bv5vVIwRmTHGz3BZ5MPdjBK7KYW+rOhvoRaDrVXY+aTy45OsHi0x3Ivl/dDQQo9oAsvQs99y oGch00SErKN2/ajXRqKlj/ZQby/ta3WuC4/SU46StwAblB4TPqzPqpCZwxu5Z/WNd/eeoJ+u l8LTwnlDaRmp+mldwBVgIfyVxGoTEVIVdpZSuoWvo83WpTNjuN6ZvI+YrwhuFjo7uFZwbKBv FBTrkyaJxjJGyDKd38E8OEvBhXBmg4sVpR2VXq4YrkRmJ5ykYnwA9Dwkj6F/qNbaWwu9lHcw CvU5lzcHeos+L5P5ooBYKmCELEBnAe2iuWZa1KdgIr9FxwfNJfNXHjW1evZJa/bjLdmhGjP+ Tn1uFRzQp07BIOUEaxRjG7F5qKb6q2yqotDKWWpRJb3tSsuYthcZ1TYbzNMSg3lIFjL6HVP0 C3XklNKzsPkAfSSL+FdcTeoqmwpusaj8WFx94q+iphuQ3KCpgdF3MmUkWSy+zVfLYxVaR/Hw XsYrlV9IWTXUKyTXbJ6uLtHnd0Ev7BxKHZdqtEgrq8cWKt+dpU/0pP9uxvO0LLVeQb0awT3o TCJfAX0gavfN6nNyGXCQzjJSx72UspkYWA5nM74twkvLiai91F3pxVg4Vt8SD95E81jK3USJ G6GXUN/pluZuVZGNRmTq8ORO3qfKo9azY900GjVVLMwi3myEZ6m3I2u19HvQs932gmCQ+gqf zyTClyF5j/o/GIHMFts79A12/6Gov4jO8DitU6s2iLUF+KqMGVz5tE4MD4fVGsNSlpZyWjHk Hfgwi7xr+Y+D6fAHWjvJNSPqd1lYqO2+k2hfpeithT5k7SGWCm0foX8dUpS5L0/f7cT+aWjY h8cGQY8liobzvutIehY9ReblMuavPI09MG77Mnhayw2r0Vym5QZr1HKZYbUujAbeJFs6ljyE TC/y5pDaiXJ3gTaWbibvHHQOhN5k+6xtcSJqLJa/Qk85HckvV9Qn72FnxqJJals8EwtH4f9+ 2N/N9prQJ9J8jWflyNi1F5nlzL/9GEPi9AW8St+fx4iRR/QuZJSYQ7QvhjM2wjJWMjpzrdRc MotlMVoyo6nN4UrsX25HKvSswPMrqMse6D2UmCTy+0WYRX+JY6fW/QSSnazlrHU3MNse04jy JqG5nnjYgPcaVX9yjWpOnFBt8U3gJDu2KCYY8+P34vOZjAbH6GX7bexpO8ZWU5cmbOhL/xqp 8sln0MD/L8T3gJPs6K39UUaAboyr3fBnNzysnLPWNmJ4rPW8HVGx/5iWIiOejiH76AvHmB2O 6Ywg5T4u/PdoheuCIXhMON7vwmJGPF3556jNQcKfrTu1QFcFJ6nFE8xNRKaMpVpuA5IVxOoq xsmr6Uc7gj1CbwqGadSF+nbfD3x9L7RHoDPs0fAB3fcxMu/Hqpd1nvW/7uvo2pM3uo2+rSRY zLsNO3m3QefuWfp/de46nmi7YL4+h/IyeVKzFU5KOc5xOHGeUk2HP593AxbA2QhWRe+EH1Xv Qa8G+5E6C7w1klSs0fe13Fr09AFXwlkNlkflHkVGcTjayjXVy1f0x0Y2qw9nKccZGL29oLXY E5W1SteZyK/CthDNlUgWIZlqPaG1QLNLrorID0qPB9fxhkA/sA6sAqfbUij9OJYXYdVI6z34 feDn2nJtKbbu4HSwBj1boc+Q66A+7fUmoWc7OBU8xbsiq6JSRusKE/kmcLN9GwH7V0RvX1i+ 6u9mWyF6d0LLGq5o3sP/O5B/Hwu3Wx/yJsMALF+PfL8oEmz7qszD0Ll4I1ftEVpLnAt/FpoP KifMUjo4ENGjtY/YN1WUE4xQbUEeLVUYWasa9ttywXXYlgl9K7ifcm+DrotS5/M0dgztPh// ay3mR5GjdCfbUhHOp+3ma7nILLH+pNYHFeO0Qpw+Eu4F1ys/nIF8o2LssHJi2BAuQ3NP4m0L dRxsYwnNT0by6pkyW0f7zg91OQPWtJzCk6foHernvRatH1rnEvkz8PAM4nwu8vXaj9A2R5+D O2eh71E6eJcS34CzAnvO8Kz8ViRHQddC91GUdrFP0gcTJ4OJ1cGUMpgWGUzk12tLgUVwCq0G +lQdz5G7YfOcqI+o5H34hF7mZmPPWKVbR+g7tzJSJU2ds9wE46rHjTedJvxrdZUZNflb46tN ZdW4aXeZqmmTx91uHtK3jb4+sryTjGumtdXEJF/CZJg2pq25TD8JT99I1O8lzja5Js9kyWf9 TyxNMRcol199FV0jvzask367oPB4K4803+RckHRMYNpNmHDnVDMLnAvOA2vBOrBhYtXtt5nV k26/a5xZD75y+123TzNbwO233/3tKrML3CuC48wB8FDVtydUmWPg+3d+a+LtpglsrpZkx4Ah bwnGLqArNUrI1b5D6P4Z5Yu9Ngf/N2My0/CyNMxIw5w0TKa9n5iVhtkR5psrTR8zwAwyw81o U2kmmbvMdDPTzDXzzWJTZ541K81a84rZanaavSbUl17NKryp73lwDZ+hvZ34QBPq/9XER2O7 E6+2lsdnipwj1w32msgSvlyTuxSNk6FvPibkOiK6TrTXnOX2mtdX8sm1/Vabv+CEvXYoFxtE f4dREnt6nWzt6FAdpc+J6i3rfb5B0gil36801AwzJv5S/CU+/Y99R3owRdoyx+ns9vYG+RWm yPQz15shZqS52Yw3U0y1udfMlh6xwCwxz5gG8fJFvzeaw+aEaTJnHd/JlCb1EqcTHyUdrmeS LtePkx7X5qQv148Sp5MB14+SIdczyRjXj5Nxrs3JhHElNSmfzoh0BtePkplczyQv4/pxMotr czJbpM8kc+TTxyLdhutHyVyuZ5JtuX6czOPanGwn0h8n8+VTs0i35/pRsoDrmWQHrh8nC7k2 Jy8X6eY/84j+jt7/a+88oKJYtr1f09Wb1AMioKLkoJKZAckCEk1ECSb0oARFRRARDBhAkgEx YOIgICYQjKCgiGLAiCgqGEHUY8CEIgYM+PWU7RzPOd53313fe/esu9aDRc+u7uqqmn/V/tWu Hihmo0X/LUVUyTt/J6PGKaPOKaPBKaPJKaPF1vNORpvTR4fTRZfTpS+nSz9Okf6cInqcIvqc IgacIoZEESNOEWNOERNOEVNOEQGniJAoYsYpYs4pMoBTxIJTxJJTxOqfKPJX3/yjItacIjac IracInacIgM5ReyJIg6cIo7ciBnEKePEKePMKeNCRowrp48bp487p8tgTpchnCJDOUWGcYoM 5xTx4BTxJIp4cYp4c4r4cIr4coqM4BTx+xcUOYVq0TV0h+xX1I4+8iiejIw/p0gAp0ggp8hI TpFRnCKjiSJjOEXGcooEcYqM4xQZzynyC1EkmFNkAqfIRG7EhHDKhHLKhJERE87pM4nTZzKn TwSnS5ToncpM4XSZyukyjdMlktNl+jdd/mVFnosVieYUmcEpEsMpMpNTJJZTZBZRJI5TJJ5T ZDanyBxOkbmcIvOIIgmcIvM5RRZwiizkFFnEKZJIFEniFFnMKZLMKZLCjZhUTpk0MmLSOWWW cMos5ZRZ9k0Z0V7PonaTOWo1Owfw0XTRR64s/VVRPyRg9XJlZ7tRfHZeksyR3El58Bdylid/ EbGK2XOJnOXJT2KtXJJvMWd58pOJJcqXwlmeZPdBXXY+tWb7w4OdTYNZqseyc2k6P1VcU5q4 pnRxTUvENS0V17RMXNNycU0Z32vir2OtfMkc9tx6zvLkbyBWLntuI2f9Vy1aIW5RprhFK8Ut WiVu0Wpxi9aIW5QlbtFacYuyxS36VdyiHHGLNolbxM5VPBOeCds1Z0V/m8ur59WTWVgO0bQh bST67zkk3Sn6u3qeBk9TdId4Fu9DZnFFUXRED6JdftzVmy1BtM8MRSfQYaLZnw4n+3Kqot93 m1Yi+UX7iKN/YadxdzaakEPKbARhxKZoPBhR1HtiDRVbw4iF2frlkBLJ0U6udpArb8mule1U O1ttByX6/db3JDePl4N6/7VvUAEqYX22Gt1Cv4nCJJ4ST52nxzPjDeS583zYEc3WyMZIFNmp jGbCxFb4d4u6yFobiFUnti6Jrctiq55YXLupK6IU9UC0pzd1HFH8SpLnqjj3NbHV8If7Gsl9 J9hjBnWSPa4lea7/kKcndYqUWsPqsIF9vSEu6abYuiW2boutO2KrSWw1i627YquFWJJsfykj TdbHRTHtQOocW9smtr5zpNZN1BmyX/h5NpXLps+Ts7nUWfZsLnVPXNZ9YlFIklpBrWR7LJ/a zuYspEqQDLWb2o26UXupfUieKqXKkAJ1kDrMjitMRpQSyxbR3oqisdaD29N8M3uhmCpmyyxj 82OqSrSbuGiEU1lk5yXRntWi8c7GZgjIqomNSqhsKhupUTlUDlJnyziGNMh+So5kP6VBZN9p LPlWsoMSrW4wJtVjGSz6yw0+5pPy2By4FX/Ba0QpupFuZEf6TdFf/SKKNwbtxFZYE/fEqlgd 62EjbILNsCVOwsk4FafjpXgFXomz8DqcjXNxAd6Od+ISvBvvxfvxQXwYH8Un8Gl8HtfhK7gR 38LN+D5+hJ/i5/glfoXb8Vf6Il1PX6Ub6Dt0M9alO+lP9Bf6K/AAA4AkMNANFKEXqIAG6EB/ MARTMAcrsAE7sAdHcAIXcIPBMBSGgyd4gy/4wUgYC79ACEyCCIiEGTAL5sB8WAiJkAxLIANW wVrYCJtgM2yDItgF++AAHIIqOAYnoQbOwQW4CJegHq5CA1yHm3Ab7sI9eAAfoUuCkpCSLmX8 mUBmFLOZ2cYUMbuYfcwB5hBTxRxnapgzzDnmAnOJucpcZ24zd5kHzGPmGdPGvGHeM5+Yr6zk knxpvui/FxRiKSzF9oUG1mD7QgfrIAr3xWwciQ2xIZLAxtgYSWIhFiIpbIEtkDROxIlIBi/G ixGDU3AK4uM0nIZk8RK8BMnhDJyBuuFMnInk8Rq2L7vjtXgtUsAb8UakiDfhTSxtNuPNqAfe hrehnrgIF6FeuBgXI2W8C+9CvfEevAf1wfvwPqSCD+ADSBUfwoeQGq7CVUgdH8fHkQauwTVI E5/D55AWvogvIm1cj+uRDm7ADUgX38Q3UV/chJtQP3wP30P98UP8EOmxo6sV6eNn+BkywC/w C2SI23AbMsKv8WtkzI68L8iErqVrkSl9mb6MBPQV+goS0tfoa8iMvk3fRuZ0E92EBtAddAey oD/QH5Al/ZH+iKzoz/RnZE130V3IBkROYQsUUMgOaKDRQJAACWQPMiCDHEAO5JAjKIACGgQ9 oSdygj7QBzmDOqgjF9AGbeQK/aAfcgMDMEDuYAImaDCYgRkaApZgiYaCNVijYWALtmg4DISB yAMcwAF5wiAYhLzAGZyRN7iCK/IBd3BHvjAEhqARMAyGIT/wAA/kD17ghQLAB3xQIIyAEWgk BEIgGgVjYAwaDeNhPBoDE2EiGgvhEI6CYDJMRuNgGkxD4yEaotEvEAuxKBhmw2w0ARIgAU2E BbAAhcAiWIRC2fGdjMIgHdJROCyH5WgSrISVaDJkQRaKgA2wAU2BHMhBUyEf8tE02ApbUSQU QiGaDiVQgqJgL+xF0VAGZWgGVEAFioEjcATNhKNwFMXCCTiBZsEpOIXi4CycRfFwHs6j2VAL tWgO1EEdmguX4TKaB1fgCkqAa3ANzYdGaEQL4AbcQAvhFtxCi6AZmlEitEALSoL7cB8thk7o RMnwBb6gFAmeBA+lSkhKSKI06f3S+1E648f4oSVMABOAljKjmdFoGZPP5KPlzFZmK8pgCplC tIIpYUpQJrOX2YtWMmVMGVrFVDAVaDVzhDmC1jDVTDXKYk4xp9Ba5jRzGq1jzjJn0XrmPHMe bWDqmDq0kbnCXEHZTCPTiH5lbjG3UA7TzDSjTcx95j7KZR4xj1Ae85R5ivKZl8xLtJlpZ9pR AfOOeYe2MB+Zj2gr08V0oW18ik+h7XwJvgTawZfiS6FCvgy7EC8i+6TOxFq4F+6OJbA+NsXm dCFehlfh9fhXnIe34B24FJfjSnyM9bYafAFfwlfxdXwb38UP8GOR/7B3vqHr8GP6OlvCMpAC PsiDEiiDKmiCLuiBEQhgAPjDKAiCYAhlx9EUmA4xEAdz2bJ6QRKkwlJYAathHWRDLhTAdtgJ u2E/HITDdB1UYy04DXeAz75+gq8SGFYwI5kCZjuzk9nN7GcOMoeZo8wJppa5zFxjbjB3mBbm N+YJ85x5xXQwH5jPfMSn+aJ5ZQYhGyJk4xGyUYRpQJgmQZgmSdglRaglTXglQ3jFEF7xCa9k Ca/kCJe6ES7JEy51J1xSIFxSJFxSIlzqQbjUk3CpF+GSMuFSb8KlPoRLKoRLqoRLaoRL6oRI GoRImoRFWoQ/2mQ+1CHk0SVU6Uuo0o9QpT+hih6hij6higGhiiGhihGhijGhigmhiimhioBQ RUgIYEYIYE4IMIAQwIIQwJIQwIoQwJoQwIYQwJYQwI4QYCAhgD0hgAMhgCMhwCBCACdCAGdC ABdCAFdCADdCAHdCgMGEAEMIAYYSAgwjBBhOCOBBCOBJCOBFCOBNCOBDCOBLfHkE8WI/4sX+ xIsDiBcHEi8eSfx3FPHZ0cRnxxCfHUt8Noj47Djis+OJz/5CfDaY+OwE4rMTiYeGEA8NJR4a Rjw0nHjoJOKhk4mHRhAPnUI8dCrx0GnEQyOJh04nHhpFPDSaeOgM4pUxnFdqYyUsiXtjAyzA A3AHXo5X4w04B+fjrbgQl+EKfARX41P4LK7Fl/E1fAPfwS34N/yEjWSes3d20JfwE/oGW8Iy kAZZ6A49oDeogRb0BX0wBiFYQACMhnEwAcLYvp0KUTAT4mEeW5YSLIY0WAaZsAbWw6+QB1tg BxTDHiiFcqikL8FxrA1nWK+UZb3yswS7HIFMZgyzhdnBFDN7mFKmnKlkjjEnmYtMPdPA3GSa mHvMQ6aVecG8Zt4yncwXPo8PfNn/88r/88r/EK/k8STYdYk6u9L9vsI9j66hZvQEtaPP5PmM MntVFxmw6yh2/YbZdTO7JnnPHpNxJ3tMx5/Y4wrpCnZF0yn5iD1+knzCHr9IPmWPX39SwjtS wgdSwkdSwmdSwiFSwmNSQisp4RkpgV3/ST4X5SDWC7H1Umy1ia1XYuu12GoXW2++W/xcsZVH LIr1yLu4BSF2jmbXhew8vQfR7FxdiiTY+bocSbFzLZB9xIeRZ1f90ADy+ZY8E4Vo0Z346XeL biTr/mg29YZdszWRfHJ4IbveYK99e8VPyRpRtJJAZE3AY++8K3oSQp6oSJE1L6sEu77lIR6V /23tiBpk9sns/cmnJTKsTtn0sh+ewMgjoONFT0voufS8H56wiNoP7FXRcxNLsmple5+6QFa+ teKnBL+Jdh0n1kOx9ei7JV0uyv1frqQRqYn37ZMfhFQWkOc85EslTpCkEiMhbZA6JPW9LE+S yk9SCWFP/ULxeEJGIC0BhnKY6gNIMEFCxlCCR/OSrCgene8n8BUY/XBGtUB9kSoaSL690UQ0 E0WhaSgMxbI/DqJvgdYPhdFKJ8ekFLf60juE51NMEl7MeCh7a6VUflLPwYIkWkGQRH3MxxSP orqh42jZwIHp3esd3oU8vztIICtuKY9m2xQtNBToS+AAmlHUdomKnhMTMWlyrKZeiL6m0MbG StMzIiQmamZUeKymS1RMtIlQXaD6LXOPP16JipkQGxE1Xagl0BBdx4rKv18fERUVq+k0K3Zy VExE7ByBei9ZGyuBUCgQWAnYrzG9ZM0EQjNzIZf8G1qUxNP+URYeIJzE64bY8zJUEo+Hiqiq 49GP7Nq9VPTy1s8eL3haUJTR95cPXWs9tpR3bSrQdEjwLfi1IDPYbGq9c+iclyVx5/xvtT/L SVXNzEsOL62ZOneiTqPawOZuvNVP1p06ZhyenT2538bLtkbH+AdG9Tvu/ljGwXqdUZGeTeHz oYudHyR3q8yeFjChJClhc7BxvEfrxrJQu2wfVaGUrlJe0eNVhsqP7DeEKAWPgrA8NasRae93 tGVRp1WuHgtwK12y6Jjtc/8sr91fdsyNjPXao1y7TlpPC41cGRxhVTlcQXJg4Nexn7aGy0ht v5IYOLLtoN34nonx9K13R3cvWtu19+LCxh19YoIGnj/ySmqLtqBUIuVcqWa8YspdSvS/O7Yk FgoStwkSC1g11Xh0YrYgcf0i+bGXo9siYnJ1fBco7fdc8fXC5ph/f/8l/ZMxjkV9uPYJU53x Zr2yxYsKnu6N+O5vgoLN8nKZCw6wKj3znO0jrfZXI9cYHcgffHZi2+frtXZ2Y4os/SO6dCMd z9XubIaEJmGGfZ589JTKLgVv5Yjqz5ddHnQfo+n9dOK8PTt7nzW06mt8NGyzwtK+3UK2vPdX 7dQ619jjzYiS6S5mkl+Sen14OGmarO+7qtcjzlQ9PiX4rCmUTldbq9/Hs0GN2vZ6UQsuG9ux r+nsyJdhQ8+M8D9YhvUUvq5sfCWVuaBifU2xldFvc38rjH8Ql48uT3E8fsVyaYuTQqHFFJUp ty3uXVOlfyt0o8+OMbee7qkqO7FcpmD51QZ/R/eLqgHbo28r2KatmZW340o+S4VgQRL2+EYF GZPi7nd8vgZtulD9nSlqfxcMWL+3NmO/WAKYsTAQmrFJi+8wmEMIyhYioUgF+AkVBd1FCSlF mZETZk6OmD4plq1GXiAnOimpKDkiLDQyanro94bJ/KOG6Qi0vjWsz4/XQ8M0/SImTWdL1fRx cfqnVCifM79xXKmbTeGAEuGtzr4WQ+OrP2nknnGb0Vbv/uTa8pNTPUZM7NhInfS8MXSaqa5D 2LE6nXJmSPnCWU1uVTsz5Xxq+hq25z+W1dGod9L9OHHjpd5u29YM09h4sdRU++Qw44Somz3U 7ZbbyNs0Vel3hNsZ88y+dvUfsv3ANF5azqfD+0MWJnUG5Scmp6zY216RteWS9XaflF7907ya BO+QfcfpTvvEo6kvptnsMBnwrsxkj8z8iatmh+dsmCmbuqf91BvNQ94KGSEXjG6aufV+WTls nZ2Pn3JduO+cnbvSzgY65CX5pE+HfRbH5+lWjQi33+hVa7jAfHryYIn63MvDUqnpqWhrddpd P44KHwWJ7wWKIij0pfkCGQkpdkIDkMT4PwMV3URtVOTxvtIgwOyLQE10Qo7uSSvVqtXFoeix e17fOuWV7etqssU15JWAEV3uRtOsG6X+4DqEMfOKdy8Y1q+97ohXbMGo/rEGs0pTvxR7ZM1G nq3nnynfiaiRK0h4Q7mcPp9W+8Gv9kReVWDUqxDXIlf0ct3Z7AbVCiavt2zW9Vvqu/Tnt73Y PrMks9lmhf2GKUesI6+k79H5cre1MUJ6VXpV1z1UOeDN+4ROeQUTeKa/bo3zVL0Z5daZLZKy 58ZNvli1yGlqeGFleeWKAefbsXzC3LdXWpzvzuu6d6+k693dBtnS6MbVD7wPWhckGF+zvz2A mWhF5SVO0VnyLigkc++YSpvrwcsDkvuYv7XbkJ/EL/hlWalR+eZtF4pvaR48Juidoqkka3Bk RIdTy3jBg9V6EWnHo++/2VFct8g5Jk6OZcxcljETOcZMkOifSCIkqR/9CFjO/I1eLQKONUsa MzOh2QALCxFwBGz4wSbNRUlB4uL/lbbJkoHDDl3a09tnxPfs+B9k/6fsqYopW/JYNS/lTGxF cBC2tM/5snFutr679t4daX4vXrrbnhkLzMjC8vNQe9UjfnB0SunDC3cnPd7yJbb/mkl515di V8Hp9+cOn7NVkwp09e4lJdtZ1nvyTl3VTzAypbXGS1LLasezOiPTg84XtWBH46OreiPPqMyt 07eUvJgbUFv5WvtZoc5WWf0Tny6fHOMQYn/GaCgzb07Kq/S2GVUuYx5sKZV9E/Cpb8t9zauP s8dnbTM31ls4UiVgCt/MtS18WtQr65w2alf25qYNkvJyA5Uj7s/xcldqObT88qzInBKUY+z8 1rdiTMdst8WtJgmGleMu9p6gtyvLRaZmivPXA2a7t+prN/d8cpVjzwdB4tufs+d3L9apn2ng UfXpodbHGeobe9T36jy1fSnpPrVuIq9nHVlyEeGGmg6tLOi56Odu7yrKoEHbC+wENvlW+Rap 5pNjY6NtTU1DYqaZRH7vQ5OQqEjT6KkRorOm0TFRobNCYmeauvixA8+EPSUY8r2FbFwyUGAr sP6eFlCpRlyB8fHxPyswLOaHkmL/5FCEPi76l0Kqpj2YGXly4/VIfrrd6SEz5/atM7pvNW/T gLwqnbqjd28Ezek+VdFXkxdyKOa91IPT830Neupdq3/8q8ElZdkrijNW6T8PrOpsrJE13RNm HOnpph8Yk+zteGWKmtPEojlBK16diV96gdIz2XQmx/DhIQPppufr7z+cmzFePt1vc1Owd/yG GcGFY21WXS1W0IDWk25FV0/4HtpTceezRDLqiN1y+2utWr4OSP7W3+LE+pW9dyYF93/yKdlQ vZ6+sOJSkuz1Qk+XQbOuNDfFty0NmtotLTSz7HD54eJJ/lpuO4dNfuw/fplS0KTZz1cGYflV Upt0Ndc/uYu6Rxd17o+JLt99/0ReT4qlzyaWPinf6CM/hdnoXY36Fne/7aYxau6kgj8z6O+J dSwFNkJLgVAwYICVCD02bPJviHX8IyLDZsZOiIz+78Y6d6ymf9pz1nnYDOWzdUMc/Ko/Fisd NjKrVPAecXbxCwfzm0OFq/UOrgpt0fBJPnxieP1C+NA26+iyM4UNuyOiw2f3D39ysLwt5dDF lzu/KGxlRmvrm14adDOQVok7EBkaOcz/dtPr5mN5i88survQg7LKeludKxWoPnnwxZvVcUGm 8w/2pcsCx05RDfm6KGHgywa6r6dNfKzkuBNBN1KtjGadk3uqbiOdENe1adr0uS3PHTLX586Q +8XAW3lisFnulcVehtpBk92WNZsmy/vs7zzQJ2Pay76/Kn64IH89Ra4jKW6m5em1cwtqgyWe w95U8/IPWWOTnZJHpWRN36thNKQ2KselZcqThf1WTP3GmySeHquI7s+II/WfEe3IS0hzzxt6 8EQhDPoBlFFPvBzXHxpQPDw180jO0xI7J5fTlwW9xTcoUTRfXQb5oVloInJBTn+MhP4SRv0E UFme3YUnEnwqu6/YPEGSJ7c82i2jbaZ/laM0GH+t8PVLUX1hs6p8SyDTvPygnUr9p5Id58r3 +WqpRElFLJiKC7TdX0wri0zQrnC/mvwmo9tRyaWWx58taI0e55a3+kptXdOK6nvHDC4mPD+3 26wh7dCFkFOW9cpax+Ka7bJLVWbmaqXfKCtT8F/ekXMibFi2Xr+c4KXd7M4ohs0eUnlp12Jb 770TRzULWltt1B4sab9lk9ipqLU8dFGIBL2uPZtyMZ3nnn74K3UzrHNY8y0cu6YUpvNrN93R m5Aw5HWvnO5a1pRqWolEzTqzioeDTvvZVxUtaX4SbpXRob0up3ZvvL+vbWOM636ddyygdrKA Wi0Oj7KMSXgk/feFR38BAQmPBFZmFiyazISEUebfkkJRUpBY+u8Ij/oL+n5Lqk93iYieHBaj 6ernpunm52Vr5WRtZmxpbe1kbONuYybsK9D59p5U//iejP1Eb0rTLywmLiIk7J/ibW2ijKaz su/cm2tf/PrlTlr9J7lMxac7rfQU4ro8fYrj1husGdxSFBhBPcxa4Jlye+GMtlnodqXLtE9R JTNeGdYnrK7L6rVpc83hzvcLmibcMxao5/QzjnN85L5uxe4bS6xu1La9uTT25OfJLe2hmb8+ OanQueVo8ufGZXVgX8WL8+mPPySX90zNCD46Tt9o4KVtXzaMsVDz7lltfUN9gqO9ZWmgUo/4 tXbyH9HeNffHWRX3rwwxGqKUGPBg2tMiw7UZ6XILtqBt8bqSGwyicYWB7srs5poC7eHHPEZL xPvHuOx1CG1akyw16mBXa9pQacvS0g/mRQs8CuYsNButL5d74G3LwFzH5+52P4ZTvwNBb236 Mcru2a2sw/Pdu3280LFg09f6P0RKPyXG/0+kFDszOmTC/0ik9L2k2J/D+g/xn0T1z2iFXpZ8 vn8lPfy8/oMxhy6ipAW9gmp0RytUFr6fej2tK+PCgTgNFe137++dLzvkxOtjtWuI1broj7Xm O/SWVzAHYxX1yktn3TOQvr/M++4Gx/XlAxQSn8o3qd05HHrJy8fOY+mX3k19dzesS3s6/NTD V51Ovcbxno1Mnx8392FUV5pmyZqc5dnHfumT30Og21KwYMIqNX39k0NX2rosXvKyuWFxk7eR hd1jJyfeTsRn2huHqtQ5Z8zb+8Y4Y5z+vaMZC1f1iCsL/qTUf2eUQoiz3ijbpXbLBv1WXlO7 eqSqe+DUzAurPQMBnf8gGOTmdbd3etVb+VdNfe7qqZf5tse39HtQKZ2ocEfd9rKbkIRT9EaK xxMkpv2NS7Y/LCR/fwCen3hWoCSenfR4QkkM5DfURHMW15nSWMj/8Zk725rfU4xQTvDj1R4s S8Q30kLWAR637khY4jNizotZD/ndR+nMnl/gO1gw4odb+EJXgXO+8qKeyB9NQJNRFIpkXzWR M3l0H7q53yLdfzhWY+dER02KmRA9eY7mn9hEJ/EQk1seYJvRlllbdvjW/R2zanKKtKMn5n9u Gfkih5Y6WuPbc1z2tpX1kTfqUldQRtVBQZErH+17dqhlaJFn3uEbugZ7jCr2W6glezzmh36a LW03v2DKnoptHt17umwvjBzhUD1r+xFDV6WTb1byH+q/i28rthuhLd+rvLLuXNo+59aX481S Xak1dlqj5nnXbB5109JwcutIl2rhjtwquaUerkEuMb7MKCeDqENX1N7cuXZ6d4dF5J2jKtbR Dbevnr25UDF2Z4hjPdOaf7DufMngTXK8VcpnZU9c2vYYF9vk60bqdaJ7cw0L1lAXH5uGDrnR PamHO0/za+EB6YLLAY5aWXfsHa9W6Kp+Dd2cRGkIkiiV33tEQphE8dlTUv/2AfnnSfIPU7ck NyDzxwmUfxx3zO8fCPHYOsVXQNiNnWJFk6s5+yMUWo75y7C7pu9sMn/gCVenXMYmw2iunM0m K4c/EUo0REady8l94LCOD64NUjZrH5bXbQ7oQ6+RWN7U3j34lYap8oW84R++ZI17tq3hwCOI 2GWxUudSerTvB72cHc8re+1KMavfv61Yd7dUo/LzYHu+d71328EJ1a7lvWYf8npnVDJN5qbT HU2lw1MCXvf7OLvbKw2d5W+LFzyNccpynW76Lse81Xr5IPOMU2sejnTKE5xeplTYVtP/zNqA pZ0N9xVTeoW8to08fE6+3anBMbArgYm3978krZuM3o8LHrxQgT6kultwWPXsm+ErhSVF9gcc tZv2dPPepzG29WWHQ3bU63k5+ckeSx526tlYhMc+uf651bxp6NiHo+KXDNvgdsZTxXLktWzr Xtvb7yH0/wDTrX/oDQplbmRzdHJlYW0NCmVuZG9iag0KNDI5IDAgb2JqDQpbIDI1MCAwIDAg MCAwIDAgMCAwIDMzMyAzMzMgMCAwIDAgMzMzIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgNjExIDAgNjY3IDcyMiA2MTEgNjExIDcyMiA3MjIgMzMzIDAgNjY3IDU1 NiA4MzMgNjY3IDcyMiA2MTEgMCA2MTEgNTAwIDU1NiA3MjIgMCA4MzMgMCAwIDAgMCAwIDAg MCAwIDAgNTAwIDUwMCA0NDQgNTAwIDQ0NCAyNzggNTAwIDUwMCAyNzggMCAwIDI3OCA3MjIg NTAwIDUwMCA1MDAgNTAwIDM4OSAzODkgMjc4IDUwMCA0NDQgMCA0NDQgNDQ0IDM4OV0gDQpl bmRvYmoNCjQzMCAwIG9iag0KWyAyNzhdIA0KZW5kb2JqDQo0MzEgMCBvYmoNCjw8L1R5cGUv WFJlZi9TaXplIDQzMS9XWyAxIDQgMl0gL1Jvb3QgMSAwIFIvSW5mbyA0MTYgMCBSL0lEWzxF MjNDRDkwQzNFMjZCODQzOUI3QjJCODU2MjE3RTExNT48RTIzQ0Q5MEMzRTI2Qjg0MzlCN0Iy Qjg1NjIxN0UxMTU+XSAvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA5MzQ+Pg0Kc3RyZWFt DQp4nC3WeZhNZRzA8fsbMUwbRUWL9k07KiKUpX3XjtQU7XYqStuMpVU7bcpSoUIqadFKykyj FC1UMqQxrWgf1/s594/7ec7z3PPec97zPuf75nL5T01N5L8b5HKbGIa1iYImiTo9E4UNE3UL 0QZrEvWWJIoWJZovT7RolGhpzI6ViU4TEp1nJLpMTfSZnejbK9GvG1Yl+tfGFKxLDFifGDgt MWhyYnD7xBD/V9IbGxKlrqV0bmJEUWJkfUxPjBqTGF2eGDsnMa46MXF8YtKCxMwViVkFiXnt EvO7JioMvahpfvryE9kqeuJiXIKLErlA9svi/HlLO2RHuTooQC1shtqoi0LUM8qljoqwObbE FtgKW6M+GmAbbIvGaIjt0QjbYQc0wY7YCTtjFzTFrq7zMke7YXfsgT2xF/bGftgX+2B/NMMB OBCH4GAchEPRAs1xGFricByBI3EUWqMV2qAtjkY7HIMOaI9jcTw6oSOOQxd0xuk4BSfiBDPY y9HJOAmn4VScga44C2fibJyHc3EOzkc3XIgL0B3WdS5byT1gleeyNVgMaz6XPfDL0RvZPVyB K3EVrkYfXItrcDsGoh/6mpds6AHoj8EYhNtwHYbgBlyPYRiKm3AjbsZw3IpbUIJSjMBojMJI 3IE7cRfuxj1uJZusezEG9+F+PICH8RAexCN4FOMwFo/hSTyBxzEeE/A0nsJEPIPJmIRnMRVT 8Bym4UW8gOcxHS9hJmZgFl7FK3gZs/E65uA1vIG5eAtv4m28h3fxDt7HfMzDB/jQU8lW6wJ8 hI+xEJ+gHGXOy94aX2IRKvAZPsXnWIwl+AJLUYmv8RWW4Rt8h+X4Fj/ge6zASvyO1ViFNfgR 1fgJVViLX/EzfsFv7j2r2jr8gQ1Yj3/wJ/7C3/gf/+I/1Bha40IpQ1NDKUM3Q0xDNyMrpW6G ioZghriFYIZghlKGboZShm6GUoZuhlKGZIV8hlKGfIZghlKGbkYWRd0M3QzdDN0MUQzBDMEM wQylDK0KUQyJDMEM+QwZDMEMwQzBDBkMwQz5DMEMUQzBDPkMwQylDG0MpQypC20MpQwv+NDG UMrQzVDKUMoQxZCCUMoQxZDIEMwQ08iiKJGhhqGNIZ8hiiGRIa0hkSGKIZEhmCGRIYohkSGY IZEhiiGRIYOhm9E9v6GrGpr2g1XLEtVpdxgLmyXKeiTKSxIVjTdRsDKXqEy72IJVixOr04a8 VutiDE+UtU2U53fNGwHARi0mDQplbmRzdHJlYW0NCmVuZG9iag0KeHJlZg0KMCA0MzINCjAw MDAwMDAwNTAgNjU1MzUgZg0KMDAwMDAwMDAxNyAwMDAwMCBuDQowMDAwMDAwMTI1IDAwMDAw IG4NCjAwMDAwMDAyMzcgMDAwMDAgbg0KMDAwMDAwMDUzOCAwMDAwMCBuDQowMDAwMDAxNjMz IDAwMDAwIG4NCjAwMDAwMDE4MTIgMDAwMDAgbg0KMDAwMDAwMjA1NSAwMDAwMCBuDQowMDAw MDAyMTA4IDAwMDAwIG4NCjAwMDAwMDIyODIgMDAwMDAgbg0KMDAwMDAwMjUyMCAwMDAwMCBu DQowMDAwMDAyNzcwIDAwMDAwIG4NCjAwMDAwMTMyNzkgMDAwMDAgbg0KMDAwMDAxMzMzMyAw MDAwMCBuDQowMDAwMDEzNjkzIDAwMDAwIG4NCjAwMDAwMTc2MzggMDAwMDAgbg0KMDAwMDAx NzgyOCAwMDAwMCBuDQowMDAwMDE4MDk4IDAwMDAwIG4NCjAwMDAwMTgzNDggMDAwMDAgbg0K MDAwMDAyODg1NyAwMDAwMCBuDQowMDAwMDI5MDMxIDAwMDAwIG4NCjAwMDAwMjkyNzcgMDAw MDAgbg0KMDAwMDAyOTQxNSAwMDAwMCBuDQowMDAwMDI5NDQ1IDAwMDAwIG4NCjAwMDAwMjk2 MTEgMDAwMDAgbg0KMDAwMDAyOTY4NSAwMDAwMCBuDQowMDAwMDI5OTQyIDAwMDAwIG4NCjAw MDAwMzAxMjUgMDAwMDAgbg0KMDAwMDAzMDM3NSAwMDAwMCBuDQowMDAwMDMwNTI4IDAwMDAw IG4NCjAwMDAwMzA4NDUgMDAwMDAgbg0KMDAwMDAzNDQwOCAwMDAwMCBuDQowMDAwMDM0NTUx IDAwMDAwIG4NCjAwMDAwMzQ1ODEgMDAwMDAgbg0KMDAwMDAzNDc1MiAwMDAwMCBuDQowMDAw MDM0ODI2IDAwMDAwIG4NCjAwMDAwMzUwODggMDAwMDAgbg0KMDAwMDAzNTI0OSAwMDAwMCBu DQowMDAwMDM1NDc0IDAwMDAwIG4NCjAwMDAwMzU3OTEgMDAwMDAgbg0KMDAwMDAzOTYxMSAw MDAwMCBuDQowMDAwMDM5OTE4IDAwMDAwIG4NCjAwMDAwNDI0MDEgMDAwMDAgbg0KMDAwMDA0 MjY5OCAwMDAwMCBuDQowMDAwMDQ2MDUxIDAwMDAwIG4NCjAwMDAwNDYzMzggMDAwMDAgbg0K MDAwMDA1MTAwNyAwMDAwMCBuDQowMDAwMDUxMjg1IDAwMDAwIG4NCjAwMDAwNTM1MTQgMDAw MDAgbg0KMDAwMDA1Mzc5MSAwMDAwMCBuDQowMDAwMDAwMDUxIDY1NTM1IGYNCjAwMDAwMDAw NTIgNjU1MzUgZg0KMDAwMDAwMDA1MyA2NTUzNSBmDQowMDAwMDAwMDU0IDY1NTM1IGYNCjAw MDAwMDAwNTUgNjU1MzUgZg0KMDAwMDAwMDA1NiA2NTUzNSBmDQowMDAwMDAwMDU3IDY1NTM1 IGYNCjAwMDAwMDAwNTggNjU1MzUgZg0KMDAwMDAwMDA1OSA2NTUzNSBmDQowMDAwMDAwMDYw IDY1NTM1IGYNCjAwMDAwMDAwNjEgNjU1MzUgZg0KMDAwMDAwMDA2MiA2NTUzNSBmDQowMDAw MDAwMDYzIDY1NTM1IGYNCjAwMDAwMDAwNjQgNjU1MzUgZg0KMDAwMDAwMDA2NSA2NTUzNSBm DQowMDAwMDAwMDY2IDY1NTM1IGYNCjAwMDAwMDAwNjcgNjU1MzUgZg0KMDAwMDAwMDA2OCA2 NTUzNSBmDQowMDAwMDAwMDY5IDY1NTM1IGYNCjAwMDAwMDAwNzAgNjU1MzUgZg0KMDAwMDAw MDA3MSA2NTUzNSBmDQowMDAwMDAwMDcyIDY1NTM1IGYNCjAwMDAwMDAwNzMgNjU1MzUgZg0K MDAwMDAwMDA3NCA2NTUzNSBmDQowMDAwMDAwMDc1IDY1NTM1IGYNCjAwMDAwMDAwNzYgNjU1 MzUgZg0KMDAwMDAwMDA3NyA2NTUzNSBmDQowMDAwMDAwMDc4IDY1NTM1IGYNCjAwMDAwMDAw NzkgNjU1MzUgZg0KMDAwMDAwMDA4MCA2NTUzNSBmDQowMDAwMDAwMDgxIDY1NTM1IGYNCjAw MDAwMDAwODIgNjU1MzUgZg0KMDAwMDAwMDA4MyA2NTUzNSBmDQowMDAwMDAwMDg0IDY1NTM1 IGYNCjAwMDAwMDAwODUgNjU1MzUgZg0KMDAwMDAwMDA4NiA2NTUzNSBmDQowMDAwMDAwMDg3 IDY1NTM1IGYNCjAwMDAwMDAwODggNjU1MzUgZg0KMDAwMDAwMDA4OSA2NTUzNSBmDQowMDAw MDAwMDkwIDY1NTM1IGYNCjAwMDAwMDAwOTEgNjU1MzUgZg0KMDAwMDAwMDA5MiA2NTUzNSBm DQowMDAwMDAwMDkzIDY1NTM1IGYNCjAwMDAwMDAwOTQgNjU1MzUgZg0KMDAwMDAwMDA5NSA2 NTUzNSBmDQowMDAwMDAwMDk2IDY1NTM1IGYNCjAwMDAwMDAwOTcgNjU1MzUgZg0KMDAwMDAw MDA5OCA2NTUzNSBmDQowMDAwMDAwMDk5IDY1NTM1IGYNCjAwMDAwMDAxMDAgNjU1MzUgZg0K MDAwMDAwMDEwMSA2NTUzNSBmDQowMDAwMDAwMTAyIDY1NTM1IGYNCjAwMDAwMDAxMDMgNjU1 MzUgZg0KMDAwMDAwMDEwNCA2NTUzNSBmDQowMDAwMDAwMTA1IDY1NTM1IGYNCjAwMDAwMDAx MDYgNjU1MzUgZg0KMDAwMDAwMDEwNyA2NTUzNSBmDQowMDAwMDAwMTA4IDY1NTM1IGYNCjAw MDAwMDAxMDkgNjU1MzUgZg0KMDAwMDAwMDExMCA2NTUzNSBmDQowMDAwMDAwMTExIDY1NTM1 IGYNCjAwMDAwMDAxMTIgNjU1MzUgZg0KMDAwMDAwMDExMyA2NTUzNSBmDQowMDAwMDAwMTE0 IDY1NTM1IGYNCjAwMDAwMDAxMTUgNjU1MzUgZg0KMDAwMDAwMDExNiA2NTUzNSBmDQowMDAw MDAwMTE3IDY1NTM1IGYNCjAwMDAwMDAxMTggNjU1MzUgZg0KMDAwMDAwMDExOSA2NTUzNSBm DQowMDAwMDAwMTIwIDY1NTM1IGYNCjAwMDAwMDAxMjEgNjU1MzUgZg0KMDAwMDAwMDEyMiA2 NTUzNSBmDQowMDAwMDAwMTIzIDY1NTM1IGYNCjAwMDAwMDAxMjQgNjU1MzUgZg0KMDAwMDAw MDEyNSA2NTUzNSBmDQowMDAwMDAwMTI2IDY1NTM1IGYNCjAwMDAwMDAxMjcgNjU1MzUgZg0K MDAwMDAwMDEyOCA2NTUzNSBmDQowMDAwMDAwMTI5IDY1NTM1IGYNCjAwMDAwMDAxMzAgNjU1 MzUgZg0KMDAwMDAwMDEzMSA2NTUzNSBmDQowMDAwMDAwMTMyIDY1NTM1IGYNCjAwMDAwMDAx MzMgNjU1MzUgZg0KMDAwMDAwMDEzNCA2NTUzNSBmDQowMDAwMDAwMTM1IDY1NTM1IGYNCjAw MDAwMDAxMzYgNjU1MzUgZg0KMDAwMDAwMDEzNyA2NTUzNSBmDQowMDAwMDAwMTM4IDY1NTM1 IGYNCjAwMDAwMDAxMzkgNjU1MzUgZg0KMDAwMDAwMDE0MCA2NTUzNSBmDQowMDAwMDAwMTQx IDY1NTM1IGYNCjAwMDAwMDAxNDIgNjU1MzUgZg0KMDAwMDAwMDE0MyA2NTUzNSBmDQowMDAw MDAwMTQ0IDY1NTM1IGYNCjAwMDAwMDAxNDUgNjU1MzUgZg0KMDAwMDAwMDE0NiA2NTUzNSBm DQowMDAwMDAwMTQ3IDY1NTM1IGYNCjAwMDAwMDAxNDggNjU1MzUgZg0KMDAwMDAwMDE0OSA2 NTUzNSBmDQowMDAwMDAwMTUwIDY1NTM1IGYNCjAwMDAwMDAxNTEgNjU1MzUgZg0KMDAwMDAw MDE1MiA2NTUzNSBmDQowMDAwMDAwMTUzIDY1NTM1IGYNCjAwMDAwMDAxNTQgNjU1MzUgZg0K MDAwMDAwMDE1NSA2NTUzNSBmDQowMDAwMDAwMTU2IDY1NTM1IGYNCjAwMDAwMDAxNTcgNjU1 MzUgZg0KMDAwMDAwMDE1OCA2NTUzNSBmDQowMDAwMDAwMTU5IDY1NTM1IGYNCjAwMDAwMDAx NjAgNjU1MzUgZg0KMDAwMDAwMDE2MSA2NTUzNSBmDQowMDAwMDAwMTYyIDY1NTM1IGYNCjAw MDAwMDAxNjMgNjU1MzUgZg0KMDAwMDAwMDE2NCA2NTUzNSBmDQowMDAwMDAwMTY1IDY1NTM1 IGYNCjAwMDAwMDAxNjYgNjU1MzUgZg0KMDAwMDAwMDE2NyA2NTUzNSBmDQowMDAwMDAwMTY4 IDY1NTM1IGYNCjAwMDAwMDAxNjkgNjU1MzUgZg0KMDAwMDAwMDE3MCA2NTUzNSBmDQowMDAw MDAwMTcxIDY1NTM1IGYNCjAwMDAwMDAxNzIgNjU1MzUgZg0KMDAwMDAwMDE3MyA2NTUzNSBm DQowMDAwMDAwMTc0IDY1NTM1IGYNCjAwMDAwMDAxNzUgNjU1MzUgZg0KMDAwMDAwMDE3NiA2 NTUzNSBmDQowMDAwMDAwMTc3IDY1NTM1IGYNCjAwMDAwMDAxNzggNjU1MzUgZg0KMDAwMDAw MDE3OSA2NTUzNSBmDQowMDAwMDAwMTgwIDY1NTM1IGYNCjAwMDAwMDAxODEgNjU1MzUgZg0K MDAwMDAwMDE4MiA2NTUzNSBmDQowMDAwMDAwMTgzIDY1NTM1IGYNCjAwMDAwMDAxODQgNjU1 MzUgZg0KMDAwMDAwMDE4NSA2NTUzNSBmDQowMDAwMDAwMTg2IDY1NTM1IGYNCjAwMDAwMDAx ODcgNjU1MzUgZg0KMDAwMDAwMDE4OCA2NTUzNSBmDQowMDAwMDAwMTg5IDY1NTM1IGYNCjAw MDAwMDAxOTAgNjU1MzUgZg0KMDAwMDAwMDE5MSA2NTUzNSBmDQowMDAwMDAwMTkyIDY1NTM1 IGYNCjAwMDAwMDAxOTMgNjU1MzUgZg0KMDAwMDAwMDE5NCA2NTUzNSBmDQowMDAwMDAwMTk1 IDY1NTM1IGYNCjAwMDAwMDAxOTYgNjU1MzUgZg0KMDAwMDAwMDE5NyA2NTUzNSBmDQowMDAw MDAwMTk4IDY1NTM1IGYNCjAwMDAwMDAxOTkgNjU1MzUgZg0KMDAwMDAwMDIwMCA2NTUzNSBm DQowMDAwMDAwMjAxIDY1NTM1IGYNCjAwMDAwMDAyMDIgNjU1MzUgZg0KMDAwMDAwMDIwMyA2 NTUzNSBmDQowMDAwMDAwMjA0IDY1NTM1IGYNCjAwMDAwMDAyMDUgNjU1MzUgZg0KMDAwMDAw MDIwNiA2NTUzNSBmDQowMDAwMDAwMjA3IDY1NTM1IGYNCjAwMDAwMDAyMDggNjU1MzUgZg0K MDAwMDAwMDIwOSA2NTUzNSBmDQowMDAwMDAwMjEwIDY1NTM1IGYNCjAwMDAwMDAyMTEgNjU1 MzUgZg0KMDAwMDAwMDIxMiA2NTUzNSBmDQowMDAwMDAwMjEzIDY1NTM1IGYNCjAwMDAwMDAy MTQgNjU1MzUgZg0KMDAwMDAwMDIxNSA2NTUzNSBmDQowMDAwMDAwMjE2IDY1NTM1IGYNCjAw MDAwMDAyMTcgNjU1MzUgZg0KMDAwMDAwMDIxOCA2NTUzNSBmDQowMDAwMDAwMjE5IDY1NTM1 IGYNCjAwMDAwMDAyMjAgNjU1MzUgZg0KMDAwMDAwMDIyMSA2NTUzNSBmDQowMDAwMDAwMjIy IDY1NTM1IGYNCjAwMDAwMDAyMjMgNjU1MzUgZg0KMDAwMDAwMDIyNCA2NTUzNSBmDQowMDAw MDAwMjI1IDY1NTM1IGYNCjAwMDAwMDAyMjYgNjU1MzUgZg0KMDAwMDAwMDIyNyA2NTUzNSBm DQowMDAwMDAwMjI4IDY1NTM1IGYNCjAwMDAwMDAyMjkgNjU1MzUgZg0KMDAwMDAwMDIzMCA2 NTUzNSBmDQowMDAwMDAwMjMxIDY1NTM1IGYNCjAwMDAwMDAyMzIgNjU1MzUgZg0KMDAwMDAw MDIzMyA2NTUzNSBmDQowMDAwMDAwMjM0IDY1NTM1IGYNCjAwMDAwMDAyMzUgNjU1MzUgZg0K MDAwMDAwMDIzNiA2NTUzNSBmDQowMDAwMDAwMjM3IDY1NTM1IGYNCjAwMDAwMDAyMzggNjU1 MzUgZg0KMDAwMDAwMDIzOSA2NTUzNSBmDQowMDAwMDAwMjQwIDY1NTM1IGYNCjAwMDAwMDAy NDEgNjU1MzUgZg0KMDAwMDAwMDI0MiA2NTUzNSBmDQowMDAwMDAwMjQzIDY1NTM1IGYNCjAw MDAwMDAyNDQgNjU1MzUgZg0KMDAwMDAwMDI0NSA2NTUzNSBmDQowMDAwMDAwMjQ2IDY1NTM1 IGYNCjAwMDAwMDAyNDcgNjU1MzUgZg0KMDAwMDAwMDI0OCA2NTUzNSBmDQowMDAwMDAwMjQ5 IDY1NTM1IGYNCjAwMDAwMDAyNTAgNjU1MzUgZg0KMDAwMDAwMDI1MSA2NTUzNSBmDQowMDAw MDAwMjUyIDY1NTM1IGYNCjAwMDAwMDAyNTMgNjU1MzUgZg0KMDAwMDAwMDI1NCA2NTUzNSBm DQowMDAwMDAwMjU1IDY1NTM1IGYNCjAwMDAwMDAyNTYgNjU1MzUgZg0KMDAwMDAwMDI1NyA2 NTUzNSBmDQowMDAwMDAwMjU4IDY1NTM1IGYNCjAwMDAwMDAyNTkgNjU1MzUgZg0KMDAwMDAw MDI2MCA2NTUzNSBmDQowMDAwMDAwMjYxIDY1NTM1IGYNCjAwMDAwMDAyNjIgNjU1MzUgZg0K MDAwMDAwMDI2MyA2NTUzNSBmDQowMDAwMDAwMjY0IDY1NTM1IGYNCjAwMDAwMDAyNjUgNjU1 MzUgZg0KMDAwMDAwMDI2NiA2NTUzNSBmDQowMDAwMDAwMjY3IDY1NTM1IGYNCjAwMDAwMDAy NjggNjU1MzUgZg0KMDAwMDAwMDI2OSA2NTUzNSBmDQowMDAwMDAwMjcwIDY1NTM1IGYNCjAw MDAwMDAyNzEgNjU1MzUgZg0KMDAwMDAwMDI3MiA2NTUzNSBmDQowMDAwMDAwMjczIDY1NTM1 IGYNCjAwMDAwMDAyNzQgNjU1MzUgZg0KMDAwMDAwMDI3NSA2NTUzNSBmDQowMDAwMDAwMjc2 IDY1NTM1IGYNCjAwMDAwMDAyNzcgNjU1MzUgZg0KMDAwMDAwMDI3OCA2NTUzNSBmDQowMDAw MDAwMjc5IDY1NTM1IGYNCjAwMDAwMDAyODAgNjU1MzUgZg0KMDAwMDAwMDI4MSA2NTUzNSBm DQowMDAwMDAwMjgyIDY1NTM1IGYNCjAwMDAwMDAyODMgNjU1MzUgZg0KMDAwMDAwMDI4NCA2 NTUzNSBmDQowMDAwMDAwMjg1IDY1NTM1IGYNCjAwMDAwMDAyODYgNjU1MzUgZg0KMDAwMDAw MDI4NyA2NTUzNSBmDQowMDAwMDAwMjg4IDY1NTM1IGYNCjAwMDAwMDAyODkgNjU1MzUgZg0K MDAwMDAwMDI5MCA2NTUzNSBmDQowMDAwMDAwMjkxIDY1NTM1IGYNCjAwMDAwMDAyOTIgNjU1 MzUgZg0KMDAwMDAwMDI5MyA2NTUzNSBmDQowMDAwMDAwMjk0IDY1NTM1IGYNCjAwMDAwMDAy OTUgNjU1MzUgZg0KMDAwMDAwMDI5NiA2NTUzNSBmDQowMDAwMDAwMjk3IDY1NTM1IGYNCjAw MDAwMDAyOTggNjU1MzUgZg0KMDAwMDAwMDI5OSA2NTUzNSBmDQowMDAwMDAwMzAwIDY1NTM1 IGYNCjAwMDAwMDAzMDEgNjU1MzUgZg0KMDAwMDAwMDMwMiA2NTUzNSBmDQowMDAwMDAwMzAz IDY1NTM1IGYNCjAwMDAwMDAzMDQgNjU1MzUgZg0KMDAwMDAwMDMwNSA2NTUzNSBmDQowMDAw MDAwMzA2IDY1NTM1IGYNCjAwMDAwMDAzMDcgNjU1MzUgZg0KMDAwMDAwMDMwOCA2NTUzNSBm DQowMDAwMDAwMzA5IDY1NTM1IGYNCjAwMDAwMDAzMTAgNjU1MzUgZg0KMDAwMDAwMDMxMSA2 NTUzNSBmDQowMDAwMDAwMzEyIDY1NTM1IGYNCjAwMDAwMDAzMTMgNjU1MzUgZg0KMDAwMDAw MDMxNCA2NTUzNSBmDQowMDAwMDAwMzE1IDY1NTM1IGYNCjAwMDAwMDAzMTYgNjU1MzUgZg0K MDAwMDAwMDMxNyA2NTUzNSBmDQowMDAwMDAwMzE4IDY1NTM1IGYNCjAwMDAwMDAzMTkgNjU1 MzUgZg0KMDAwMDAwMDMyMCA2NTUzNSBmDQowMDAwMDAwMzIxIDY1NTM1IGYNCjAwMDAwMDAz MjIgNjU1MzUgZg0KMDAwMDAwMDMyMyA2NTUzNSBmDQowMDAwMDAwMzI0IDY1NTM1IGYNCjAw MDAwMDAzMjUgNjU1MzUgZg0KMDAwMDAwMDMyNiA2NTUzNSBmDQowMDAwMDAwMzI3IDY1NTM1 IGYNCjAwMDAwMDAzMjggNjU1MzUgZg0KMDAwMDAwMDMyOSA2NTUzNSBmDQowMDAwMDAwMzMw IDY1NTM1IGYNCjAwMDAwMDAzMzEgNjU1MzUgZg0KMDAwMDAwMDMzMiA2NTUzNSBmDQowMDAw MDAwMzMzIDY1NTM1IGYNCjAwMDAwMDAzMzQgNjU1MzUgZg0KMDAwMDAwMDMzNSA2NTUzNSBm DQowMDAwMDAwMzM2IDY1NTM1IGYNCjAwMDAwMDAzMzcgNjU1MzUgZg0KMDAwMDAwMDMzOCA2 NTUzNSBmDQowMDAwMDAwMzM5IDY1NTM1IGYNCjAwMDAwMDAzNDAgNjU1MzUgZg0KMDAwMDAw MDM0MSA2NTUzNSBmDQowMDAwMDAwMzQyIDY1NTM1IGYNCjAwMDAwMDAzNDMgNjU1MzUgZg0K MDAwMDAwMDM0NCA2NTUzNSBmDQowMDAwMDAwMzQ1IDY1NTM1IGYNCjAwMDAwMDAzNDYgNjU1 MzUgZg0KMDAwMDAwMDM0NyA2NTUzNSBmDQowMDAwMDAwMzQ4IDY1NTM1IGYNCjAwMDAwMDAz NDkgNjU1MzUgZg0KMDAwMDAwMDM1MCA2NTUzNSBmDQowMDAwMDAwMzUxIDY1NTM1IGYNCjAw MDAwMDAzNTIgNjU1MzUgZg0KMDAwMDAwMDM1MyA2NTUzNSBmDQowMDAwMDAwMzU0IDY1NTM1 IGYNCjAwMDAwMDAzNTUgNjU1MzUgZg0KMDAwMDAwMDM1NiA2NTUzNSBmDQowMDAwMDAwMzU3 IDY1NTM1IGYNCjAwMDAwMDAzNTggNjU1MzUgZg0KMDAwMDAwMDM1OSA2NTUzNSBmDQowMDAw MDAwMzYwIDY1NTM1IGYNCjAwMDAwMDAzNjEgNjU1MzUgZg0KMDAwMDAwMDM2MiA2NTUzNSBm DQowMDAwMDAwMzYzIDY1NTM1IGYNCjAwMDAwMDAzNjQgNjU1MzUgZg0KMDAwMDAwMDM2NSA2 NTUzNSBmDQowMDAwMDAwMzY2IDY1NTM1IGYNCjAwMDAwMDAzNjcgNjU1MzUgZg0KMDAwMDAw MDM2OCA2NTUzNSBmDQowMDAwMDAwMzY5IDY1NTM1IGYNCjAwMDAwMDAzNzAgNjU1MzUgZg0K MDAwMDAwMDM3MSA2NTUzNSBmDQowMDAwMDAwMzcyIDY1NTM1IGYNCjAwMDAwMDAzNzMgNjU1 MzUgZg0KMDAwMDAwMDM3NCA2NTUzNSBmDQowMDAwMDAwMzc1IDY1NTM1IGYNCjAwMDAwMDAz NzYgNjU1MzUgZg0KMDAwMDAwMDM3NyA2NTUzNSBmDQowMDAwMDAwMzc4IDY1NTM1IGYNCjAw MDAwMDAzNzkgNjU1MzUgZg0KMDAwMDAwMDM4MCA2NTUzNSBmDQowMDAwMDAwMzgxIDY1NTM1 IGYNCjAwMDAwMDAzODIgNjU1MzUgZg0KMDAwMDAwMDM4MyA2NTUzNSBmDQowMDAwMDAwMzg0 IDY1NTM1IGYNCjAwMDAwMDAzODUgNjU1MzUgZg0KMDAwMDAwMDM4NiA2NTUzNSBmDQowMDAw MDAwMzg3IDY1NTM1IGYNCjAwMDAwMDAzODggNjU1MzUgZg0KMDAwMDAwMDM4OSA2NTUzNSBm DQowMDAwMDAwMzkwIDY1NTM1IGYNCjAwMDAwMDAzOTEgNjU1MzUgZg0KMDAwMDAwMDM5MiA2 NTUzNSBmDQowMDAwMDAwMzkzIDY1NTM1IGYNCjAwMDAwMDAzOTQgNjU1MzUgZg0KMDAwMDAw MDM5NSA2NTUzNSBmDQowMDAwMDAwMzk2IDY1NTM1IGYNCjAwMDAwMDAzOTcgNjU1MzUgZg0K MDAwMDAwMDM5OCA2NTUzNSBmDQowMDAwMDAwMzk5IDY1NTM1IGYNCjAwMDAwMDA0MDAgNjU1 MzUgZg0KMDAwMDAwMDQwMSA2NTUzNSBmDQowMDAwMDAwNDAyIDY1NTM1IGYNCjAwMDAwMDA0 MDMgNjU1MzUgZg0KMDAwMDAwMDQwNCA2NTUzNSBmDQowMDAwMDAwNDA1IDY1NTM1IGYNCjAw MDAwMDA0MDYgNjU1MzUgZg0KMDAwMDAwMDQwNyA2NTUzNSBmDQowMDAwMDAwNDA4IDY1NTM1 IGYNCjAwMDAwMDA0MDkgNjU1MzUgZg0KMDAwMDAwMDQxMCA2NTUzNSBmDQowMDAwMDAwNDEx IDY1NTM1IGYNCjAwMDAwMDA0MTIgNjU1MzUgZg0KMDAwMDAwMDQxMyA2NTUzNSBmDQowMDAw MDAwNDE0IDY1NTM1IGYNCjAwMDAwMDA0MTUgNjU1MzUgZg0KMDAwMDAwMDAwMCA2NTUzNSBm DQowMDAwMDYwNTQwIDAwMDAwIG4NCjAwMDAwNjA2MzggMDAwMDAgbg0KMDAwMDA2MDkzOCAw MDAwMCBuDQowMDAwMTE4MDU5IDAwMDAwIG4NCjAwMDAxMTgzNjcgMDAwMDAgbg0KMDAwMDEx ODY2MiAwMDAwMCBuDQowMDAwMTE5MDY1IDAwMDAwIG4NCjAwMDAxODk2OTYgMDAwMDAgbg0K MDAwMDE5MDA3NyAwMDAwMCBuDQowMDAwMTkwNDIxIDAwMDAwIG4NCjAwMDAxOTA3MDEgMDAw MDAgbg0KMDAwMDIxMTU1NiAwMDAwMCBuDQowMDAwMjExNTg0IDAwMDAwIG4NCjAwMDAyNDk0 MDUgMDAwMDAgbg0KMDAwMDI0OTcwMyAwMDAwMCBuDQowMDAwMjQ5NzMxIDAwMDAwIG4NCnRy YWlsZXINCjw8L1NpemUgNDMyL1Jvb3QgMSAwIFIvSW5mbyA0MTYgMCBSL0lEWzxFMjNDRDkw QzNFMjZCODQzOUI3QjJCODU2MjE3RTExNT48RTIzQ0Q5MEMzRTI2Qjg0MzlCN0IyQjg1NjIx N0UxMTU+XSA+Pg0Kc3RhcnR4cmVmDQoyNTA4NjkNCiUlRU9GDQp4cmVmDQowIDANCnRyYWls ZXINCjw8L1NpemUgNDMyL1Jvb3QgMSAwIFIvSW5mbyA0MTYgMCBSL0lEWzxFMjNDRDkwQzNF MjZCODQzOUI3QjJCODU2MjE3RTExNT48RTIzQ0Q5MEMzRTI2Qjg0MzlCN0IyQjg1NjIxN0Ux MTU+XSAvUHJldiAyNTA4NjkvWFJlZlN0bSAyNDk3MzE+Pg0Kc3RhcnR4cmVmDQoyNTk2NzAN CiUlRU9G --------------030354029FF7DC07ACD6C14F-- From nobody Wed Mar 7 17:10:31 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BC0B126CB6 for ; Wed, 7 Mar 2018 17:10:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H8nswZhwfZdE for ; Wed, 7 Mar 2018 17:10:27 -0800 (PST) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87B0D12008A for ; Wed, 7 Mar 2018 17:10:27 -0800 (PST) Received: by mail-qt0-x235.google.com with SMTP id v90so4948617qte.12 for ; Wed, 07 Mar 2018 17:10:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8EGk6Ssi+cTYezoH5xoJnSKHnGQxxfg7FJLvEd2fyLQ=; b=LAgiV47oPXGqWFQYOJCVlzsHIsCOKOsFxzCY095xhZ9dJeR+Nvcy9XZAaTiy8nxzHK bZZusJ85WKdnYyFl62eMQuRfImR4RnSifSlhCUletgEjrSb0m7WlquOnvJ3re68EL8Og hx/kjGKX0kMoPTWe/M6ovKZQNxHA4FGYXywGE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8EGk6Ssi+cTYezoH5xoJnSKHnGQxxfg7FJLvEd2fyLQ=; b=jb12Ch8WC1P6yuixUKwE+LkmEMgDZxQyvz/41Fi8KHBJSORSA4X5ot7w9h6/kqIWm3 CKWH5eayDWrZiaD+x2FdCVsHK21lnF9EfrjTlo+AlDTsp4z/dzdiYb4rk4KJNs0jA2HA PIIvORMI+Rk94fzepf1gnqSY15yb3PwYBgo0JB9pKrbIZTTtPNdeP/cSPm++JInu1SP+ E0VkQWaJPcLkn1K78BubWkjcrbT2Ol9B4+p+0PtYi5fjjMUyuvxUFHy1PgLsG9H7xDMQ VTRVnK4/P0e+OJsGIlpRsylA8YkwOTs7UNBu6y7V9GHu8S2JQy3Qpba18DuDkn/81IXE fY7Q== X-Gm-Message-State: AElRT7FTrg5r+0ntZRYQ0DkAzWG8RNGt9C/bLDAOgN5ahxcPAv69QkVm SiqJ4roL1SbKDpCqj6cvm1ZfTw== X-Google-Smtp-Source: AG47ELvl8+DM6RKxR0/Na/z6ncmheVFQxsNy7BeR0Q/0zTgGpX68f3pTR75RQK2kWWJNRgANnKo9dA== X-Received: by 10.200.50.75 with SMTP id y11mr36671912qta.153.1520471426576; Wed, 07 Mar 2018 17:10:26 -0800 (PST) Received: from [172.16.0.18] ([96.231.225.106]) by smtp.gmail.com with ESMTPSA id z9sm13104183qtb.49.2018.03.07.17.10.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Mar 2018 17:10:25 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) From: Sean Turner In-Reply-To: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> Date: Wed, 7 Mar 2018 20:10:24 -0500 Cc: SPASM Content-Transfer-Encoding: quoted-printable Message-Id: <85B71AC7-C4E8-4D02-8909-001D454E446F@sn3rd.com> References: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> To: Russ Housley X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [lamps] Adoption call for draft-hoffman-andrews-caa-simplification X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Mar 2018 01:10:29 -0000 I believe we should adopt this draft to begin work on obsoleting = RFC6844. I agree with Paul about a section/appendix that says here=E2=80=99= s what was changed. spt. > On Feb 24, 2018, at 14:28, Russ Housley wrote: >=20 > Should draft-hoffman-andrews-caa-simplification be adopted by the = LAMPS WG as the starting point for rfc6844bis? >=20 > Please voice you opinion by March 10th. >=20 > Russ >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Mar 8 10:58:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E0C4127076 for ; Thu, 8 Mar 2018 10:58:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dgWqt4B_meiW for ; Thu, 8 Mar 2018 10:58:19 -0800 (PST) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39B9C1201F8 for ; Thu, 8 Mar 2018 10:58:19 -0800 (PST) Received: from [10.47.60.100] (138-196.icannmeeting.org [199.91.196.138]) (authenticated bits=0) by mail.proper.com (8.15.2/8.15.2) with ESMTPSA id w28IvlDO049290 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 8 Mar 2018 11:57:49 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 138-196.icannmeeting.org [199.91.196.138] claimed to be [10.47.60.100] From: "Paul Hoffman" To: "Michael Jenkins" Cc: spasm@ietf.org Date: Thu, 08 Mar 2018 14:58:15 -0400 X-Mailer: MailMate (1.10r5443) Message-ID: In-Reply-To: <19dbe3c2-dd6b-5313-7663-e85aba7c65c3@tycho.ncsc.mil> References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> <19dbe3c2-dd6b-5313-7663-e85aba7c65c3@tycho.ncsc.mil> MIME-Version: 1.0 Content-Type: text/plain; format=flowed Archived-At: Subject: Re: [lamps] [Non-DoD Source] Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Mar 2018 18:58:21 -0000 Humorously, you have now caused a better URL for that document to appear. Your message is archived at: https://mailarchive.ietf.org/arch/msg/spasm/e6Lprn5oXI4bFdP4SYAUhksMIh4 The attachment itself is at: https://mailarchive.ietf.org/arch/attach/spasm/pdf2BY7gK.pdf According to the design of the mail archive, you should be able to use either of those URLs forever. --Paul Hoffman From nobody Thu Mar 8 16:24:41 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60470124B18 for ; Thu, 8 Mar 2018 16:24:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TfXbvWmmhYq9 for ; Thu, 8 Mar 2018 16:24:38 -0800 (PST) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66184120727 for ; Thu, 8 Mar 2018 16:24:38 -0800 (PST) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip1.isaracorp.com with ESMTP; 09 Mar 2018 00:31:18 +0000 Received: from mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) by mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Thu, 8 Mar 2018 19:24:36 -0500 Received: from mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f]) by mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f%12]) with mapi id 15.00.1044.021; Thu, 8 Mar 2018 19:24:36 -0500 From: Daniel Van Geest To: Russ Housley , SPASM Thread-Topic: [lamps] draft-housley-cms-mix-with-psk-03 Thread-Index: AQHTtL/VYSnZFqn2DUqDOvC/89dF56PHZC6A Date: Fri, 9 Mar 2018 00:24:36 +0000 Message-ID: References: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> In-Reply-To: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.5.17.45] Content-Type: text/plain; charset="utf-8" Content-ID: <582F9CEC81E68C429DF795727B5DE46A@isaracorp.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] draft-housley-cms-mix-with-psk-03 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Mar 2018 00:24:40 -0000 SGkgUnVzcywNCg0KSSBoYXZlIGEgZmV3IG1pbm9yIG5pdHMgYW5kIG9uZSAoc3RpbGwgbWlub3Ip IGNvbW1lbnQuDQoNClNlY3Rpb24gMjoNCg0KKG5pdCkgcy90aGVuIGFsbCByZWNpcGllbnQgb2J0 YWluL3RoZW4gYWxsIHJlY2lwaWVudHMgb2J0YWluLw0KKG5pdCkgcy90aGVuIGtleS1kZXJpdmF0 aW9uIGtleSBpcyBtaXhlZC90aGVuIHRoZSBrZXktZGVyaXZhdGlvbiBrZXkgaXMgbWl4ZWQvICh4 MikNCg0KU2VjdGlvbiA2Og0KDQrigJxDb21wcm9taXNlIG9mIHRoZSBrZXkgdHJhbnNwb3J0IHBy aXZhdGUga2V5IG9yIHRoZSBhZ3JlZW1lbnQgcHJpdmF0ZSBrZXkgbWF5IHJlc3VsdCBpbiB0aGUg ZGlzY2xvc3VyZSBvZiBhbGwgY29udGVudHMgcHJvdGVjdGVkIHdpdGggdGhhdCBrZXkuIENvbXBy b21pc2Ugb2YgdGhlIGtleS1kZXJpdmF0aW9uIGtleSB0aGF0IGlzIGVzdGFibGlzaGVkIHdpdGgg dGhlIGtleSB0cmFuc3BvcnQgcHJpdmF0ZSBrZXkgb3IgdGhlIGFncmVlbWVudCBwcml2YXRlIGtl eSBtYXkgcmVzdWx0IGluIGRpc2Nsb3N1cmUgb2YgdGhlIGFzc29jaWF0ZWQgZW5jcnlwdGVkIGNv bnRlbnQu4oCdDQoNCkluIHRoaXMgZHJhZnQsIGRpc2Nsb3N1cmUgb2YgdGhlc2Uga2V5cyB3b3Vs ZCBub3QgcmVzdWx0IGluIHRoZSBkaXNjbG9zdXJlIG9mIHRoZSBwcm90ZWN0ZWQgY29udGVudCB1 bmxlc3MgdGhlIFBTSyB3YXMgYWxzbyBkaXNjbG9zZWQuICBJIGd1ZXNzIHRoZSDigJxtYXnigJ0g aGVkZ2VzIHRob3NlIHN0YXRlbWVudHMgYW5kIG1ha2VzIHRoZW0gc3RpbGwgdGVjaG5pY2FsbHkg dHJ1ZS4gIFJGQyA1NjUyIHNheXMgdGhlIHNhbWUgdGhpbmcgYWJvdXQgdGhlIHByaXZhdGUga2V5 cywgZXhjZXB0IGluIHRoYXQgY2FzZSB0aGUgZGlzY2xvc3VyZSBvZiB0aGUga2V5cyB3b3VsZCBk ZWZpbml0ZWx5IGFsbG93IGRpc2Nsb3N1cmUgb2YgdGhlIHByb3RlY3QgY29udGVudC4gIFNvIG1h eWJlIGluIHRoaXMgZHJhZnQgeW91IHdhbnQgdG8gcXVhbGlmeSB0aGF0IGlmIHRoZSBwcml2YXRl IGtleXMgYW5kIHRoZSBQU0sgYXJlIGRpc2Nsb3NlZCwgdGhlIHByb3RlY3RlZCBjb250ZW50IG1h eSBhbHNvIGJlIGRpc2Nsb3NlZC4NCg0KKG5pdCkgcy9yYW5kb21seSBnZW5lcmF0ZSBrZXktZGVy aXZhdGlvbiBrZXkvcmFuZG9tbHkgZ2VuZXJhdGUga2V5LWRlcml2YXRpb24ga2V5cy8NCihuaXQ/ KSBzL2FzIHdlbGwgYXMgdGhlIGNvbnRlbnQtZW5jcnlwdGlvbiBrZXkvYXMgd2VsbCBhcyB0aGUg Y29udGVudC1lbmNyeXB0aW9uIGtleXMvDQoobml0Pykgcy9vciBjb250ZW50LWF1dGhlbnRpY2F0 ZWQtZW5jcnlwdGlvbiBrZXkvb3IgY29udGVudC1hdXRoZW50aWNhdGVkLWVuY3J5cHRpb24ga2V5 cy8NCihuaXQpIHMvSWYgdGhlIGtleS1lbmNyeXB0aW9uIGFsZ29yaXRobSBpcyBkaWZmZXJlbnQg dGhhdC9JZiB0aGUga2V5LWVuY3J5cHRpb24gYWxnb3JpdGhtIGlzIGRpZmZlcmVudCB0aGFuLw0K KG5pdCkgcy9JbXBsZW1lbnRlciBzaG91bGQgbm90L0ltcGxlbWVudGVycyBzaG91bGQgbm90Lw0K KG5pdCkgcy9zZW5kIHRoZSBzYW1lIGNvbnRlbnQgaW4gZGlmZmVyZW50IGluIHNlcGFyYXRlIG1l c3NhZ2VzL3NlbmQgdGhlIHNhbWUgY29udGVudCBpbiBkaWZmZXJlbnQvDQoNClRoYW5rcywNCkRh bg0KDQrvu79PbiAyMDE4LTAzLTA1LCA4OjIzIFBNLCAiU3Bhc20gb24gYmVoYWxmIG9mIFJ1c3Mg SG91c2xleSIgPHNwYXNtLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGhvdXNsZXlAdmln aWxzZWMuY29tPiB3cm90ZToNCg0KICAgIEkgd291bGQgbGlrZSB0byBtYWtlIHBlb3BsZSBvbiB0 aGlzIG1haWwgbGlzdCBhd2FyZSBvZiB0aGlzIEludGVybmV0LURyYWZ0Lg0KICAgIA0KICAgIFJ1 c3MNCiAgICANCiAgICA9ID0gPSA9ID0gPSA9ID0gPSA9DQogICAgDQogICAgQSBuZXcgdmVyc2lv biBvZiBJLUQsIGRyYWZ0LWhvdXNsZXktY21zLW1peC13aXRoLXBzay0wMy50eHQNCiAgICBoYXMg YmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IFJ1c3NlbGwgSG91c2xleSBhbmQgcG9zdGVk IHRvIHRoZQ0KICAgIElFVEYgcmVwb3NpdG9yeS4NCiAgICANCiAgICBOYW1lOgkJZHJhZnQtaG91 c2xleS1jbXMtbWl4LXdpdGgtcHNrDQogICAgUmV2aXNpb246CTAzDQogICAgVGl0bGU6CQlVc2lu ZyBQcmUtU2hhcmVkIEtleSAoUFNLKSBpbiB0aGUgQ3J5cHRvZ3JhcGhpYyBNZXNzYWdlIFN5bnRh eCAoQ01TKQ0KICAgIERvY3VtZW50IGRhdGU6CTIwMTgtMDMtMDUNCiAgICBHcm91cDoJCUluZGl2 aWR1YWwgU3VibWlzc2lvbg0KICAgIFBhZ2VzOgkJMTMNCiAgICBVUkw6ICAgICAgICAgICAgaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWhvdXNsZXktY21zLW1peC13 aXRoLXBzay0wMy50eHQNCiAgICBTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvZHJhZnQtaG91c2xleS1jbXMtbWl4LXdpdGgtcHNrLw0KICAgIEh0bWxpemVk OiAgICAgICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaG91c2xleS1jbXMtbWl4 LXdpdGgtcHNrLTAzDQogICAgSHRtbGl6ZWQ6ICAgICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvZG9jL2h0bWwvZHJhZnQtaG91c2xleS1jbXMtbWl4LXdpdGgtcHNrLTAzDQogICAgRGlm ZjogICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1ob3Vz bGV5LWNtcy1taXgtd2l0aC1wc2stMDMNCiAgICANCiAgICBBYnN0cmFjdDoNCiAgICAgIFRoZSBp bnZlbnRpb24gb2YgYSBsYXJnZS1zY2FsZSBxdWFudHVtIGNvbXB1dGVyIHdvdWxkIHBvc2UgYSBz ZXJpb3VzDQogICAgICBjaGFsbGVuZ2UgZm9yIHRoZSBjcnlwdG9ncmFwaGljIGFsZ29yaXRobXMg dGhhdCBhcmUgd2lkZWx5IGRlcGxveWVkDQogICAgICB0b2RheS4gIFRoZSBDcnlwdG9ncmFwaGlj IE1lc3NhZ2UgU3ludGF4IChDTVMpIHN1cHBvcnRzIGtleSB0cmFuc3BvcnQNCiAgICAgIGFuZCBr ZXkgYWdyZWVtZW50IGFsZ29yaXRobXMgdGhhdCBjb3VsZCBiZSBicm9rZW4gYnkgdGhlIGludmVu dGlvbiBvZg0KICAgICAgc3VjaCBhIHF1YW50dW0gY29tcHV0ZXIuICBCeSBzdG9yaW5nIGNvbW11 bmljYXRpb25zIHRoYXQgYXJlDQogICAgICBwcm90ZWN0ZWQgd2l0aCB0aGUgQ01TIHRvZGF5LCBz b21lb25lIGNvdWxkIGRlY3J5cHQgdGhlbSBpbiB0aGUNCiAgICAgIGZ1dHVyZSB3aGVuIGEgbGFy Z2Utc2NhbGUgcXVhbnR1bSBjb21wdXRlciBiZWNvbWVzIGF2YWlsYWJsZS4gIE9uY2UNCiAgICAg IHF1YW50dW0tc2VjdXJlIGtleSBtYW5hZ2VtZW50IGFsZ29yaXRobXMgYXJlIGF2YWlsYWJsZSwg dGhlIENNUyB3aWxsDQogICAgICBiZSBleHRlbmRlZCB0byBzdXBwb3J0IHRoZW0sIGlmIGN1cnJl bnQgc3ludGF4IHRoZSBkb2VzIG5vdA0KICAgICAgYWNjb21tb2RhdGVkIHRoZW0uICBJbiB0aGUg bmVhci10ZXJtLCB0aGlzIGRvY3VtZW50IGRlc2NyaWJlcyBhDQogICAgICBtZWNoYW5pc20gdG8g cHJvdGVjdCB0b2RheSdzIGNvbW11bmljYXRpb24gZnJvbSB0aGUgZnV0dXJlIGludmVudGlvbg0K ICAgICAgb2YgYSBsYXJnZS1zY2FsZSBxdWFudHVtIGNvbXB1dGVyIGJ5IG1peGluZyB0aGUgb3V0 cHV0IG9mIGtleQ0KICAgICAgdHJhbnNwb3J0IGFuZCBrZXkgYWdyZWVtZW50IGFsZ29yaXRobXMg d2l0aCBhIHByZS1zaGFyZWQga2V5Lg0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQogICAgU3Bhc20gbWFpbGluZyBsaXN0DQogICAgU3Bh c21AaWV0Zi5vcmcNCiAgICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Nw YXNtDQogICAgDQoNCg== From nobody Fri Mar 9 06:33:27 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 102F612778E for ; Fri, 9 Mar 2018 06:33:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rTYojTuq9yUq for ; Fri, 9 Mar 2018 06:33:22 -0800 (PST) Received: from USFB19PA11.eemsg.mail.mil (uphb19pa08.eemsg.mail.mil [214.24.26.82]) by ietfa.amsl.com (Postfix) with ESMTP id 43D0412D7E8 for ; Fri, 9 Mar 2018 06:33:21 -0800 (PST) Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by USFB19PA11.eemsg.mail.mil with ESMTP/TLS/AES256-SHA; 09 Mar 2018 14:33:20 +0000 X-IronPort-AV: E=Sophos;i="5.47,445,1515456000"; d="scan'208";a="10371504" IronPort-PHdr: =?us-ascii?q?9a23=3AG1W+DRcp8LU31VmyvMDyJNVnlGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxc26YRWN2/xhgRfzUJnB7Loc0qyK6/umATRIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBxrwKxd+?= =?us-ascii?q?KPjrFY7OlcS30P2594HObwlSizexfb1/IA+qoQnNq8IbnZZsJqEtxxXTv3BGYf?= =?us-ascii?q?5WxWRmJVKSmxbz+MK994N9/ipTpvws6ddOXb31cKokQ7NYCi8mM30u683wqRbD?= =?us-ascii?q?VwqP6WACXWgQjxFFHhLK7BD+Xpf2ryv6qu9w0zSUMMHqUbw5Xymp4rx1QxH0li?= =?us-ascii?q?gIKz858HnWisNuiqJbvAmhrAF7z4LNfY2ZKOZycqbbcNwUX2pBWttaWTJHDI2y?= =?us-ascii?q?coADC/MNMOlcooX4oVYFsBmwChS2BO731zFGmHH206053eovHw7J0w4vEM4Bvn?= =?us-ascii?q?nPsNX4Nr0fXfypwKTGzzjOae5d1zfn6IjPdxAsufaCXbNsfsrR00YgCQfFhUiU?= =?us-ascii?q?p4P7OTOV1eUNs26A7+F9Uu+vjmwnqwNvrTipxccsi5LEhp4Vy1/Y9SV5x5w5Jd?= =?us-ascii?q?ukR05gfdGoCp5QtyCeN4ZvRM4pXm9muCE/yrIcuJ67ejAHyJU5yB7DZfyLaY+I?= =?us-ascii?q?4gjsVOuXPDx2h2pldaqiixu9/kWs0O3xWtSu3FpUoSdJjMPAum0L2hfO8MaIUO?= =?us-ascii?q?F98V2k2TuX0gDT7fxLLl4smKrALp4h3qYwlp0OsUTfBiP2mFv5jKuRdkg85uin?= =?us-ascii?q?8f7nYrT7pp+HLYN0lgH/Pbgumsy4G+g4NBQBX3OH9uim0b3j/En5TK1Ljv0wjK?= =?us-ascii?q?bZrIjXKdkUq6O2GQNY0psv5wyhAzqpztgUh2QLIEpAeB2djojpP1/OIOr/Dfe6?= =?us-ascii?q?m1mslTVrx/LYMb3nAZXNL2POkKvhfLlh605czxA/zdZD6JJPFr4NOvfzWk71tN?= =?us-ascii?q?DAFB82LxS0w/r7CNV6zo4eQn6PDbGBMKPSr1CI4PgjI+eWa48PojbyNfwl5/r1?= =?us-ascii?q?gHAlgl8RZ7Wp0ocKZ3yiH/RpPV2TYWDwjdcZDWcKog0+QfTxiF2aSzFTfHOyUr?= =?us-ascii?q?k95j4lFIKmA53PRoe3gLyOxC27BIFZZnhaClCQFnflb4GEW/MNaSKTPMBhnTgE?= =?us-ascii?q?WKOnS486zx6irgD6y715LuDM4C0XqYrj1MRp5+3UjRwy8CZ4D8aD3GGLTGF0n2?= =?us-ascii?q?UIRyQs0K1xoEFwxVWO3bR5jvBfG91T4OlJUgQhOJ7Tyux1EdHyWgbbctiVT1am?= =?us-ascii?q?R4buPTZkdc48298DZQ5TEs+4gxTHl36xH7INl7GNQpI96LjR23zZLN07133Kkq?= =?us-ascii?q?gs2R1uWdNGLmiOh6Nj+U7UHYGavV+ekvOPdK8c1SPJvEWOy2mPuloQBAtyU6jD?= =?us-ascii?q?XnE3elrdrdO/4EjZRPmrCLBxYVgJ8tKLNqYfMo6htl5BXvq2fY2CMm8=3D?= X-IPAS-Result: =?us-ascii?q?A2C7AQD3maJa/wHyM5BeGQEBAQEBAQEBAQEBAQcBAQEBAYM?= =?us-ascii?q?jLWZvKINQmBVCAwMGgTSBFpY4ByINhQACgxEhNxUBAgEBAQEBAQIBaieCOCQBg?= =?us-ascii?q?kYBAQEBAgEBASEVNgsFCwsYAgImAgInHxEGAQwGAgEBgwIRgXUFCA+tBYImhHG?= =?us-ascii?q?DdYIVBYEOhCiCLoEOgi4pgwSBLoIAAQEBgVABAYMngmIEjmeLbgmQYgeOYUWOJ?= =?us-ascii?q?YQJNCKBUjMaCDA6gkODUQEJgQsiNwGIUoI5AQEB?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 09 Mar 2018 14:33:19 +0000 Received: from rd2ul-48143y.infosec.tycho.ncsc.mil (rd2ul-48143y [192.168.26.149]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w29EXGaV006210; Fri, 9 Mar 2018 09:33:16 -0500 To: Stephen Farrell , spasm@ietf.org Cc: "Zieglar, Lydia Q" , m.jenkins.364706+work@gmail.com References: <863b6e71-c179-3856-9edf-28e8306031e4@tycho.ncsc.mil> From: Michael Jenkins Message-ID: <4b617f02-4b35-e4fc-f621-078c3e8c07b7@tycho.ncsc.mil> Date: Fri, 9 Mar 2018 09:33:16 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [lamps] [Non-DoD Source] Re: Request for review of revised RFC 5759 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Mar 2018 14:33:25 -0000 Hi Stephen, > I'd encourage the authors to consider if they need an RFC that is not under IETF change control for this content. Thanks for taking the time to look at the draft and comment. I wanted to respond that we certainly are considering the benefits and costs of publishing this information, and which mechanisms for publication might be more or less appropriate. Your input (and Martin's, Paul W's, and Paul H's) plays a significant role in that discussion. Mike On 03/06/2018 04:41 PM, Stephen Farrell wrote: > Hiya, > > I commented on making the suite-b profiles historic on the IETF > discuss list. (Probably better to keep that discussion on that > list and not here - thread is at [1], but briefly I suggested we > not do another suite-b-like exercise within the IETF.) > > Russ asked me to take a peek at this draft as part of some > offlist discussion about that. > > Generally the content of the draft seems reasonable. If it is the > case that the choices in this profile are widely implemented (and > I'm guessing they are), then I would support a profile with such > content being processed as a BCP (and hence coming under IETF change > control). > > If there is a real need to retain change control and keep this as > a national profile, then see my opinion on [1], I'm not supportive > of that. (But in this case, as the content seems to not involve > any "innovative" or odd choices, and if done via the ISE, I'm only > very very mildly opposed - almost neutral:-) > > I'd encourage the authors to consider if they need an RFC that is > not under IETF change control for this content. I can't see how > that'd be beneficial tbh but maybe I'm missing something. And if > the content had IETF consensus, then I'd guess that'd help in terms > of getting implementations that match the profile more quickly. > > If there are other documents to come, that do make "innovative" > choices (e.g. algs or params that are not widely implemented), > then I think even a national profile for that published via the > ISE is a bad idea, (but again, discussion of that via [1] is > better). > > Cheers, > S > > [1] https://www.ietf.org/mail-archive/web/ietf/current/msg106634.html > > On 31/01/18 20:59, Michael Jenkins wrote: >> The US National Security Agency (NSA) has begun the process of updating >> the "Suite B for..." RFCs to define requirements for implementing and >> configuring IETF protocols in compliance with the 2016 revision of >> CNSSP-15 (the Commercial National Security Algorithm, or CNSA, suite). >> These RFCs are intended for use by commercial product vendors who wish >> their products to be used in US National Security Systems, over which >> NSA has oversight. >> >> As part of this process, the older RFCs will be moved to Historical >> status, and we plan to publish new RFCs via the ISE. We are seeking >> review and comment of the drafts prior to publication, and so will be >> announcing the drafts on appropriate mail-lists as we produce them. >> >> The first draft updates RFC 5759, and addresses requirements for RFC >> 5280 compliant public-key certificates and CRLs that contain or >> reference algorithms in the CNSA suite. It is available at >> . >> We would appreciate any comments you might have regarding the draft, >> either via the mail-list or via direct reply. >> >> >> Mike Jenkins >> Lydia Zieglar >> NSA >> >> >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >> From nobody Fri Mar 9 09:27:44 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CD9712E039 for ; Fri, 9 Mar 2018 09:27:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A8cTjvj3cwil for ; Fri, 9 Mar 2018 09:27:36 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EAB312D946 for ; Fri, 9 Mar 2018 09:27:36 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 177AE3005DB for ; Fri, 9 Mar 2018 12:27:34 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id QQ-pSpG3MhiQ for ; Fri, 9 Mar 2018 12:27:32 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 4692A300435; Fri, 9 Mar 2018 12:27:32 -0500 (EST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Russ Housley In-Reply-To: Date: Fri, 9 Mar 2018 12:27:33 -0500 Cc: SPASM Content-Transfer-Encoding: quoted-printable Message-Id: <1A02FB20-9018-43ED-BE2B-BFC3CE82B168@vigilsec.com> References: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> To: Daniel Van Geest X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] draft-housley-cms-mix-with-psk-03 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Mar 2018 17:27:43 -0000 Thanks for reading the document. I will go through your comments and = update the document. You are correct. I was probably being too subtle with the "may" in the = security considerations. I will come up with better wording. Russ > On Mar 8, 2018, at 7:24 PM, Daniel Van Geest = wrote: >=20 > Hi Russ, >=20 > I have a few minor nits and one (still minor) comment. >=20 > Section 2: >=20 > (nit) s/then all recipient obtain/then all recipients obtain/ > (nit) s/then key-derivation key is mixed/then the key-derivation key = is mixed/ (x2) >=20 > Section 6: >=20 > =E2=80=9CCompromise of the key transport private key or the agreement = private key may result in the disclosure of all contents protected with = that key. Compromise of the key-derivation key that is established with = the key transport private key or the agreement private key may result in = disclosure of the associated encrypted content.=E2=80=9D >=20 > In this draft, disclosure of these keys would not result in the = disclosure of the protected content unless the PSK was also disclosed. = I guess the =E2=80=9Cmay=E2=80=9D hedges those statements and makes them = still technically true. RFC 5652 says the same thing about the private = keys, except in that case the disclosure of the keys would definitely = allow disclosure of the protect content. So maybe in this draft you = want to qualify that if the private keys and the PSK are disclosed, the = protected content may also be disclosed. >=20 > (nit) s/randomly generate key-derivation key/randomly generate = key-derivation keys/ > (nit?) s/as well as the content-encryption key/as well as the = content-encryption keys/ > (nit?) s/or content-authenticated-encryption key/or = content-authenticated-encryption keys/ > (nit) s/If the key-encryption algorithm is different that/If the = key-encryption algorithm is different than/ > (nit) s/Implementer should not/Implementers should not/ > (nit) s/send the same content in different in separate messages/send = the same content in different/ >=20 > Thanks, > Dan >=20 > =EF=BB=BFOn 2018-03-05, 8:23 PM, "Spasm on behalf of Russ Housley" = wrote: >=20 > I would like to make people on this mail list aware of this = Internet-Draft. >=20 > Russ >=20 > =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D >=20 > A new version of I-D, draft-housley-cms-mix-with-psk-03.txt > has been successfully submitted by Russell Housley and posted to = the > IETF repository. >=20 > Name: draft-housley-cms-mix-with-psk > Revision: 03 > Title: Using Pre-Shared Key (PSK) in the Cryptographic = Message Syntax (CMS) > Document date: 2018-03-05 > Group: Individual Submission > Pages: 13 > URL: = https://www.ietf.org/internet-drafts/draft-housley-cms-mix-with-psk-03.txt= > Status: = https://datatracker.ietf.org/doc/draft-housley-cms-mix-with-psk/ > Htmlized: = https://tools.ietf.org/html/draft-housley-cms-mix-with-psk-03 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-housley-cms-mix-with-psk-03 > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-cms-mix-with-psk-03 >=20 > Abstract: > The invention of a large-scale quantum computer would pose a = serious > challenge for the cryptographic algorithms that are widely = deployed > today. The Cryptographic Message Syntax (CMS) supports key = transport > and key agreement algorithms that could be broken by the = invention of > such a quantum computer. By storing communications that are > protected with the CMS today, someone could decrypt them in the > future when a large-scale quantum computer becomes available. = Once > quantum-secure key management algorithms are available, the CMS = will > be extended to support them, if current syntax the does not > accommodated them. In the near-term, this document describes a > mechanism to protect today's communication from the future = invention > of a large-scale quantum computer by mixing the output of key > transport and key agreement algorithms with a pre-shared key. >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 From nobody Sat Mar 10 18:28:11 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AFE6124B18 for ; Sat, 10 Mar 2018 18:28:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WHO1tVYOvs-L for ; Sat, 10 Mar 2018 18:28:07 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96AA8124234 for ; Sat, 10 Mar 2018 18:28:07 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 4011C300558 for ; Sat, 10 Mar 2018 21:28:05 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id gd9fMW-pkm-t for ; Sat, 10 Mar 2018 21:28:04 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 269C23004D7 for ; Sat, 10 Mar 2018 21:28:04 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Sat, 10 Mar 2018 21:28:09 -0500 References: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> To: SPASM In-Reply-To: <588FD7CB-1D4D-4EBA-8CC0-B671BF871359@vigilsec.com> Message-Id: <52115BCB-49E9-4094-B8EA-17279E70F6B0@vigilsec.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Adoption call for draft-hoffman-andrews-caa-simplification X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Mar 2018 02:28:09 -0000 No one has spoken against adopting this I-D. After discussion of this = document in London, please post the next revision as = draft-ietf-lamps-rfc6844bis-00. Russ > On Feb 24, 2018, at 14:28, Russ Housley wrote: >=20 > Should draft-hoffman-andrews-caa-simplification be adopted by the = LAMPS WG as the starting point for rfc6844bis? >=20 > Please voice you opinion by March 10th. >=20 > Russ From nobody Mon Mar 12 15:57:12 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AEAB124BFA for ; Mon, 12 Mar 2018 15:57:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6nifFASS1nul for ; Mon, 12 Mar 2018 15:57:08 -0700 (PDT) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0466312702E for ; Mon, 12 Mar 2018 15:57:07 -0700 (PDT) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip1.isaracorp.com with ESMTP; 12 Mar 2018 23:03:50 +0000 Received: from mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) by mb.isaracorp.com (2001:470:b1cb:1500:9056:5d62:46d0:fe1f) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Mon, 12 Mar 2018 18:57:06 -0400 Received: from mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f]) by mb.isaracorp.com ([fe80::9056:5d62:46d0:fe1f%12]) with mapi id 15.00.1044.021; Mon, 12 Mar 2018 18:57:06 -0400 From: Daniel Van Geest To: Russ Housley CC: "spasm@ietf.org" Thread-Topic: [lamps] draft-housley-cms-mix-with-psk-03 Thread-Index: AQHTtL/VYSnZFqn2DUqDOvC/89dF56PHZC6AgAEd9ICABQJNgA== Date: Mon, 12 Mar 2018 22:57:06 +0000 Message-ID: <998C7BFA-0C23-4CAF-A1E0-B442352E2C4D@isara.com> References: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> <1A02FB20-9018-43ED-BE2B-BFC3CE82B168@vigilsec.com> In-Reply-To: <1A02FB20-9018-43ED-BE2B-BFC3CE82B168@vigilsec.com> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.5.17.55] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] draft-housley-cms-mix-with-psk-03 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Mar 2018 22:57:10 -0000 SGkgUnVzcywNCg0KSSBoYWQgc29tZSBtb3JlIHRob3VnaHRzIG9uIHRoZSBkcmFmdCwgYWxsIGZy b20gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24uDQoNCjEpICJBIGxhcmdlLXNj YWxlIHF1YW50dW0gY29tcHV0ZXIgd2lsbCBlZmZlY3RpdmVseSBjdXQgdGhlIHNlY3VyaXR5DQog ICBwcm92aWRlZCBieSBhIHN5bW1ldHJpYyBrZXkgYWxnb3JpdGhtIGluIGhhbGYuICBBcyBhIHJl c3VsdCwgdGhlIFBTSywNCiAgIHRoZSBrZXktZGVyaXZhdGlvbiBrZXksIGFuZCB0aGUga2V5LWVu Y3J5cHRpb24ga2V5IG5lZWQgYXQgbGVhc3QgMjU2DQogICBiaXRzIG9mIGVudHJvcHkgdG8gcHJv dmlkZSAxMjggYml0cyBvZiBzZWN1cml0eS4gIEZvciB0aGlzIHJlYXNvbiwNCiAgIHRoZXNlIHN5 bW1ldHJpYyBrZXlzIFNIT1VMRCBiZSBhdCBsZWFzdCAyNTYgYml0cyBpbiBsZW5ndGgu4oCdDQoN CkFzc3VtaW5nIHRoZSBleGlzdGVuY2Ugb2YgYSBsYXJnZS1zY2FsZSBxdWFudHVtIGNvbXB1dGVy IHdoaWNoIGNhbiBicmVhayBSU0EvRUNESCwgdGhlIGVudHJvcHkgb2YgdGhlIGtleS1kZXJpdmF0 aW9uIGtleSBpcyBpcnJlbGV2YW50IHNpbmNlIHRoZSBrZXkgd291bGQgYmUgZnVsbHkgcmVjb3Zl cmFibGUgYnkgYSBxdWFudHVtIGNvbXB1dGVyLiBTbywgd2hhdOKAmXMgcmVhbGx5IGltcG9ydGFu dCBpcyB0aGF0IHRoZSBQU0sgY29udGFpbnMgMjU2IGJpdHMgb2YgZW50cm9weSBhbmQgdGhlIEtE RiBpcyBxdWFudHVtIHJlc2lzdGFudCBhbmQgb3V0cHV0cyBhIGtleS1lbmNyeXB0aW9uIGtleSB3 aXRoIGEgbGVuZ3RoIG9mIGF0IGxlYXN0IDI1NiBiaXRzLg0KDQoyKSBUaGlzIGRyYWZ0IGZvY3Vz ZXMgb24ga2V5IHRyYW5zcG9ydCBhbmQga2V5IGFncmVlbWVudCBmb3IgdGhlIG9idmlvdXMgcmVh c29uIHRoYXQgdGhlc2UgYXJlIHZ1bG5lcmFibGUgdG8gYXR0YWNrIGJ5IGEgbGFyZ2Utc2NhbGUg cXVhbnR1bSBjb21wdXRlciwgc28gbWF5YmUgdGhpcyBzdWdnZXN0aW9uIGlzIG91dHNpZGUgdGhl IHNjb3BlIG9mIHRoaXMgZHJhZnQuICBGb3IgS0VLUmVjaXBpZW50SW5mbyBzaG91bGQgeW91IGV4 cGxpY2l0bHkgbWVudGlvbiB0aGF0IHRoaXMgaXMgYWxyZWFkeSBxdWFudHVtIHJlc2lzdGFudCBh cyBsb25nIGEgcXVhbnR1bSByZXNpc3RhbnQga2V5LWVuY3J5cHRpb24gYWxnb3JpdGhtIHdpdGgg a2V5IHNpemUgb2YgYXQgbGVhc3QgMjU2IGJpdHMgaXMgdXNlZD8gIFNpbWlsYXJseSB0aGF0IFBh c3N3b3JkUmVjaXBpZW50SW5mbyBpcyBxdWFudHVtLXJlc2lzdGFudCBhcyBsb25nIGFzIGEgcXVh bnR1bS1yZXNpc3RhbnQga2V5LWVuY3J5cHRpb24gYWxnb3JpdGhtIHdpdGgga2V5IHNpemUgYXQg bGVhc3QgMjU2IGJpdHMgaXMgdXNlZCBhbmQgYSBxdWFudHVtIHJlc2lzdGFudCBLREYgaXMgdXNl ZCB3aXRoIGEgc3VmZmljaWVudGx5IGxhcmdlIHBhc3N3b3JkIChmb3Igc29tZSBkZWZpbml0aW9u IG9mIHN1ZmZpY2llbnQpLiBPciBpZiBubyBLREYgaXMgdXNlZCwgdGhlIGtleS1lbmNyeXB0aW9u IGtleSBmcm9tIHRoZSBleHRlcm5hbCBzb3VyY2UgaGFzIGF0IGxlYXN0IDI1NiBiaXRzIG9mIGVu dHJvcHkuDQoNCjMpIFRoaXMgaXMgaGludGVkIGF0IGluIHRoZSBpbnRyb2R1Y3Rpb24sIGJ1dCBu b3doZXJlIGluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIGRvIHlvdSBzdGF0 ZSB0aGF0IHRoZSBjb250ZW50LWVuY3J5cHRpb24ga2V5IHNob3VsZCBiZSBhdCBsZWFzdCAyNTYg Yml0cyBsb25nIHRvIGJlIHF1YW50dW0gcmVzaXN0YW50IChhcyBtZW50aW9uZWQgYWJvdmUsIHlv dSBkbyBtYWtlIHRoaXMgcmVjb21tZW5kYXRpb24gZm9yIHRoZSBvdGhlciBrZXlzIGluIHRoaXMg ZHJhZnQpLg0KDQo0KSAiV2hlbiB1c2luZyBhIGtleSBhZ3JlZW1lbnQgYWxnb3JpdGhtLCBhIGtl eS1lbmNyeXB0aW9uIGtleSBpcw0KICAgcHJvZHVjZWQgdG8gZW5jcnlwdCB0aGUgY29udGVudC1l bmNyeXB0aW9uIGtleSBvciBjb250ZW50LQ0KICAgYXV0aGVudGljYXRlZC1lbmNyeXB0aW9uIGtl eS7igJ0NCg0KSW4gdGhpcyBkcmFmdCwgdGhpcyBpcyB0cnVlIG5vdCBqdXN0IGZvciBrZXkgYWdy ZWVtZW50IGFsZ29yaXRobXMgYnV0IGZvciBrZXkgdHJhbnNwb3J0IGFsZ29yaXRobXMgYXMgd2Vs bC4NCg0KNSkgIkltcGxlbWVudGVycyBzaG91bGQgbm90IG1peCB0aGUgcXVhbnR1bS1yZXNpc3Rh bnQga2V5IG1hbmFnZW1lbnQNCiAgIGFsZ29yaXRobXMgd2l0aCB0aGVpciBub24tcXVhbnR1bS1y ZXNpc3RhbnQgY291bnRlcnBhcnRzLiAgVGhhdCBpcywNCiAgIHRoZSBzYW1lIGNvbnRlbnQgc2hv dWxkIG5vdCBiZSBwcm90ZWN0ZWQgd2l0aCBLZXlUcmFuc1JlY2lwaWVudEluZm8NCiAgIGFuZCBL ZXlUcmFuc1BTS1JlY2lwaWVudEluZm8sIGFuZCB0aGUgc2FtZSBjb250ZW50IHNob3VsZCBub3Qg YmUNCiAgIHByb3RlY3RlZCB3aXRoIEtleUFncmVlUmVjaXBpZW50SW5mbyBhbmQgS2V5QWdyZWVQ U0tSZWNpcGllbnRJbmZvLg0KICAgRG9pbmcgc28gd291bGQgbWFrZSB0aGUgY29udGVudCB2dWxu ZXJhYmxlIHRvIHRoZSBmdXR1cmUgaW52ZW50aW9uIG9mDQogICBhIGxhcmdlLXNjYWxlIHF1YW50 dW0gY29tcHV0ZXIu4oCdDQoNClRoaXMgaXMgdHJ1ZSBub3QganVzdCBmb3IgUVIgUmVjaXBpZW50 SW5mb3Mgd2l0aCB0aGVpciBub24tUVIgY291bnRlcnBhcnRzLCBidXQgZm9yIGFueSBRUiBSZWNp cGllbnRJbmZvIGNvbWJpbmVkIHdpdGggYW55IG5vbi1RUiBSZWNpcGllbnRJbmZvLCBzdWNoIGFz IEtleVRyYW5zUFNLUmVjaXBpZW50SW5mbyB3aXRoIEtleUFncmVlUmVjaXBpZW50SW5mby4gU28s IEkgdGhpbmsgdGhpcyBzaG91bGQgYmUgZ2VuZXJhbGl6ZWQgdG8gbWl4aW5nIFFSIGFuZCBub24t UVIgUmVjaXBpZW50SW5mb3MuICBJIGFsc28gd29uZGVyIGlmIHRoaXMgc2hvdWxkIGJlIGEgU0hP VUxEIE5PVCByYXRoZXIgdGhhbiBqdXN0IGEgc2hvdWxkIG5vdD8NCg0KSW4gdGhlIGZvbGxvd2lu ZyBwYXJhZ3JhcGggdGFsa2luZyBhYm91dCBpbXBsZW1lbnRlcnMgc2VuZGluZyB0aGUgc2FtZSBj b250ZW50IGluIGRpZmZlcmVudCBtZXNzYWdlcywgSSBzdXBwb3NlIHlvdSBhZGRlZCB0aGlzIHRv IHByZXZlbnQgYW4gaW1wbGVtZW50ZXIgZnJvbSBnZXR0aW5nIGFyb3VuZCB0aGUgcHJldmlvdXMg cGFyYWdyYXBoIGJ5IHNlbmRpbmcgdHdvIG1lc3NhZ2VzIHdpdGhvdXQgdGhlIHVzZXIgYmVpbmcg YXdhcmU/ICBUaGlzIGlzIGZpbmUsIHRob3VnaCBJIGRvbuKAmXQgdGhpbmsgYW4gaW1wbGVtZW50 ZXIgY291bGQvc2hvdWxkIHByYWN0aWNhbGx5IHByZXZlbnQgYSB1c2VyIGZyb20gYmVpbmcgZHVt YiBhbmQgYWN0aXZlbHkgc2VuZGluZyB0aGUgc2FtZSBtZXNzYWdlIHR3aWNlLg0KDQpUaGFua3Ms DQpEYW4NCg0K77u/T24gMjAxOC0wMy0wOSwgNToyNyBQTSwgIlJ1c3MgSG91c2xleSIgPGhvdXNs ZXlAdmlnaWxzZWMuY29tPiB3cm90ZToNCg0KICAgIFRoYW5rcyBmb3IgcmVhZGluZyB0aGUgZG9j dW1lbnQuICBJIHdpbGwgZ28gdGhyb3VnaCB5b3VyIGNvbW1lbnRzIGFuZCB1cGRhdGUgdGhlIGRv Y3VtZW50Lg0KICAgIA0KICAgIFlvdSBhcmUgY29ycmVjdC4gIEkgd2FzIHByb2JhYmx5IGJlaW5n IHRvbyBzdWJ0bGUgd2l0aCB0aGUgIm1heSIgaW4gdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25z LiAgSSB3aWxsIGNvbWUgdXAgd2l0aCBiZXR0ZXIgd29yZGluZy4NCiAgICANCiAgICBSdXNzDQog ICAgDQogICAgDQogICAgPiBPbiBNYXIgOCwgMjAxOCwgYXQgNzoyNCBQTSwgRGFuaWVsIFZhbiBH ZWVzdCA8RGFuaWVsLlZhbkdlZXN0QGlzYXJhLmNvbT4gd3JvdGU6DQogICAgPiANCiAgICA+IEhp IFJ1c3MsDQogICAgPiANCiAgICA+IEkgaGF2ZSBhIGZldyBtaW5vciBuaXRzIGFuZCBvbmUgKHN0 aWxsIG1pbm9yKSBjb21tZW50Lg0KICAgID4gDQogICAgPiBTZWN0aW9uIDI6DQogICAgPiANCiAg ICA+IChuaXQpIHMvdGhlbiBhbGwgcmVjaXBpZW50IG9idGFpbi90aGVuIGFsbCByZWNpcGllbnRz IG9idGFpbi8NCiAgICA+IChuaXQpIHMvdGhlbiBrZXktZGVyaXZhdGlvbiBrZXkgaXMgbWl4ZWQv dGhlbiB0aGUga2V5LWRlcml2YXRpb24ga2V5IGlzIG1peGVkLyAoeDIpDQogICAgPiANCiAgICA+ IFNlY3Rpb24gNjoNCiAgICA+IA0KICAgID4g4oCcQ29tcHJvbWlzZSBvZiB0aGUga2V5IHRyYW5z cG9ydCBwcml2YXRlIGtleSBvciB0aGUgYWdyZWVtZW50IHByaXZhdGUga2V5IG1heSByZXN1bHQg aW4gdGhlIGRpc2Nsb3N1cmUgb2YgYWxsIGNvbnRlbnRzIHByb3RlY3RlZCB3aXRoIHRoYXQga2V5 LiBDb21wcm9taXNlIG9mIHRoZSBrZXktZGVyaXZhdGlvbiBrZXkgdGhhdCBpcyBlc3RhYmxpc2hl ZCB3aXRoIHRoZSBrZXkgdHJhbnNwb3J0IHByaXZhdGUga2V5IG9yIHRoZSBhZ3JlZW1lbnQgcHJp dmF0ZSBrZXkgbWF5IHJlc3VsdCBpbiBkaXNjbG9zdXJlIG9mIHRoZSBhc3NvY2lhdGVkIGVuY3J5 cHRlZCBjb250ZW50LuKAnQ0KICAgID4gDQogICAgPiBJbiB0aGlzIGRyYWZ0LCBkaXNjbG9zdXJl IG9mIHRoZXNlIGtleXMgd291bGQgbm90IHJlc3VsdCBpbiB0aGUgZGlzY2xvc3VyZSBvZiB0aGUg cHJvdGVjdGVkIGNvbnRlbnQgdW5sZXNzIHRoZSBQU0sgd2FzIGFsc28gZGlzY2xvc2VkLiAgSSBn dWVzcyB0aGUg4oCcbWF54oCdIGhlZGdlcyB0aG9zZSBzdGF0ZW1lbnRzIGFuZCBtYWtlcyB0aGVt IHN0aWxsIHRlY2huaWNhbGx5IHRydWUuICBSRkMgNTY1MiBzYXlzIHRoZSBzYW1lIHRoaW5nIGFi b3V0IHRoZSBwcml2YXRlIGtleXMsIGV4Y2VwdCBpbiB0aGF0IGNhc2UgdGhlIGRpc2Nsb3N1cmUg b2YgdGhlIGtleXMgd291bGQgZGVmaW5pdGVseSBhbGxvdyBkaXNjbG9zdXJlIG9mIHRoZSBwcm90 ZWN0IGNvbnRlbnQuICBTbyBtYXliZSBpbiB0aGlzIGRyYWZ0IHlvdSB3YW50IHRvIHF1YWxpZnkg dGhhdCBpZiB0aGUgcHJpdmF0ZSBrZXlzIGFuZCB0aGUgUFNLIGFyZSBkaXNjbG9zZWQsIHRoZSBw cm90ZWN0ZWQgY29udGVudCBtYXkgYWxzbyBiZSBkaXNjbG9zZWQuDQogICAgPiANCiAgICA+IChu aXQpIHMvcmFuZG9tbHkgZ2VuZXJhdGUga2V5LWRlcml2YXRpb24ga2V5L3JhbmRvbWx5IGdlbmVy YXRlIGtleS1kZXJpdmF0aW9uIGtleXMvDQogICAgPiAobml0Pykgcy9hcyB3ZWxsIGFzIHRoZSBj b250ZW50LWVuY3J5cHRpb24ga2V5L2FzIHdlbGwgYXMgdGhlIGNvbnRlbnQtZW5jcnlwdGlvbiBr ZXlzLw0KICAgID4gKG5pdD8pIHMvb3IgY29udGVudC1hdXRoZW50aWNhdGVkLWVuY3J5cHRpb24g a2V5L29yIGNvbnRlbnQtYXV0aGVudGljYXRlZC1lbmNyeXB0aW9uIGtleXMvDQogICAgPiAobml0 KSBzL0lmIHRoZSBrZXktZW5jcnlwdGlvbiBhbGdvcml0aG0gaXMgZGlmZmVyZW50IHRoYXQvSWYg dGhlIGtleS1lbmNyeXB0aW9uIGFsZ29yaXRobSBpcyBkaWZmZXJlbnQgdGhhbi8NCiAgICA+IChu aXQpIHMvSW1wbGVtZW50ZXIgc2hvdWxkIG5vdC9JbXBsZW1lbnRlcnMgc2hvdWxkIG5vdC8NCiAg ICA+IChuaXQpIHMvc2VuZCB0aGUgc2FtZSBjb250ZW50IGluIGRpZmZlcmVudCBpbiBzZXBhcmF0 ZSBtZXNzYWdlcy9zZW5kIHRoZSBzYW1lIGNvbnRlbnQgaW4gZGlmZmVyZW50Lw0KICAgID4gDQog ICAgPiBUaGFua3MsDQogICAgPiBEYW4NCiAgICA+IA0KICAgID4gT24gMjAxOC0wMy0wNSwgODoy MyBQTSwgIlNwYXNtIG9uIGJlaGFsZiBvZiBSdXNzIEhvdXNsZXkiIDxzcGFzbS1ib3VuY2VzQGll dGYub3JnIG9uIGJlaGFsZiBvZiBob3VzbGV5QHZpZ2lsc2VjLmNvbT4gd3JvdGU6DQogICAgPiAN CiAgICA+ICAgIEkgd291bGQgbGlrZSB0byBtYWtlIHBlb3BsZSBvbiB0aGlzIG1haWwgbGlzdCBh d2FyZSBvZiB0aGlzIEludGVybmV0LURyYWZ0Lg0KICAgID4gDQogICAgPiAgICBSdXNzDQogICAg PiANCiAgICA+ICAgID0gPSA9ID0gPSA9ID0gPSA9ID0NCiAgICA+IA0KICAgID4gICAgQSBuZXcg dmVyc2lvbiBvZiBJLUQsIGRyYWZ0LWhvdXNsZXktY21zLW1peC13aXRoLXBzay0wMy50eHQNCiAg ICA+ICAgIGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkgUnVzc2VsbCBIb3VzbGV5 IGFuZCBwb3N0ZWQgdG8gdGhlDQogICAgPiAgICBJRVRGIHJlcG9zaXRvcnkuDQogICAgPiANCiAg ICA+ICAgIE5hbWU6CQlkcmFmdC1ob3VzbGV5LWNtcy1taXgtd2l0aC1wc2sNCiAgICA+ICAgIFJl dmlzaW9uOgkwMw0KICAgID4gICAgVGl0bGU6CQlVc2luZyBQcmUtU2hhcmVkIEtleSAoUFNLKSBp biB0aGUgQ3J5cHRvZ3JhcGhpYyBNZXNzYWdlIFN5bnRheCAoQ01TKQ0KICAgID4gICAgRG9jdW1l bnQgZGF0ZToJMjAxOC0wMy0wNQ0KICAgID4gICAgR3JvdXA6CQlJbmRpdmlkdWFsIFN1Ym1pc3Np b24NCiAgICA+ICAgIFBhZ2VzOgkJMTMNCiAgICA+ICAgIFVSTDogICAgICAgICAgICBodHRwczov L3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtaG91c2xleS1jbXMtbWl4LXdpdGgt cHNrLTAzLnR4dA0KICAgID4gICAgU3RhdHVzOiAgICAgICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2RyYWZ0LWhvdXNsZXktY21zLW1peC13aXRoLXBzay8NCiAgICA+ICAgIEh0 bWxpemVkOiAgICAgICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaG91c2xleS1j bXMtbWl4LXdpdGgtcHNrLTAzDQogICAgPiAgICBIdG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1ob3VzbGV5LWNtcy1taXgtd2l0aC1wc2st MDMNCiAgICA+ICAgIERpZmY6ICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZm P3VybDI9ZHJhZnQtaG91c2xleS1jbXMtbWl4LXdpdGgtcHNrLTAzDQogICAgPiANCiAgICA+ICAg IEFic3RyYWN0Og0KICAgID4gICAgICBUaGUgaW52ZW50aW9uIG9mIGEgbGFyZ2Utc2NhbGUgcXVh bnR1bSBjb21wdXRlciB3b3VsZCBwb3NlIGEgc2VyaW91cw0KICAgID4gICAgICBjaGFsbGVuZ2Ug Zm9yIHRoZSBjcnlwdG9ncmFwaGljIGFsZ29yaXRobXMgdGhhdCBhcmUgd2lkZWx5IGRlcGxveWVk DQogICAgPiAgICAgIHRvZGF5LiAgVGhlIENyeXB0b2dyYXBoaWMgTWVzc2FnZSBTeW50YXggKENN Uykgc3VwcG9ydHMga2V5IHRyYW5zcG9ydA0KICAgID4gICAgICBhbmQga2V5IGFncmVlbWVudCBh bGdvcml0aG1zIHRoYXQgY291bGQgYmUgYnJva2VuIGJ5IHRoZSBpbnZlbnRpb24gb2YNCiAgICA+ ICAgICAgc3VjaCBhIHF1YW50dW0gY29tcHV0ZXIuICBCeSBzdG9yaW5nIGNvbW11bmljYXRpb25z IHRoYXQgYXJlDQogICAgPiAgICAgIHByb3RlY3RlZCB3aXRoIHRoZSBDTVMgdG9kYXksIHNvbWVv bmUgY291bGQgZGVjcnlwdCB0aGVtIGluIHRoZQ0KICAgID4gICAgICBmdXR1cmUgd2hlbiBhIGxh cmdlLXNjYWxlIHF1YW50dW0gY29tcHV0ZXIgYmVjb21lcyBhdmFpbGFibGUuICBPbmNlDQogICAg PiAgICAgIHF1YW50dW0tc2VjdXJlIGtleSBtYW5hZ2VtZW50IGFsZ29yaXRobXMgYXJlIGF2YWls YWJsZSwgdGhlIENNUyB3aWxsDQogICAgPiAgICAgIGJlIGV4dGVuZGVkIHRvIHN1cHBvcnQgdGhl bSwgaWYgY3VycmVudCBzeW50YXggdGhlIGRvZXMgbm90DQogICAgPiAgICAgIGFjY29tbW9kYXRl ZCB0aGVtLiAgSW4gdGhlIG5lYXItdGVybSwgdGhpcyBkb2N1bWVudCBkZXNjcmliZXMgYQ0KICAg ID4gICAgICBtZWNoYW5pc20gdG8gcHJvdGVjdCB0b2RheSdzIGNvbW11bmljYXRpb24gZnJvbSB0 aGUgZnV0dXJlIGludmVudGlvbg0KICAgID4gICAgICBvZiBhIGxhcmdlLXNjYWxlIHF1YW50dW0g Y29tcHV0ZXIgYnkgbWl4aW5nIHRoZSBvdXRwdXQgb2Yga2V5DQogICAgPiAgICAgIHRyYW5zcG9y dCBhbmQga2V5IGFncmVlbWVudCBhbGdvcml0aG1zIHdpdGggYSBwcmUtc2hhcmVkIGtleS4NCiAg ICA+IA0KICAgID4gICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCiAgICA+ICAgIFNwYXNtIG1haWxpbmcgbGlzdA0KICAgID4gICAgU3Bhc21AaWV0Zi5v cmcNCiAgICA+ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Bhc20N CiAgICA+IA0KICAgID4gDQogICAgDQogICAgDQoNCg== From nobody Wed Mar 21 06:08:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3115127522; Wed, 21 Mar 2018 06:08:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s0L-3k7su82F; Wed, 21 Mar 2018 06:08:12 -0700 (PDT) Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id D921F12DA13; Wed, 21 Mar 2018 06:08:11 -0700 (PDT) Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id B63423741012; Wed, 21 Mar 2018 13:08:11 +0000 (UTC) X-Virus-Scanned: amavisd-new at katezarealty.com Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 7Z5D7AxZjq-Q; Wed, 21 Mar 2018 09:08:09 -0400 (EDT) Received: from dhcp-98fb.meeting.ietf.org (dhcp-98fb.meeting.ietf.org [31.133.152.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id BECD53741011; Wed, 21 Mar 2018 09:08:08 -0400 (EDT) To: LAMPS , "saag@ietf.org" , PKIX From: "Dr. Pala" Organization: OpenCA Labs Message-ID: Date: Wed, 21 Mar 2018 13:08:07 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000404000703020301010105" Archived-At: Subject: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2018 13:08:15 -0000 This is a cryptographically signed message in MIME format. --------------ms000404000703020301010105 Content-Type: multipart/alternative; boundary="------------1419891C6CABA6A3536CA3B5" Content-Language: en-US This is a multi-part message in MIME format. --------------1419891C6CABA6A3536CA3B5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, unfortunately I missed the sec-dispatch session, but I have some important considerations about the document. In general, short-lived certificates have been around for many years and for many different applications (nothing new here), however nobody who have been working with PKI long enough would actually made the case that the security levels of short-lived-no-revo and any-lived-plus-revo are the same (which seems the life-motif of the presentation and the document itself).= Other aspects that I think shall be revisited are the lack of considerations about the usability of deployed infrastructures (when no revocation is assumed) and some wrong considerations in the document about validity periods of OCSP Responses and CRLs (that clearly undermine the equivalence claim). _*Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev Support*_ The statements that made me jump on my seat is the claim that short-lived certificates without revocation support (BTW, short-lived does not necessarily exclude revocation support) and certificates (short-lived or not) vs. any-lived certificates with revocation support have the same level of security as long as the validity period of the short-lived ones is equal or shorter than CRLs or OCSP validity. I find this quite a puzzling statement. For once, there should be considerations about the fact that if a key is compromised and it is used by a malicious entity to attack/disrupt/etc. another entity, the rightful owner of the certificate does not have any possibility to prove that someone else did it - there is no authenticated trail (OCSP response or CRL) that can be used in this case and this can lead, in some environments, to legal implications. I am curious about how do the authors address this point, maybe some considerations shall be made here.= Also the claim that: " it is hard to justify why the CA or a delegate needs to both sign blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to tell relying parties that blob-1 is still valid." is quite curious and, I might say, misleading. Although the revocation status (either in the form of an OCSP or CRL) does not provide additional information besides the validity when the certificate is not revoked, it does provide quite a lot of useful information when the certificate is revoked (e.g., when a compromised happened, the reason for revocation - e.g., key compromise, a person has left the organization, a HW token is broken, etc.). I would prefer the authors to explain what they mean in more extensive and engineering-appropriate form. This is another evidence that the two systems are definitely NOT equivalent from a security perspective. Another example about the fact that some form of revocation is still needed comes from the document itself (thus contradicting, IMO, the main claim of the document - 5.1): "No matter how short-term these short term certificates are, there is a certain window of time when the attacker can use the certificate.=C2=A0 This can often be mitigated with application-level= measures." this is "application-level measures =3D=3D application-level revocation".= This means that now, instead of having standardized ways to check for the status of certificates, each application need to implement a way to deal with it on an ad-hoc basis and being able to distribute securely this information to all relying parties. Undoubtedly, for anybody who has ever had to deal with such problems this becomes a quite costly and intractable problems very quickly. Maybe some considerations about this should be added in the document as well. _*Usability of Deployed Infrastructures*_ One important section that is missing is: how do these no-revocation PKIs look like? There are basically two main choices here: 1. Deploy a 2 level-only PKI. That means having a Trust Anchor that issues directly the EE certificates. Besides all security considerations about TAs being online (as required in short-lived environments), this makes it very difficult to deploy. *Important considerations should be made in this case. * 2. Deploy a 3+ level PKIs (current best practices). This approach involves having (usually one) intermediate CAs (there can be more). In this case, the TAs issue the intermediate CAs' certificates and the last intermediate CAs issue the EE ones. Obviously, intermediate CAs can not have the same short validity period as the EE certs, therefore the need for revocation (at least at the intermediate CAs level) is evident. *Important considerations shall be made also in this case.* *Wrong Considerations about CRLs and OCSP Responses validity periods* In the document, statements like the following shall be fixed and expanded for clarity: "If a CRL has a nextUpdate field that is 4 days in the future, a typical system will not attempt to fetch a new one before those 4 days have elapsed." And then it continue by stating the following: "For this reason, moving to STAR certificates provides a similar level of security to what is generally practiced on the web." Since the first statement is incomplete and, thus, misleading - the second statement does not hold. Let me explain further for the people that are not familiar with how CRLs and OCSP are processed. Although there is a validity period for revocation information, it is well-known that the expiration field indicates the time "within a new revocation status information will be made available" and it is NOT "this is the revocation status of the target certificate until the expiration" - common practice is that when a revocation event occurs, new CRLs and OCSP responses for the revoked certificates are made available immediately or within few hours at most. It is an important distinction that highlights also why the lack of revocation information makes the system less secure. Although it is quite evident why and since this is not addressed in the document, it might be useful to spell it out. In a multi-party environment, different applications might have (a) different strategies when it comes to caching of the revocation information and/or (b) check the revocation information at different times. Let's make the case of 2 parties checking the rev info for the same certificate. If party A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, party B retrieves it at {time2} and caches it until {time2+delta}. Let's assume that time2 > time1 and that new revocation status information is already available at {time2}. This means that, although party A is still vulnerable until {time1+delta}, party B is not. In a short-lived cert environment w/out revocation ALL parties are VULNERABLE until the compromised {key+certificate} expires. It seems quite clear that the two environments (short-lived w/ no revo and any-lived w/ revo) do not have the same security properties. Therefore I think that the authors ought to demonstrate the equivalence of security levels (not just assume it as hypothesis - given I just disproved it) or to remove all claims that the two environments are actually equivalent from as security perspective and to add specific considerations for short-lived-no-revo about the the fact that not supporting revocation is inherently weaker because it potentially exposes all parties to attacks (e.g., MITM, un-authorized access to resources, etc.) that can not be stopped (unless you implement application-level revocation.. and, therefore, re-introduce revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manage across application fashion). *Final Considerations* I am not opposed at the concept of this document to be considered for BCP, however all the above issues MUST, IMO, be addressed before the document can be considered further. I think I already raised these considerations at the last IETF, but I do not think the authors missed or have not considered the provided feedback. I hope that a more explicit and written feedback might be taken into considerations. Just my 2 cents form an old barnacle... :D Cheers, Max --=20 Best Regards, Massimiliano Pala, Ph.D. OpenCA Labs Director OpenCA Logo --------------1419891C6CABA6A3536CA3B5 Content-Type: multipart/related; boundary="------------B13C537DA97196213E3CF5A2" --------------B13C537DA97196213E3CF5A2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi all,

unfortunately I missed the sec-dispatch session, but I have some important considerations about the document. In general, short-lived certificates have been around for many years and for many different applications (nothing new here), however nobody who have been working with PKI long enough would actually made the case that the security levels of short-lived-no-revo and any-lived-plus-revo are the same (which seems the life-motif of the presentation and the document itself).

Other aspects that I think shall be revisited are the lack of considerations about the usability of deployed infrastructures (when no revocation is assumed) and some wrong considerations in the document about validity periods of OCSP Responses and CRLs (that clearly undermine the equivalence claim).

Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev Support

The statements that made me jump on my seat is the claim that short-lived certificates without revocation support (BTW, short-lived does not necessarily exclude revocation support) and certificates (short-lived or not) vs. any-lived certificates with revocation support have the same level of security as long as the validity period of the short-lived ones is equal or shorter than CRLs or OCSP validity. I find this quite a puzzling statement. For once, there should be considerations about the fact that if a key is compromised and it is used by a malicious entity to attack/disrupt/etc. another entity, the rightful owner of the certificate does not have any possibility to prove that someone else did it - there is no authenticated trail (OCSP response or CRL) that can be used in this case and this can lead, in some environments, to legal implications. I am curious about how do the authors address this point, maybe some considerations shall be made here.

Also the claim that:

" it is hard to justify why the CA or a delegate needs to both sign blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to tell relying parties that blob-1 is still valid."

is quite curious and, I might say, misleading. Although the revocation status (either in the form of an OCSP or CRL) does not provide additional information besides the validity when the certificate is not revoked, it does provide quite a lot of useful information when the certificate is revoked (e.g., when a compromised happened, the reason for revocation - e.g., key compromise, a person has left the organization, a HW token is broken, etc.). I would prefer the authors to explain what they mean in more extensive and engineering-appropriate form. This is another evidence that the two systems are definitely NOT equivalent from a security perspective.

Another example about the fact that some form of revocation is still needed comes from the document itself (thus contradicting, IMO, the main claim of the document - 5.1):

"No matter how short-term these short term certificates are, there is a certain window of time when the attacker can use the certificate.=C2=A0 This can often be mitigated with application-l= evel measures."

this is "application-level measures =3D=3D application-level revocation". This means that now, instead of having standardized ways to check for the status of certificates, each application need to implement a way to deal with it on an ad-hoc basis and being able to distribute securely this information to all relying parties. Undoubtedly, for anybody who has ever had to deal with such problems this becomes a quite costly and intractable problems very quickly. Maybe some considerations about this should be added in the document as well.

Usability of Deployed Infrastructures

One important section that is missing is: how do these no-revocation PKIs look like? There are basically two main choices here:

  1. Deploy a 2 level-only PKI. That means having a Trust Anchor that issues directly the EE certificates. Besides all security considerations about TAs being online (as required in short-lived environments), this makes it very difficult to deploy. Important considerations should be made in this case.

  2. Deploy a 3+ level PKIs (current best practices). This approach involves having (usually one) intermediate CAs (there can be more). In this case, the TAs issue the intermediate CAs' certificates and the last intermediate CAs issue the EE ones. Obviously, intermediate CAs can not have the same short validity period as the EE certs, therefore the need for revocation (at least at the intermediate CAs level) is evident. Important considerations shall be made also in this case.

Wrong Considerations about CRLs and OCSP Responses validity periods

In the document, statements like the following shall be fixed and expanded for clarity:

"If a CRL has a nextUpdate field that is 4 days in the future, a typical system will not attempt to fetch a new one before those 4 days have elapsed."

And then it continue by stating the following:

"For this reason, moving to STAR certificates provides a similar level of security to what is generally practiced on the web."

Since the first statement is incomplete and, thus, misleading - the second statement does not hold. Let me explain further for the people that are not familiar with how CRLs and OCSP are processed. Although there is a validity period for revocation information, it is well-known that the expiration field indicates the time "within a new revocation status information will be made available" and it is NOT "this is the revocation status of the target certificate until the expiration" - common practice is that when a revocation event occurs, new CRLs and OCSP responses for the revoked certificates are made available immediately or within few hours at most.

It is an important distinction that highlights also why the lack of revocation information makes the system less secure. Although it is quite evident why and since this is not addressed in the document, it might be useful to spell it out.

In a multi-party environment, different applications might have (a) different strategies when it comes to caching of the revocation information and/or (b) check the revocation information at different times. Let's make the case of 2 parties checking the rev info for the same certificate. If party A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, party B retrieves it at {time2} and caches it until {time2+delta}. Let's assume that time2 > time1 and that new revocation status information is already available at {time2}. This means that, although party A is still vulnerable until {time1+delta}, party B is not. In a short-lived cert environment w/out revocation ALL parties are VULNERABLE until the compromised {key+certificate} expires.

It seems quite clear that the two environments (short-lived w/ no revo and any-lived w/ revo) do not have the same security properties.

Therefore I think that the authors ought to demonstrate the equivalence of security levels (not just assume it as hypothesis - given I just disproved it) or to remove all claims that the two environments are actually equivalent from as security perspective and to add specific considerations for short-lived-no-revo about the the fact that not supporting revocation is inherently weaker because it potentially exposes all parties to attacks (e.g., MITM, un-authorized access to resources, etc.) that can not be stopped (unless you implement application-level revocation.. and, therefore, re-introduce revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manage across application fashion).

Final Considerations

I am not opposed at the concept of this document to be considered for BCP, however all the above issues MUST, IMO, be addressed before the document can be considered further. I think I already raised these considerations at the last IETF, but I do not think the authors missed or have not considered the provided feedback. I hope that a more explicit and written feedback might be taken into considerations.

Just my 2 cents form an old barnacle... :D

Cheers,
Max

--
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
3D"OpenCA
--------------B13C537DA97196213E3CF5A2 Content-Type: image/png; name="cndojoacigamfbdj.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="cndojoacigamfbdj.png" iVBORw0KGgoAAAANSUhEUgAAAGQAAAA2CAMAAAAGesyaAAADAFBMVEUsJiEAAQAKAwMABwoX BwESCQAqDgEkEQItFQESGykaGh0WGyE1FwE9GwJHHwElJiY4JBQmKDE1KCAfLUQ8KygoMEAq MjpXKgs/MilMMR0pOFEyOUo4OTo1OkRqMgpjOBlpNxUwQV1DPz48QExdOyM4QVV+OQRRQzo1 SGdDR0lDSFJfRDFASVyaPwF+RRpNT1I9UXlwSi8+UnNDUm6hQgCPRhBdUEZTUlBKVGlPVF27 PgCaSANtUT57VBerSQOMUgxHW4KMUiepTwmJVDh6WT6KVjGCWDpRYH21TwFiYF57YgJXYXae VR+lVRZrYld1ZiB7YEuSYQBgZW+8VAlkZWjBVQCfXiqqXwG1WhPLVgedYDazXiDZVgCWZEDV WQJ1blapYjbXWgDRXACMaU6WbgCiZjnIXw9mcIixZC6pZjJ/cUeLbFdycmZ4cGnnWwNwc3Wq aS6BcGeobwndXwzkXwLgYgDaYwyMeCq/bQHJaBi9ajDMagWVegvRZxzVaAvXaQDLainqZAuv cEPrZQDQaSyockrFbSvmZwnabQLvZwDpaQB0fpPkaxGld1d+f3/3aACfeV6RfG2JfnLebSF7 gYy2fQmugQCigxW8d0K3eEr1bQXaciTicRqKgnzNewHuchbUdzKYiDzrdwKah1erjAvOfEXl eSq5g1qYjGikiHO2kADigwC2hmSZjIGGj6aHkJzQiwCximixim/EkAORkZGVkYrOh0rPiVL5 giTvhDKkk4LMjF23mR+zmTrhikrviDzsi0TAlHDCnwvKlGqpnJLdlF2boKy+m324nImkoZ+e o6XKpgrloATwl1WypZPOn3zfqQjYrgLBrVDdo3nGq5mysa/SrI7dq4bqqXTOrpWttL+6s6uw tbe/t4rhvALetpjQuqnuwwe9v8LAv7vauqD3xA68w9XBw83rvJfRwbXFyMvbxbPNyMP8zgTc zMDr0mb91xLM1ODQ1NfS1c7p0sD70bPd19PX4qj83cje4+Xr4tv54NLp7/Hy9PHw9fj6/v3Y ktvJAAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAjrSURBVFjDtVcNWFPXGT6E+l9BZ0EF sTKEIQaUAIrTZdYqxqG0I3UjIuiDM0ipoyO5l0rFh2PE472EoIJKL9hQV2OxqM+USgFL4r9g EaIoQxgqKBZBR+nGGhXYdwNro0Kfkcp3ntzce/7e8/2e70PoJVDl3bMlZyurUSsaKnqESrMp lYrByozCjUOEUZORodMRVsViTjJc8GbLUGCUUstLv1SyLCGch8DGRiDPe/kY5/2HCQQTxZEE y4fb2gDI8KjjLxsjfyyc3lZgM3KixwgeY4TEzk7+kjHODbeb6u0xAhiw8XgFMOxolpP6J75U jLZfp6dzHIcBYCQbIBB4sCxDOLK6eMAVT39it57+e09ysCnDUtnrJ0vS5ZMW0PBFWDbd40G/ 85sH2KeXvj94u/flX8/2J6kYQkhkHbzWbkdH0N0UDN8sURS8uMd9dMzPL7BxIIjOayuWLBIf 70RPUPjxLouBEgVhMaYuWXQlMjwsN+eFTR4cDZ4werRDYOoAIFkrptm/Ni0gthOt9Q4yWQxc AwyWTbacW0sTDGoJen4P002/2S7LjgV6BpY1N6OO5g5eeiZTY/P9b1FzRwfKWuk9p/72ct+N puKpq32qLVaexOCCJB91aezt5y6zt7fXILSdJZjlVr1w0mCR66x6FL3QOXiUQ2a0k/sFlDlq 1LzUMQ4uxxycjl0LWO1bBsY6yXR3wSTJGxqLhdsJHDsS9cwF47XlvcQGQiXhRbih/HkQv4XO cajZb6GDu7PTFEdPkVu0k4vQyd3Jc/SUwNnB+RJ/XsI9ptZDIxMly3dbLNwGnGBJF+Id3cZM 9ui8Gjq5P/TDiRCegbOFgSKRo5e7yNHV2dnPdVb0bHfHQCevNIV/rxqrX48oFQdYcpKMtYRb juxtfqRypNACK28+j3FsqcilAD0ADuIWCt0yRa7zRNEOY2YELhW5CV2dXVKixH8BC+s8GDN9 wWKxf94zpsRiJuWmBYjgndsKFmu5Bc+D3HQXCcu7QTFTMl3HF0SLxruLvGa4zUqdMGFWqqfX 3GSxN0y6NT154i+v75zvH2thXiWgY2YVElhwYl9NYxarlr0grlQn92DQt1vBUk+nUFeHGZme gUIvl1RXr1AnV/fx6zd4v3HptM/YaXbrzmYFePu2WpowYRlJo+2PGLb2d9WE5bw1L4DcnOco 9HIcH3o02HOecMqMJhQqdLPXpArHl2uEo+Na8qZPXxw0+bVx46bFzhw3eZylM2dgwkbWW3Iy Jp9lMDe9H2/raiqPCy5/fHSCu+M7mkffoQuzQhvRhWVlj1FcWTfq6dwdElJmarxedr/u3P6C Nn7Fk95ol8wRjIMsOLGJSwLm/OMGjlFHJ7hqelDuxdMlpbU16JvqlJTamivoBjrfUgNB69zf b6Fr1TWPKmtOw9xCdLayEFWvBlaSfmEBsk6LSdTMNnQaldTe7Qfj20yveddR2toVEevCi9/f fmntR7ErtvompmyICM9qyYpZsG3FhqwNYRH5KUtyW7eGRRxfH1OHDv0ZXH6ihbSyVYzSY3Fu BkVR9LaS2wPxUxyTFpu2eGverr+dezvi0ttpOy/tTKlL2ZkWs6p4VV1Kyq60nevS8iLyi1tW hfNWzMfhYT+ArAQ+5odRBENjlRW5F/vH6O7u7urpXtvR/bQbmX/dPd3w7Ok+2Ij4ry5o0N/d Y1p7qA21FodhFRc1ctjIsXZ2Y18VcwCixNgcWlgVbUiue3b3J33te7497vv/oT1Bj5/7br1R grYlfrReSqmwPDyK0GqOUHKWj/RwP0J0ZlmsK3o2HP+7Qt9HBr3BYH5aNL3FG/+ul8sjKcxH dRJFGJkhfKxgmM2rUoaSg5h4GAwXJsF00dRGq+/21k2EF7o50oNswrNfsYUQKRBIZWIFh3lu aLNe1F++bjXGyWyzZiGoYFYLx5Ys4v0R3GWRdBHNErBiSiqVRhHMyeaYrMQ4SENWCvEcfhCm GIzpqKlm27KTSWUcAX1goBw5oATctDb33aLTYV5SWoaXP5+gyqlFdnZ23nB+plcnREv0RWJC BVkrrBJ1BewMmlVpgRUQF7wpItMJTcsJ34GBRVaFdQZaqoqxFmSb3qDQgu1A2GI4YAnODkQY IOhklDKzo2C1IV2sijzdhjorqwefNdL6ihxzegU7SynexHgBMXy+xWFG8qvdf91D8WpRi41q KFl02YaswYNkULTeLC9CFFK4bDHDMmZbhnuXSOdAsnN1LxgfVu7ZvG8LpSJUlO/gnaWQFwYv JpZeKdUaSC8ApuhIShYQYp5yWQ0oPgVXPtkcHz/fx5rqqzosHSSlBYHIxKSolJcUsIIpnzkh mt4b7Z/tOzBRQWaA6uNCNdet0nxLkL8CgzeQKIlCXaHjXR9MlqQn9Y1fNd5RE0zF/ryKwVR/ JMnsI3S8Umcw6NRYxRuUKqk3lfnKeGcTySAx5hy+7WfgZOv4uLLl0w8wUah71QLBpJeXq/eM VVivV8jz6lB2ofWF6i1dEYRZfMJ4piE+ZweNeb7A2VVyKEx6vjt1z/ghMehVKiUpyt1VYBXC N6j0Q4Mazp7TvvndhIaGhqqvP1bwFk0YRYR5RoLR+PkWmlIpV/oEDQ6jB9Wc3Z6bm6zLTtLl gLC4LVWXz5Q1ffbV5oZ24wmsV/NeKTlirmg+u/q7w7/38PDdeKF8UBgXs2kV4WUC0YR/KOLv Pby3L5O30yvG9vY/6vX8JSbb2je96coXX5QPznqfokKKEPWBAwd20ApaTWsP7LnTfsd42at3 +B+H7+zRUfwZZMutN6baHCX5+Ou9Zy4f3nuiKr7KaHxoNDbsSwhp6htvfyg3Zw901G+ttVlT Ja34/E+fvrXmvY3713xy6tSZfadOJby7X1P/vwn/MeaYr0mF7IMEq690Gu95KwQq5L5K+f59 qGUtaZMSciHMKjdVbY6zFqRC/pv3LgxY5tcW0pjIpGGJ7+89kxBnbXZSmjuz7CeyihyG8fbd XXYdrWlqQg+sZWTdzPqBB68VEdnkzDY0lHSjSD9/GRpaMt3OWqLpQENOTf/PpP8CK9ZVVe2a 8XoAAAAASUVORK5CYII= --------------B13C537DA97196213E3CF5A2-- --------------1419891C6CABA6A3536CA3B5-- --------------ms000404000703020301010105 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CyAwggUyMIIEGqADAgECAhEAu2YCW4tRQdGHMc0S/FQsNDANBgkqhkiG9w0BAQsFADCBlzEL MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs Zm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0Eg Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwHhcNMTcxMjAxMDAw MDAwWhcNMTgxMjAxMjM1OTU5WjAkMSIwIAYJKoZIhvcNAQkBFhNkaXJlY3RvckBvcGVuY2Eu b3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyEDKYfy+DFhtDn8bIXyP25Xe DjUIkMQDm90A1JPoQ4tuTk6kXwulPvAmvtLGuRAzEqFpV/fqz4sAlx8FgxvRZ5PunZ1H1/lJ CNEdir53Xv8TEf+R/n+Ca5RNUR+GhS72zhp9xx8uDRZds2DeXvW9uhYp9nsbX6rWIFT5YfWF 1SukFXwXSnHuXc9nDT6p0Kp6UNzusn/lMhXhIwgpNA26/mHAdScYyMoB4yaZeMpdZN75XGWO slhXcXdeGJo93E48kffdu0yo4WTbpLwhs/IrkG4OXB1N3Bf+9oHZwVun1hlCZEfuSit0mvrx x8wzPCPiggXu6j6VqPoJqecV6xKCHwIDAQABo4IB6TCCAeUwHwYDVR0jBBgwFoAUgq9sjPjF /pZhfOgfPStxSF7Ei8AwHQYDVR0OBBYEFEPV9allspkmYqkQRx2BlAdbOrjhMA4GA1UdDwEB /wQEAwIFoDAMBgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsGAQUFBwMEBgsrBgEEAbIxAQMF AjARBglghkgBhvhCAQEEBAMCBSAwRgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggr BgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUuY29tb2RvLm5ldC9DUFMwWgYDVR0fBFMwUTBPoE2g S4ZJaHR0cDovL2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBQ2xpZW50QXV0aGVudGljYXRp b25hbmRTZWN1cmVFbWFpbENBLmNybDCBiwYIKwYBBQUHAQEEfzB9MFUGCCsGAQUFBzAChklo dHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5j b20wHgYDVR0RBBcwFYETZGlyZWN0b3JAb3BlbmNhLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEA g+REupW946f7esdYmE1QxsYlkubErxz8JLovVDSKTHwxR1/VxF/B7rGeiSPBHTmKQYwlWCrp eHZNfzaDDkDamwLXm7v4+brNfQKRpOLnYPQQffp7xim72INakLgts8d5I7bic785dj4M5JP4 XA2qUD9wduwNwquua6v7zM3chpoRjapumzLNDDr47GccOKAZYaaqFwbpwJPQYuiC07WWnn7g FzdNKYN6VM6Re6wVEHP6fEvNrleV0pf1iFjLKugnriGKL9wj6xX25JsMmGmqZcfdpnkTE4Zf eQBEZVnn8s7HBX+MA/K+YnHxRwA2c5XwNbEhZ2rvh2uFIMXBDlt+tDCCBeYwggPOoAMCAQIC EGqb4Tg7/ytrnwHV2binUlYwDQYJKoZIhvcNAQEMBQAwgYUxCzAJBgNVBAYTAkdCMRswGQYD VQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNP TU9ETyBDQSBMaW1pdGVkMSswKQYDVQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0 aG9yaXR5MB4XDTEzMDExMDAwMDAwMFoXDTI4MDEwOTIzNTk1OVowgZcxCzAJBgNVBAYTAkdC MRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNV BAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRo ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAvrOeV6wodnVAFsc4A5jTxhh2IVDzJXkLTLWg0X06WD6cpzEup/Y0dtmEatrQ PTRI5Or1u6zf+bGBSyD9aH95dDSmeny1nxdlYCeXIoymMv6pQHJGNcIDpFDIMypVpVSRsivl JTRENf+RKwrB6vcfWlP8dSsE3Rfywq09N0ZfxcBa39V0wsGtkGWC+eQKiz4pBZYKjrc5NOpG 9qrxpZxyb4o4yNNwTqzaaPpGRqXB7IMjtf7tTmU2jqPMLxFNe1VXj9XB1rHvbRikw8lBoNoS WY66nJN/VCJv5ym6Q0mdCbDKCMPybTjoNCQuelc0IAaO4nLUXk0BOSxSxt8kCvsUtQIDAQAB o4IBPDCCATgwHwYDVR0jBBgwFoAUu69+Aj36pvE8hI6t7jiY7NkyMtQwHQYDVR0OBBYEFIKv bIz4xf6WYXzoHz0rcUhexIvAMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEA MBEGA1UdIAQKMAgwBgYEVR0gADBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9k b2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFk ZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJ KoZIhvcNAQEMBQADggIBAHhcsoEoNE887l9Wzp+XVuyPomsX9vP2SQgG1NgvNc3fQP7TcePo 7EIMERoh42awGGsma65u/ITse2hKZHzT0CBxhuhb6txM1n/y78e/4ZOs0j8CGpfb+SJA3GaB Q+394k+z3ZByWPQedXLL1OdK8aRINTsjk/H5Ns77zwbjOKkDamxlpZ4TKSDMKVmU/PUWNMKS TvtlenlxBhh7ETrN543j/Q6qqgCWgWuMAXijnRglp9fyadqGOncjZjaaSOGTTFB+E2pvOUtY +hPebuPtTbq7vODqzCM6ryEhNhzf+enm0zlpXK7q332nXttNtjv7VFNYG+I31gnMrwfHM5td hYF/8v5UY5g2xANPECTQdu9vWPoqNSGDt87b3gXb1AiGGaI06vzgkejL580ul+9hz9D0S0U4 jkhJiA7EuTecP/CFtR72uYRBcunwwH3fciPjviDDAI9SnC/2aPY8ydehzuZutLbZdRJ5PDEJ M/1tyZR2niOYihZ+FCbtf3D9mB12D4ln9icgc7CwaxpNSCPt8i/GqK2HsOgkL3VYnwtx7cJU mpvVdZ4ognzgXtgtdk3ShrtOS1iAN2ZBXFiRmjVzmehoMof06r1xub+85hFQzVxZx5/bRaTK TlL8YXLI8nAbR9HWdFqzcOoB/hxfEyIQpx9/s81rgzdEZOofSlZHynoSMYIEODCCBDQCAQEw ga0wgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNV BAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01P RE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEAu2YC W4tRQdGHMc0S/FQsNDANBglghkgBZQMEAgEFAKCCAlswGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTgwMzIxMTMwODA3WjAvBgkqhkiG9w0BCQQxIgQgIDZR ZErkHOxCzNk40CdSvOLug7FhSF7QiFe2IrN+w1AwbAYJKoZIhvcNAQkPMV8wXTALBglghkgB ZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG 9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBvgYJKwYBBAGCNxAEMYGwMIGtMIGX MQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT YWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJT QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRALtmAluLUUHR hzHNEvxULDQwgcAGCyqGSIb3DQEJEAILMYGwoIGtMIGXMQswCQYDVQQGEwJHQjEbMBkGA1UE CBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P RE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJTQSBDbGllbnQgQXV0aGVudGljYXRp b24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRALtmAluLUUHRhzHNEvxULDQwDQYJKoZIhvcNAQEB BQAEggEAWkwRcg7GJ2d8VqMzjwZen8Werrk2JtstgM5YJq2X2NLodXCLqON3NbWIBxCvQx7n vAY2TaoZ0qSd6wi7iEDCS8ZMngy7yclEken56wLUjgJ3NED5+VUGSkv/+5mm63/txMuFBOMG ZT9X9m6Fi+1SL64YtXRjDlmHA0FQV+EPfXKz4xHo/z4WiJn/yqNmcfbJJSZh29J6Fniy+INF QA5DoLMLuK4vWybKS83bz0VhX5Q03AhD7WPrEWwDlvMn2IJcGnhCzcz6wPTfNLzb+ct3UoAH OUMq8p8tPESyxp+ZK8WuGnET0JLOiSsDzzm/wKfufFdjasJvQ4jehPOvLlP0CQAAAAAAAA== --------------ms000404000703020301010105-- From nobody Wed Mar 21 06:23:01 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5279126DFB for ; Wed, 21 Mar 2018 06:23:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqVrW3QzLBzS for ; Wed, 21 Mar 2018 06:22:58 -0700 (PDT) Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id A6CEF1200A0 for ; Wed, 21 Mar 2018 06:22:58 -0700 (PDT) Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id 896433741012 for ; Wed, 21 Mar 2018 13:22:58 +0000 (UTC) X-Virus-Scanned: amavisd-new at katezarealty.com Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id hE_LsekTHw9J for ; Wed, 21 Mar 2018 09:22:52 -0400 (EDT) Received: from dhcp-98fb.meeting.ietf.org (dhcp-98fb.meeting.ietf.org [31.133.152.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id A7AF83741011 for ; Wed, 21 Mar 2018 09:22:51 -0400 (EDT) To: spasm@ietf.org References: <7E8301B2-B15E-4B3D-A559-4F29D8031F2A@vigilsec.com> From: "Dr. Pala" Message-ID: <6a779839-fede-3d96-6ab9-993d0688e25f@openca.org> Date: Wed, 21 Mar 2018 13:22:50 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <7E8301B2-B15E-4B3D-A559-4F29D8031F2A@vigilsec.com> Content-Type: multipart/alternative; boundary="------------C0CE0C5289FA6320AA552FF2" Content-Language: en-US Archived-At: Subject: Re: [lamps] Revocation Request Format? X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2018 13:23:01 -0000 This is a multi-part message in MIME format. --------------C0CE0C5289FA6320AA552FF2 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit +1 to Russ's response. Some solutions I saw deployed involve the "owner" of the account for those keys to sign a single CMS with the administrative (or account) key/certificate and then to submit the generated signed message through a web-portal. Mass-revocation (or mass-any-pki-op) is not currently handled well with existing protocols, if I am not mistaken, unfortunately. So, there might be mixed proprietary/standard combination that are, today, more efficient. Things might happen (most probably outside IETF) to address these cases, especially for IoT environments. Cheers, Max On 3/5/18 4:58 PM, Russ Housley wrote: > Phill: > > PKCS#10 does not specify a method to request certificate revocation. > > CMP has a Revocation Request; see Section 5.3.9 of RFC 4210. > > CMC has a Revocation Request; see Section 6.11 of RFC 5272. > > EST does not specify a method to request certificate revocation, but > it does specify a way to carry a "Full PKI Request", which could be a > CMC Revocation Request. > > SCEP does not specify a method to request certificate revocation. > > Russ > > On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker > > wrote: > > Do we have a PKIX revocation request format? > > I am asking because of a detail in the Trustico situation in which > a file of 23K private keys was emailed to a CA to request revocation. > > At the point, the circumstances of that situation are not clear. > But I can see a scenario in which it is entirely plausible that a > CA reseller would have access to large numbers of TLS private keys > and that is when they are either hosting or managing the Web sites. > > The management interfaces that allow Web sites to be wheeled > around a data center have become very sophisticated of late with > virtualization and much of that infrastructure is 'secret sauce'. > > What might appear to be a five racks of 100 separate machines is > likely visible in the management console as one single entity. > > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --------------C0CE0C5289FA6320AA552FF2 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

+1 to Russ's response.

Some solutions I saw deployed involve the "owner" of the account for those keys to sign a single CMS with the administrative (or account) key/certificate and then to submit the generated signed message through a web-portal.

Mass-revocation (or mass-any-pki-op) is not currently handled well with existing protocols, if I am not mistaken, unfortunately. So, there might be mixed proprietary/standard combination that are, today, more efficient.

Things might happen (most probably outside IETF) to address these cases, especially for IoT environments.

Cheers,
Max


On 3/5/18 4:58 PM, Russ Housley wrote:
Phill:

PKCS#10 does not specify a method to request certificate revocation.

CMP has a Revocation Request; see Section 5.3.9 of RFC 4210.

CMC has a Revocation Request; see Section 6.11 of RFC 5272.

EST does not specify a method to request certificate revocation, but it does specify a way to carry a "Full PKI Request", which could be a CMC Revocation Request.

SCEP does not specify a method to request certificate revocation.

Russ

On Fri, Mar 2, 2018 at 9:24 AM, Phillip Hallam-Baker <phill@hallambaker.com> wrote:
Do we have a PKIX revocation request format?

I am asking because of a detail in the Trustico situation in which a file of 23K private keys was emailed to a CA to request revocation.

At the point, the circumstances of that situation are not clear. But I can see a scenario in which it is entirely plausible that a CA reseller would have access to large numbers of TLS private keys and that is when they are either hosting or managing the Web sites.

The management interfaces that allow Web sites to be wheeled around a data center have become very sophisticated of late with virtualization and much of that infrastructure is 'secret sauce'.

What might appear to be a five racks of 100 separate machines is likely visible in the management console as one single entity.



_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--------------C0CE0C5289FA6320AA552FF2-- From nobody Wed Mar 21 10:53:52 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC19112E741 for ; Wed, 21 Mar 2018 10:53:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s30KWrGRGn3Z for ; Wed, 21 Mar 2018 10:53:42 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63E7112E058 for ; Wed, 21 Mar 2018 10:53:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 535A53009FB for ; Wed, 21 Mar 2018 13:53:40 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id lIjdt8H2_ow9 for ; Wed, 21 Mar 2018 13:53:39 -0400 (EDT) Received: from dhcp-8e33.meeting.ietf.org (dhcp-8e33.meeting.ietf.org [31.133.142.51]) by mail.smeinc.net (Postfix) with ESMTPSA id 51353300577 for ; Wed, 21 Mar 2018 13:53:39 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: Date: Wed, 21 Mar 2018 13:53:39 -0400 To: SPASM X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [lamps] Minutes and jabber scribe X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2018 17:53:47 -0000 We need someone to take notes and and another person to be jabber scribe = for the LAMPS session on Friday. Please volunteer now so that we do not = need to spend valuable meeting time twisting arms. Russ From nobody Wed Mar 21 16:28:44 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D5CC12E856; Wed, 21 Mar 2018 16:16:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9fLe79IHE4Xi; Wed, 21 Mar 2018 16:16:32 -0700 (PDT) Received: from dmz-mailsec-scanner-3.mit.edu (dmz-mailsec-scanner-3.mit.edu [18.9.25.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A285D129C6E; Wed, 21 Mar 2018 16:16:31 -0700 (PDT) X-AuditID: 1209190e-d51ff70000004ac5-01-5ab2e7ce83eb Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-3.mit.edu (Symantec Messaging Gateway) with SMTP id E2.78.19141.EC7E2BA5; Wed, 21 Mar 2018 19:16:30 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id w2LNGTqi001469; Wed, 21 Mar 2018 19:16:29 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w2LNGO5r011644 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 21 Mar 2018 19:16:27 -0400 Date: Wed, 21 Mar 2018 18:16:25 -0500 From: Benjamin Kaduk To: "Dr. Pala" Cc: "saag@ietf.org" Message-ID: <20180321231624.GK55745@kduck.kaduk.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprCKsWRmVeSWpSXmKPExsUixCmqrXvu+aYogyVnNSz2b/CxuHiwyGJK fyeTxbxryQ4sHkuW/GTymD7xPksAUxSXTUpqTmZZapG+XQJXxr6fD1kLJvFUPPo1nbmB8TNn FyMnh4SAicT1/1PZQGwhgcVMEktP+XcxcgHZGxklOk4tZ4JwrjJJfO5dxgRSxSKgKvH6bhsr iM0moCLR0H2ZGcQWAbIXtLxh72Lk4GAWUJY4ftUPJCwsECLx/cAldhCbF2jZ2lc/mSCW2Ups 23+UBSIuKHFy5hMwm1lAS+LGv5dMEGOkJZb/44AIa0ssW/gabBOngJ3Eg9NbGUFsUaBNe/sO sU9gFJyFZNIsJJNmIUyahWTSAkaWVYyyKblVurmJmTnFqcm6xcmJeXmpRbrGermZJXqpKaWb GMEBLsm3g3FSg/chRgEORiUe3oycTVFCrIllxZW5hxglOZiURHnXlQGF+JLyUyozEosz4otK c1KLDzFKcDArifBmPwbK8aYkVlalFuXDpKQ5WJTEed1NtKOEBNITS1KzU1MLUotgsjIcHEoS vKrASBYSLEpNT61Iy8wpQUgzcXCCDOcBGq4CUsNbXJCYW5yZDpE/xajLcePF6zZmIZa8/LxU KXFeTpAiAZCijNI8uDmgxCSRvb/mFaM40FvCvGnPgKp4gEkNbtIroCVMIB/M3ACypCQRISXV wFgz5fXf1kSJFLOMiy/KzrAduHElJOi+6K4Za+e3nqq+sbDEO83arPOULdfnV7Ojiu+unTNR mKPzIMfCkmve6TaTNtzYpv7Q6kT654R8Nnd+X/XHmVXyvZPcD53fvdfInevo8pW3F/R9+Lz0 c/CaKzGPG8XVtr24xu8Rd1PuvWvTPfbsmSIbwo8psRRnJBpqMRcVJwIA1JfBQScDAAA= Archived-At: X-Mailman-Approved-At: Wed, 21 Mar 2018 16:28:41 -0700 Subject: Re: [lamps] [saag] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2018 23:16:33 -0000 [spasm and pkix to bcc; please continue discussion on one list only] Hi Max, On Wed, Mar 21, 2018 at 01:08:07PM +0000, Dr. Pala wrote: > Hi all, >=20 > unfortunately I missed the sec-dispatch session, but I have some > important considerations about the document. In general, short-lived > certificates have been around for many years and for many different > applications (nothing new here), however nobody who have been working > with PKI long enough would actually made the case that the security > levels of short-lived-no-revo and any-lived-plus-revo are the same > (which seems the life-motif of the presentation and the document itself). >=20 > Other aspects that I think shall be revisited are the lack of > considerations about the usability of deployed infrastructures (when no > revocation is assumed) and some wrong considerations in the document > about validity periods of OCSP Responses and CRLs (that clearly > undermine the equivalence claim). It would probably be helpful if you included a description of what attacker capabilities are present in your mental model. If the attacker is modelled as being in control of the network (and revocation status is carried over HTTP-not-S) then the claim of equivalence between short-lived certs and "short-lived" OCSP holds much more weight. When you say that a second party can get the valid revocation status information, that implies that the attacker does *not* have full control over the network -- so what exactly can and cannot the attacker do? -Ben From nobody Thu Mar 22 03:57:53 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BECBB124235 for ; Thu, 22 Mar 2018 03:57:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NhV0JE5Yz7Hc for ; Thu, 22 Mar 2018 03:57:49 -0700 (PDT) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86A3A1200C5 for ; Thu, 22 Mar 2018 03:57:49 -0700 (PDT) Received: from [216.82.251.38] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-6.bemta-12.messagelabs.com id 0F/D6-27145-C2C83BA5; Thu, 22 Mar 2018 10:57:48 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WSeUgUYRjG95tjHcOJabzeFsXcqFRaUSMTSlT 8o+yAqKCyomZtcjf3kJ1VNrq0yEojTDTTNDvsEgMpMS3tsMxcO3DT0EgqVDKlUrMbqp39Vqv/ fvM+zzzv+368DMk7lCpGtFlFi0kwqJVTqO4ZtX6auUeuJUcU27mYocEej5hTz1PiiSWVld+JJ VUvx+mVRDKtN2nNti207tz5USq9bpnty+DOLFSzOBd5MhT3kYDfFUG5aArDc8cJKKk8SOGP1w ge2QdI2aXkIuB5Uyshsw8XBwVFhzxk9uai4WRnPY3rC+Di6E2EOQrqXsh1xtlhFrRmG+Uyy22 Egux9rhjeGdP+oICS2ZOLh7OX7C5GnB98tVe7PCTnDy/6K1wMnA+86WhXYvaFd32/aOzfCOWf mt11NbwfKKQxB4KjIg/JuwBXS0B3b507SAMjRUUk5hXQ2N5PY5MDwUhdvTspDKq/jVOY06DwW Zc7dSE8PNdD4R8qSeg4892dFACHBi67hQ80XBgqV+I9t0JhlTyfLPwkoKMHL+HNqaC38zDKR6 Gl/+xa6vSRXAWC4rL7VKnr0aZBW0k/hU0auHHrDok5CK6/L3PzQjjx464SczAU5r3xwDwfhlt G0WnEVKEQSbRkihZNVFS41qJP1VmNgt6giYyMCjeKkiSkigZBK4WnmI1XkfOy9ioUqB6VZS9t RtMZQu3Ljg1eTeanas1bd+gESbfZkmEQpWYUwDBqYGfkXUvmp1nEVNG2TW9wnueEDIyX2ofty XXKrJQuGCV9KpbsaB7TWfw2h2S6B4dzSJ4ymU2iyp+dIydxslWXYZoMmjh1BwpUebNIoVDwXu mixai3/q8PIX8Gqb3ZMbmhl95knew35ByFcI6SVlIjj2IV/kqqLOSTyKcsrp2rzUjc3hTKHz3 c+erj7ifrj9FBK+iQ8j4i3yzOSjs6sCauaF6DOXPD5x9HRtjVbWtDxyLX2aZvRw9vJ57UejYm IGNtwqbhx9EtEcFguxLzusv6dPm9TEXa2tbZuxa19ZYv3dPgCOaTZkYkHciKpS/2B19fFVuz/ 8Rl/5lqStIJkWGkRRL+AJjFUMHlAwAA X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-2.tower-163.messagelabs.com!1521716267!155376720!1 X-Originating-IP: [216.32.180.22] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 63517 invoked from network); 22 Mar 2018 10:57:48 -0000 Received: from mail-sn1nam02lp0022.outbound.protection.outlook.com (HELO NAM02-SN1-obe.outbound.protection.outlook.com) (216.32.180.22) by server-2.tower-163.messagelabs.com with AES256-GCM-SHA384 encrypted SMTP; 22 Mar 2018 10:57:48 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=zjGRmBqk10T8VNNy47sEaEBGOasyUWLihECVPxPYakc=; b=TnmsbY84MCf05/BdiJ2C02eyKbbyCzjB048g2U6zhGPXwPm1ATw7JsIeYg9IFTdkqgsYiGb+v49pq51p7YpTwQPEyohBSzCy5Br+lN4ZjraI6afghtYNkpI8Y9yu+kDC2kpxP89T5vWFAb9dCyTQeGSoSkkNhop7OX640crhx2E= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1678.namprd14.prod.outlook.com (10.171.146.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.609.10; Thu, 22 Mar 2018 10:57:45 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::7929:3f48:4a4f:1e32%18]) with mapi id 15.20.0588.017; Thu, 22 Mar 2018 10:57:45 +0000 From: Tim Hollebeek To: Russ Housley , SPASM Thread-Topic: [lamps] draft-housley-cms-mix-with-psk-03 Thread-Index: AQHTtL/TsNPJ4k4/i0OuWF00g3LM4qPcLsyg Date: Thu, 22 Mar 2018 10:57:45 +0000 Message-ID: References: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> In-Reply-To: <836CB2DA-9A82-4DEC-845A-15A7ED195C8A@vigilsec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [31.133.148.144] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1678; 7:he7Su1xFnBhuboTSvafc+vtiwtoT6GgyQFfVS8t6i3vT1LBkCLVqwt+p5FJ8cS2f23PzSYu00SYHGuEuY1B0HraVnOebOaEZMDvNEFA26cumhAJj0p5iZOX+tu5+aFSaNfA40QhlOpd50ccmf57b4ggmfmeCmXp6w6Og2E5jVkJEGDHjHvI6AzF6r1VaBzL3e8ocsUJ97Zms7ugSiLpi9bIqfiBj7yWVuT0/CUQIun9Q5LL1lj/gCwS42xRMA0oc x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 87c23d57-c953-41dd-2dc1-08d58fe3be7b x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1678; x-ms-traffictypediagnostic: MWHPR14MB1678: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231221)(944501327)(52105095)(10201501046)(3002001)(6041310)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123558120)(20161123562045)(6072148)(201708071742011); SRVR:MWHPR14MB1678; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1678; x-forefront-prvs: 0619D53754 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39380400002)(396003)(346002)(366004)(39850400004)(376002)(377424004)(199004)(189003)(13464003)(99936001)(6436002)(6506007)(53546011)(2906002)(55016002)(6306002)(9686003)(316002)(446003)(110136005)(14454004)(3660700001)(2950100002)(3280700002)(76176011)(59450400001)(229853002)(6246003)(3846002)(6116002)(53936002)(7696005)(97736004)(966005)(105586002)(5250100002)(186003)(102836004)(66066001)(26005)(81166006)(25786009)(8676002)(81156014)(478600001)(8936002)(305945005)(2900100001)(7736002)(74316002)(33656002)(99286004)(106356001)(68736007)(86362001)(5660300001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1678; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: f8AqIMQnYB0dwKigTbOJX1lIekLglXkPqSeudb7NlJKDvrS8YB1GKExY+7+qXHZnDsiX4zvs192bVaC0rS+bAWxyo9dT6i0oJ8JHhL+74nd/92ZLDD3YeaWwHKz5ocyauKhBjDJlhOFEHDX3pc6348uWgtBQyIdF7Qs1lH7iCoqKy2XFolOcdL4tr13AEP8fjimFmPQTc4KhN5jV3aL4W7UI2xLFeq79wBXyW7DZbEB43fuS6sJxBlndCp3T/8auqx9UIyiwt/maRqhh8AcYg+Hpb6pSEaIMMYlPuGBIGFhz8D5RJ6PhwHxin2PSOko8PwQykWr3aUEvH3bH2AO7Ow== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_08EC_01D3C1CC.9960E670" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 87c23d57-c953-41dd-2dc1-08d58fe3be7b X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2018 10:57:45.8103 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1678 Archived-At: Subject: Re: [lamps] draft-housley-cms-mix-with-psk-03 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Mar 2018 10:57:52 -0000 ------=_NextPart_000_08EC_01D3C1CC.9960E670 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit It is unfortunate this dropped off the bottom of the schedule this week. I think this is extremely important work, and well thought out countermeasures like this will give people the runway to wait until NIST and others get post-quantum crypto figured out, and then all the related standards updated, which will take some time. I read the document and believe it is in pretty good shape, especially with the other comments that have been made. -Tim > -----Original Message----- > From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Russ Housley > Sent: Monday, March 5, 2018 8:23 PM > To: SPASM > Subject: [lamps] draft-housley-cms-mix-with-psk-03 > > I would like to make people on this mail list aware of this Internet-Draft. > > Russ > > = = = = = = = = = = > > A new version of I-D, draft-housley-cms-mix-with-psk-03.txt > has been successfully submitted by Russell Housley and posted to the IETF > repository. > > Name: draft-housley-cms-mix-with-psk > Revision: 03 > Title: Using Pre-Shared Key (PSK) in the Cryptographic Message > Syntax (CMS) > Document date: 2018-03-05 > Group: Individual Submission > Pages: 13 > URL: https://www.ietf.org/internet-drafts/draft-housley-cms-mix-with- > psk-03.txt > Status: https://datatracker.ietf.org/doc/draft-housley-cms-mix-with-psk/ > Htmlized: https://tools.ietf.org/html/draft-housley-cms-mix-with-psk-03 > Htmlized: https://datatracker.ietf.org/doc/html/draft-housley-cms-mix- > with-psk-03 > Diff: https://www.ietf.org/rfcdiff?url2=draft-housley-cms-mix-with-psk-03 > > Abstract: > The invention of a large-scale quantum computer would pose a serious > challenge for the cryptographic algorithms that are widely deployed > today. The Cryptographic Message Syntax (CMS) supports key transport > and key agreement algorithms that could be broken by the invention of > such a quantum computer. By storing communications that are > protected with the CMS today, someone could decrypt them in the > future when a large-scale quantum computer becomes available. Once > quantum-secure key management algorithms are available, the CMS will > be extended to support them, if current syntax the does not > accommodated them. In the near-term, this document describes a > mechanism to protect today's communication from the future invention > of a large-scale quantum computer by mixing the output of key > transport and key agreement algorithms with a pre-shared key. > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm ------=_NextPart_000_08EC_01D3C1CC.9960E670 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzIyMTA1NzQxWjAvBgkqhkiG9w0BCQQxIgQgpid156TvUKLWKLmncFU0YEufU5J9 8gcbNnHln5q9g9swgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAHULrlJYf6k3xbvkSEOxkKycyrIbW3UmiEqwlaexDIzIHsQ/6gARYoSqXYHxDk+qi+x45ZsF mWAafWg3BQkZ4+QTdBlG16OFm+Q6B8adqDCqD1FLK2V1VkW13RZbzFAxrFrJ8ei70S1DxxN/TpA+ 9R+Dyvk5ExH/hFYlhQ2p/JU95mqk5V8yj92y5aiSTvCbxAAQy0JnmlJiFSloHjNDoptUwqE32E0+ SZzqAYu/2hSsJgtwDUVTc3ckghwmthx3qkPXhcGPurBEIr1x615u/qnrXBpwCAZjeT3RZSYknQvd 7Z7Sxcp6HTrn78COesU2JzbeAmdmXE7JFmnqxncUtHQAAAAAAAA= ------=_NextPart_000_08EC_01D3C1CC.9960E670-- From nobody Fri Mar 23 05:49:27 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E7A8A12D948; Fri, 23 Mar 2018 05:49:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.76.0 Auto-Submitted: auto-generated Precedence: bulk Cc: lamps-chairs@ietf.org, ekr@rtfm.com, Russ Housley , housley@vigilsec.com, draft-ietf-lamps-eai-addresses@ietf.org, spasm@ietf.org, The IESG , rfc-editor@rfc-editor.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152180934994.17542.16919863314551977663.idtracker@ietfa.amsl.com> Date: Fri, 23 Mar 2018 05:49:09 -0700 Archived-At: Subject: [lamps] Protocol Action: 'Internationalized Email Addresses in X.509 certificates' to Proposed Standard (draft-ietf-lamps-eai-addresses-18.txt) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Mar 2018 12:49:10 -0000 The IESG has approved the following document: - 'Internationalized Email Addresses in X.509 certificates' (draft-ietf-lamps-eai-addresses-18.txt) as Proposed Standard This document is the product of the Limited Additional Mechanisms for PKIX and SMIME Working Group. The IESG contact persons are Benjamin Kaduk and Eric Rescorla. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-eai-addresses/ (1) What type of RFC is being requested (BCP, Proposed Standard, Internet Standard, Informational, Experimental, or Historic)? Why is this the proper type of RFC? Is this type of RFC indicated in the title page header? Proposed Standard (2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: Technical Summary This document defines a new name form for inclusion in the otherName field of an X.509 Subject Alternative Name and Issuer Alternate Name extension that allows a certificate subject to be associated with an Internationalized Email Address. Working Group Summary The LAMPS WG reviewed the document and reached consensus on the content. Document Quality Vendors associated with major implementations of S/MIME have indicated that they intend to support EAI, and this capability is needed for them to do so. Personnel Document Shepherd: Russ Housley Responsible Area Director: Eric Rescorla From nobody Mon Mar 26 16:49:45 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5803127871 for ; Mon, 26 Mar 2018 16:49:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.01 X-Spam-Level: X-Spam-Status: No, score=-7.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=eff.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7YkaeaEX1z2F for ; Mon, 26 Mar 2018 16:49:41 -0700 (PDT) Received: from mail2.eff.org (mail2.eff.org [173.239.79.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8158C126CD6 for ; Mon, 26 Mar 2018 16:49:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=eff.org; s=mail2; h=Content-Type:In-Reply-To:MIME-Version:Date:Message-ID:From: References:To:Subject:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To: Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe :List-Post:List-Owner:List-Archive; bh=sGtlYRlsBF5WcLoebzJsbjlOVdVlZfEaDI5JXMmjY8Q=; b=rNd6GSNsd8XbzuLwx05EOoQTv/ J+/G7E7ax1OKM3o6Rsg/1Kt/YjlUpG/6YZQ4GYfy2UEhvXKWwRAsjxyfSprRQleFcC7e3/K1yC9c0 eF7AuMsrH5Q41FQXMZSD2M9u4tMaled9BG0SHUt8ZivCUqzqseDuFU463SCk1suUXpgQ=; Received: ; Mon, 26 Mar 2018 16:49:41 -0700 To: Corey Bonnell , "spasm@ietf.org" References: <878C91A0-6875-47A4-872F-F5D1F7F7AE7E@trustwave.com> From: Jacob Hoffman-Andrews Message-ID: Date: Mon, 26 Mar 2018 16:49:40 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <878C91A0-6875-47A4-872F-F5D1F7F7AE7E@trustwave.com> Content-Type: multipart/alternative; boundary="------------46281F5E719D917C4F4D38C1" Content-Language: en-US Archived-At: Subject: Re: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Mar 2018 23:49:44 -0000 This is a multi-part message in MIME format. --------------46281F5E719D917C4F4D38C1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I've written this up as a PR: https://github.com/jsha/caa-simplification/pull/1/files. If there are no objections, I'll merge it in a week for the 6844bis draft. Note that I tweaked it slightly from your erratum (https://www.rfc-editor.org/errata/eid5244). Where you referred just to "issue" property tags, I mention both "issue" and "issuewild." On 01/12/2018 01:41 PM, Corey Bonnell wrote: > > Hello, > > I believe that there are several ambiguities in RFC 6844 in regard to > processing CAA resource record sets that do not contain "issue" records. > >   > > Section 3 of RFC 6844 (http://www.rfcreader.com/#rfc6844_line196) > defines the "issue" property tag to authorize "the holder of the > domain name or a party acting under the explicit > authority of the holder of that domain name to issue certificates for > the domain in which the property is published". Based on my > interpretation, the definition given here is suggesting that CAA issue > restriction processing is done regardless of whether or not there is > an "issue" record(s) present to specify the set of permitted Issuer > Domain Names. In other words, the lack of "issue" records in a CAA > resource record set indicates that no CA may issue for that domain, > since no CA has been authorized to issue. > >   > > However, section 5.2 (http://www.rfcreader.com/#rfc6844_line447) > defines the "issue" property tag to "request that certificate issuers > perform CAA issue restriction processing for the domain and to grant > authorization to specific certificate issuers". Based on this > definition, it sounds as if CAA issue restriction processing is > "opt-in". In other words, the absence of "issue" records in a CAA > record set indicate that any CA may issue for that domain (since there > was no "opt-in" into CAA restriction processing). > >   > > Section 4 (http://www.rfcreader.com/#rfc6844_line288) states that, > "before issuing a certificate, a compliant CA MUST check for > publication of a relevant CAA Resource Record set." Unfortunately, the > term "relevant" is not defined by the RFC, which, compounded with the > ambiguity highlighted above in regard to the definition of the "issue" > property tag in sections 3 and 5.2, leads to ambiguity in the handling > following scenarios: > >   > > - A CAA resource record set consisting solely of unknown non-critical > property tags (including misspellings of "issue", such as "iisue", etc.) > > - A CAA resource record set consisting solely of "iodef" property tags > > - A CAA resource record set that contains both of the above > >   > > For each of these cases above, it is unclear which of the following > three actions a CA should take: > > - Fail issuance (since the CAA resource record set did not authorize > any CA to issue, given the definition of the "issue" property tag in > Section 3) > > - Continue the tree-climbing search for records (since the resource > record sets above could conceivably be considered as "not relevant") > > - Allow issuance (since the resource record sets above could > conceivably be considered as "relevant" and any CA may issue, given > the definition of the "issue" property tag in section 5.2) > >   > > At Trustwave, we have taken the conservative approach and will not > issue certificates if we encounter CAA resource record sets matching > the descriptions of the three above. However, given that we may be > overly restrictive by doing this, as well as for a desire for CAA > record sets to be processed uniformly regardless of the CA, we would > like to see these ambiguities resolved. > >   > > If others agree that the current wording of the RFC is ambiguous, I > would be happy to present changes to relevant sections to clear up the > ambiguity, but for now I wanted to send this along to see if others > share our interpretation of the RFC. > >   > > Thanks, > > Corey > >   > >   > >   > > *Corey Bonnell* > > Senior Software Engineer > > t: +1 412.395.2233 > >   > > *Trustwave** *| SMART SECURITY ON DEMAND > www.trustwave.com > >   > > /2017 Best Managed Security Service Winner – SC Media/ > > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --------------46281F5E719D917C4F4D38C1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit I've written this up as a PR: https://github.com/jsha/caa-simplification/pull/1/files. If there are no objections, I'll merge it in a week for the 6844bis draft.

Note that I tweaked it slightly from your erratum (https://www.rfc-editor.org/errata/eid5244). Where you referred just to "issue" property tags, I mention both "issue" and "issuewild."

On 01/12/2018 01:41 PM, Corey Bonnell wrote:

Hello,

I believe that there are several ambiguities in RFC 6844 in regard to processing CAA resource record sets that do not contain "issue" records.

 

Section 3 of RFC 6844 (http://www.rfcreader.com/#rfc6844_line196) defines the "issue" property tag to authorize "the holder of the domain name <Issuer Domain Name> or a party acting under the explicit authority of the holder of that domain name to issue certificates for the domain in which the property is published". Based on my interpretation, the definition given here is suggesting that CAA issue restriction processing is done regardless of whether or not there is an "issue" record(s) present to specify the set of permitted Issuer Domain Names. In other words, the lack of "issue" records in a CAA resource record set indicates that no CA may issue for that domain, since no CA has been authorized to issue.

 

However, section 5.2 (http://www.rfcreader.com/#rfc6844_line447) defines the "issue" property tag to "request that certificate issuers perform CAA issue restriction processing for the domain and to grant authorization to specific certificate issuers". Based on this definition, it sounds as if CAA issue restriction processing is "opt-in". In other words, the absence of "issue" records in a CAA record set indicate that any CA may issue for that domain (since there was no "opt-in" into CAA restriction processing).

 

Section 4 (http://www.rfcreader.com/#rfc6844_line288) states that, "before issuing a certificate, a compliant CA MUST check for publication of a relevant CAA Resource Record set." Unfortunately, the term "relevant" is not defined by the RFC, which, compounded with the ambiguity highlighted above in regard to the definition of the "issue" property tag in sections 3 and 5.2, leads to ambiguity in the handling following scenarios:

 

- A CAA resource record set consisting solely of unknown non-critical property tags (including misspellings of "issue", such as "iisue", etc.)

- A CAA resource record set consisting solely of "iodef" property tags

- A CAA resource record set that contains both of the above

 

For each of these cases above, it is unclear which of the following three actions a CA should take:

- Fail issuance (since the CAA resource record set did not authorize any CA to issue, given the definition of the "issue" property tag in Section 3)

- Continue the tree-climbing search for records (since the resource record sets above could conceivably be considered as "not relevant")

- Allow issuance (since the resource record sets above could conceivably be considered as "relevant" and any CA may issue, given the definition of the "issue" property tag in section 5.2)

 

At Trustwave, we have taken the conservative approach and will not issue certificates if we encounter CAA resource record sets matching the descriptions of the three above. However, given that we may be overly restrictive by doing this, as well as for a desire for CAA record sets to be processed uniformly regardless of the CA, we would like to see these ambiguities resolved.

 

If others agree that the current wording of the RFC is ambiguous, I would be happy to present changes to relevant sections to clear up the ambiguity, but for now I wanted to send this along to see if others share our interpretation of the RFC.

 

Thanks,

Corey

 

 

 

Corey Bonnell

Senior Software Engineer

t: +1 412.395.2233

 

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com

 

2017 Best Managed Security Service Winner – SC Media



_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--------------46281F5E719D917C4F4D38C1-- From nobody Mon Mar 26 18:37:55 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 155BD128D2E for ; Mon, 26 Mar 2018 18:37:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.99 X-Spam-Level: X-Spam-Status: No, score=-1.99 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jdZHANLrf5Uh for ; Mon, 26 Mar 2018 18:37:50 -0700 (PDT) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ABEAE126DC2 for ; Mon, 26 Mar 2018 18:37:50 -0700 (PDT) Received: from [216.82.242.36] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-17.bemta-8.messagelabs.com id E9/1B-05522-C60A9BA5; Tue, 27 Mar 2018 01:37:48 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WTa0gUURTHuzPj7vjYuK6v06I9tjLc0Aystvp QEYHRuw9BJtiok7u0L3ZWsyIqKcG2VEJJpVqjTVLUQiQUzNa1krQgdSs1xTRDUzFXDanoMbMz vebD5XfP/3/OPfdwhyaVV+Qqms22sVYTY1DLAqiepfXrY4+XNybFO6+s13q9tZS21PNFpr35O m0rmTg1M+qX6HR+IRLbe/Oo/WSSn96Uas4+6qdr6vbILYXNKPui/cQ5VFmLLqEAmsKfCOgbdM uEjRIXE1A5NC4XN+8QXM6xk5eQPy3D8fD6YRshcCi2wZjrOSVwCDZB2+dHMjFuhuuv3ki8Cao LOn25FF4Jk3e8vlwFToaBn+d9rMQWuOMq59ugaX+8GXrno4UwwuEw317ts5A4AvpGHD4GHApD nR0ykcPg4/sffqI/GW7MuqW4Gmon+yV/FHQ57L5bAq4nIP+xUy4KsTBdXEyKvAfmf7RLpi4EF a4pSdDA1MiAlHAcSitbpapnIH+ukRQTnCQ86SiQjo6E76N1hChclcFkU4N0zXQoqhIHDPgbAR UXLpDi7FQw4MlDhSim7J+7lvE+EjsQ1M/1U2W+mQXDs9IRSjQlgauplRBZA8U141J8NVTcmiD L+FmSOAaedqv/Dwu8GUq+tshEXgZF9iG5yOtg4okXlaPAKrSKY61ZrDU2IS7Vqs/Q2YyM3hC7 Nl4bZ2Q5jslgDUwqF5dmNtYh/iEu4L8G1J+/3Y0W0YQ6THFqSWOScmGqOf2kjuF0KdZMA8u5U SRNq0HBOHgt2MpmsNnH9Ab+Nf+WgQ5ShyosN3lZwVkYI6fPEKV2tIX2XBvNJen64Y/86vKtPW MTuaSSMplNrCpCsVSoioU0XabpT9Hff0kXilKFKBDfpjLIwlqNetv/+jiKoJE6RLFOqBKkN9n +nD3Ot0XwbT3IaRDasjF/JdU5RM7mnWZa092uzqdR+/rG7v7c7byHb+d4Ck7WJHQmbjNqCxc0 OJZMH578HuPdkwwzytxrM3OqjYtVltIjOQdGltUGhkeXG19UlWwtij77wb/CoMnqKfEefJuyd 7vGnblmheflhprzuuHIRS27dw4e2vVph3JLgXe2+b6d6t20a3lmoJridMxaDWnlmF8kkAOIIA QAAA== X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-13.tower-94.messagelabs.com!1522114666!186154790!1 X-Originating-IP: [216.32.180.54] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 86908 invoked from network); 27 Mar 2018 01:37:47 -0000 Received: from mail-by2nam03lp0054.outbound.protection.outlook.com (HELO NAM03-BY2-obe.outbound.protection.outlook.com) (216.32.180.54) by server-13.tower-94.messagelabs.com with AES256-GCM-SHA384 encrypted SMTP; 27 Mar 2018 01:37:47 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=6Xx5OviW+NjfcNFX6pf/23KcNIiyn5dNH8/YaP4CGP8=; b=mGg8TcD84pQtmsyZxR4Ah+eT8lCPDupOdxNEG/f7FM3XhglMCtXrLM3M9fiY+pMncjE3QmPpSWHVKYEKa309PVl/gnYrm2qtqf4VNC+GNPLdG3V0lg8agzJZCt/lBsT0MMCBb4FEyShrDf+72fNdkgQsYYKKwYWzGoR6s2dBIzo= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1261.namprd14.prod.outlook.com (10.173.102.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.609.10; Tue, 27 Mar 2018 01:37:45 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd%17]) with mapi id 15.20.0609.012; Tue, 27 Mar 2018 01:37:46 +0000 From: Tim Hollebeek To: Jacob Hoffman-Andrews , Corey Bonnell , "spasm@ietf.org" Thread-Topic: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags Thread-Index: AQHTi+4QDmko90Ob9kiZJwieEDaNDqPjolkAgAAeGoA= Date: Tue, 27 Mar 2018 01:37:46 +0000 Message-ID: References: <878C91A0-6875-47A4-872F-F5D1F7F7AE7E@trustwave.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1261; 7:4EYVRtYCEvD5BVQNKy+dwU4FzZCXnyuhEALQe1rK80yzNLwCJxDIafoyFwH/SGEVxt+hNd4gbNVc3mkXwameN2/+q3MPQNemnL/h0qklAKZuKGFbxxhwzD81jbD4GE6xoh+QB0vD/igCfc5rS0aiCpc5wRg7VX6sAGdiDSAQRCpkmTJaJ0BuIWxk+vpScLSX60w8Neo9i2HfeEpHxsPxwISTApVzhlTtENbFD0Rz4Epc3o/UDNnMqXlmnIMTAv1b x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 99ee89eb-959e-42d4-c65f-08d593835785 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1261; x-ms-traffictypediagnostic: MWHPR14MB1261: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(166708455590820)(192374486261705)(171964332516350)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(3231221)(944501327)(52105095)(93006095)(93001095)(10201501046)(3002001)(6041310)(20161123558120)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(6072148)(201708071742011); SRVR:MWHPR14MB1261; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1261; x-forefront-prvs: 0624A2429E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(39380400002)(39860400002)(396003)(346002)(376002)(199004)(189003)(53936002)(6246003)(8936002)(5250100002)(3280700002)(2501003)(66066001)(68736007)(33656002)(11346002)(446003)(99286004)(81156014)(81166006)(7736002)(478600001)(606006)(966005)(486005)(486005)(316002)(8676002)(2906002)(229853002)(6436002)(26005)(186003)(110136005)(7696005)(97736004)(59450400001)(5660300001)(3660700001)(105586002)(106356001)(6306002)(54896002)(2900100001)(25786009)(14454004)(3846002)(99936001)(76176011)(86362001)(6506007)(790700001)(53546011)(55016002)(74316002)(102836004)(476003)(236005)(6116002)(9686003); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1261; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: RqoJ53iS6uTvIdSdNdjWeFYW+thSfAUVIO0Z07FVu/ur9PSeAL1tNL2/fiWYOfycVsefRnwrt0VgwtLVgxBoj7/cRa/lpvIQ/2E2662E3KIvoodbD2uPtfgct1u7O/Iu9PZSthoGknKlZS5X3gd50LkHRIGt7Mg09CGPjNaY/WKhjKg7v3yT2Lxo/++jvsrffrgq6QJVxwEMJyzLOvleg7ho1DP9yuPQPb7SWxRSiMndU9rUAbSYQ3er75mYVZKNyrqw66+j/qiOmcv8uq1ApnUSrHDDnSNgsj+htObSATKfdRKS0CRexDSGTqEXRfe91W0i+jeTtlDF+Hz/s4dN6g== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0101_01D3C54A.ACD75000" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 99ee89eb-959e-42d4-c65f-08d593835785 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2018 01:37:46.0239 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1261 Archived-At: Subject: Re: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 01:37:54 -0000 ------=_NextPart_000_0101_01D3C54A.ACD75000 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0102_01D3C54A.ACD75000" ------=_NextPart_001_0102_01D3C54A.ACD75000 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Looks good to me. =20 Thanks Jacob. =20 -Tim =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jacob = Hoffman-Andrews Sent: Monday, March 26, 2018 7:50 PM To: Corey Bonnell ; spasm@ietf.org Subject: Re: [lamps] Ambiguities in RFC 6844 regarding CAA resource = record sets with no "issue" property tags =20 I've written this up as a PR: = https://github.com/jsha/caa-simplification/pull/1/files. If there are no = objections, I'll merge it in a week for the 6844bis draft. Note that I tweaked it slightly from your erratum = (https://www.rfc-editor.org/errata/eid5244). Where you referred just to = "issue" property tags, I mention both "issue" and "issuewild." On 01/12/2018 01:41 PM, Corey Bonnell wrote: Hello, I believe that there are several ambiguities in RFC 6844 in regard to = processing CAA resource record sets that do not contain "issue" records. =20 Section 3 of RFC 6844 (http://www.rfcreader.com/#rfc6844_line196) = defines the "issue" property tag to authorize "the holder of the domain = name or a party acting under the explicit authority = of the holder of that domain name to issue certificates for the domain = in which the property is published". Based on my interpretation, the = definition given here is suggesting that CAA issue restriction = processing is done regardless of whether or not there is an "issue" = record(s) present to specify the set of permitted Issuer Domain Names. = In other words, the lack of "issue" records in a CAA resource record set = indicates that no CA may issue for that domain, since no CA has been = authorized to issue. =20 However, section 5.2 (http://www.rfcreader.com/#rfc6844_line447) defines = the "issue" property tag to "request that certificate issuers perform = CAA issue restriction processing for the domain and to grant = authorization to specific certificate issuers". Based on this = definition, it sounds as if CAA issue restriction processing is = "opt-in". In other words, the absence of "issue" records in a CAA record = set indicate that any CA may issue for that domain (since there was no = "opt-in" into CAA restriction processing). =20 Section 4 (http://www.rfcreader.com/#rfc6844_line288) states that, = "before issuing a certificate, a compliant CA MUST check for publication = of a relevant CAA Resource Record set." Unfortunately, the term = "relevant" is not defined by the RFC, which, compounded with the = ambiguity highlighted above in regard to the definition of the "issue" = property tag in sections 3 and 5.2, leads to ambiguity in the handling = following scenarios: =20 - A CAA resource record set consisting solely of unknown non-critical = property tags (including misspellings of "issue", such as "iisue", etc.) = - A CAA resource record set consisting solely of "iodef" property tags - A CAA resource record set that contains both of the above =20 For each of these cases above, it is unclear which of the following = three actions a CA should take: - Fail issuance (since the CAA resource record set did not authorize any = CA to issue, given the definition of the "issue" property tag in Section = 3) - Continue the tree-climbing search for records (since the resource = record sets above could conceivably be considered as "not relevant") - Allow issuance (since the resource record sets above could conceivably = be considered as "relevant" and any CA may issue, given the definition = of the "issue" property tag in section 5.2) =20 At Trustwave, we have taken the conservative approach and will not issue = certificates if we encounter CAA resource record sets matching the = descriptions of the three above. However, given that we may be overly = restrictive by doing this, as well as for a desire for CAA record sets = to be processed uniformly regardless of the CA, we would like to see = these ambiguities resolved. =20 If others agree that the current wording of the RFC is ambiguous, I = would be happy to present changes to relevant sections to clear up the = ambiguity, but for now I wanted to send this along to see if others = share our interpretation of the RFC. =20 Thanks, Corey =20 =20 =20 Corey Bonnell Senior Software Engineer t: +1 412.395.2233 =20 Trustwave | SMART SECURITY ON DEMAND =20 www.trustwave.com =20 2017 Best Managed Security Service Winner =E2=80=93 SC Media _______________________________________________ Spasm mailing list Spasm@ietf.org =20 https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_001_0102_01D3C54A.ACD75000 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Looks good to = me.

 

<= p class=3DMsoNormal>Thanks = Jacob.

 

<= p class=3DMsoNormal>-Tim

 

<= div style=3D'border:none;border-left:solid blue 1.5pt;padding:0in 0in = 0in 4.0pt'>

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Jacob = Hoffman-Andrews
Sent: Monday, March 26, 2018 7:50 = PM
To: Corey Bonnell <CBonnell@trustwave.com>; = spasm@ietf.org
Subject: Re: [lamps] Ambiguities in RFC 6844 = regarding CAA resource record sets with no "issue" property = tags

 

I've written this up as a PR: https://= github.com/jsha/caa-simplification/pull/1/files. If there are no = objections, I'll merge it in a week for the 6844bis draft.

Note = that I tweaked it slightly from your erratum (https://www.rfc-editor= .org/errata/eid5244). Where you referred just to "issue" = property tags, I mention both "issue" and = "issuewild."

On 01/12/2018 01:41 PM, Corey Bonnell = wrote:

Hello,

I believe that there = are several ambiguities in RFC 6844 in regard to processing CAA resource = record sets that do not contain "issue" = records.

 

Section 3 of RFC 6844 = (http://www.rfcreader.c= om/#rfc6844_line196) defines the "issue" property tag to = authorize "the holder of the domain name <Issuer Domain Name> = or a party acting under the explicit authority of the holder of that = domain name to issue certificates for the domain in which the property = is published". Based on my interpretation, the definition given = here is suggesting that CAA issue restriction processing is done = regardless of whether or not there is an "issue" record(s) = present to specify the set of permitted Issuer Domain Names. In other = words, the lack of "issue" records in a CAA resource record = set indicates that no CA may issue for that domain, since no CA has been = authorized to issue.

 

However, section 5.2 = (http://www.rfcreader.c= om/#rfc6844_line447) defines the "issue" property tag to = "request that certificate issuers perform CAA issue restriction = processing for the domain and to grant authorization to specific = certificate issuers". Based on this definition, it sounds as if CAA = issue restriction processing is "opt-in". In other words, the = absence of "issue" records in a CAA record set indicate that = any CA may issue for that domain (since there was no "opt-in" = into CAA restriction processing).

 

Section 4 (http://www.rfcreader.c= om/#rfc6844_line288) states that, "before issuing a = certificate, a compliant CA MUST check for publication of a relevant CAA = Resource Record set." Unfortunately, the term "relevant" = is not defined by the RFC, which, compounded with the ambiguity = highlighted above in regard to the definition of the "issue" = property tag in sections 3 and 5.2, leads to ambiguity in the handling = following scenarios:

 

- A CAA resource = record set consisting solely of unknown non-critical property tags = (including misspellings of "issue", such as "iisue", = etc.)

- A CAA resource record set consisting solely = of "iodef" property tags

- A CAA resource = record set that contains both of the above

 

For each of these = cases above, it is unclear which of the following three actions a CA = should take:

- Fail issuance (since the CAA resource = record set did not authorize any CA to issue, given the definition of = the "issue" property tag in Section 3)

- Continue the = tree-climbing search for records (since the resource record sets above = could conceivably be considered as "not = relevant")

- Allow issuance (since the resource record = sets above could conceivably be considered as "relevant" and = any CA may issue, given the definition of the "issue" property = tag in section 5.2)

 

At Trustwave, we have = taken the conservative approach and will not issue certificates if we = encounter CAA resource record sets matching the descriptions of the = three above. However, given that we may be overly restrictive by doing = this, as well as for a desire for CAA record sets to be processed = uniformly regardless of the CA, we would like to see these ambiguities = resolved.

 

If others agree that = the current wording of the RFC is ambiguous, I would be happy to present = changes to relevant sections to clear up the ambiguity, but for now I = wanted to send this along to see if others share our interpretation of = the RFC.

 

Thanks,

Corey

 

 

 

C= orey Bonnell

Seni= or Software Engineer

t: = +1 412.395.2233

 

T= rustwave&nbs= p;|&nb= sp;SMART SECURITY ON DEMAND
www.trustwave.com

&nbs= p;

2017 = Best Managed Security Service Winner =E2=80=93 SC = Media




_______=
________________________________________
Spasm =
mailing list
Spasm@ietf.org
https://www.ietf.org=
/mailman/listinfo/spasm

 

------=_NextPart_001_0102_01D3C54A.ACD75000-- ------=_NextPart_000_0101_01D3C54A.ACD75000 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzI3MDEzNzQ0WjAvBgkqhkiG9w0BCQQxIgQghp3Oj+hD5fcYASpCrJcWytf7yJoR Y/wjdgYY65bcoNUwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBADvp1wOfvqiGcnSijI6MO6qaO592Eejr/044NmrbnolqBES+eFNnVsIBWy0vKR1LxRkOAjvx UqZIKt0LGyajr0IQZCwPL4LF0vkQZMHjNtHDogsvO4JIpKEgHZ+juyS7r70Js0tbppU0OfM3fv54 m7PNxxnRuIoECMV9Teq4dtuEyrqK41xkgFtcyFdLm0I8zKUbNdVLNWQOJYYDbXLI/Nupaw8/NNJM GAQ1WCmxTwn2bVSwu97AvdUHDdvD9p9Yxun0dW1CtraZp1banIIdfIwxbVZToTzYfbAEljluF0mI IIQZyPWxTEX0LyaUXmKS07PVB7j1nulmjpRor/cxQJMAAAAAAAA= ------=_NextPart_000_0101_01D3C54A.ACD75000-- From nobody Tue Mar 27 04:10:32 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B943112D955 for ; Tue, 27 Mar 2018 04:10:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.199 X-Spam-Level: X-Spam-Status: No, score=-1.199 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ynJsufA2-UwP for ; Tue, 27 Mar 2018 04:10:28 -0700 (PDT) Received: from smtp.outgoing.loopia.se (smtp.outgoing.loopia.se [194.9.95.112]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CE4D12D94C for ; Tue, 27 Mar 2018 04:10:27 -0700 (PDT) Received: from s554.loopia.se (localhost [127.0.0.1]) by s554.loopia.se (Postfix) with ESMTP id D47FCFDBC2 for ; Tue, 27 Mar 2018 13:10:03 +0200 (CEST) Received: from s499.loopia.se (unknown [172.21.200.97]) by s554.loopia.se (Postfix) with ESMTP id B5DFC5F2B50; Tue, 27 Mar 2018 13:10:03 +0200 (CEST) Received: from s404.loopia.se (unknown [172.21.200.105]) by s499.loopia.se (Postfix) with ESMTP id B1E02134FFCF; Tue, 27 Mar 2018 13:10:03 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s498.loopia.se ([172.21.200.105]) by s404.loopia.se (s404.loopia.se [172.21.200.134]) (amavisd-new, port 10024) with UTF8LMTP id bttXx_TrmiWS; Tue, 27 Mar 2018 13:10:03 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: mailstore2@aaa-sec.com X-Loopia-Originating-IP: 90.229.17.25 Received: from [10.0.1.54] (unknown [90.229.17.25]) (Authenticated sender: mailstore2@aaa-sec.com) by s498.loopia.se (Postfix) with ESMTPSA id 1E29A45A9A1; Tue, 27 Mar 2018 13:10:03 +0200 (CEST) User-Agent: Microsoft-MacOutlook/10.b.0.180311 Date: Tue, 27 Mar 2018 13:10:02 +0200 From: Stefan Santesson To: "Dr. Pala" , LAMPS Message-ID: Thread-Topic: [pkix] Considerations and Clarifications about draft-nir-saag-star-01 References: In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3605001003_1077337105" Archived-At: Subject: Re: [lamps] [pkix] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 11:10:31 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3605001003_1077337105 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable HI, =20 I think this discussion underlines my argument to rescope this effort from = =E2=80=9Cshort-lived=E2=80=9D certificates to =E2=80=9Cno-revocation=E2=80=9D certificates. =20 The concept of =E2=80=9Cshort-lived=E2=80=9D is filled with policy considerations that = we can battle forever. Things like what actually is =E2=80=9Cshort=E2=80=9D and how shor= t is good enough to skip revocation is impossible to agree on. And there is = no need to agree on that. At least not in the IETF. =20 CAB forum and other policy related forums may want to agree on that, but no= t IETF. =20 There may be a number or good reasons to provide certificates with no revoc= ation. One such reason is if the private key is used only once and then dest= royed in a secure and controlled fashion. =20 =20 /Stefan =20 --B_3605001003_1077337105 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

HI,

 

I think this discussion underlines my argument to resco= pe this effort from =E2=80=9Cshort-lived=E2=80=9D certificates to =E2=80=9Cno-revocation=E2=80=9D ce= rtificates.

&n= bsp;

The concept of =E2=80=9Cs= hort-lived=E2=80=9D is filled with policy considerations that we can battle foreve= r. Things like what actually is =E2=80=9Cshort=E2=80=9D and how short is good enough to = skip revocation is impossible to agree on. And there is no need to agree on = that. At least not in the IETF.

 

CAB forum and other policy related forums may want to agree on that, but no= t IETF.

 =

There may be a number o= r good reasons to provide certificates with no revocation. One such reason i= s if the private key is used only once and then destroyed in a secure and co= ntrolled fashion.

<= o:p> 

 

/Stefan=

 

--B_3605001003_1077337105-- From nobody Tue Mar 27 07:27:54 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1634112E047 for ; Tue, 27 Mar 2018 07:27:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.08 X-Spam-Level: X-Spam-Status: No, score=0.08 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YGlxp1ybyuQe for ; Tue, 27 Mar 2018 07:27:45 -0700 (PDT) Received: from seg-node-chi-03.trustwave.com (seg-node-chi-03.trustwave.com [204.13.200.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77E4012E049 for ; Tue, 27 Mar 2018 07:27:44 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (Not Verified[207.46.163.56]) by seg-node-chi-03.trustwave.com with Trustwave SEG (v8, 0, 6, 10676) (using TLS: TLSv1.2, AES256-SHA256) id ; Tue, 27 Mar 2018 09:27:41 -0500 Received: from SN6PR07MB4575.namprd07.prod.outlook.com (52.135.95.19) by SN6PR07MB4381.namprd07.prod.outlook.com (52.135.91.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.609.10; Tue, 27 Mar 2018 14:27:40 +0000 Received: from SN6PR07MB4575.namprd07.prod.outlook.com ([fe80::fc6f:e45f:736f:a85c]) by SN6PR07MB4575.namprd07.prod.outlook.com ([fe80::fc6f:e45f:736f:a85c%13]) with mapi id 15.20.0609.012; Tue, 27 Mar 2018 14:27:40 +0000 From: Corey Bonnell To: Jacob Hoffman-Andrews , "spasm@ietf.org" Thread-Topic: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags Thread-Index: AQHTi+4QDmko90Ob9kiZJwieEDaNDqPjolkAgACyQYA= Date: Tue, 27 Mar 2018 14:27:40 +0000 Message-ID: References: <878C91A0-6875-47A4-872F-F5D1F7F7AE7E@trustwave.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=CBonnell@trustwave.com; x-originating-ip: [204.13.202.248] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN6PR07MB4381; 7:jSy5kF3TVK6VJRrlinJARB+05mHVX5NPi6uRS2t6OsBEixPRcVg1PzBEGDnlnkf3xhMHUQyZhPuNOQzUYUuv2BGsiL4pvAeGyPdtEQS0UHKn4wcHho9NXOqPjsJK7EWKLZUcF2IeQnr7pKL6zIPRVD9VRGZu/sy4HreNuT72ePaxfY7LT4xiNU/ojtqxw1YSWZgoUx0o6ddbu7HrLNomx05yEolcR+7SGYGAY60SAo0uMNOOWZp4URG1E2d15nWr x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 51a18b7c-85dd-4c6b-3d0f-08d593eee55e x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:SN6PR07MB4381; x-ms-traffictypediagnostic: SN6PR07MB4381: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(232896897485771)(166708455590820)(192374486261705)(171964332516350)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(8121501046)(5005006)(3231221)(944501327)(52105095)(93006095)(93001095)(3002001)(10201501046)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(20161123564045)(6072148)(201708071742011); SRVR:SN6PR07MB4381; BCL:0; PCL:0; RULEID:; SRVR:SN6PR07MB4381; x-forefront-prvs: 0624A2429E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(366004)(39380400002)(39860400002)(396003)(189003)(199004)(105586002)(8676002)(26005)(110136005)(446003)(6436002)(53936002)(236005)(2906002)(229853002)(36756003)(33656002)(476003)(6486002)(11346002)(186003)(99286004)(72206003)(345774005)(2501003)(82746002)(80792005)(66066001)(102836004)(106356001)(97736004)(14454004)(478600001)(6512007)(81156014)(316002)(54896002)(5250100002)(81166006)(6116002)(3846002)(6306002)(6506007)(53546011)(3280700002)(6246003)(83716003)(5660300001)(8936002)(7736002)(59450400001)(2616005)(606006)(3660700001)(2900100001)(68736007)(25786009)(86362001)(486005)(76176011)(486005)(966005)(19400905002); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR07MB4381; H:SN6PR07MB4575.namprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: trustwave.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: xlu1KN4tv79tFqMO98oddEzs8CTResjuADbdQkNTwari7aXK3aV/CypYLrMLMc3Z1hD+Ia1S/DWAwMqOVKTsa4feKBIPl8upENcJLZ+V7NO8Rsgj1kjmd+gYoKPWMztMdbYpVR33VzdurUN5sKll3byxXNxgOXmAYt92Mg2GXIbQ3YvWpbQui/eMTkaexsWm0JfAUECoRPbb4z8r4malzJRNOhKVIYaZPM2BsZh9CW3tfhdPKLoCJLIkCmUrbEOBfTBHM73/qwTRcoHtL7de9lDLvhZ9sjkcCWuiYI6DWmqNSONmUhcP0Mt43SCh9VDTUWYjhat53FZSrT2Bd1ADHg== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_C051979C47264AF99C7AB63DB7309426trustwavecom_" MIME-Version: 1.0 X-OriginatorOrg: trustwave.com X-MS-Exchange-CrossTenant-Network-Message-Id: 51a18b7c-85dd-4c6b-3d0f-08d593eee55e X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2018 14:27:40.1669 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cb1dab68-a067-4b6b-ae7e-c012e8c33f6a X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR07MB4381 Archived-At: Subject: Re: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 14:27:53 -0000 --_000_C051979C47264AF99C7AB63DB7309426trustwavecom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SmFjb2IsDQpUaGFuayB5b3UgZm9yIGdldHRpbmcgdGhpcyBlcnJhdHVtIGluY2x1ZGVkIGluIFJG QyA2ODQ0LWJpcy4gSXQgd2lsbCBiZSBnb29kIHRvIGdldCB0aGUgd29yZGluZyBjbGVhcmVkIHVw Lg0KDQpBcyBmb3IgbXkgb3JpZ2luYWwgZXJyYXR1bSB0ZXh0IG5vdCBzcGVjaWZ5aW5nICJpc3N1 ZXdpbGQiLCB0aGF0IGlzIGJlY2F1c2Ugc2VjdGlvbiA1LjMgKDUuMy4gIENBQSBpc3N1ZXdpbGQg UHJvcGVydHkpIHNwZWNpZmllcyB0aGF0ICJUaGUgaXNzdWV3aWxkIHByb3BlcnR5IGhhcyB0aGUg c2FtZSBzeW50YXggYW5kIHNlbWFudGljcyBhcyB0aGUgaXNzdWUgcHJvcGVydHkgZXhjZXB0IHRo YXQgaXNzdWV3aWxkIHByb3BlcnRpZXMgb25seSBncmFudCBhdXRob3JpemF0aW9uIHRvIGlzc3Vl IGNlcnRpZmljYXRlcyB0aGF0IHNwZWNpZnkgYSB3aWxkY2FyZCBkb21haW4iLiBHaXZlbiB0aGF0 IGlzc3Vld2lsZCBwcm9wZXJ0eSB0YWdzIGhhdmUgdGhlIHNhbWUgc2VtYW50aWNzIGFzIGlzc3Vl IHByb3BlcnR5IHRhZ3MsIHRoZSBhZGRpdGlvbiBvZiBteSBvcmlnaW5hbCBlcnJhdHVtIHRleHQg KGluIHNlY3Rpb24gNS4yLCB3aGljaCBkZWZpbmVzIGlzc3VlIHByb3BlcnR5IHRhZyBzZW1hbnRp Y3MpIHdpbGwgYWxzbyBhZGRyZXNzIHRoZSBjYXNlIG9mIGEgcmVzb3VyY2UgcmVjb3JkIHNldCBu b3QgY29udGFpbmluZyBpc3N1ZSBwcm9wZXJ0eSB0YWdzIGFuZCBub3QgY29udGFpbmluZyBpc3N1 ZXdpbGQgcHJvcGVydHkgdGFncyAob25seSBpbiB0aGUgY2FzZSBvZiB3aWxkY2FyZCBkb21haW4g bmFtZXMsIHNpbmNlIGlzc3Vld2lsZCBwcm9wZXJ0eSB0YWdzIGFyZSBvdGhlcndpc2UgaWdub3Jl ZCBhcyBwZXIgc2VjdGlvbiA1LjMpLg0KDQpJZiB5b3UgdGhpbmsgdGhhdCdzIHRvbyB2YWd1ZSBh bmQgaXQncyBiZXR0ZXIgdG8gZXhwbGljaXRseSBtZW50aW9uIHRoZSBsYWNrIG9mIGlzc3Vld2ls ZCB0YWdzLCB3ZSBzaG91bGQgcXVhbGlmeSB0aGUgbGFuZ3VhZ2UgYSBiaXQgdG8gc2F5ICJBIG5v bi1lbXB0eSBDQUEgcmVjb3JkIHNldCB0aGF0IGNvbnRhaW5zIG5vIGlzc3VlIHByb3BlcnR5IHRh Z3MgKGFuZCBhbHNvIGRvZXMgbm90IGNvbnRhaW4gYW55IGlzc3Vld2lsZCBwcm9wZXJ0eSB0YWdz IHdoZW4gcGVyZm9ybWluZyBpc3N1ZSByZXN0cmljdGlvbiBwcm9jZXNzaW5nIGZvciBhIHdpbGRj YXJkIGRvbWFpbikgaXMgYXV0aG9yaXphdGlvbiB0byBhbnkgY2VydGlmaWNhdGUgaXNzdWVyIHRv IGlzc3VlIGZvciB0aGUgY29ycmVzcG9uZGluZyBkb21haW4sIHByb3ZpZGVkIHRoYXQgbm8gcmVj b3JkcyBpbiB0aGUgQ0FBIHJlY29yZCBzZXQgb3RoZXJ3aXNlIHByb2hpYml0IGlzc3VhbmNlLiIg T3RoZXJ3aXNlLCBpdCBpcyB1bmNsZWFyIGhvdyB0byBoYW5kbGUgdGhlIGNhc2Ugb2YgYSBub24t ZW1wdHkgQ0FBIHJlY29yZCBzZXQgZm9yIGEgbm9uLXdpbGRjYXJkIGRvbWFpbiB0aGF0IGRvZXMg bm90IGNvbnRhaW4gYW4gaXNzdWUgcHJvcGVydHkgdGFnIGJ1dCBjb250YWlucyBvbmUgb3IgbW9y ZSBpc3N1ZXdpbGQgcHJvcGVydHkgdGFncy4NCg0KVGhhbmtzLA0KQ29yZXkNCg0KDQpDb3JleSBC b25uZWxsDQpTZW5pb3IgU29mdHdhcmUgRW5naW5lZXINCnQ6ICsxIDQxMi4zOTUuMjIzMw0KDQpU cnVzdHdhdmUgfCBTTUFSVCBTRUNVUklUWSBPTiBERU1BTkQNCnd3dy50cnVzdHdhdmUuY29tPGh0 dHA6Ly93d3cudHJ1c3R3YXZlLmNvbS8+DQpGcm9tOiBKYWNvYiBIb2ZmbWFuLUFuZHJld3MgPGpz aGFAZWZmLm9yZz4NCkRhdGU6IE1vbmRheSwgTWFyY2ggMjYsIDIwMTggYXQgNzo0OSBQTQ0KVG86 IENvcmV5IEJvbm5lbGwgPENCb25uZWxsQHRydXN0d2F2ZS5jb20+LCAic3Bhc21AaWV0Zi5vcmci IDxzcGFzbUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIEFtYmlndWl0aWVzIGluIFJG QyA2ODQ0IHJlZ2FyZGluZyBDQUEgcmVzb3VyY2UgcmVjb3JkIHNldHMgd2l0aCBubyAiaXNzdWUi IHByb3BlcnR5IHRhZ3MNCg0KSSd2ZSB3cml0dGVuIHRoaXMgdXAgYXMgYSBQUjogaHR0cHM6Ly9n aXRodWIuY29tL2pzaGEvY2FhLXNpbXBsaWZpY2F0aW9uL3B1bGwvMS9maWxlczxodHRwczovL3Nj YW5tYWlsLnRydXN0d2F2ZS5jb20vP2M9NDA2MiZkPWxvZTUyak5pOFYyUXRMbG1DeHEteV9uYmta MHI1NERIdmYwR3VvT2tqUSZzPTUmdT1odHRwcyUzYSUyZiUyZmdpdGh1YiUyZWNvbSUyZmpzaGEl MmZjYWEtc2ltcGxpZmljYXRpb24lMmZwdWxsJTJmMSUyZmZpbGVzPi4gSWYgdGhlcmUgYXJlIG5v IG9iamVjdGlvbnMsIEknbGwgbWVyZ2UgaXQgaW4gYSB3ZWVrIGZvciB0aGUgNjg0NGJpcyBkcmFm dC4NCg0KTm90ZSB0aGF0IEkgdHdlYWtlZCBpdCBzbGlnaHRseSBmcm9tIHlvdXIgZXJyYXR1bSAo aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvZXJyYXRhL2VpZDUyNDQ8aHR0cHM6Ly9zY2FubWFp bC50cnVzdHdhdmUuY29tLz9jPTQwNjImZD1sb2U1MmpOaThWMlF0TGxtQ3hxLXlfbmJrWjByNTRE SHZmMEV2OUdtalEmcz01JnU9aHR0cHMlM2ElMmYlMmZ3d3clMmVyZmMtZWRpdG9yJTJlb3JnJTJm ZXJyYXRhJTJmZWlkNTI0ND4pLiBXaGVyZSB5b3UgcmVmZXJyZWQganVzdCB0byAiaXNzdWUiIHBy b3BlcnR5IHRhZ3MsIEkgbWVudGlvbiBib3RoICJpc3N1ZSIgYW5kICJpc3N1ZXdpbGQuIg0KT24g MDEvMTIvMjAxOCAwMTo0MSBQTSwgQ29yZXkgQm9ubmVsbCB3cm90ZToNCkhlbGxvLA0KSSBiZWxp ZXZlIHRoYXQgdGhlcmUgYXJlIHNldmVyYWwgYW1iaWd1aXRpZXMgaW4gUkZDIDY4NDQgaW4gcmVn YXJkIHRvIHByb2Nlc3NpbmcgQ0FBIHJlc291cmNlIHJlY29yZCBzZXRzIHRoYXQgZG8gbm90IGNv bnRhaW4gImlzc3VlIiByZWNvcmRzLg0KDQpTZWN0aW9uIDMgb2YgUkZDIDY4NDQgKGh0dHA6Ly93 d3cucmZjcmVhZGVyLmNvbS8jcmZjNjg0NF9saW5lMTk2PGh0dHA6Ly9zY2FubWFpbC50cnVzdHdh dmUuY29tLz9jPTQwNjImZD1sb2U1MmpOaThWMlF0TGxtQ3hxLXlfbmJrWjByNTRESHZhMVd1TlNu aVEmcz01JnU9aHR0cCUzYSUyZiUyZnd3dyUyZXJmY3JlYWRlciUyZWNvbSUyZiUyM3JmYzY4NDQl NWZsaW5lMTk2PikgZGVmaW5lcyB0aGUgImlzc3VlIiBwcm9wZXJ0eSB0YWcgdG8gYXV0aG9yaXpl ICJ0aGUgaG9sZGVyIG9mIHRoZSBkb21haW4gbmFtZSA8SXNzdWVyIERvbWFpbiBOYW1lPiBvciBh IHBhcnR5IGFjdGluZyB1bmRlciB0aGUgZXhwbGljaXQgYXV0aG9yaXR5IG9mIHRoZSBob2xkZXIg b2YgdGhhdCBkb21haW4gbmFtZSB0byBpc3N1ZSBjZXJ0aWZpY2F0ZXMgZm9yIHRoZSBkb21haW4g aW4gd2hpY2ggdGhlIHByb3BlcnR5IGlzIHB1Ymxpc2hlZCIuIEJhc2VkIG9uIG15IGludGVycHJl dGF0aW9uLCB0aGUgZGVmaW5pdGlvbiBnaXZlbiBoZXJlIGlzIHN1Z2dlc3RpbmcgdGhhdCBDQUEg aXNzdWUgcmVzdHJpY3Rpb24gcHJvY2Vzc2luZyBpcyBkb25lIHJlZ2FyZGxlc3Mgb2Ygd2hldGhl ciBvciBub3QgdGhlcmUgaXMgYW4gImlzc3VlIiByZWNvcmQocykgcHJlc2VudCB0byBzcGVjaWZ5 IHRoZSBzZXQgb2YgcGVybWl0dGVkIElzc3VlciBEb21haW4gTmFtZXMuIEluIG90aGVyIHdvcmRz LCB0aGUgbGFjayBvZiAiaXNzdWUiIHJlY29yZHMgaW4gYSBDQUEgcmVzb3VyY2UgcmVjb3JkIHNl dCBpbmRpY2F0ZXMgdGhhdCBubyBDQSBtYXkgaXNzdWUgZm9yIHRoYXQgZG9tYWluLCBzaW5jZSBu byBDQSBoYXMgYmVlbiBhdXRob3JpemVkIHRvIGlzc3VlLg0KDQpIb3dldmVyLCBzZWN0aW9uIDUu MiAoaHR0cDovL3d3dy5yZmNyZWFkZXIuY29tLyNyZmM2ODQ0X2xpbmU0NDc8aHR0cDovL3NjYW5t YWlsLnRydXN0d2F2ZS5jb20vP2M9NDA2MiZkPWxvZTUyak5pOFYyUXRMbG1DeHEteV9uYmtaMHI1 NERIdmZ0WHZZZjMzZyZzPTUmdT1odHRwJTNhJTJmJTJmd3d3JTJlcmZjcmVhZGVyJTJlY29tJTJm JTIzcmZjNjg0NCU1ZmxpbmU0NDc+KSBkZWZpbmVzIHRoZSAiaXNzdWUiIHByb3BlcnR5IHRhZyB0 byAicmVxdWVzdCB0aGF0IGNlcnRpZmljYXRlIGlzc3VlcnMgcGVyZm9ybSBDQUEgaXNzdWUgcmVz dHJpY3Rpb24gcHJvY2Vzc2luZyBmb3IgdGhlIGRvbWFpbiBhbmQgdG8gZ3JhbnQgYXV0aG9yaXph dGlvbiB0byBzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBpc3N1ZXJzIi4gQmFzZWQgb24gdGhpcyBkZWZp bml0aW9uLCBpdCBzb3VuZHMgYXMgaWYgQ0FBIGlzc3VlIHJlc3RyaWN0aW9uIHByb2Nlc3Npbmcg aXMgIm9wdC1pbiIuIEluIG90aGVyIHdvcmRzLCB0aGUgYWJzZW5jZSBvZiAiaXNzdWUiIHJlY29y ZHMgaW4gYSBDQUEgcmVjb3JkIHNldCBpbmRpY2F0ZSB0aGF0IGFueSBDQSBtYXkgaXNzdWUgZm9y IHRoYXQgZG9tYWluIChzaW5jZSB0aGVyZSB3YXMgbm8gIm9wdC1pbiIgaW50byBDQUEgcmVzdHJp Y3Rpb24gcHJvY2Vzc2luZykuDQoNClNlY3Rpb24gNCAoaHR0cDovL3d3dy5yZmNyZWFkZXIuY29t LyNyZmM2ODQ0X2xpbmUyODg8aHR0cDovL3NjYW5tYWlsLnRydXN0d2F2ZS5jb20vP2M9NDA2MiZk PWxvZTUyak5pOFYyUXRMbG1DeHEteV9uYmtaMHI1NERIdmZOVnZORDEyUSZzPTUmdT1odHRwJTNh JTJmJTJmd3d3JTJlcmZjcmVhZGVyJTJlY29tJTJmJTIzcmZjNjg0NCU1ZmxpbmUyODg+KSBzdGF0 ZXMgdGhhdCwgImJlZm9yZSBpc3N1aW5nIGEgY2VydGlmaWNhdGUsIGEgY29tcGxpYW50IENBIE1V U1QgY2hlY2sgZm9yIHB1YmxpY2F0aW9uIG9mIGEgcmVsZXZhbnQgQ0FBIFJlc291cmNlIFJlY29y ZCBzZXQuIiBVbmZvcnR1bmF0ZWx5LCB0aGUgdGVybSAicmVsZXZhbnQiIGlzIG5vdCBkZWZpbmVk IGJ5IHRoZSBSRkMsIHdoaWNoLCBjb21wb3VuZGVkIHdpdGggdGhlIGFtYmlndWl0eSBoaWdobGln aHRlZCBhYm92ZSBpbiByZWdhcmQgdG8gdGhlIGRlZmluaXRpb24gb2YgdGhlICJpc3N1ZSIgcHJv cGVydHkgdGFnIGluIHNlY3Rpb25zIDMgYW5kIDUuMiwgbGVhZHMgdG8gYW1iaWd1aXR5IGluIHRo ZSBoYW5kbGluZyBmb2xsb3dpbmcgc2NlbmFyaW9zOg0KDQotIEEgQ0FBIHJlc291cmNlIHJlY29y ZCBzZXQgY29uc2lzdGluZyBzb2xlbHkgb2YgdW5rbm93biBub24tY3JpdGljYWwgcHJvcGVydHkg dGFncyAoaW5jbHVkaW5nIG1pc3NwZWxsaW5ncyBvZiAiaXNzdWUiLCBzdWNoIGFzICJpaXN1ZSIs IGV0Yy4pDQotIEEgQ0FBIHJlc291cmNlIHJlY29yZCBzZXQgY29uc2lzdGluZyBzb2xlbHkgb2Yg ImlvZGVmIiBwcm9wZXJ0eSB0YWdzDQotIEEgQ0FBIHJlc291cmNlIHJlY29yZCBzZXQgdGhhdCBj b250YWlucyBib3RoIG9mIHRoZSBhYm92ZQ0KDQpGb3IgZWFjaCBvZiB0aGVzZSBjYXNlcyBhYm92 ZSwgaXQgaXMgdW5jbGVhciB3aGljaCBvZiB0aGUgZm9sbG93aW5nIHRocmVlIGFjdGlvbnMgYSBD QSBzaG91bGQgdGFrZToNCi0gRmFpbCBpc3N1YW5jZSAoc2luY2UgdGhlIENBQSByZXNvdXJjZSBy ZWNvcmQgc2V0IGRpZCBub3QgYXV0aG9yaXplIGFueSBDQSB0byBpc3N1ZSwgZ2l2ZW4gdGhlIGRl ZmluaXRpb24gb2YgdGhlICJpc3N1ZSIgcHJvcGVydHkgdGFnIGluIFNlY3Rpb24gMykNCi0gQ29u dGludWUgdGhlIHRyZWUtY2xpbWJpbmcgc2VhcmNoIGZvciByZWNvcmRzIChzaW5jZSB0aGUgcmVz b3VyY2UgcmVjb3JkIHNldHMgYWJvdmUgY291bGQgY29uY2VpdmFibHkgYmUgY29uc2lkZXJlZCBh cyAibm90IHJlbGV2YW50IikNCi0gQWxsb3cgaXNzdWFuY2UgKHNpbmNlIHRoZSByZXNvdXJjZSBy ZWNvcmQgc2V0cyBhYm92ZSBjb3VsZCBjb25jZWl2YWJseSBiZSBjb25zaWRlcmVkIGFzICJyZWxl dmFudCIgYW5kIGFueSBDQSBtYXkgaXNzdWUsIGdpdmVuIHRoZSBkZWZpbml0aW9uIG9mIHRoZSAi aXNzdWUiIHByb3BlcnR5IHRhZyBpbiBzZWN0aW9uIDUuMikNCg0KQXQgVHJ1c3R3YXZlLCB3ZSBo YXZlIHRha2VuIHRoZSBjb25zZXJ2YXRpdmUgYXBwcm9hY2ggYW5kIHdpbGwgbm90IGlzc3VlIGNl cnRpZmljYXRlcyBpZiB3ZSBlbmNvdW50ZXIgQ0FBIHJlc291cmNlIHJlY29yZCBzZXRzIG1hdGNo aW5nIHRoZSBkZXNjcmlwdGlvbnMgb2YgdGhlIHRocmVlIGFib3ZlLiBIb3dldmVyLCBnaXZlbiB0 aGF0IHdlIG1heSBiZSBvdmVybHkgcmVzdHJpY3RpdmUgYnkgZG9pbmcgdGhpcywgYXMgd2VsbCBh cyBmb3IgYSBkZXNpcmUgZm9yIENBQSByZWNvcmQgc2V0cyB0byBiZSBwcm9jZXNzZWQgdW5pZm9y bWx5IHJlZ2FyZGxlc3Mgb2YgdGhlIENBLCB3ZSB3b3VsZCBsaWtlIHRvIHNlZSB0aGVzZSBhbWJp Z3VpdGllcyByZXNvbHZlZC4NCg0KSWYgb3RoZXJzIGFncmVlIHRoYXQgdGhlIGN1cnJlbnQgd29y ZGluZyBvZiB0aGUgUkZDIGlzIGFtYmlndW91cywgSSB3b3VsZCBiZSBoYXBweSB0byBwcmVzZW50 IGNoYW5nZXMgdG8gcmVsZXZhbnQgc2VjdGlvbnMgdG8gY2xlYXIgdXAgdGhlIGFtYmlndWl0eSwg YnV0IGZvciBub3cgSSB3YW50ZWQgdG8gc2VuZCB0aGlzIGFsb25nIHRvIHNlZSBpZiBvdGhlcnMg c2hhcmUgb3VyIGludGVycHJldGF0aW9uIG9mIHRoZSBSRkMuDQoNClRoYW5rcywNCkNvcmV5DQoN Cg0KDQpDb3JleSBCb25uZWxsDQpTZW5pb3IgU29mdHdhcmUgRW5naW5lZXINCnQ6ICsxIDQxMi4z OTUuMjIzMw0KDQpUcnVzdHdhdmUgfCBTTUFSVCBTRUNVUklUWSBPTiBERU1BTkQNCnd3dy50cnVz dHdhdmUuY29tPGh0dHA6Ly93d3cudHJ1c3R3YXZlLmNvbS8+DQoNCjIwMTcgQmVzdCBNYW5hZ2Vk IFNlY3VyaXR5IFNlcnZpY2UgV2lubmVyIOKAkyBTQyBNZWRpYQ0KDQoNCg0KDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpTcGFzbSBtYWlsaW5nIGxp c3QNCg0KU3Bhc21AaWV0Zi5vcmc8bWFpbHRvOlNwYXNtQGlldGYub3JnPg0KDQpodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtPGh0dHBzOi8vc2Nhbm1haWwudHJ1c3R3 YXZlLmNvbS8/Yz00MDYyJmQ9bG9lNTJqTmk4VjJRdExsbUN4cS15X25ia1owcjU0REh2ZkpWN29X ampRJnM9NSZ1PWh0dHBzJTNhJTJmJTJmd3d3JTJlaWV0ZiUyZW9yZyUyZm1haWxtYW4lMmZsaXN0 aW5mbyUyZnNwYXNtPg0KDQoNCg== --_000_C051979C47264AF99C7AB63DB7309426trustwavecom_ Content-Type: text/html; charset="utf-8" Content-ID: <3C06D7A74608D84D95CDF1C8238C9868@namprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJZdSBNaW5j aG8iOw0KCXBhbm9zZS0xOjIgMiA0IDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseToiXEBZdSBNaW5jaG8iO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29s YXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlv bnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2lu OjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5r DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUt bGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNv LXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFu LkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRl ZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwg UHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25zb2xhczt9DQpzcGFuLkVtYWlsU3R5bGUy MQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBp biAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwv c3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9 IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5KYWNvYiw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+VGhhbmsgeW91IGZvciBnZXR0aW5nIHRoaXMgZXJyYXR1bSBpbmNsdWRlZCBpbiBSRkMgNjg0 NC1iaXMuIEl0IHdpbGwgYmUgZ29vZCB0byBnZXQgdGhlIHdvcmRpbmcgY2xlYXJlZCB1cC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkFzIGZvciBteSBvcmlnaW5h bCBlcnJhdHVtIHRleHQgbm90IHNwZWNpZnlpbmcgJnF1b3Q7aXNzdWV3aWxkJnF1b3Q7LCB0aGF0 IGlzIGJlY2F1c2Ugc2VjdGlvbiA1LjMgKDUuMy4mbmJzcDsgQ0FBIGlzc3Vld2lsZCBQcm9wZXJ0 eSkgc3BlY2lmaWVzIHRoYXQgJnF1b3Q7VGhlIGlzc3Vld2lsZCBwcm9wZXJ0eSBoYXMgdGhlIHNh bWUgc3ludGF4IGFuZCBzZW1hbnRpY3MgYXMgdGhlIGlzc3VlDQogcHJvcGVydHkgZXhjZXB0IHRo YXQgaXNzdWV3aWxkIHByb3BlcnRpZXMgb25seSBncmFudCBhdXRob3JpemF0aW9uIHRvIGlzc3Vl IGNlcnRpZmljYXRlcyB0aGF0IHNwZWNpZnkgYSB3aWxkY2FyZCBkb21haW4mcXVvdDsuIEdpdmVu IHRoYXQgaXNzdWV3aWxkIHByb3BlcnR5IHRhZ3MgaGF2ZSB0aGUgc2FtZSBzZW1hbnRpY3MgYXMg aXNzdWUgcHJvcGVydHkgdGFncywgdGhlIGFkZGl0aW9uIG9mIG15IG9yaWdpbmFsIGVycmF0dW0g dGV4dCAoaW4gc2VjdGlvbg0KIDUuMiwgd2hpY2ggZGVmaW5lcyBpc3N1ZSBwcm9wZXJ0eSB0YWcg c2VtYW50aWNzKSB3aWxsIGFsc28gYWRkcmVzcyB0aGUgY2FzZSBvZiBhIHJlc291cmNlIHJlY29y ZCBzZXQgbm90IGNvbnRhaW5pbmcgaXNzdWUgcHJvcGVydHkgdGFncyBhbmQgbm90IGNvbnRhaW5p bmcgaXNzdWV3aWxkIHByb3BlcnR5IHRhZ3MgKG9ubHkgaW4gdGhlIGNhc2Ugb2Ygd2lsZGNhcmQg ZG9tYWluIG5hbWVzLCBzaW5jZSBpc3N1ZXdpbGQgcHJvcGVydHkgdGFncyBhcmUNCiBvdGhlcndp c2UgaWdub3JlZCBhcyBwZXIgc2VjdGlvbiA1LjMpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+SWYgeW91IHRoaW5rIHRoYXQncyB0b28gdmFndWUgYW5kIGl0J3Mg YmV0dGVyIHRvIGV4cGxpY2l0bHkgbWVudGlvbiB0aGUgbGFjayBvZiBpc3N1ZXdpbGQgdGFncywg d2Ugc2hvdWxkIHF1YWxpZnkgdGhlIGxhbmd1YWdlIGEgYml0IHRvIHNheSAmcXVvdDtBIG5vbi1l bXB0eSBDQUEgcmVjb3JkIHNldCB0aGF0IGNvbnRhaW5zIG5vIGlzc3VlIHByb3BlcnR5IHRhZ3MN CiAoYW5kIGFsc28gZG9lcyBub3QgY29udGFpbiBhbnkgaXNzdWV3aWxkIHByb3BlcnR5IHRhZ3Mg d2hlbiBwZXJmb3JtaW5nIGlzc3VlIHJlc3RyaWN0aW9uIHByb2Nlc3NpbmcgZm9yIGEgd2lsZGNh cmQgZG9tYWluKSBpcyBhdXRob3JpemF0aW9uIHRvIGFueSBjZXJ0aWZpY2F0ZSBpc3N1ZXIgdG8g aXNzdWUgZm9yIHRoZSBjb3JyZXNwb25kaW5nIGRvbWFpbiwgcHJvdmlkZWQgdGhhdCBubyByZWNv cmRzIGluIHRoZSBDQUEgcmVjb3JkIHNldCBvdGhlcndpc2UNCiBwcm9oaWJpdCBpc3N1YW5jZS4m cXVvdDsgT3RoZXJ3aXNlLCBpdCBpcyB1bmNsZWFyIGhvdyB0byBoYW5kbGUgdGhlIGNhc2Ugb2Yg YSBub24tZW1wdHkgQ0FBIHJlY29yZCBzZXQgZm9yIGEgbm9uLXdpbGRjYXJkIGRvbWFpbiB0aGF0 IGRvZXMgbm90IGNvbnRhaW4gYW4gaXNzdWUgcHJvcGVydHkgdGFnIGJ1dCBjb250YWlucyBvbmUg b3IgbW9yZSBpc3N1ZXdpbGQgcHJvcGVydHkgdGFncy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPlRoYW5rcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Q29yZXk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2NvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojNDI4RkM1Ij5Db3JleSBCb25uZWxsPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjojNDI4RkM1Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOmdyYXkiPlNlbmlvciBTb2Z0d2FyZSBFbmdpbmVlcjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpn cmF5Ij50OiAmIzQzOzEgNDEyLjM5NS4yMjMzPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0O2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtjb2xv cjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQt ZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzQyOEZDNSI+VHJ1c3R3 YXZlPC9zcGFuPjwvYj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmdyYXkiPiZuYnNwOzwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpncmF5Ij58Jm5ic3A7U01BUlQNCiBTRUNVUklUWSBPTiBE RU1BTkQ8YSBocmVmPSJodHRwOi8vd3d3LnRydXN0d2F2ZS5jb20vIj48c3BhbiBzdHlsZT0iY29s b3I6Z3JheTt0ZXh0LWRlY29yYXRpb246bm9uZSI+PGJyPg0Kd3d3LnRydXN0d2F2ZS5jb208L3Nw YW4+PC9hPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVD NERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+SmFjb2IgSG9mZm1hbi1BbmRyZXdzICZsdDtqc2hhQGVmZi5vcmcm Z3Q7PGJyPg0KPGI+RGF0ZTogPC9iPk1vbmRheSwgTWFyY2ggMjYsIDIwMTggYXQgNzo0OSBQTTxi cj4NCjxiPlRvOiA8L2I+Q29yZXkgQm9ubmVsbCAmbHQ7Q0Jvbm5lbGxAdHJ1c3R3YXZlLmNvbSZn dDssICZxdW90O3NwYXNtQGlldGYub3JnJnF1b3Q7ICZsdDtzcGFzbUBpZXRmLm9yZyZndDs8YnI+ DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtsYW1wc10gQW1iaWd1aXRpZXMgaW4gUkZDIDY4NDQgcmVn YXJkaW5nIENBQSByZXNvdXJjZSByZWNvcmQgc2V0cyB3aXRoIG5vICZxdW90O2lzc3VlJnF1b3Q7 IHByb3BlcnR5IHRhZ3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxhIG5hbWU9Il9NYWlsT3JpZ2luYWxCb2R5Ij5JJ3ZlIHdy aXR0ZW4gdGhpcyB1cCBhcyBhIFBSOg0KPC9hPjxhIGhyZWY9Imh0dHBzOi8vc2Nhbm1haWwudHJ1 c3R3YXZlLmNvbS8/Yz00MDYyJmFtcDtkPWxvZTUyak5pOFYyUXRMbG1DeHEteV9uYmtaMHI1NERI dmYwR3VvT2tqUSZhbXA7cz01JmFtcDt1PWh0dHBzJTNhJTJmJTJmZ2l0aHViJTJlY29tJTJmanNo YSUyZmNhYS1zaW1wbGlmaWNhdGlvbiUyZnB1bGwlMmYxJTJmZmlsZXMiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPmh0dHBzOi8vZ2l0aHViLmNvbS9qc2hhL2Nh YS1zaW1wbGlmaWNhdGlvbi9wdWxsLzEvZmlsZXM8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4uDQogSWYgdGhlcmUgYXJlIG5vIG9iamVjdGlvbnMsIEkn bGwgbWVyZ2UgaXQgaW4gYSB3ZWVrIGZvciB0aGUgNjg0NGJpcyBkcmFmdC48YnI+DQo8YnI+DQpO b3RlIHRoYXQgSSB0d2Vha2VkIGl0IHNsaWdodGx5IGZyb20geW91ciBlcnJhdHVtICg8L3NwYW4+ PGEgaHJlZj0iaHR0cHM6Ly9zY2FubWFpbC50cnVzdHdhdmUuY29tLz9jPTQwNjImYW1wO2Q9bG9l NTJqTmk4VjJRdExsbUN4cS15X25ia1owcjU0REh2ZjBFdjlHbWpRJmFtcDtzPTUmYW1wO3U9aHR0 cHMlM2ElMmYlMmZ3d3clMmVyZmMtZWRpdG9yJTJlb3JnJTJmZXJyYXRhJTJmZWlkNTI0NCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+aHR0cHM6Ly93d3cucmZj LWVkaXRvci5vcmcvZXJyYXRhL2VpZDUyNDQ8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij4pLg0KIFdoZXJlIHlvdSByZWZlcnJlZCBqdXN0IHRvICZxdW90 O2lzc3VlJnF1b3Q7IHByb3BlcnR5IHRhZ3MsIEkgbWVudGlvbiBib3RoICZxdW90O2lzc3VlJnF1 b3Q7IGFuZCAmcXVvdDtpc3N1ZXdpbGQuJnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxP cmlnaW5hbEJvZHkiPk9uIDAxLzEyLzIwMTggMDE6NDEgUE0sIENvcmV5IEJvbm5lbGwgd3JvdGU6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij5IZWxsbyw8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkkgYmVsaWV2ZSB0aGF0IHRoZXJl IGFyZSBzZXZlcmFsIGFtYmlndWl0aWVzIGluIFJGQyA2ODQ0IGluIHJlZ2FyZCB0byBwcm9jZXNz aW5nIENBQSByZXNvdXJjZSByZWNvcmQgc2V0cyB0aGF0IGRvIG5vdCBjb250YWluICZxdW90O2lz c3VlJnF1b3Q7IHJlY29yZHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHki PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlNlY3Rp b24gMyBvZiBSRkMgNjg0NCAoPC9zcGFuPjwvc3Bhbj48YSBocmVmPSJodHRwOi8vc2Nhbm1haWwu dHJ1c3R3YXZlLmNvbS8/Yz00MDYyJmFtcDtkPWxvZTUyak5pOFYyUXRMbG1DeHEteV9uYmtaMHI1 NERIdmExV3VOU25pUSZhbXA7cz01JmFtcDt1PWh0dHAlM2ElMmYlMmZ3d3clMmVyZmNyZWFkZXIl MmVjb20lMmYlMjNyZmM2ODQ0JTVmbGluZTE5NiI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPmh0dHA6Ly93 d3cucmZjcmVhZGVyLmNvbS8jcmZjNjg0NF9saW5lMTk2PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij4pDQogZGVmaW5lcyB0aGUgJnF1b3Q7aXNzdWUmcXVvdDsgcHJvcGVydHkgdGFnIHRv IGF1dGhvcml6ZSAmcXVvdDt0aGUgaG9sZGVyIG9mIHRoZSBkb21haW4gbmFtZSAmbHQ7SXNzdWVy IERvbWFpbiBOYW1lJmd0OyBvciBhIHBhcnR5IGFjdGluZyB1bmRlciB0aGUgZXhwbGljaXQgYXV0 aG9yaXR5IG9mIHRoZSBob2xkZXIgb2YgdGhhdCBkb21haW4gbmFtZSB0byBpc3N1ZSBjZXJ0aWZp Y2F0ZXMgZm9yIHRoZSBkb21haW4gaW4gd2hpY2ggdGhlIHByb3BlcnR5IGlzIHB1Ymxpc2hlZCZx dW90Oy4gQmFzZWQNCiBvbiBteSBpbnRlcnByZXRhdGlvbiwgdGhlIGRlZmluaXRpb24gZ2l2ZW4g aGVyZSBpcyBzdWdnZXN0aW5nIHRoYXQgQ0FBIGlzc3VlIHJlc3RyaWN0aW9uIHByb2Nlc3Npbmcg aXMgZG9uZSByZWdhcmRsZXNzIG9mIHdoZXRoZXIgb3Igbm90IHRoZXJlIGlzIGFuICZxdW90O2lz c3VlJnF1b3Q7IHJlY29yZChzKSBwcmVzZW50IHRvIHNwZWNpZnkgdGhlIHNldCBvZiBwZXJtaXR0 ZWQgSXNzdWVyIERvbWFpbiBOYW1lcy4gSW4gb3RoZXIgd29yZHMsIHRoZSBsYWNrIG9mDQogJnF1 b3Q7aXNzdWUmcXVvdDsgcmVjb3JkcyBpbiBhIENBQSByZXNvdXJjZSByZWNvcmQgc2V0IGluZGlj YXRlcyB0aGF0IG5vIENBIG1heSBpc3N1ZSBmb3IgdGhhdCBkb21haW4sIHNpbmNlIG5vIENBIGhh cyBiZWVuIGF1dGhvcml6ZWQgdG8gaXNzdWUuPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPkhvd2V2ZXIsIHNlY3Rpb24gNS4yICg8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Imh0dHA6Ly9z Y2FubWFpbC50cnVzdHdhdmUuY29tLz9jPTQwNjImYW1wO2Q9bG9lNTJqTmk4VjJRdExsbUN4cS15 X25ia1owcjU0REh2ZnRYdllmMzNnJmFtcDtzPTUmYW1wO3U9aHR0cCUzYSUyZiUyZnd3dyUyZXJm Y3JlYWRlciUyZWNvbSUyZiUyM3JmYzY4NDQlNWZsaW5lNDQ3Ij48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ aHR0cDovL3d3dy5yZmNyZWFkZXIuY29tLyNyZmM2ODQ0X2xpbmU0NDc8L3NwYW4+PC9zcGFuPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPikNCiBkZWZpbmVzIHRoZSAmcXVvdDtpc3N1ZSZxdW90OyBwcm9wZXJ0 eSB0YWcgdG8gJnF1b3Q7cmVxdWVzdCB0aGF0IGNlcnRpZmljYXRlIGlzc3VlcnMgcGVyZm9ybSBD QUEgaXNzdWUgcmVzdHJpY3Rpb24gcHJvY2Vzc2luZyBmb3IgdGhlIGRvbWFpbiBhbmQgdG8gZ3Jh bnQgYXV0aG9yaXphdGlvbiB0byBzcGVjaWZpYyBjZXJ0aWZpY2F0ZSBpc3N1ZXJzJnF1b3Q7LiBC YXNlZCBvbiB0aGlzIGRlZmluaXRpb24sIGl0IHNvdW5kcyBhcyBpZiBDQUEgaXNzdWUgcmVzdHJp Y3Rpb24gcHJvY2Vzc2luZw0KIGlzICZxdW90O29wdC1pbiZxdW90Oy4gSW4gb3RoZXIgd29yZHMs IHRoZSBhYnNlbmNlIG9mICZxdW90O2lzc3VlJnF1b3Q7IHJlY29yZHMgaW4gYSBDQUEgcmVjb3Jk IHNldCBpbmRpY2F0ZSB0aGF0IGFueSBDQSBtYXkgaXNzdWUgZm9yIHRoYXQgZG9tYWluIChzaW5j ZSB0aGVyZSB3YXMgbm8gJnF1b3Q7b3B0LWluJnF1b3Q7IGludG8gQ0FBIHJlc3RyaWN0aW9uIHBy b2Nlc3NpbmcpLjwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxP cmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5TZWN0aW9uIDQgKDwv c3Bhbj48L3NwYW4+PGEgaHJlZj0iaHR0cDovL3NjYW5tYWlsLnRydXN0d2F2ZS5jb20vP2M9NDA2 MiZhbXA7ZD1sb2U1MmpOaThWMlF0TGxtQ3hxLXlfbmJrWjByNTRESHZmTlZ2TkQxMlEmYW1wO3M9 NSZhbXA7dT1odHRwJTNhJTJmJTJmd3d3JTJlcmZjcmVhZGVyJTJlY29tJTJmJTIzcmZjNjg0NCU1 ZmxpbmUyODgiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5odHRwOi8vd3d3LnJmY3JlYWRlci5jb20vI3Jm YzY4NDRfbGluZTI4ODwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+KQ0KIHN0YXRlcyB0 aGF0LCAmcXVvdDtiZWZvcmUgaXNzdWluZyBhIGNlcnRpZmljYXRlLCBhIGNvbXBsaWFudCBDQSBN VVNUIGNoZWNrIGZvciBwdWJsaWNhdGlvbiBvZiBhIHJlbGV2YW50IENBQSBSZXNvdXJjZSBSZWNv cmQgc2V0LiZxdW90OyBVbmZvcnR1bmF0ZWx5LCB0aGUgdGVybSAmcXVvdDtyZWxldmFudCZxdW90 OyBpcyBub3QgZGVmaW5lZCBieSB0aGUgUkZDLCB3aGljaCwgY29tcG91bmRlZCB3aXRoIHRoZSBh bWJpZ3VpdHkgaGlnaGxpZ2h0ZWQgYWJvdmUgaW4gcmVnYXJkIHRvDQogdGhlIGRlZmluaXRpb24g b2YgdGhlICZxdW90O2lzc3VlJnF1b3Q7IHByb3BlcnR5IHRhZyBpbiBzZWN0aW9ucyAzIGFuZCA1 LjIsIGxlYWRzIHRvIGFtYmlndWl0eSBpbiB0aGUgaGFuZGxpbmcgZm9sbG93aW5nIHNjZW5hcmlv czo8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxC b2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+LSBBIENBQSByZXNvdXJjZSByZWNv cmQgc2V0IGNvbnNpc3Rpbmcgc29sZWx5IG9mIHVua25vd24gbm9uLWNyaXRpY2FsIHByb3BlcnR5 IHRhZ3MgKGluY2x1ZGluZyBtaXNzcGVsbGluZ3Mgb2YgJnF1b3Q7aXNzdWUmcXVvdDssIHN1Y2gg YXMgJnF1b3Q7aWlzdWUmcXVvdDssIGV0Yy4pDQo8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPi0gQSBDQUEgcmVzb3Vy Y2UgcmVjb3JkIHNldCBjb25zaXN0aW5nIHNvbGVseSBvZiAmcXVvdDtpb2RlZiZxdW90OyBwcm9w ZXJ0eSB0YWdzPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij4tIEEgQ0FBIHJlc291cmNlIHJlY29yZCBzZXQgdGhhdCBj b250YWlucyBib3RoIG9mIHRoZSBhYm92ZTwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij5Gb3IgZWFjaCBvZiB0aGVzZSBjYXNlcyBhYm92ZSwgaXQgaXMgdW5jbGVhciB3aGljaCBvZiB0 aGUgZm9sbG93aW5nIHRocmVlIGFjdGlvbnMgYSBDQSBzaG91bGQgdGFrZTo8L3NwYW4+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi Pi0gRmFpbCBpc3N1YW5jZSAoc2luY2UgdGhlIENBQSByZXNvdXJjZSByZWNvcmQgc2V0IGRpZCBu b3QgYXV0aG9yaXplIGFueSBDQSB0byBpc3N1ZSwgZ2l2ZW4gdGhlIGRlZmluaXRpb24gb2YgdGhl ICZxdW90O2lzc3VlJnF1b3Q7IHByb3BlcnR5IHRhZyBpbiBTZWN0aW9uIDMpPC9zcGFuPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij4tIENvbnRpbnVlIHRoZSB0cmVlLWNsaW1iaW5nIHNlYXJjaCBmb3IgcmVjb3JkcyAoc2luY2Ug dGhlIHJlc291cmNlIHJlY29yZCBzZXRzIGFib3ZlIGNvdWxkIGNvbmNlaXZhYmx5IGJlIGNvbnNp ZGVyZWQgYXMgJnF1b3Q7bm90IHJlbGV2YW50JnF1b3Q7KTwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+LSBBbGxvdyBp c3N1YW5jZSAoc2luY2UgdGhlIHJlc291cmNlIHJlY29yZCBzZXRzIGFib3ZlIGNvdWxkIGNvbmNl aXZhYmx5IGJlIGNvbnNpZGVyZWQgYXMgJnF1b3Q7cmVsZXZhbnQmcXVvdDsgYW5kIGFueSBDQSBt YXkgaXNzdWUsIGdpdmVuIHRoZSBkZWZpbml0aW9uIG9mIHRoZSAmcXVvdDtpc3N1ZSZxdW90OyBw cm9wZXJ0eQ0KIHRhZyBpbiBzZWN0aW9uIDUuMik8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+QXQgVHJ1c3R3YXZlLCB3ZSBoYXZlIHRha2VuIHRoZSBjb25zZXJ2YXRpdmUgYXBwcm9h Y2ggYW5kIHdpbGwgbm90IGlzc3VlIGNlcnRpZmljYXRlcyBpZiB3ZSBlbmNvdW50ZXIgQ0FBIHJl c291cmNlIHJlY29yZCBzZXRzIG1hdGNoaW5nIHRoZSBkZXNjcmlwdGlvbnMgb2YgdGhlDQogdGhy ZWUgYWJvdmUuIEhvd2V2ZXIsIGdpdmVuIHRoYXQgd2UgbWF5IGJlIG92ZXJseSByZXN0cmljdGl2 ZSBieSBkb2luZyB0aGlzLCBhcyB3ZWxsIGFzIGZvciBhIGRlc2lyZSBmb3IgQ0FBIHJlY29yZCBz ZXRzIHRvIGJlIHByb2Nlc3NlZCB1bmlmb3JtbHkgcmVnYXJkbGVzcyBvZiB0aGUgQ0EsIHdlIHdv dWxkIGxpa2UgdG8gc2VlIHRoZXNlIGFtYmlndWl0aWVzIHJlc29sdmVkLjwvc3Bhbj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij5JZiBvdGhlcnMgYWdyZWUgdGhhdCB0aGUgY3VycmVudCB3b3Jk aW5nIG9mIHRoZSBSRkMgaXMgYW1iaWd1b3VzLCBJIHdvdWxkIGJlIGhhcHB5IHRvIHByZXNlbnQg Y2hhbmdlcyB0byByZWxldmFudCBzZWN0aW9ucyB0byBjbGVhciB1cCB0aGUgYW1iaWd1aXR5LCBi dXQgZm9yIG5vdw0KIEkgd2FudGVkIHRvIHNlbmQgdGhpcyBhbG9uZyB0byBzZWUgaWYgb3RoZXJz IHNoYXJlIG91ciBpbnRlcnByZXRhdGlvbiBvZiB0aGUgUkZDLjwvc3Bhbj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5UaGFua3MsPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Db3JleTwvc3Bhbj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2siPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojNDI4RkM1Ij5Db3JleSBCb25uZWxsPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmdy YXkiPlNlbmlvciBTb2Z0d2FyZSBFbmdpbmVlcjwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmdyYXkiPnQ6ICYj NDM7MSA0MTIuMzk1LjIyMzM8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Y29sb3I6YmxhY2si PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxC b2R5Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM0MjhGQzUiPlRydXN0d2F2ZTwvc3Bhbj48L2I+ PC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6Z3JheSI+Jm5ic3A7PC9zcGFuPjwvYj48L3NwYW4+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpn cmF5Ij58Jm5ic3A7U01BUlQNCiBTRUNVUklUWSBPTiBERU1BTkQ8L3NwYW4+PC9zcGFuPjxhIGhy ZWY9Imh0dHA6Ly93d3cudHJ1c3R3YXZlLmNvbS8iPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Z3JheTt0ZXh0LWRlY29yYXRp b246bm9uZSI+PGJyPg0Kd3d3LnRydXN0d2F2ZS5jb208L3NwYW4+PC9zcGFuPjwvYT48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmdyYXkiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxpPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpncmF5Ij4yMDE3IEJlc3QgTWFuYWdlZCBTZWN1cml0eSBTZXJ2aWNlIFdpbm5lciDigJMgU0Mg TWVkaWE8L3NwYW4+PC9pPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPHByZT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxv OnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij5TcGFzbSBtYWlsaW5nIGxpc3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3By ZT4NCjxwcmU+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9z cGFuPjxhIGhyZWY9Im1haWx0bzpTcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+U3Bhc21AaWV0Zi5vcmc8L3NwYW4+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFu PjxhIGhyZWY9Imh0dHBzOi8vc2Nhbm1haWwudHJ1c3R3YXZlLmNvbS8/Yz00MDYyJmFtcDtkPWxv ZTUyak5pOFYyUXRMbG1DeHEteV9uYmtaMHI1NERIdmZKVjdvV2pqUSZhbXA7cz01JmFtcDt1PWh0 dHBzJTNhJTJmJTJmd3d3JTJlaWV0ZiUyZW9yZyUyZm1haWxtYW4lMmZsaXN0aW5mbyUyZnNwYXNt Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8L2Js b2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PGJyPg0K PGJyPg0KPC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_C051979C47264AF99C7AB63DB7309426trustwavecom_-- From nobody Tue Mar 27 08:44:07 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8E5712785F for ; Tue, 27 Mar 2018 08:44:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xJPrLQtu0xmu for ; Tue, 27 Mar 2018 08:44:01 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FA6612DA6F for ; Tue, 27 Mar 2018 08:44:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 972A1300A12 for ; Tue, 27 Mar 2018 11:43:59 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id PGXF_O97wLkD for ; Tue, 27 Mar 2018 11:43:56 -0400 (EDT) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id C696E30044B for ; Tue, 27 Mar 2018 11:43:56 -0400 (EDT) From: Russ Housley Content-Type: multipart/alternative; boundary="Apple-Mail=_A7D4E41F-E64F-4C3D-AB7B-4B6116E75B8A" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 27 Mar 2018 11:44:01 -0400 References: To: LAMPS In-Reply-To: Message-Id: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 15:44:06 -0000 --Apple-Mail=_A7D4E41F-E64F-4C3D-AB7B-4B6116E75B8A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Trimming the distribution to the LAMPS mail list ... RFC 3281 includes the definition of noRevAvail certificate extension. = It is defined in X.509, and the definition is repeated in RFC 3281, = Section 4.3.6. If the CA is not going to publish revocation information about the = certificate, I think we should include this extension to tell relying = parties not to bother looking for it. Russ > On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >=20 > Hi all, >=20 > unfortunately I missed the sec-dispatch session, but I have some = important considerations about the document. In general, short-lived = certificates have been around for many years and for many different = applications (nothing new here), however nobody who have been working = with PKI long enough would actually made the case that the security = levels of short-lived-no-revo and any-lived-plus-revo are the same = (which seems the life-motif of the presentation and the document = itself). >=20 > Other aspects that I think shall be revisited are the lack of = considerations about the usability of deployed infrastructures (when no = revocation is assumed) and some wrong considerations in the document = about validity periods of OCSP Responses and CRLs (that clearly = undermine the equivalence claim). > Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev = Support > The statements that made me jump on my seat is the claim that = short-lived certificates without revocation support (BTW, short-lived = does not necessarily exclude revocation support) and certificates = (short-lived or not) vs. any-lived certificates with revocation support = have the same level of security as long as the validity period of the = short-lived ones is equal or shorter than CRLs or OCSP validity. I find = this quite a puzzling statement. For once, there should be = considerations about the fact that if a key is compromised and it is = used by a malicious entity to attack/disrupt/etc. another entity, the = rightful owner of the certificate does not have any possibility to prove = that someone else did it - there is no authenticated trail (OCSP = response or CRL) that can be used in this case and this can lead, in = some environments, to legal implications. I am curious about how do the = authors address this point, maybe some considerations shall be made = here. >=20 > Also the claim that: >=20 > " it is hard to justify why the CA or a delegate needs to both sign = blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) = to tell relying parties that blob-1 is still valid." >=20 > is quite curious and, I might say, misleading. Although the revocation = status (either in the form of an OCSP or CRL) does not provide = additional information besides the validity when the certificate is not = revoked, it does provide quite a lot of useful information when the = certificate is revoked (e.g., when a compromised happened, the reason = for revocation - e.g., key compromise, a person has left the = organization, a HW token is broken, etc.). I would prefer the authors to = explain what they mean in more extensive and engineering-appropriate = form. This is another evidence that the two systems are definitely NOT = equivalent from a security perspective. >=20 > Another example about the fact that some form of revocation is still = needed comes from the document itself (thus contradicting, IMO, the main = claim of the document - 5.1): >=20 > "No matter how short-term these short term certificates are, there is = a certain window of time when the attacker can use the certificate. = This can often be mitigated with application-level measures." >=20 > this is "application-level measures =3D=3D application-level = revocation". This means that now, instead of having standardized ways to = check for the status of certificates, each application need to implement = a way to deal with it on an ad-hoc basis and being able to distribute = securely this information to all relying parties. Undoubtedly, for = anybody who has ever had to deal with such problems this becomes a quite = costly and intractable problems very quickly. Maybe some considerations = about this should be added in the document as well. >=20 > Usability of Deployed Infrastructures >=20 > One important section that is missing is: how do these no-revocation = PKIs look like? There are basically two main choices here: >=20 > Deploy a 2 level-only PKI. That means having a Trust Anchor that = issues directly the EE certificates. Besides all security considerations = about TAs being online (as required in short-lived environments), this = makes it very difficult to deploy. Important considerations should be = made in this case. >=20 > Deploy a 3+ level PKIs (current best practices). This approach = involves having (usually one) intermediate CAs (there can be more). In = this case, the TAs issue the intermediate CAs' certificates and the last = intermediate CAs issue the EE ones. Obviously, intermediate CAs can not = have the same short validity period as the EE certs, therefore the need = for revocation (at least at the intermediate CAs level) is evident. = Important considerations shall be made also in this case. > Wrong Considerations about CRLs and OCSP Responses validity periods >=20 > In the document, statements like the following shall be fixed and = expanded for clarity: >=20 > "If a CRL has a nextUpdate field that is 4 days in the future, a = typical system will not attempt to fetch a new one before those 4 days = have elapsed." >=20 > And then it continue by stating the following: > "For this reason, moving to STAR certificates provides a similar level = of security to what is generally practiced on the web." >=20 > Since the first statement is incomplete and, thus, misleading - the = second statement does not hold. Let me explain further for the people = that are not familiar with how CRLs and OCSP are processed. Although = there is a validity period for revocation information, it is well-known = that the expiration field indicates the time "within a new revocation = status information will be made available" and it is NOT "this is the = revocation status of the target certificate until the expiration" - = common practice is that when a revocation event occurs, new CRLs and = OCSP responses for the revoked certificates are made available = immediately or within few hours at most. > It is an important distinction that highlights also why the lack of = revocation information makes the system less secure. Although it is = quite evident why and since this is not addressed in the document, it = might be useful to spell it out. >=20 > In a multi-party environment, different applications might have (a) = different strategies when it comes to caching of the revocation = information and/or (b) check the revocation information at different = times. Let's make the case of 2 parties checking the rev info for the = same certificate. If party A accesses OCSP/CRLs at {time1} and caches it = until {time1 + delta}, party B retrieves it at {time2} and caches it = until {time2+delta}. Let's assume that time2 > time1 and that new = revocation status information is already available at {time2}. This = means that, although party A is still vulnerable until {time1+delta}, = party B is not. In a short-lived cert environment w/out revocation ALL = parties are VULNERABLE until the compromised {key+certificate} expires. >=20 > It seems quite clear that the two environments (short-lived w/ no revo = and any-lived w/ revo) do not have the same security properties. >=20 > Therefore I think that the authors ought to demonstrate the = equivalence of security levels (not just assume it as hypothesis - given = I just disproved it) or to remove all claims that the two environments = are actually equivalent from as security perspective and to add specific = considerations for short-lived-no-revo about the the fact that not = supporting revocation is inherently weaker because it potentially = exposes all parties to attacks (e.g., MITM, un-authorized access to = resources, etc.) that can not be stopped (unless you implement = application-level revocation.. and, therefore, re-introduce revocation = from the backdoor in a non-standardized, ad-hoc, hard-to-manage across = application fashion). >=20 > Final Considerations >=20 > I am not opposed at the concept of this document to be considered for = BCP, however all the above issues MUST, IMO, be addressed before the = document can be considered further. I think I already raised these = considerations at the last IETF, but I do not think the authors missed = or have not considered the provided feedback. I hope that a more = explicit and written feedback might be taken into considerations. >=20 > Just my 2 cents form an old barnacle... :D >=20 > Cheers, > Max > --=20 > Best Regards, > Massimiliano Pala, Ph.D. > OpenCA Labs Director > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --Apple-Mail=_A7D4E41F-E64F-4C3D-AB7B-4B6116E75B8A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Trimming the distribution to the LAMPS mail list ...

RFC 3281 includes the = definition of noRevAvail certificate extension.  It is defined in = X.509, and the definition is repeated in RFC 3281, Section = 4.3.6.

If the = CA is not going to publish revocation information about the certificate, = I think we should include this extension to tell relying parties not to = bother looking for it.

Russ


On Mar 21, 2018, at 9:08 AM, = Dr. Pala <director@openca.org> wrote:

=20 =20

Hi = all,

unfortunately I missed the sec-dispatch session, = but I have some important considerations about the document. In general, short-lived certificates have been around for many years and for many different applications (nothing new here), however nobody who have been working with PKI long enough would actually made the case that the security levels of short-lived-no-revo and any-lived-plus-revo are the same (which seems the life-motif of the presentation and the document itself).

Other = aspects that I think shall be revisited are the lack of considerations about the usability of deployed infrastructures (when no revocation is assumed) and some wrong considerations in the document about validity periods of OCSP Responses and CRLs (that clearly undermine the equivalence claim).

Equivalence of = Short-Lived w/out Rev Support and Any-Lived w/ Rev Support

The statements that made me jump on my seat is the = claim that short-lived certificates without revocation support (BTW, short-lived does not necessarily exclude revocation support) and certificates (short-lived or not) vs. any-lived certificates with revocation support have the same level of security as long as the validity period of the short-lived ones is equal or shorter than CRLs or OCSP validity. I find this quite a puzzling statement. For once, there should be considerations about the fact that if a key is compromised and it is used by a malicious entity to attack/disrupt/etc. another entity, the rightful owner of the certificate does not have any possibility to prove that someone else did it - there is no authenticated trail (OCSP response or CRL) that can be used in this case and this can lead, in some environments, to legal implications. I am curious about how do the authors address this point, maybe some considerations shall be made here.

Also the claim that:

" it is hard to justify why the = CA or a delegate needs to both sign blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to tell relying parties that blob-1 is still valid."

is quite curious and, I might say, = misleading. Although the revocation status (either in the form of an OCSP or CRL) does not provide additional information besides the validity when the certificate is not revoked, it does provide quite a lot of useful information when the certificate is revoked (e.g., when a compromised happened, the reason for revocation - e.g., key compromise, a person has left the organization, a HW token is broken, etc.). I would prefer the authors to explain what they mean in more extensive and engineering-appropriate form. This is another evidence that the two systems are definitely NOT equivalent from a security perspective.

Another = example about the fact that some form of revocation is still needed comes from the document itself (thus contradicting, IMO, the main claim of the document - 5.1):

"No matter how short-term these = short term certificates are, there is a certain window of time when the attacker can use the certificate.  This can often be mitigated with = application-level measures."

this is "application-level measures =3D=3D = application-level revocation". This means that now, instead of having standardized ways to check for the status of certificates, each application need to implement a way to deal with it on an ad-hoc basis and being able to distribute securely this information to all relying parties. Undoubtedly, for anybody who has ever had to deal with such problems this becomes a quite costly and intractable problems very quickly. Maybe some considerations about this should be added in the document as well.

Usability of Deployed Infrastructures

One important section that is missing is: how do these no-revocation PKIs look like? There are basically two main choices here:

  1. Deploy a 2 level-only PKI. That means having a = Trust Anchor that issues directly the EE certificates. Besides all security considerations about TAs being online (as required in short-lived environments), this makes it very difficult to deploy. Important considerations should be made in = this case.

  2. Deploy a 3+ level PKIs (current best practices). = This approach involves having (usually one) intermediate CAs (there can be more). In this case, the TAs issue the intermediate CAs' certificates and the last intermediate CAs issue the EE ones. Obviously, intermediate CAs can not have the same short validity period as the EE certs, therefore the need for revocation (at least at the intermediate CAs level) is evident. Important considerations shall be made also in this case.

Wrong Considerations about CRLs and = OCSP Responses validity periods

In the document, statements like = the following shall be fixed and expanded for clarity:

"If a CRL has a nextUpdate = field that is 4 days in the future, a typical system will not attempt to fetch a new one before those 4 days have elapsed."

And then it continue by stating the = following:

"For this reason, moving to = STAR certificates provides a similar level of security to what is generally practiced on the web."

Since the first statement is incomplete = and, thus, misleading - the second statement does not hold. Let me explain further for the people that are not familiar with how CRLs and OCSP are processed. Although there is a validity period for revocation information, it is well-known that the expiration field indicates the time "within a new revocation status information will be made available" and it is NOT "this is the revocation status of the target certificate until the expiration" - common practice is that when a revocation event occurs, new CRLs and OCSP responses for the revoked certificates are made available immediately or within few hours at most.

It is an important distinction that highlights = also why the lack of revocation information makes the system less secure. Although it is quite evident why and since this is not addressed in the document, it might be useful to spell it out.

In = a multi-party environment, different applications might have (a) different strategies when it comes to caching of the revocation information and/or (b) check the revocation information at different times. Let's make the case of 2 parties checking the rev info for the same certificate. If party A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, party B retrieves it at {time2} and caches it until {time2+delta}. Let's assume that time2 > time1 and that new revocation status information is already available at {time2}. This means that, although party A is still vulnerable until {time1+delta}, party B is not. In a short-lived cert environment w/out revocation ALL parties are VULNERABLE until the compromised {key+certificate} expires.

It seems quite clear that the two environments (short-lived = w/ no revo and any-lived w/ revo) do not have the same security properties.

Therefore I think that the authors = ought to demonstrate the equivalence of security levels (not just assume it as hypothesis - given I just disproved it) or to remove all claims that the two environments are actually equivalent from as security perspective and to add specific considerations for short-lived-no-revo about the the fact that not supporting revocation is inherently weaker because it potentially exposes all parties to attacks (e.g., MITM, un-authorized access to resources, etc.) that can not be stopped (unless you implement application-level revocation.. and, therefore, re-introduce revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manage across application fashion).

Final = Considerations

I am not opposed at the concept of = this document to be considered for BCP, however all the above issues MUST, IMO, be addressed before the document can be considered further. I think I already raised these considerations at the last IETF, but I do not think the authors missed or have not considered the provided feedback. I hope that a more explicit and written feedback might be taken into considerations.

Just my 2 cents form an old = barnacle... :D

Cheers,
Max

--
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
<cndojoacigamfbdj.png>=
_______________________________________________
Spasm = mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

= --Apple-Mail=_A7D4E41F-E64F-4C3D-AB7B-4B6116E75B8A-- From nobody Tue Mar 27 08:50:46 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D49EE12DA6A for ; Tue, 27 Mar 2018 08:50:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.31 X-Spam-Level: X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5eo8vbjdtJ9X for ; Tue, 27 Mar 2018 08:50:36 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72CDF12DA69 for ; Tue, 27 Mar 2018 08:50:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 41FF3BE6F; Tue, 27 Mar 2018 16:50:34 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H9ZRpCeU5ep1; Tue, 27 Mar 2018 16:50:34 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id DBF9FBE5C; Tue, 27 Mar 2018 16:50:33 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1522165834; bh=vGR2ZRbyWKN1/u+YX4ApXRF0vQdNyP1DeF8xpcIiqdE=; h=Subject:To:References:From:Date:In-Reply-To:From; b=FskceEPxFtHrA3Xsi/qwh9TlNv+1ofUi8D/BWsscmDKVV/kjaWcra/3YyKbQu2dLJ uQnpjzif9FbmwIvA+GVeUCQUtALs2aogchdvkbg0+ur1QU1d/4Yw55QkgQbi4JefDf hMXPDF3nvJxISyeFfg485bgRqXoylAHMjuFjrxKc= To: Russ Housley , LAMPS References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> Date: Tue, 27 Mar 2018 16:50:31 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="RfsF5nNpHMS7Kn74XyjzNChcEW3B80kh2" Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 15:50:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --RfsF5nNpHMS7Kn74XyjzNChcEW3B80kh2 Content-Type: multipart/mixed; boundary="GeKHNCnvzmKyxBYjarqnGF6CTJYnko380"; protected-headers="v1" From: Stephen Farrell To: Russ Housley , LAMPS Message-ID: <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> In-Reply-To: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> --GeKHNCnvzmKyxBYjarqnGF6CTJYnko380 Content-Type: multipart/mixed; boundary="------------3ADA2014D6D5AE4A6D8A7187" Content-Language: en-GB This is a multi-part message in MIME format. --------------3ADA2014D6D5AE4A6D8A7187 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/03/18 16:44, Russ Housley wrote: > Trimming the distribution to the LAMPS mail list ... >=20 > RFC 3281 includes the definition of noRevAvail certificate extension. = It is defined in X.509, and the definition is repeated in RFC 3281, Secti= on 4.3.6. >=20 > If the CA is not going to publish revocation information about the cert= ificate, I think we should include this extension to tell relying parties= not to bother looking for it. Makes sense to me too. It's non-critical so shouldn't break anything. S. >=20 > Russ >=20 >=20 >> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >> >> Hi all, >> >> unfortunately I missed the sec-dispatch session, but I have some impor= tant considerations about the document. In general, short-lived certifica= tes have been around for many years and for many different applications (= nothing new here), however nobody who have been working with PKI long eno= ugh would actually made the case that the security levels of short-lived-= no-revo and any-lived-plus-revo are the same (which seems the life-motif = of the presentation and the document itself). >> >> Other aspects that I think shall be revisited are the lack of consider= ations about the usability of deployed infrastructures (when no revocatio= n is assumed) and some wrong considerations in the document about validit= y periods of OCSP Responses and CRLs (that clearly undermine the equivale= nce claim). >> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev Supp= ort >> The statements that made me jump on my seat is the claim that short-li= ved certificates without revocation support (BTW, short-lived does not ne= cessarily exclude revocation support) and certificates (short-lived or no= t) vs. any-lived certificates with revocation support have the same level= of security as long as the validity period of the short-lived ones is eq= ual or shorter than CRLs or OCSP validity. I find this quite a puzzling s= tatement. For once, there should be considerations about the fact that if= a key is compromised and it is used by a malicious entity to attack/disr= upt/etc. another entity, the rightful owner of the certificate does not h= ave any possibility to prove that someone else did it - there is no authe= nticated trail (OCSP response or CRL) that can be used in this case and t= his can lead, in some environments, to legal implications. I am curious a= bout how do the authors address this point, maybe some considerations sha= ll be made here. >> >> Also the claim that: >> >> " it is hard to justify why the CA or a delegate needs to both sign bl= ob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to= tell relying parties that blob-1 is still valid." >> >> is quite curious and, I might say, misleading. Although the revocation= status (either in the form of an OCSP or CRL) does not provide additiona= l information besides the validity when the certificate is not revoked, i= t does provide quite a lot of useful information when the certificate is = revoked (e.g., when a compromised happened, the reason for revocation - e= =2Eg., key compromise, a person has left the organization, a HW token is = broken, etc.). I would prefer the authors to explain what they mean in mo= re extensive and engineering-appropriate form. This is another evidence t= hat the two systems are definitely NOT equivalent from a security perspec= tive. >> >> Another example about the fact that some form of revocation is still n= eeded comes from the document itself (thus contradicting, IMO, the main c= laim of the document - 5.1): >> >> "No matter how short-term these short term certificates are, there is = a certain window of time when the attacker can use the certificate. This= can often be mitigated with application-level measures." >> >> this is "application-level measures =3D=3D application-level revocatio= n". This means that now, instead of having standardized ways to check for= the status of certificates, each application need to implement a way to = deal with it on an ad-hoc basis and being able to distribute securely thi= s information to all relying parties. Undoubtedly, for anybody who has ev= er had to deal with such problems this becomes a quite costly and intract= able problems very quickly. Maybe some considerations about this should b= e added in the document as well. >> >> Usability of Deployed Infrastructures >> >> One important section that is missing is: how do these no-revocation P= KIs look like? There are basically two main choices here: >> >> Deploy a 2 level-only PKI. That means having a Trust Anchor that issue= s directly the EE certificates. Besides all security considerations about= TAs being online (as required in short-lived environments), this makes i= t very difficult to deploy. Important considerations should be made in th= is case. >> >> Deploy a 3+ level PKIs (current best practices). This approach involve= s having (usually one) intermediate CAs (there can be more). In this case= , the TAs issue the intermediate CAs' certificates and the last intermedi= ate CAs issue the EE ones. Obviously, intermediate CAs can not have the s= ame short validity period as the EE certs, therefore the need for revocat= ion (at least at the intermediate CAs level) is evident. Important consid= erations shall be made also in this case. >> Wrong Considerations about CRLs and OCSP Responses validity periods >> >> In the document, statements like the following shall be fixed and expa= nded for clarity: >> >> "If a CRL has a nextUpdate field that is 4 days in the future, a typic= al system will not attempt to fetch a new one before those 4 days have el= apsed." >> >> And then it continue by stating the following: >> "For this reason, moving to STAR certificates provides a similar level= of security to what is generally practiced on the web." >> >> Since the first statement is incomplete and, thus, misleading - the se= cond statement does not hold. Let me explain further for the people that = are not familiar with how CRLs and OCSP are processed. Although there is = a validity period for revocation information, it is well-known that the e= xpiration field indicates the time "within a new revocation status inform= ation will be made available" and it is NOT "this is the revocation statu= s of the target certificate until the expiration" - common practice is th= at when a revocation event occurs, new CRLs and OCSP responses for the re= voked certificates are made available immediately or within few hours at = most. >> It is an important distinction that highlights also why the lack of re= vocation information makes the system less secure. Although it is quite e= vident why and since this is not addressed in the document, it might be u= seful to spell it out. >> >> In a multi-party environment, different applications might have (a) di= fferent strategies when it comes to caching of the revocation information= and/or (b) check the revocation information at different times. Let's ma= ke the case of 2 parties checking the rev info for the same certificate. = If party A accesses OCSP/CRLs at {time1} and caches it until {time1 + del= ta}, party B retrieves it at {time2} and caches it until {time2+delta}. L= et's assume that time2 > time1 and that new revocation status information= is already available at {time2}. This means that, although party A is st= ill vulnerable until {time1+delta}, party B is not. In a short-lived cert= environment w/out revocation ALL parties are VULNERABLE until the compro= mised {key+certificate} expires. >> >> It seems quite clear that the two environments (short-lived w/ no revo= and any-lived w/ revo) do not have the same security properties. >> >> Therefore I think that the authors ought to demonstrate the equivalenc= e of security levels (not just assume it as hypothesis - given I just dis= proved it) or to remove all claims that the two environments are actually= equivalent from as security perspective and to add specific consideratio= ns for short-lived-no-revo about the the fact that not supporting revocat= ion is inherently weaker because it potentially exposes all parties to at= tacks (e.g., MITM, un-authorized access to resources, etc.) that can not = be stopped (unless you implement application-level revocation.. and, ther= efore, re-introduce revocation from the backdoor in a non-standardized, a= d-hoc, hard-to-manage across application fashion). >> >> Final Considerations >> >> I am not opposed at the concept of this document to be considered for = BCP, however all the above issues MUST, IMO, be addressed before the docu= ment can be considered further. I think I already raised these considerat= ions at the last IETF, but I do not think the authors missed or have not = considered the provided feedback. I hope that a more explicit and written= feedback might be taken into considerations. >> >> Just my 2 cents form an old barnacle... :D >> >> Cheers, >> Max >> --=20 >> Best Regards, >> Massimiliano Pala, Ph.D. >> OpenCA Labs Director >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 --------------3ADA2014D6D5AE4A6D8A7187 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3Dg8yx -----END PGP PUBLIC KEY BLOCK----- --------------3ADA2014D6D5AE4A6D8A7187-- --GeKHNCnvzmKyxBYjarqnGF6CTJYnko380-- --RfsF5nNpHMS7Kn74XyjzNChcEW3B80kh2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJaumhIAAoJEFqy+vF7FyvqiFgP/2zC2Y9yvhoFT9DMQ0x+LRlY RX6X6kiSEjgPytysxqxFRoXXST0JtOF+nobFhW9RmkaF7K3rOCMy1UaKvl/eXTxS xwlPgAU/Autjp21BVt0BRSd3Xtgnq9+E9Ec37mEmENbVFwyiTFlMpOlxr7YPcjUY 5TaT5iqVAC8CtTndcASUAaP8q9mAD2Lo1rs72tIuJqVmUo9AlaqENIw0PQJvKlm4 kTk0jhhv2kxPcQ/NKXGcrswvOnSWDIuIaKEO1a1Kx0cMxMWZx6tz+F/kbCQM/Bci 4cEET1Fkztb5UrPtwG3duXJEwdE07YUSFq7SVwD/7Z2/lQlxN7Ggre4X0tVhF1kY b0h0bNdrPM6g9e6V/+CUrC2eGpYgCbfAx8gPme//1TclKR1ksboA6kwBq4maAXsE WKsEuJO6R87AyHe9JDtsMD8XSjZfjq6J8dxJvklS8tdD74dEfYs6oOAsUUuc2xgg m0ON+EHpi4oMikiAxdzz7xLAgyXxDXsQ9ei9WLxWWKVlMLwMNRBzSI9YrjQPOkvA /TNV1tonDge99BOznTOhzKrFZz2ra/EMYjVfzDnUCr961Q4p8i/ph0Tp35migRmq 1FhDr/NFA9F105J32GpGpSJKYHia9WL7PlfB1zVj2KOgZN7Z3HUx8q28s4YPxed/ 7XRUH5JFZ/0I2lyupFe9 =Ndxw -----END PGP SIGNATURE----- --RfsF5nNpHMS7Kn74XyjzNChcEW3B80kh2-- From nobody Tue Mar 27 12:40:56 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFCDA12785F for ; Tue, 27 Mar 2018 12:40:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iryzf4kqNumo for ; Tue, 27 Mar 2018 12:40:48 -0700 (PDT) Received: from smtp.outgoing.loopia.se (smtp.outgoing.loopia.se [194.9.95.112]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86EB812E04B for ; Tue, 27 Mar 2018 12:40:47 -0700 (PDT) Received: from s554.loopia.se (localhost [127.0.0.1]) by s554.loopia.se (Postfix) with ESMTP id 4EA28148737A for ; Tue, 27 Mar 2018 21:40:45 +0200 (CEST) Received: from s630.loopia.se (unknown [172.21.200.107]) by s554.loopia.se (Postfix) with ESMTP id 17BA65F65A1; Tue, 27 Mar 2018 21:40:45 +0200 (CEST) Received: from s405.loopia.se (unknown [172.21.200.105]) by s630.loopia.se (Postfix) with ESMTP id 0E533C6ED4A; Tue, 27 Mar 2018 21:40:45 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s499.loopia.se ([172.21.200.105]) by s405.loopia.se (s405.loopia.se [172.21.200.135]) (amavisd-new, port 10024) with LMTP id rYLxqJmbmEa4; Tue, 27 Mar 2018 21:40:43 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: mailstore2@aaa-sec.com X-Loopia-Originating-IP: 90.229.17.25 Received: from [10.0.1.54] (unknown [90.229.17.25]) (Authenticated sender: mailstore2@aaa-sec.com) by s499.loopia.se (Postfix) with ESMTPSA id F3E18134E858; Tue, 27 Mar 2018 21:40:42 +0200 (CEST) User-Agent: Microsoft-MacOutlook/10.b.0.180311 Date: Tue, 27 Mar 2018 21:40:42 +0200 From: Stefan Santesson To: Stephen Farrell , Russ Housley , LAMPS Message-ID: Thread-Topic: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> In-Reply-To: <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 19:40:52 -0000 We had a long discussion in ETSI about this. One aspect is that the absence of revocation information actually breaks se= veral implementations. One idea was to publish an empty CRL + an extension with the semantics =3D "Y= ou may skip the rev checking, because the CRL is empty" This way you would have the cake and eat it too. Old systems would use the = CRL and work. New systems would understand the extension and skip CRL checki= ng. But maybe this is to overcomplicate things. /Stefan =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" wrote: =20 =20 On 27/03/18 16:44, Russ Housley wrote: > Trimming the distribution to the LAMPS mail list ... >=20 > RFC 3281 includes the definition of noRevAvail certificate extension.= It is defined in X.509, and the definition is repeated in RFC 3281, Sectio= n 4.3.6. >=20 > If the CA is not going to publish revocation information about the ce= rtificate, I think we should include this extension to tell relying parties = not to bother looking for it. =20 Makes sense to me too. It's non-critical so shouldn't break anything. =20 S. =20 >=20 > Russ >=20 >=20 >> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >> >> Hi all, >> >> unfortunately I missed the sec-dispatch session, but I have some imp= ortant considerations about the document. In general, short-lived certificat= es have been around for many years and for many different applications (noth= ing new here), however nobody who have been working with PKI long enough wou= ld actually made the case that the security levels of short-lived-no-revo an= d any-lived-plus-revo are the same (which seems the life-motif of the presen= tation and the document itself). >> >> Other aspects that I think shall be revisited are the lack of consid= erations about the usability of deployed infrastructures (when no revocation= is assumed) and some wrong considerations in the document about validity pe= riods of OCSP Responses and CRLs (that clearly undermine the equivalence cla= im). >> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev Su= pport >> The statements that made me jump on my seat is the claim that short-= lived certificates without revocation support (BTW, short-lived does not nec= essarily exclude revocation support) and certificates (short-lived or not) v= s. any-lived certificates with revocation support have the same level of sec= urity as long as the validity period of the short-lived ones is equal or sho= rter than CRLs or OCSP validity. I find this quite a puzzling statement. For= once, there should be considerations about the fact that if a key is compro= mised and it is used by a malicious entity to attack/disrupt/etc. another en= tity, the rightful owner of the certificate does not have any possibility to= prove that someone else did it - there is no authenticated trail (OCSP resp= onse or CRL) that can be used in this case and this can lead, in some enviro= nments, to legal implications. I am curious about how do the authors address= this point, maybe some considerations shall be made here. >> >> Also the claim that: >> >> " it is hard to justify why the CA or a delegate needs to both sign = blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to = tell relying parties that blob-1 is still valid." >> >> is quite curious and, I might say, misleading. Although the revocati= on status (either in the form of an OCSP or CRL) does not provide additional= information besides the validity when the certificate is not revoked, it do= es provide quite a lot of useful information when the certificate is revoked= (e.g., when a compromised happened, the reason for revocation - e.g., key c= ompromise, a person has left the organization, a HW token is broken, etc.). = I would prefer the authors to explain what they mean in more extensive and e= ngineering-appropriate form. This is another evidence that the two systems a= re definitely NOT equivalent from a security perspective. >> >> Another example about the fact that some form of revocation is still= needed comes from the document itself (thus contradicting, IMO, the main cl= aim of the document - 5.1): >> >> "No matter how short-term these short term certificates are, there i= s a certain window of time when the attacker can use the certificate. This = can often be mitigated with application-level measures." >> >> this is "application-level measures =3D=3D application-level revocation"= . This means that now, instead of having standardized ways to check for the = status of certificates, each application need to implement a way to deal wit= h it on an ad-hoc basis and being able to distribute securely this informati= on to all relying parties. Undoubtedly, for anybody who has ever had to deal= with such problems this becomes a quite costly and intractable problems ver= y quickly. Maybe some considerations about this should be added in the docum= ent as well. >> >> Usability of Deployed Infrastructures >> >> One important section that is missing is: how do these no-revocation= PKIs look like? There are basically two main choices here: >> >> Deploy a 2 level-only PKI. That means having a Trust Anchor that iss= ues directly the EE certificates. Besides all security considerations about = TAs being online (as required in short-lived environments), this makes it ve= ry difficult to deploy. Important considerations should be made in this case= . >> >> Deploy a 3+ level PKIs (current best practices). This approach invol= ves having (usually one) intermediate CAs (there can be more). In this case,= the TAs issue the intermediate CAs' certificates and the last intermediate = CAs issue the EE ones. Obviously, intermediate CAs can not have the same sho= rt validity period as the EE certs, therefore the need for revocation (at le= ast at the intermediate CAs level) is evident. Important considerations shal= l be made also in this case. >> Wrong Considerations about CRLs and OCSP Responses validity periods >> >> In the document, statements like the following shall be fixed and ex= panded for clarity: >> >> "If a CRL has a nextUpdate field that is 4 days in the future, a typ= ical system will not attempt to fetch a new one before those 4 days have ela= psed." >> >> And then it continue by stating the following: >> "For this reason, moving to STAR certificates provides a similar lev= el of security to what is generally practiced on the web." >> >> Since the first statement is incomplete and, thus, misleading - the = second statement does not hold. Let me explain further for the people that a= re not familiar with how CRLs and OCSP are processed. Although there is a va= lidity period for revocation information, it is well-known that the expirati= on field indicates the time "within a new revocation status information will= be made available" and it is NOT "this is the revocation status of the targ= et certificate until the expiration" - common practice is that when a revoca= tion event occurs, new CRLs and OCSP responses for the revoked certificates = are made available immediately or within few hours at most. >> It is an important distinction that highlights also why the lack of = revocation information makes the system less secure. Although it is quite ev= ident why and since this is not addressed in the document, it might be usefu= l to spell it out. >> >> In a multi-party environment, different applications might have (a) = different strategies when it comes to caching of the revocation information = and/or (b) check the revocation information at different times. Let's make t= he case of 2 parties checking the rev info for the same certificate. If part= y A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, party= B retrieves it at {time2} and caches it until {time2+delta}. Let's assume t= hat time2 > time1 and that new revocation status information is already avai= lable at {time2}. This means that, although party A is still vulnerable unti= l {time1+delta}, party B is not. In a short-lived cert environment w/out rev= ocation ALL parties are VULNERABLE until the compromised {key+certificate} e= xpires. >> >> It seems quite clear that the two environments (short-lived w/ no re= vo and any-lived w/ revo) do not have the same security properties. >> >> Therefore I think that the authors ought to demonstrate the equivale= nce of security levels (not just assume it as hypothesis - given I just disp= roved it) or to remove all claims that the two environments are actually equ= ivalent from as security perspective and to add specific considerations for = short-lived-no-revo about the the fact that not supporting revocation is inh= erently weaker because it potentially exposes all parties to attacks (e.g., = MITM, un-authorized access to resources, etc.) that can not be stopped (unle= ss you implement application-level revocation.. and, therefore, re-introduce= revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manage = across application fashion). >> >> Final Considerations >> >> I am not opposed at the concept of this document to be considered fo= r BCP, however all the above issues MUST, IMO, be addressed before the docum= ent can be considered further. I think I already raised these considerations= at the last IETF, but I do not think the authors missed or have not conside= red the provided feedback. I hope that a more explicit and written feedback = might be taken into considerations. >> >> Just my 2 cents form an old barnacle... :D >> >> Cheers, >> Max >> --=20 >> Best Regards, >> Massimiliano Pala, Ph.D. >> OpenCA Labs Director >> >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 _______________________________________________ Spasm mailing list Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm =20 From nobody Tue Mar 27 12:48:10 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 675A512D969 for ; Tue, 27 Mar 2018 12:48:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t6WX3X-F7_A1 for ; Tue, 27 Mar 2018 12:48:02 -0700 (PDT) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 029A81273E2 for ; Tue, 27 Mar 2018 12:48:01 -0700 (PDT) Received: from [216.82.242.36] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-1.bemta-8.messagelabs.com id F6/BA-00416-0FF9ABA5; Tue, 27 Mar 2018 19:48:00 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WTe0hTYRjG951zdnYSF8dp+TYKaiGUMVEqmBV pRbWioiIJhlFHPW6jXeScKVZ/tG5mjcy05bLmsqzItCxK1C7WKEIDK3PLyizt4i26021k7eys 238/vud5n+/9Xt6PwhUDpJJi820sZ2FMKjKC6Bx/IVH9ztOkS7yaphnsfyjTVPgzNfVeL6Epu +KXpRLasu1tpLbW4SO1VVXfMG111yfpckInNVoyrPnrpIaTpd+wnNYSlF/T/Jmwo8Obd6MIiq DfYrDzZQDbjUZQCtqJwZuWiSI/Q3DjqlZgkk4E/5VbmFAQQzsR7LK7QwXR9Cp40LaXEDiGToP uV0WYyAvg3M99pMAEHQd1tXUhj5xOhw/eIqkQpKA7EVT2u0PCCDoFXEXPZQIjejR8aa0JBeF0 LDx64Qkx0DHQc+82KfIoGHg+LBX96eD+6A2fq+DM666wfxy0exxIuAzoCxgcundRKgpqeOd04 iIvBVdvABNNvQhKj12TiUI81JV8RSKvh7db3GE2w8v+knBBFQ4FvuJwwVj40Xc+LBwlwVV/mB AnmQX7q4X+BCGAweeKbUicnhKedOxCxWhy+T9vLQ/6cNqD4GLTabI8NLUoaDn4ghBN8eCsHQz zFDhROYSLPBNc36+TIk+A/Y4emcjTYejme3QEUdVoEs9yeSynTkpOyOCMeoPNzBhN6qRETYKZ 5XlGz5qYDD4h02o+j4ILt1kiQQ3owKWFXjSGwlSj5L5NTTrFyAxr1gYDwxvWcrkmlveisRSlA nlfRVCL4lg9m59tNAW39rcMVKQqRk4F91Yh53MYM2/Ui1Irmkp1lPUV4FRn/1ABriAsVgurjJ UPC0m0YDXkWv4E/f4B7WicMlqOJBKJIjKH5cxG2//6IIqlkCpa3i2kRBottj/3DQZbwYKt1G9 tEFqxMX8lpR0plrl1gbuzRutzKzsbj6pbXIX3C/Fp9oGFc1fPqJs2xz67UhPxoDtvpVUt8yUv 4W8XW3zHD+14mu5PPePwuzzzzr0vxXXbHyf/sNTk8g07ce6nI+V7Sdeiu2uIYdSz4uPiQFZX4 5qHp9CdBknc5et7NhaaDdkpzanzh8+2lfkGVqkI3sAkxeMcz/wC7YzkTfwDAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-16.tower-94.messagelabs.com!1522180079!186231447!1 X-Originating-IP: [216.32.180.48] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 116494 invoked from network); 27 Mar 2018 19:47:59 -0000 Received: from mail-by2nam03lp0048.outbound.protection.outlook.com (HELO NAM03-BY2-obe.outbound.protection.outlook.com) (216.32.180.48) by server-16.tower-94.messagelabs.com with AES256-GCM-SHA384 encrypted SMTP; 27 Mar 2018 19:47:59 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=N1dwTa6lipF8+tzdVmz/GKLPeQUU1TgY6umKSNabc5Y=; b=uwXiKXNG/cN8iqImgJJ+bT9ArGh/FDSk+9LesmwyemaS0JkriRFVbyV93CWMG77fK+5+Zclnm+SHpva3jbWbqB07ubDkDz7d9PQcYCb9sTdUP2xcZTC1IgXcAsVTEUO3RXnYOaJyxNevmKxnu9EvxK6/6XZXcAfXLox4aa7xcng= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1568.namprd14.prod.outlook.com (10.173.234.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.609.10; Tue, 27 Mar 2018 19:47:56 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd%17]) with mapi id 15.20.0609.012; Tue, 27 Mar 2018 19:47:56 +0000 From: Tim Hollebeek To: Stefan Santesson , Stephen Farrell , Russ Housley , LAMPS Thread-Topic: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 Thread-Index: AQHTwRW4eNEoTpa7PEmoGQqs7AdAaKPkQq+AgAAB0ICAAEBQAIAAALww Date: Tue, 27 Mar 2018 19:47:56 +0000 Message-ID: References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1568; 7:6xbRTs/YFN0lcEHMGwpjRxct4MvEokNJHvbW0AKxIWLH5V+BD0MkslmKE/dZS6zaICSFg+MRbTL1NZz7gP51C/nbckW3Tb51Quoq1qbHBS6amcWhggB/+YJcO9nPWLHrX94XpZXW8b9q/sfz0zLcoKQuTGV7OXnzO512DwBE3w7Cax+KjdfiRQ2jBPGMR/9LTRSmYsaK+eAd7ETMT5r3yxg64MYG4ifne3iVMatqv5k5006chBez73ol0XwqzHeY x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 0264770a-be1a-44fd-e767-08d5941ba343 x-microsoft-antispam: UriScan:(32856632585715); BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1568; x-ms-traffictypediagnostic: MWHPR14MB1568: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(278428928389397)(209352067349851)(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(8121501046)(5005006)(3231221)(944501327)(52105095)(3002001)(10201501046)(93006095)(93001095)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123558120)(20161123560045)(6072148)(201708071742011); SRVR:MWHPR14MB1568; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1568; x-forefront-prvs: 0624A2429E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(376002)(39380400002)(39860400002)(346002)(396003)(199004)(13464003)(51444003)(53754006)(189003)(377424004)(7696005)(68736007)(110136005)(316002)(59450400001)(186003)(11346002)(14454004)(6436002)(66066001)(229853002)(26005)(86362001)(53546011)(93886005)(6506007)(76176011)(102836004)(33656002)(5660300001)(99286004)(3660700001)(966005)(478600001)(476003)(446003)(2906002)(106356001)(6306002)(3280700002)(3846002)(7736002)(305945005)(25786009)(55016002)(53936002)(6246003)(2900100001)(74316002)(5250100002)(6116002)(8936002)(9686003)(81166006)(99936001)(8676002)(105586002)(81156014)(486005)(486005)(97736004); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1568; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: s2wg3UtIYZl0Dig0Y0JwcofgYnjZE7RJHfEzb9iA4tY4VJpk34Wo+L9PhsrWK5YLDC3WKw6h5hChV0eOinbCuOwgseVTfEvEapgsLSCy9Yk1vk7odGYy9BIzp/AUrw4zfYA/ybYPTef9nSY/IXiVjpdrDqLpvjnssPr8eK+F6yVSGd1FSCsohVeg/4se92ajhHQPXxIFweU3o63z31lSwk9OJGWDIZu4owFyCnZVw2dlqtido5GgCRN4Eavkn2CMKzAB/ydrd7LEzqkBOCsKgKxoLLgQxkHy51dVkQfgNwSD6kVYThbwZXEEGX+JuMsTw1dtdg6SXqaiYfK3kWg6kw== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0199_01D3C5E2.F8259650" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0264770a-be1a-44fd-e767-08d5941ba343 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2018 19:47:56.4769 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1568 Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Mar 2018 19:48:07 -0000 ------=_NextPart_000_0199_01D3C5E2.F8259650 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable It's not widely known, but Firefox already skips revocation checking if = the lifetime is short enough (that code was added after the previous discussion of = whether it was necessary to omit the information). You don't actually have to = modify the cert=20 at all if you don't want to. -Tim > -----Original Message----- > From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Stefan = Santesson > Sent: Tuesday, March 27, 2018 3:41 PM > To: Stephen Farrell ; Russ Housley > ; LAMPS > Subject: Re: [lamps] Considerations and Clarifications about = draft-nir-saag-star- > 01 >=20 > We had a long discussion in ETSI about this. >=20 > One aspect is that the absence of revocation information actually = breaks > several implementations. > One idea was to publish an empty CRL + an extension with the semantics = =3D > "You may skip the rev checking, because the CRL is empty" >=20 > This way you would have the cake and eat it too. Old systems would use = the > CRL and work. New systems would understand the extension and skip CRL > checking. >=20 > But maybe this is to overcomplicate things. >=20 > /Stefan >=20 >=20 >=20 >=20 > =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" = bounces@ietf.org on behalf of stephen.farrell@cs.tcd.ie> wrote: >=20 >=20 >=20 > On 27/03/18 16:44, Russ Housley wrote: > > Trimming the distribution to the LAMPS mail list ... > > > > RFC 3281 includes the definition of noRevAvail certificate = extension. It is > defined in X.509, and the definition is repeated in RFC 3281, Section = 4.3.6. > > > > If the CA is not going to publish revocation information about = the > certificate, I think we should include this extension to tell relying = parties not to > bother looking for it. >=20 > Makes sense to me too. It's non-critical so shouldn't > break anything. >=20 > S. >=20 > > > > Russ > > > > > >> On Mar 21, 2018, at 9:08 AM, Dr. Pala = wrote: > >> > >> Hi all, > >> > >> unfortunately I missed the sec-dispatch session, but I have = some > important considerations about the document. In general, short-lived > certificates have been around for many years and for many different > applications (nothing new here), however nobody who have been working = with > PKI long enough would actually made the case that the security levels = of short- > lived-no-revo and any-lived-plus-revo are the same (which seems the = life-motif > of the presentation and the document itself). > >> > >> Other aspects that I think shall be revisited are the lack of = considerations > about the usability of deployed infrastructures (when no revocation is > assumed) and some wrong considerations in the document about validity > periods of OCSP Responses and CRLs (that clearly undermine the = equivalence > claim). > >> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ = Rev > Support > >> The statements that made me jump on my seat is the claim that = short- > lived certificates without revocation support (BTW, short-lived does = not > necessarily exclude revocation support) and certificates (short-lived = or not) vs. > any-lived certificates with revocation support have the same level of = security as > long as the validity period of the short-lived ones is equal or = shorter than CRLs > or OCSP validity. I find this quite a puzzling statement. For once, = there should > be considerations about the fact that if a key is compromised and it = is used by a > malicious entity to attack/disrupt/etc. another entity, the rightful = owner of the > certificate does not have any possibility to prove that someone else = did it - > there is no authenticated trail (OCSP response or CRL) that can be = used in this > case and this can lead, in some environments, to legal implications. I = am > curious about how do the authors address this point, maybe some > considerations shall be made here. > >> > >> Also the claim that: > >> > >> " it is hard to justify why the CA or a delegate needs to both = sign blob-1 > (the certificate) and also sign blob-2 (the CRL or OCSP response) to = tell relying > parties that blob-1 is still valid." > >> > >> is quite curious and, I might say, misleading. Although the = revocation > status (either in the form of an OCSP or CRL) does not provide = additional > information besides the validity when the certificate is not revoked, = it does > provide quite a lot of useful information when the certificate is = revoked (e.g., > when a compromised happened, the reason for revocation - e.g., key > compromise, a person has left the organization, a HW token is broken, = etc.). I > would prefer the authors to explain what they mean in more extensive = and > engineering-appropriate form. This is another evidence that the two = systems > are definitely NOT equivalent from a security perspective. > >> > >> Another example about the fact that some form of revocation is = still > needed comes from the document itself (thus contradicting, IMO, the = main > claim of the document - 5.1): > >> > >> "No matter how short-term these short term certificates are, = there is a > certain window of time when the attacker can use the certificate. = This can > often be mitigated with application-level measures." > >> > >> this is "application-level measures =3D=3D application-level = revocation". This > means that now, instead of having standardized ways to check for the = status of > certificates, each application need to implement a way to deal with it = on an ad- > hoc basis and being able to distribute securely this information to = all relying > parties. Undoubtedly, for anybody who has ever had to deal with such > problems this becomes a quite costly and intractable problems very = quickly. > Maybe some considerations about this should be added in the document = as > well. > >> > >> Usability of Deployed Infrastructures > >> > >> One important section that is missing is: how do these = no-revocation PKIs > look like? There are basically two main choices here: > >> > >> Deploy a 2 level-only PKI. That means having a Trust Anchor = that issues > directly the EE certificates. Besides all security considerations = about TAs being > online (as required in short-lived environments), this makes it very = difficult to > deploy. Important considerations should be made in this case. > >> > >> Deploy a 3+ level PKIs (current best practices). This approach = involves > having (usually one) intermediate CAs (there can be more). In this = case, the TAs > issue the intermediate CAs' certificates and the last intermediate CAs = issue the > EE ones. Obviously, intermediate CAs can not have the same short = validity > period as the EE certs, therefore the need for revocation (at least at = the > intermediate CAs level) is evident. Important considerations shall be = made also > in this case. > >> Wrong Considerations about CRLs and OCSP Responses validity = periods > >> > >> In the document, statements like the following shall be fixed = and > expanded for clarity: > >> > >> "If a CRL has a nextUpdate field that is 4 days in the future, = a typical > system will not attempt to fetch a new one before those 4 days have = elapsed." > >> > >> And then it continue by stating the following: > >> "For this reason, moving to STAR certificates provides a = similar level of > security to what is generally practiced on the web." > >> > >> Since the first statement is incomplete and, thus, misleading - = the second > statement does not hold. Let me explain further for the people that = are not > familiar with how CRLs and OCSP are processed. Although there is a = validity > period for revocation information, it is well-known that the = expiration field > indicates the time "within a new revocation status information will be = made > available" and it is NOT "this is the revocation status of the target = certificate > until the expiration" - common practice is that when a revocation = event occurs, > new CRLs and OCSP responses for the revoked certificates are made = available > immediately or within few hours at most. > >> It is an important distinction that highlights also why the = lack of revocation > information makes the system less secure. Although it is quite evident = why and > since this is not addressed in the document, it might be useful to = spell it out. > >> > >> In a multi-party environment, different applications might have = (a) > different strategies when it comes to caching of the revocation = information > and/or (b) check the revocation information at different times. Let's = make the > case of 2 parties checking the rev info for the same certificate. If = party A > accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, = party B > retrieves it at {time2} and caches it until {time2+delta}. Let's = assume that time2 > > time1 and that new revocation status information is already = available at > {time2}. This means that, although party A is still vulnerable until = {time1+delta}, > party B is not. In a short-lived cert environment w/out revocation ALL = parties > are VULNERABLE until the compromised {key+certificate} expires. > >> > >> It seems quite clear that the two environments (short-lived w/ = no revo > and any-lived w/ revo) do not have the same security properties. > >> > >> Therefore I think that the authors ought to demonstrate the = equivalence > of security levels (not just assume it as hypothesis - given I just = disproved it) or > to remove all claims that the two environments are actually equivalent = from as > security perspective and to add specific considerations for = short-lived-no-revo > about the the fact that not supporting revocation is inherently weaker = because > it potentially exposes all parties to attacks (e.g., MITM, = un-authorized access to > resources, etc.) that can not be stopped (unless you implement = application- > level revocation.. and, therefore, re-introduce revocation from the = backdoor in > a non-standardized, ad-hoc, hard-to-manage across application = fashion). > >> > >> Final Considerations > >> > >> I am not opposed at the concept of this document to be = considered for > BCP, however all the above issues MUST, IMO, be addressed before the > document can be considered further. I think I already raised these > considerations at the last IETF, but I do not think the authors missed = or have > not considered the provided feedback. I hope that a more explicit and = written > feedback might be taken into considerations. > >> > >> Just my 2 cents form an old barnacle... :D > >> > >> Cheers, > >> Max > >> -- > >> Best Regards, > >> Massimiliano Pala, Ph.D. > >> OpenCA Labs Director > >> > >> _______________________________________________ > >> Spasm mailing list > >> Spasm@ietf.org > >> https://www.ietf.org/mailman/listinfo/spasm > > > > > > > > > > _______________________________________________ > > Spasm mailing list > > Spasm@ietf.org > > https://www.ietf.org/mailman/listinfo/spasm > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm ------=_NextPart_000_0199_01D3C5E2.F8259650 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzI3MTk0NzU0WjAvBgkqhkiG9w0BCQQxIgQgfrHburOXxWQSMTzahufuyFeFNgA6 Enm6V5KkCL83rKowgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBABVzlt2mmw73sbBcPo+M4VVslYDVvx10161Mz6mpB6gLVESPr/IoAAOF+m6j8cUBS1m02ib8 G8VOaWrLaLvzlzzu3ESj6vPhOr4DrNEpi/DtOb1p7ppNUqF2rbKNSjaXfYfV+QdBLi4Y9X0fMH/C a25DmP/yqAQXIqmm46521QZ6UyQwpeQW2r07c7G+YmVFaSjhMgnED30KIpxU0kqsatEZnZF0bb4e vAfjGheFDMa852mHxvrI02FqGJ0QFjP+iKXtPGOjb41chZgGXdrwiJShrnWgCFfOq7qSe3mFjHej mFS9DJ8GPZHlPYmY3Hx0nEOnmHf/+D5ojF9S83ZgeDAAAAAAAAA= ------=_NextPart_000_0199_01D3C5E2.F8259650-- From nobody Tue Mar 27 19:19:15 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2585126BF7 for ; Tue, 27 Mar 2018 19:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kAMDmnyoBBpu for ; Tue, 27 Mar 2018 19:19:13 -0700 (PDT) Received: from mail-qt0-x22b.google.com (mail-qt0-x22b.google.com [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D01DE120724 for ; Tue, 27 Mar 2018 19:19:12 -0700 (PDT) Received: by mail-qt0-x22b.google.com with SMTP id z23so327777qti.5 for ; Tue, 27 Mar 2018 19:19:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4CypC7U2UXJBUyQAGqnkPONkE7He3WymdhDUvEL/oo8=; b=abg75xphGr8aZ7w7R7xfGO/dY38plKu9rVF/r5xm1Xd2SrB0YZJ6/GKb27usom5Li0 qkU73fzc+1yzzyIvtF4Ma0qIPoORRdk3pfjvRSGvICmgsJBRBsEifCS6ynCrGc2rtvn9 AArwgjnAxDlygLj4k1/O5zJ79MHQVUWDCPN4E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4CypC7U2UXJBUyQAGqnkPONkE7He3WymdhDUvEL/oo8=; b=sB/j4tgRanOYnEEhEK8z/XfMAvKMhhQQmmI+0lQT6DF7E3wJzbWjUJMtp5ZQYaJzed NVNwkIW6p4XEH99L2NqguCDfwLGxdcexgpkwiJ9VEMYjTNH4cVToFTTwwsjgi3d4Q2Hy PTZs4kqwzuvghSoV7dDqVXr8hrBOn8lbDWp9HTFrkTjtcVpyCl3/63VUd/cgiw9WjgQG 0CWD0RrW0i73rN5ot81HLKi9EA1he2pF3+uiGsoF3WZGYCW6blyN01bB7+pjrt+XyEGf YF7pjnvui9qKZs1a3jVGwNJ52Rt/PBMX0lkeRDWWbav2klBYXNjeNBkAXAWYt5EglCtN 1pgg== X-Gm-Message-State: AElRT7FsYm3I+fVB6oSMS9v9g3M3fje58BZfTEnt1wLkV4GkSTykpdDv +iG5n/fQvp7bD++1/l4Hcly9LyZDRSg= X-Google-Smtp-Source: AIpwx487WxUNzKxv++G33h3VoWTGNghugEODAssPQRpZ8vkwdD1OWaP1q+684sxvkM5hv61zFemzVA== X-Received: by 10.200.83.16 with SMTP id t16mr2787807qtn.48.1522203551995; Tue, 27 Mar 2018 19:19:11 -0700 (PDT) Received: from [172.16.0.18] ([96.231.225.106]) by smtp.gmail.com with ESMTPSA id v84sm1945302qkv.15.2018.03.27.19.19.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Mar 2018 19:19:10 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) From: Sean Turner In-Reply-To: Date: Tue, 27 Mar 2018 22:19:07 -0400 Cc: LAMPS Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Stefan Santesson X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [lamps] [pkix] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Mar 2018 02:19:14 -0000 > On Mar 27, 2018, at 07:10, Stefan Santesson = wrote: >=20 > =E2=80=9Cno-revocation=E2=80=9D Might I humbly suggest the slight more positive: "revocation-free" = certificates. spt= From nobody Wed Mar 28 06:47:19 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AD7B1270AC for ; Wed, 28 Mar 2018 06:47:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w3C4oHJDnXsb for ; Wed, 28 Mar 2018 06:47:16 -0700 (PDT) Received: from smtp.outgoing.loopia.se (smtp.outgoing.loopia.se [194.9.95.112]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B0FB12711B for ; Wed, 28 Mar 2018 06:47:15 -0700 (PDT) Received: from s554.loopia.se (localhost [127.0.0.1]) by s554.loopia.se (Postfix) with ESMTP id 90D67FDF41 for ; Wed, 28 Mar 2018 15:47:13 +0200 (CEST) Received: from s645.loopia.se (unknown [172.21.200.108]) by s554.loopia.se (Postfix) with ESMTP id 71EBB673C1C; Wed, 28 Mar 2018 15:47:13 +0200 (CEST) Received: from s405.loopia.se (unknown [172.21.200.105]) by s645.loopia.se (Postfix) with ESMTP id 6ABA813C1F59; Wed, 28 Mar 2018 15:47:13 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s630.loopia.se ([172.21.200.105]) by s405.loopia.se (s405.loopia.se [172.21.200.135]) (amavisd-new, port 10024) with LMTP id YF6Ccgbt2O3P; Wed, 28 Mar 2018 15:47:12 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: mailstore2@aaa-sec.com X-Loopia-Originating-IP: 85.235.7.89 Received: from [192.168.1.7] (gw.aaa-sec.ideon.se [85.235.7.89]) (Authenticated sender: mailstore2@aaa-sec.com) by s630.loopia.se (Postfix) with ESMTPSA id B0797C71798; Wed, 28 Mar 2018 15:47:12 +0200 (CEST) User-Agent: Microsoft-MacOutlook/10.b.0.180311 Date: Wed, 28 Mar 2018 15:47:11 +0200 From: Stefan Santesson To: Sean Turner CC: LAMPS Message-ID: Thread-Topic: [lamps] [pkix] Considerations and Clarifications about draft-nir-saag-star-01 References: In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [lamps] [pkix] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Mar 2018 13:47:18 -0000 Great suggestion!! ( =EF=BB=BFOn 2018-03-28, 04:19, "Spasm on behalf of Sean Turner" wrote: =20 =20 > On Mar 27, 2018, at 07:10, Stefan Santesson wrot= e: >=20 > =E2=80=9Cno-revocation=E2=80=9D =20 Might I humbly suggest the slight more positive: "revocation-free" cert= ificates. =20 spt _______________________________________________ Spasm mailing list Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm =20 From nobody Wed Mar 28 11:28:56 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D44E1271DF for ; Wed, 28 Mar 2018 11:28:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9cj0YtEuNvJ7 for ; Wed, 28 Mar 2018 11:28:51 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 829C5124E15 for ; Wed, 28 Mar 2018 11:28:51 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 381E5300A12 for ; Wed, 28 Mar 2018 14:28:49 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id NmgxZMbjBhoP for ; Wed, 28 Mar 2018 14:28:46 -0400 (EDT) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id BCF5A300441; Wed, 28 Mar 2018 14:28:46 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Russ Housley In-Reply-To: Date: Wed, 28 Mar 2018 14:28:47 -0400 Cc: LAMPS Content-Transfer-Encoding: quoted-printable Message-Id: References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> To: Stefan Santesson X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Mar 2018 18:28:55 -0000 Stefan: Are us saying that it allows a relying party that does not recognize the = non-critical noRevAvail extension to use the CRLDP extension to get an = empty CRL? In this way, only the relying parties that do not recognize = the noRevAvail extension will get the latency hit?=20 Russ > On Mar 27, 2018, at 3:40 PM, Stefan Santesson = wrote: >=20 > We had a long discussion in ETSI about this. >=20 > One aspect is that the absence of revocation information actually = breaks several implementations. > One idea was to publish an empty CRL + an extension with the semantics = =3D "You may skip the rev checking, because the CRL is empty" >=20 > This way you would have the cake and eat it too. Old systems would use = the CRL and work. New systems would understand the extension and skip = CRL checking. >=20 > But maybe this is to overcomplicate things. >=20 > /Stefan >=20 >=20 >=20 >=20 > =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" = wrote: >=20 >=20 >=20 > On 27/03/18 16:44, Russ Housley wrote: >> Trimming the distribution to the LAMPS mail list ... >>=20 >> RFC 3281 includes the definition of noRevAvail certificate extension. = It is defined in X.509, and the definition is repeated in RFC 3281, = Section 4.3.6. >>=20 >> If the CA is not going to publish revocation information about the = certificate, I think we should include this extension to tell relying = parties not to bother looking for it. >=20 > Makes sense to me too. It's non-critical so shouldn't > break anything. >=20 > S. >=20 >>=20 >> Russ >>=20 >>=20 >>> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >>>=20 >>> Hi all, >>>=20 >>> unfortunately I missed the sec-dispatch session, but I have some = important considerations about the document. In general, short-lived = certificates have been around for many years and for many different = applications (nothing new here), however nobody who have been working = with PKI long enough would actually made the case that the security = levels of short-lived-no-revo and any-lived-plus-revo are the same = (which seems the life-motif of the presentation and the document = itself). >>>=20 >>> Other aspects that I think shall be revisited are the lack of = considerations about the usability of deployed infrastructures (when no = revocation is assumed) and some wrong considerations in the document = about validity periods of OCSP Responses and CRLs (that clearly = undermine the equivalence claim). >>> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev = Support >>> The statements that made me jump on my seat is the claim that = short-lived certificates without revocation support (BTW, short-lived = does not necessarily exclude revocation support) and certificates = (short-lived or not) vs. any-lived certificates with revocation support = have the same level of security as long as the validity period of the = short-lived ones is equal or shorter than CRLs or OCSP validity. I find = this quite a puzzling statement. For once, there should be = considerations about the fact that if a key is compromised and it is = used by a malicious entity to attack/disrupt/etc. another entity, the = rightful owner of the certificate does not have any possibility to prove = that someone else did it - there is no authenticated trail (OCSP = response or CRL) that can be used in this case and this can lead, in = some environments, to legal implications. I am curious about how do the = authors address this point, maybe some considerations shall be made = here. >>>=20 >>> Also the claim that: >>>=20 >>> " it is hard to justify why the CA or a delegate needs to both sign = blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) = to tell relying parties that blob-1 is still valid." >>>=20 >>> is quite curious and, I might say, misleading. Although the = revocation status (either in the form of an OCSP or CRL) does not = provide additional information besides the validity when the certificate = is not revoked, it does provide quite a lot of useful information when = the certificate is revoked (e.g., when a compromised happened, the = reason for revocation - e.g., key compromise, a person has left the = organization, a HW token is broken, etc.). I would prefer the authors to = explain what they mean in more extensive and engineering-appropriate = form. This is another evidence that the two systems are definitely NOT = equivalent from a security perspective. >>>=20 >>> Another example about the fact that some form of revocation is still = needed comes from the document itself (thus contradicting, IMO, the main = claim of the document - 5.1): >>>=20 >>> "No matter how short-term these short term certificates are, there = is a certain window of time when the attacker can use the certificate. = This can often be mitigated with application-level measures." >>>=20 >>> this is "application-level measures =3D=3D application-level = revocation". This means that now, instead of having standardized ways to = check for the status of certificates, each application need to implement = a way to deal with it on an ad-hoc basis and being able to distribute = securely this information to all relying parties. Undoubtedly, for = anybody who has ever had to deal with such problems this becomes a quite = costly and intractable problems very quickly. Maybe some considerations = about this should be added in the document as well. >>>=20 >>> Usability of Deployed Infrastructures >>>=20 >>> One important section that is missing is: how do these no-revocation = PKIs look like? There are basically two main choices here: >>>=20 >>> Deploy a 2 level-only PKI. That means having a Trust Anchor that = issues directly the EE certificates. Besides all security considerations = about TAs being online (as required in short-lived environments), this = makes it very difficult to deploy. Important considerations should be = made in this case. >>>=20 >>> Deploy a 3+ level PKIs (current best practices). This approach = involves having (usually one) intermediate CAs (there can be more). In = this case, the TAs issue the intermediate CAs' certificates and the last = intermediate CAs issue the EE ones. Obviously, intermediate CAs can not = have the same short validity period as the EE certs, therefore the need = for revocation (at least at the intermediate CAs level) is evident. = Important considerations shall be made also in this case. >>> Wrong Considerations about CRLs and OCSP Responses validity periods >>>=20 >>> In the document, statements like the following shall be fixed and = expanded for clarity: >>>=20 >>> "If a CRL has a nextUpdate field that is 4 days in the future, a = typical system will not attempt to fetch a new one before those 4 days = have elapsed." >>>=20 >>> And then it continue by stating the following: >>> "For this reason, moving to STAR certificates provides a similar = level of security to what is generally practiced on the web." >>>=20 >>> Since the first statement is incomplete and, thus, misleading - the = second statement does not hold. Let me explain further for the people = that are not familiar with how CRLs and OCSP are processed. Although = there is a validity period for revocation information, it is well-known = that the expiration field indicates the time "within a new revocation = status information will be made available" and it is NOT "this is the = revocation status of the target certificate until the expiration" - = common practice is that when a revocation event occurs, new CRLs and = OCSP responses for the revoked certificates are made available = immediately or within few hours at most. >>> It is an important distinction that highlights also why the lack of = revocation information makes the system less secure. Although it is = quite evident why and since this is not addressed in the document, it = might be useful to spell it out. >>>=20 >>> In a multi-party environment, different applications might have (a) = different strategies when it comes to caching of the revocation = information and/or (b) check the revocation information at different = times. Let's make the case of 2 parties checking the rev info for the = same certificate. If party A accesses OCSP/CRLs at {time1} and caches it = until {time1 + delta}, party B retrieves it at {time2} and caches it = until {time2+delta}. Let's assume that time2 > time1 and that new = revocation status information is already available at {time2}. This = means that, although party A is still vulnerable until {time1+delta}, = party B is not. In a short-lived cert environment w/out revocation ALL = parties are VULNERABLE until the compromised {key+certificate} expires. >>>=20 >>> It seems quite clear that the two environments (short-lived w/ no = revo and any-lived w/ revo) do not have the same security properties. >>>=20 >>> Therefore I think that the authors ought to demonstrate the = equivalence of security levels (not just assume it as hypothesis - given = I just disproved it) or to remove all claims that the two environments = are actually equivalent from as security perspective and to add specific = considerations for short-lived-no-revo about the the fact that not = supporting revocation is inherently weaker because it potentially = exposes all parties to attacks (e.g., MITM, un-authorized access to = resources, etc.) that can not be stopped (unless you implement = application-level revocation.. and, therefore, re-introduce revocation = from the backdoor in a non-standardized, ad-hoc, hard-to-manage across = application fashion). >>>=20 >>> Final Considerations >>>=20 >>> I am not opposed at the concept of this document to be considered = for BCP, however all the above issues MUST, IMO, be addressed before the = document can be considered further. I think I already raised these = considerations at the last IETF, but I do not think the authors missed = or have not considered the provided feedback. I hope that a more = explicit and written feedback might be taken into considerations. >>>=20 >>> Just my 2 cents form an old barnacle... :D >>>=20 >>> Cheers, >>> Max >>> --=20 >>> Best Regards, >>> Massimiliano Pala, Ph.D. >>> OpenCA Labs Director >>> >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >>=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Wed Mar 28 13:58:06 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14124126DFB for ; Wed, 28 Mar 2018 13:58:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qGcEFSQlqdq8 for ; Wed, 28 Mar 2018 13:58:02 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F4BE126DC2 for ; Wed, 28 Mar 2018 13:58:02 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 0DECB300A10 for ; Wed, 28 Mar 2018 16:58:00 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 3x6b0yy5K4UH for ; Wed, 28 Mar 2018 16:57:59 -0400 (EDT) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 0F8AA300481 for ; Wed, 28 Mar 2018 16:57:59 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: Date: Wed, 28 Mar 2018 16:58:00 -0400 To: LAMPS X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [lamps] Draft Minutes for IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Mar 2018 20:58:04 -0000 I uploaded the DRAFT minutes for the LAMPS session at IETF 101: https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-00 Please review them and send comments to the list. Russ From nobody Wed Mar 28 23:35:31 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBA41124D6C for ; Wed, 28 Mar 2018 23:35:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id taG0nf3Hm6HM for ; Wed, 28 Mar 2018 23:35:26 -0700 (PDT) Received: from smtp.outgoing.loopia.se (smtp.outgoing.loopia.se [194.9.95.112]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82AEF1205D3 for ; Wed, 28 Mar 2018 23:35:25 -0700 (PDT) Received: from s554.loopia.se (localhost [127.0.0.1]) by s554.loopia.se (Postfix) with ESMTP id C288BECEE9 for ; Thu, 29 Mar 2018 08:35:22 +0200 (CEST) Received: from s500.loopia.se (unknown [172.21.200.98]) by s554.loopia.se (Postfix) with ESMTP id A3F485F842E; Thu, 29 Mar 2018 08:35:22 +0200 (CEST) Received: from s404.loopia.se (unknown [172.21.200.105]) by s500.loopia.se (Postfix) with ESMTP id A0F6DA84685; Thu, 29 Mar 2018 08:35:22 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s500.loopia.se ([172.21.200.105]) by s404.loopia.se (s404.loopia.se [172.21.200.134]) (amavisd-new, port 10024) with UTF8LMTP id tv0WTCnVQzU7; Thu, 29 Mar 2018 08:35:18 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: mailstore2@aaa-sec.com X-Loopia-Originating-IP: 90.229.17.25 Received: from [10.0.1.54] (unknown [90.229.17.25]) (Authenticated sender: mailstore2@aaa-sec.com) by s500.loopia.se (Postfix) with ESMTPSA id 7E486A84049; Thu, 29 Mar 2018 08:35:18 +0200 (CEST) User-Agent: Microsoft-MacOutlook/10.b.0.180311 Date: Thu, 29 Mar 2018 08:35:17 +0200 From: Stefan Santesson To: Russ Housley CC: LAMPS Message-ID: Thread-Topic: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 06:35:30 -0000 Basically yes. At least that was the discussion. I have to check what the outcome was. Also this discussion started as "Short-lived" certs, and ended up as "Revoc= ation-free" certs. This way to deal with real implementations by using both noRevAvail, combin= ed with a CRLDP and an empty CRL probably don't need a standard, but maybe a= BCP or something. /Stefan =EF=BB=BFOn 2018-03-28, 20:29, "Russ Housley" wrote: Stefan: =20 Are us saying that it allows a relying party that does not recognize th= e non-critical noRevAvail extension to use the CRLDP extension to get an emp= ty CRL? In this way, only the relying parties that do not recognize the noR= evAvail extension will get the latency hit?=20 =20 Russ =20 =20 > On Mar 27, 2018, at 3:40 PM, Stefan Santesson wr= ote: >=20 > We had a long discussion in ETSI about this. >=20 > One aspect is that the absence of revocation information actually bre= aks several implementations. > One idea was to publish an empty CRL + an extension with the semantic= s =3D "You may skip the rev checking, because the CRL is empty" >=20 > This way you would have the cake and eat it too. Old systems would us= e the CRL and work. New systems would understand the extension and skip CRL = checking. >=20 > But maybe this is to overcomplicate things. >=20 > /Stefan >=20 >=20 >=20 >=20 > =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" wrote: >=20 >=20 >=20 > On 27/03/18 16:44, Russ Housley wrote: >> Trimming the distribution to the LAMPS mail list ... >>=20 >> RFC 3281 includes the definition of noRevAvail certificate extension= . It is defined in X.509, and the definition is repeated in RFC 3281, Secti= on 4.3.6. >>=20 >> If the CA is not going to publish revocation information about the c= ertificate, I think we should include this extension to tell relying parties= not to bother looking for it. >=20 > Makes sense to me too. It's non-critical so shouldn't > break anything. >=20 > S. >=20 >>=20 >> Russ >>=20 >>=20 >>> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >>>=20 >>> Hi all, >>>=20 >>> unfortunately I missed the sec-dispatch session, but I have some im= portant considerations about the document. In general, short-lived certifica= tes have been around for many years and for many different applications (not= hing new here), however nobody who have been working with PKI long enough wo= uld actually made the case that the security levels of short-lived-no-revo a= nd any-lived-plus-revo are the same (which seems the life-motif of the prese= ntation and the document itself). >>>=20 >>> Other aspects that I think shall be revisited are the lack of consi= derations about the usability of deployed infrastructures (when no revocatio= n is assumed) and some wrong considerations in the document about validity p= eriods of OCSP Responses and CRLs (that clearly undermine the equivalence cl= aim). >>> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev S= upport >>> The statements that made me jump on my seat is the claim that short= -lived certificates without revocation support (BTW, short-lived does not ne= cessarily exclude revocation support) and certificates (short-lived or not) = vs. any-lived certificates with revocation support have the same level of se= curity as long as the validity period of the short-lived ones is equal or sh= orter than CRLs or OCSP validity. I find this quite a puzzling statement. Fo= r once, there should be considerations about the fact that if a key is compr= omised and it is used by a malicious entity to attack/disrupt/etc. another e= ntity, the rightful owner of the certificate does not have any possibility t= o prove that someone else did it - there is no authenticated trail (OCSP res= ponse or CRL) that can be used in this case and this can lead, in some envir= onments, to legal implications. I am curious about how do the authors addres= s this point, maybe some considerations shall be made here. >>>=20 >>> Also the claim that: >>>=20 >>> " it is hard to justify why the CA or a delegate needs to both sign= blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) to= tell relying parties that blob-1 is still valid." >>>=20 >>> is quite curious and, I might say, misleading. Although the revocat= ion status (either in the form of an OCSP or CRL) does not provide additiona= l information besides the validity when the certificate is not revoked, it d= oes provide quite a lot of useful information when the certificate is revoke= d (e.g., when a compromised happened, the reason for revocation - e.g., key = compromise, a person has left the organization, a HW token is broken, etc.).= I would prefer the authors to explain what they mean in more extensive and = engineering-appropriate form. This is another evidence that the two systems = are definitely NOT equivalent from a security perspective. >>>=20 >>> Another example about the fact that some form of revocation is stil= l needed comes from the document itself (thus contradicting, IMO, the main c= laim of the document - 5.1): >>>=20 >>> "No matter how short-term these short term certificates are, there = is a certain window of time when the attacker can use the certificate. This= can often be mitigated with application-level measures." >>>=20 >>> this is "application-level measures =3D=3D application-level revocation= ". This means that now, instead of having standardized ways to check for the= status of certificates, each application need to implement a way to deal wi= th it on an ad-hoc basis and being able to distribute securely this informat= ion to all relying parties. Undoubtedly, for anybody who has ever had to dea= l with such problems this becomes a quite costly and intractable problems ve= ry quickly. Maybe some considerations about this should be added in the docu= ment as well. >>>=20 >>> Usability of Deployed Infrastructures >>>=20 >>> One important section that is missing is: how do these no-revocatio= n PKIs look like? There are basically two main choices here: >>>=20 >>> Deploy a 2 level-only PKI. That means having a Trust Anchor that is= sues directly the EE certificates. Besides all security considerations about= TAs being online (as required in short-lived environments), this makes it v= ery difficult to deploy. Important considerations should be made in this cas= e. >>>=20 >>> Deploy a 3+ level PKIs (current best practices). This approach invo= lves having (usually one) intermediate CAs (there can be more). In this case= , the TAs issue the intermediate CAs' certificates and the last intermediate= CAs issue the EE ones. Obviously, intermediate CAs can not have the same sh= ort validity period as the EE certs, therefore the need for revocation (at l= east at the intermediate CAs level) is evident. Important considerations sha= ll be made also in this case. >>> Wrong Considerations about CRLs and OCSP Responses validity periods >>>=20 >>> In the document, statements like the following shall be fixed and e= xpanded for clarity: >>>=20 >>> "If a CRL has a nextUpdate field that is 4 days in the future, a ty= pical system will not attempt to fetch a new one before those 4 days have el= apsed." >>>=20 >>> And then it continue by stating the following: >>> "For this reason, moving to STAR certificates provides a similar le= vel of security to what is generally practiced on the web." >>>=20 >>> Since the first statement is incomplete and, thus, misleading - the= second statement does not hold. Let me explain further for the people that = are not familiar with how CRLs and OCSP are processed. Although there is a v= alidity period for revocation information, it is well-known that the expirat= ion field indicates the time "within a new revocation status information wil= l be made available" and it is NOT "this is the revocation status of the tar= get certificate until the expiration" - common practice is that when a revoc= ation event occurs, new CRLs and OCSP responses for the revoked certificates= are made available immediately or within few hours at most. >>> It is an important distinction that highlights also why the lack of= revocation information makes the system less secure. Although it is quite e= vident why and since this is not addressed in the document, it might be usef= ul to spell it out. >>>=20 >>> In a multi-party environment, different applications might have (a)= different strategies when it comes to caching of the revocation information= and/or (b) check the revocation information at different times. Let's make = the case of 2 parties checking the rev info for the same certificate. If par= ty A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, part= y B retrieves it at {time2} and caches it until {time2+delta}. Let's assume = that time2 > time1 and that new revocation status information is already ava= ilable at {time2}. This means that, although party A is still vulnerable unt= il {time1+delta}, party B is not. In a short-lived cert environment w/out re= vocation ALL parties are VULNERABLE until the compromised {key+certificate} = expires. >>>=20 >>> It seems quite clear that the two environments (short-lived w/ no r= evo and any-lived w/ revo) do not have the same security properties. >>>=20 >>> Therefore I think that the authors ought to demonstrate the equival= ence of security levels (not just assume it as hypothesis - given I just dis= proved it) or to remove all claims that the two environments are actually eq= uivalent from as security perspective and to add specific considerations for= short-lived-no-revo about the the fact that not supporting revocation is in= herently weaker because it potentially exposes all parties to attacks (e.g.,= MITM, un-authorized access to resources, etc.) that can not be stopped (unl= ess you implement application-level revocation.. and, therefore, re-introduc= e revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manage= across application fashion). >>>=20 >>> Final Considerations >>>=20 >>> I am not opposed at the concept of this document to be considered f= or BCP, however all the above issues MUST, IMO, be addressed before the docu= ment can be considered further. I think I already raised these consideration= s at the last IETF, but I do not think the authors missed or have not consid= ered the provided feedback. I hope that a more explicit and written feedback= might be taken into considerations. >>>=20 >>> Just my 2 cents form an old barnacle... :D >>>=20 >>> Cheers, >>> Max >>> --=20 >>> Best Regards, >>> Massimiliano Pala, Ph.D. >>> OpenCA Labs Director >>> >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >>=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm =20 =20 From nobody Thu Mar 29 01:05:24 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C77B812708C for ; Thu, 29 Mar 2018 01:05:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1BHp-qeG2vLE for ; Thu, 29 Mar 2018 01:05:05 -0700 (PDT) Received: from off-send01.osa.jprs.co.jp (off-send01.osa.jprs.co.jp [IPv6:2001:218:3001:17::10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38C0912025C for ; Thu, 29 Mar 2018 01:05:05 -0700 (PDT) Received: from off-sendsmg01.osa.jprs.co.jp (off-sendsmg01.osa.jprs.co.jp [172.23.8.61]) by off-send01.osa.jprs.co.jp (8.14.4/8.14.4) with ESMTP id w2T8537Z010754 for ; Thu, 29 Mar 2018 17:05:03 +0900 Received: from off-sendsmg01.osa.jprs.co.jp (localhost [127.0.0.1]) by postfix.imss71 (Postfix) with ESMTP id B00FB180064 for ; Thu, 29 Mar 2018 17:05:00 +0900 (JST) Received: from localhost (off-cpu05.osa.jprs.co.jp [172.23.4.15]) by off-sendsmg01.osa.jprs.co.jp (Postfix) with ESMTP id 8CF8E180062 for ; Thu, 29 Mar 2018 17:05:00 +0900 (JST) Date: Thu, 29 Mar 2018 17:05:00 +0900 (JST) Message-Id: <20180329.170500.1237390909213152355.fujiwara@jprs.co.jp> To: spasm@ietf.org From: fujiwara@jprs.co.jp X-Mailer: Mew version 6.5 on Emacs 24.4 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-TM-AS-Product-Ver: IMSS-7.1.0.1690-8.2.0.1013-23748.005 X-TM-AS-Result: Yes-19.807-5.0-31-11 X-imss-scan-details: Yes-19.807-5.0-31-11 X-TMASE-MatchedRID: RowX92bJu8RCXIGdsOwlUh5+URxv1WlBwbuK0Zbt5thM8/h8iDp8ots1 CHzkaGoi0e+MIg7zZb5WrR4hk4bufD+YkS80Uv51Dq5QZEGvahYY0xNaH5MD25J5XtPVefA9cUP QjSOUQN0az8zZ8cl/0iMdorAXp9Xrcyn09m+qqw6M29hkek7Xd1+U6kGoEdO38cWgFw6wp7NAoQ 12mG1S3lz6a9AXqc59kZOl7WKIImq0P2qkGU0XymvfiVSqJzu366cYQGo+KX6kSYi/oi9rTgtuK BGekqUpAH6r2Or7OdJrmiErAO2fus8NwM6g/gnQG7bH2qf7mdvsigLj5zDbyWTo2Sp/Y3NrCaGB CdqedYuIYxLkYTZ8tHcsenzoD9DmubiAr42yZMUjmGuwjFo1e01F5jvuCdKpgjqx1ktoqR9IuDB 6RDPpcbMALSfq1LAX Archived-At: Subject: [lamps] RFC 6844 Errata remains in caa-simplification draft X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 08:05:09 -0000 Both draft-hoffman-andrews-caa-simplification-03 and https://github.com/jsha/caa-simplification/ have RFC 6844 Errata. RFC 6844 Errata is https://www.rfc-editor.org/errata/rfc6844 . * Errata ID: 3547 Errata 3547 says [HB2011] should be [RFC6844]. And more, all "Reference" in IANA considerations section should be changed as new draft because caa-simplification draft obsoletes RFC 6844. For example, RFC 6891 EDNS0 Extensions updates old RFC 2671 and it states that "IANA has updated references to [RFC2671] in these entries and subregistries to this document." * Errata ID: 3528 and 3532 Remaining in draft-ietf-lamps-rfc6844bis-00.md . | 1-7 | Reserved> | {{!RFC6844}} ^^^^^^^^^ * Errata ID: 5200 Which is correct ? [; = ]* written in Section 3 of RFC 6844 issuevalue = space [domain] space [";" *(space parameter) space] written in Section 5.2 of RFC 6844 * Errata ID: 4070 Errata 4070 remains in -03 and caa-simplification in github. However, we can use FQDN in the resource record and remove "$ORIGIN". --- $ORIGIN example.com . CAA 0 issue "ca.example.net" --- is incorrect written in "Errata ID: 4070". --- $ORIGIN example.com CAA 0 issue "ca.example.net" --- is correct but use of default domain name is a little unclear. "$ORIGIN example.com" may be "$ORIGIN example.com." Tailing dot is important. --- example.com. CAA 0 issue "ca.example.net" --- is simple and sufficient. Other parts are also possible to simplify. --- example.com. CAA 0 issue "ca.example.net" example.com. CAA 0 iodef "mailto:security@example.com" example.com. CAA 0 iodef "http://iodef.example.com/" example.com. CAA 0 issue "ca.example.net; account=230123" example.com. CAA 0 issue "ca.example.net; policy=ev" example.com. CAA 128 tbs "Unknown" --- -- Kazunori Fujiwara, JPRS From nobody Thu Mar 29 06:59:38 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1711F12D954 for ; Thu, 29 Mar 2018 06:59:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4kpB06nBE1yf for ; Thu, 29 Mar 2018 06:59:35 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F581124BE8 for ; Thu, 29 Mar 2018 06:59:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id EE1BB300441 for ; Thu, 29 Mar 2018 09:59:32 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id KCv7gO3ZdXDJ for ; Thu, 29 Mar 2018 09:59:31 -0400 (EDT) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 98A64300494 for ; Thu, 29 Mar 2018 09:59:31 -0400 (EDT) From: Russ Housley Content-Type: multipart/alternative; boundary="Apple-Mail=_162595DF-59DF-4D23-ADF3-3250ABA9F260" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 29 Mar 2018 09:59:36 -0400 References: To: LAMPS In-Reply-To: Message-Id: <10C7C01F-15EE-4BDE-9C15-F207F3DB736F@vigilsec.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [lamps] Draft Minutes for IETF 101 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 13:59:37 -0000 --Apple-Mail=_162595DF-59DF-4D23-ADF3-3250ABA9F260 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I uploaded to correct file this time... The DRAFT minutes for the LAMPS session at IETF 101: https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01 = Please review them and send comments to the list. Russ --Apple-Mail=_162595DF-59DF-4D23-ADF3-3250ABA9F260 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=us-ascii I uploaded to correct file this time...

The DRAFT minutes for the LAMPS session at IETF 101:
https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01

Please review them and send comments to the list.

Russ

--Apple-Mail=_162595DF-59DF-4D23-ADF3-3250ABA9F260-- From nobody Thu Mar 29 08:23:55 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6EDB12D963 for ; Thu, 29 Mar 2018 08:23:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xlDzIudt1SKm for ; Thu, 29 Mar 2018 08:23:44 -0700 (PDT) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com [IPv6:2a00:1450:400c:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3833D12D942 for ; Thu, 29 Mar 2018 08:23:44 -0700 (PDT) Received: by mail-wm0-x22a.google.com with SMTP id b127so10653105wmf.5 for ; Thu, 29 Mar 2018 08:23:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=fCLJGNwHImugBkCVPSIxJDNzG4NTbwXNkYH4Ws56IIM=; b=phqR+TvJI6D/ayLhAzdbKWFYmrCIceKvFVnzESxawK+dUi8lZOrNAaEmmxmBIBC/2N NFngMLxQOGkwFirO4q6VARvIl955F5U9CnQEYmGzLBAxp3v7VQH4bzVsZnFy6tDwPcYu Y6NvaivqEbkABKp2NyOQFPGotYrZjKRTjlUj5L6FnDrLKlN4hL/iXJSvBKVT8LVxERP8 +B73Bvz3E9ro31PsW5gvGv2MXGQ/aOObyD72tsXSBRLhS7YfnAODMO80dgD+aLqi+ZAn WQffawooymEt/1S1zMtNzvncanBBS1xKBkvi4PMizHs+cPjXh0QqzQHN+jjJA2e/PK1Q DreQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=fCLJGNwHImugBkCVPSIxJDNzG4NTbwXNkYH4Ws56IIM=; b=QLl9rCTUHMTFxmE+WQh1wbm2eS4hd3uDL4lkWVgtcRjanbzHRpjtJr6vS7KnePjS+9 DCvE/bZbpfNJUZvaQEYMKBTD84uUSDlqAmv0AHLVPRgxczeP26NMaFFISNvNc1Zg4jqe bKRTgiQcJ1csRkDE85/UGJetX4gFvPdo4Yllw9/41ODTp/v1uYRi+FEXeNZH/Z9EXuHL V9CYJlzD6fVCh0/sWYCa7sbCqMkdn5BCcIVgewXzGcVNOuB3RcD3h0Wv6jqVmSZ1av0j 0e8f/jKUXSvOrwDeGGUyisCfXd2X0KVhxkFxW1LQimS6TFhctI+yYSKTebMTtjZDjoRx GwQA== X-Gm-Message-State: AElRT7F6PUVkTcr7J+AvL2L/pEJ6KxbQBU4Ask+3YQRuSZid7dpBezyc GUxEIPVmdGR4LSR0ruWtXK2Jewvq X-Google-Smtp-Source: AIpwx4+/1gDmo4/C75iw8FJo4L9btFGHZvoBWj8ZdEDPqw7e/rtRMv6wxF6muJi18KF1GchpjOjQ9w== X-Received: by 10.80.244.214 with SMTP id v22mr7587183edm.162.1522337022643; Thu, 29 Mar 2018 08:23:42 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id p91sm4062605edp.65.2018.03.29.08.23.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 29 Mar 2018 08:23:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) From: Yoav Nir In-Reply-To: Date: Thu, 29 Mar 2018 18:24:20 +0300 Cc: Russ Housley , LAMPS Content-Transfer-Encoding: quoted-printable Message-Id: <746E17EC-9FBF-4110-8FB2-46F1D1A467D5@gmail.com> References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> To: Stefan Santesson X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 15:23:54 -0000 This is true, but any CA issuing such certificates will have to maintain = an always-on server to serve those CRLs. If the CRL DP extension is not = there, they don=E2=80=99t need that server. Yoav > On 29 Mar 2018, at 9:35, Stefan Santesson wrote: >=20 > Basically yes. >=20 > At least that was the discussion. I have to check what the outcome = was. > Also this discussion started as "Short-lived" certs, and ended up as = "Revocation-free" certs. >=20 > This way to deal with real implementations by using both noRevAvail, = combined with a CRLDP and an empty CRL probably don't need a standard, = but maybe a BCP or something. >=20 > /Stefan >=20 >=20 >=20 > =EF=BB=BFOn 2018-03-28, 20:29, "Russ Housley" = wrote: >=20 > Stefan: >=20 > Are us saying that it allows a relying party that does not = recognize the non-critical noRevAvail extension to use the CRLDP = extension to get an empty CRL? In this way, only the relying parties = that do not recognize the noRevAvail extension will get the latency hit?=20= >=20 > Russ >=20 >=20 >> On Mar 27, 2018, at 3:40 PM, Stefan Santesson = wrote: >>=20 >> We had a long discussion in ETSI about this. >>=20 >> One aspect is that the absence of revocation information actually = breaks several implementations. >> One idea was to publish an empty CRL + an extension with the = semantics =3D "You may skip the rev checking, because the CRL is empty" >>=20 >> This way you would have the cake and eat it too. Old systems would = use the CRL and work. New systems would understand the extension and = skip CRL checking. >>=20 >> But maybe this is to overcomplicate things. >>=20 >> /Stefan >>=20 >>=20 >>=20 >>=20 >> =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" = wrote: >>=20 >>=20 >>=20 >> On 27/03/18 16:44, Russ Housley wrote: >>> Trimming the distribution to the LAMPS mail list ... >>>=20 >>> RFC 3281 includes the definition of noRevAvail certificate = extension. It is defined in X.509, and the definition is repeated in = RFC 3281, Section 4.3.6. >>>=20 >>> If the CA is not going to publish revocation information about the = certificate, I think we should include this extension to tell relying = parties not to bother looking for it. >>=20 >> Makes sense to me too. It's non-critical so shouldn't >> break anything. >>=20 >> S. >>=20 >>>=20 >>> Russ >>>=20 >>>=20 >>>> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >>>>=20 >>>> Hi all, >>>>=20 >>>> unfortunately I missed the sec-dispatch session, but I have some = important considerations about the document. In general, short-lived = certificates have been around for many years and for many different = applications (nothing new here), however nobody who have been working = with PKI long enough would actually made the case that the security = levels of short-lived-no-revo and any-lived-plus-revo are the same = (which seems the life-motif of the presentation and the document = itself). >>>>=20 >>>> Other aspects that I think shall be revisited are the lack of = considerations about the usability of deployed infrastructures (when no = revocation is assumed) and some wrong considerations in the document = about validity periods of OCSP Responses and CRLs (that clearly = undermine the equivalence claim). >>>> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev = Support >>>> The statements that made me jump on my seat is the claim that = short-lived certificates without revocation support (BTW, short-lived = does not necessarily exclude revocation support) and certificates = (short-lived or not) vs. any-lived certificates with revocation support = have the same level of security as long as the validity period of the = short-lived ones is equal or shorter than CRLs or OCSP validity. I find = this quite a puzzling statement. For once, there should be = considerations about the fact that if a key is compromised and it is = used by a malicious entity to attack/disrupt/etc. another entity, the = rightful owner of the certificate does not have any possibility to prove = that someone else did it - there is no authenticated trail (OCSP = response or CRL) that can be used in this case and this can lead, in = some environments, to legal implications. I am curious about how do the = authors address this point, maybe some considerations shall be made = here. >>>>=20 >>>> Also the claim that: >>>>=20 >>>> " it is hard to justify why the CA or a delegate needs to both sign = blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) = to tell relying parties that blob-1 is still valid." >>>>=20 >>>> is quite curious and, I might say, misleading. Although the = revocation status (either in the form of an OCSP or CRL) does not = provide additional information besides the validity when the certificate = is not revoked, it does provide quite a lot of useful information when = the certificate is revoked (e.g., when a compromised happened, the = reason for revocation - e.g., key compromise, a person has left the = organization, a HW token is broken, etc.). I would prefer the authors to = explain what they mean in more extensive and engineering-appropriate = form. This is another evidence that the two systems are definitely NOT = equivalent from a security perspective. >>>>=20 >>>> Another example about the fact that some form of revocation is = still needed comes from the document itself (thus contradicting, IMO, = the main claim of the document - 5.1): >>>>=20 >>>> "No matter how short-term these short term certificates are, there = is a certain window of time when the attacker can use the certificate. = This can often be mitigated with application-level measures." >>>>=20 >>>> this is "application-level measures =3D=3D application-level = revocation". This means that now, instead of having standardized ways to = check for the status of certificates, each application need to implement = a way to deal with it on an ad-hoc basis and being able to distribute = securely this information to all relying parties. Undoubtedly, for = anybody who has ever had to deal with such problems this becomes a quite = costly and intractable problems very quickly. Maybe some considerations = about this should be added in the document as well. >>>>=20 >>>> Usability of Deployed Infrastructures >>>>=20 >>>> One important section that is missing is: how do these = no-revocation PKIs look like? There are basically two main choices here: >>>>=20 >>>> Deploy a 2 level-only PKI. That means having a Trust Anchor that = issues directly the EE certificates. Besides all security considerations = about TAs being online (as required in short-lived environments), this = makes it very difficult to deploy. Important considerations should be = made in this case. >>>>=20 >>>> Deploy a 3+ level PKIs (current best practices). This approach = involves having (usually one) intermediate CAs (there can be more). In = this case, the TAs issue the intermediate CAs' certificates and the last = intermediate CAs issue the EE ones. Obviously, intermediate CAs can not = have the same short validity period as the EE certs, therefore the need = for revocation (at least at the intermediate CAs level) is evident. = Important considerations shall be made also in this case. >>>> Wrong Considerations about CRLs and OCSP Responses validity periods >>>>=20 >>>> In the document, statements like the following shall be fixed and = expanded for clarity: >>>>=20 >>>> "If a CRL has a nextUpdate field that is 4 days in the future, a = typical system will not attempt to fetch a new one before those 4 days = have elapsed." >>>>=20 >>>> And then it continue by stating the following: >>>> "For this reason, moving to STAR certificates provides a similar = level of security to what is generally practiced on the web." >>>>=20 >>>> Since the first statement is incomplete and, thus, misleading - the = second statement does not hold. Let me explain further for the people = that are not familiar with how CRLs and OCSP are processed. Although = there is a validity period for revocation information, it is well-known = that the expiration field indicates the time "within a new revocation = status information will be made available" and it is NOT "this is the = revocation status of the target certificate until the expiration" - = common practice is that when a revocation event occurs, new CRLs and = OCSP responses for the revoked certificates are made available = immediately or within few hours at most. >>>> It is an important distinction that highlights also why the lack of = revocation information makes the system less secure. Although it is = quite evident why and since this is not addressed in the document, it = might be useful to spell it out. >>>>=20 >>>> In a multi-party environment, different applications might have (a) = different strategies when it comes to caching of the revocation = information and/or (b) check the revocation information at different = times. Let's make the case of 2 parties checking the rev info for the = same certificate. If party A accesses OCSP/CRLs at {time1} and caches it = until {time1 + delta}, party B retrieves it at {time2} and caches it = until {time2+delta}. Let's assume that time2 > time1 and that new = revocation status information is already available at {time2}. This = means that, although party A is still vulnerable until {time1+delta}, = party B is not. In a short-lived cert environment w/out revocation ALL = parties are VULNERABLE until the compromised {key+certificate} expires. >>>>=20 >>>> It seems quite clear that the two environments (short-lived w/ no = revo and any-lived w/ revo) do not have the same security properties. >>>>=20 >>>> Therefore I think that the authors ought to demonstrate the = equivalence of security levels (not just assume it as hypothesis - given = I just disproved it) or to remove all claims that the two environments = are actually equivalent from as security perspective and to add specific = considerations for short-lived-no-revo about the the fact that not = supporting revocation is inherently weaker because it potentially = exposes all parties to attacks (e.g., MITM, un-authorized access to = resources, etc.) that can not be stopped (unless you implement = application-level revocation.. and, therefore, re-introduce revocation = from the backdoor in a non-standardized, ad-hoc, hard-to-manage across = application fashion). >>>>=20 >>>> Final Considerations >>>>=20 >>>> I am not opposed at the concept of this document to be considered = for BCP, however all the above issues MUST, IMO, be addressed before the = document can be considered further. I think I already raised these = considerations at the last IETF, but I do not think the authors missed = or have not considered the provided feedback. I hope that a more = explicit and written feedback might be taken into considerations. >>>>=20 >>>> Just my 2 cents form an old barnacle... :D >>>>=20 >>>> Cheers, >>>> Max >>>> --=20 >>>> Best Regards, >>>> Massimiliano Pala, Ph.D. >>>> OpenCA Labs Director >>>> >>>> _______________________________________________ >>>> Spasm mailing list >>>> Spasm@ietf.org >>>> https://www.ietf.org/mailman/listinfo/spasm >>>=20 >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >>>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >>=20 >>=20 >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Thu Mar 29 08:32:50 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B24812D957 for ; Thu, 29 Mar 2018 08:32:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uaxEu8alnmBB for ; Thu, 29 Mar 2018 08:32:45 -0700 (PDT) Received: from smtp.outgoing.loopia.se (smtp.outgoing.loopia.se [194.9.95.112]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61F83127201 for ; Thu, 29 Mar 2018 08:32:44 -0700 (PDT) Received: from s554.loopia.se (localhost [127.0.0.1]) by s554.loopia.se (Postfix) with ESMTP id 57725148D2E8 for ; Thu, 29 Mar 2018 17:32:12 +0200 (CEST) Received: from s500.loopia.se (unknown [172.21.200.98]) by s554.loopia.se (Postfix) with ESMTP id EAA8B682363; Thu, 29 Mar 2018 17:32:11 +0200 (CEST) Received: from s406.loopia.se (unknown [172.21.200.105]) by s500.loopia.se (Postfix) with ESMTP id B649EA8B499; Thu, 29 Mar 2018 17:25:44 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s630.loopia.se ([172.21.200.105]) by s406.loopia.se (s406.loopia.se [172.21.200.136]) (amavisd-new, port 10024) with LMTP id k5PAQ8bvZ7cn; Thu, 29 Mar 2018 17:25:43 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: mailstore2@aaa-sec.com X-Loopia-Originating-IP: 85.235.7.89 Received: from [192.168.1.216] (gw.aaa-sec.ideon.se [85.235.7.89]) (Authenticated sender: mailstore2@aaa-sec.com) by s630.loopia.se (Postfix) with ESMTPSA id 5CA9AC7A331; Thu, 29 Mar 2018 17:25:43 +0200 (CEST) User-Agent: Microsoft-MacOutlook/10.b.0.180311 Date: Thu, 29 Mar 2018 17:25:42 +0200 From: Stefan Santesson To: Yoav Nir CC: Russ Housley , LAMPS Message-ID: <5D8C173D-5EED-4518-927D-5B3C1D2BFE1D@aaa-sec.com> Thread-Topic: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> <746E17EC-9FBF-4110-8FB2-46F1D1A467D5@gmail.com> In-Reply-To: <746E17EC-9FBF-4110-8FB2-46F1D1A467D5@gmail.com> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 15:32:49 -0000 Fully agree.=20 I have never suggested that a CA should be required to provide a CRL. I'm just saying that a CA should be allowed to if it has an interest to sup= port legacy clients. /Stefan =EF=BB=BFOn 2018-03-29, 17:23, "Yoav Nir" wrote: This is true, but any CA issuing such certificates will have to maintai= n an always-on server to serve those CRLs. If the CRL DP extension is not th= ere, they don=E2=80=99t need that server. =20 Yoav =20 > On 29 Mar 2018, at 9:35, Stefan Santesson wrote: >=20 > Basically yes. >=20 > At least that was the discussion. I have to check what the outcome wa= s. > Also this discussion started as "Short-lived" certs, and ended up as = "Revocation-free" certs. >=20 > This way to deal with real implementations by using both noRevAvail, = combined with a CRLDP and an empty CRL probably don't need a standard, but m= aybe a BCP or something. >=20 > /Stefan >=20 >=20 >=20 > =EF=BB=BFOn 2018-03-28, 20:29, "Russ Housley" wrote: >=20 > Stefan: >=20 > Are us saying that it allows a relying party that does not recogni= ze the non-critical noRevAvail extension to use the CRLDP extension to get a= n empty CRL? In this way, only the relying parties that do not recognize th= e noRevAvail extension will get the latency hit?=20 >=20 > Russ >=20 >=20 >> On Mar 27, 2018, at 3:40 PM, Stefan Santesson w= rote: >>=20 >> We had a long discussion in ETSI about this. >>=20 >> One aspect is that the absence of revocation information actually br= eaks several implementations. >> One idea was to publish an empty CRL + an extension with the semanti= cs =3D "You may skip the rev checking, because the CRL is empty" >>=20 >> This way you would have the cake and eat it too. Old systems would u= se the CRL and work. New systems would understand the extension and skip CRL= checking. >>=20 >> But maybe this is to overcomplicate things. >>=20 >> /Stefan >>=20 >>=20 >>=20 >>=20 >> =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen Farrell" wrote: >>=20 >>=20 >>=20 >> On 27/03/18 16:44, Russ Housley wrote: >>> Trimming the distribution to the LAMPS mail list ... >>>=20 >>> RFC 3281 includes the definition of noRevAvail certificate extensio= n. It is defined in X.509, and the definition is repeated in RFC 3281, Sect= ion 4.3.6. >>>=20 >>> If the CA is not going to publish revocation information about the = certificate, I think we should include this extension to tell relying partie= s not to bother looking for it. >>=20 >> Makes sense to me too. It's non-critical so shouldn't >> break anything. >>=20 >> S. >>=20 >>>=20 >>> Russ >>>=20 >>>=20 >>>> On Mar 21, 2018, at 9:08 AM, Dr. Pala wrote: >>>>=20 >>>> Hi all, >>>>=20 >>>> unfortunately I missed the sec-dispatch session, but I have some i= mportant considerations about the document. In general, short-lived certific= ates have been around for many years and for many different applications (no= thing new here), however nobody who have been working with PKI long enough w= ould actually made the case that the security levels of short-lived-no-revo = and any-lived-plus-revo are the same (which seems the life-motif of the pres= entation and the document itself). >>>>=20 >>>> Other aspects that I think shall be revisited are the lack of cons= iderations about the usability of deployed infrastructures (when no revocati= on is assumed) and some wrong considerations in the document about validity = periods of OCSP Responses and CRLs (that clearly undermine the equivalence c= laim). >>>> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ Rev = Support >>>> The statements that made me jump on my seat is the claim that shor= t-lived certificates without revocation support (BTW, short-lived does not n= ecessarily exclude revocation support) and certificates (short-lived or not)= vs. any-lived certificates with revocation support have the same level of s= ecurity as long as the validity period of the short-lived ones is equal or s= horter than CRLs or OCSP validity. I find this quite a puzzling statement. F= or once, there should be considerations about the fact that if a key is comp= romised and it is used by a malicious entity to attack/disrupt/etc. another = entity, the rightful owner of the certificate does not have any possibility = to prove that someone else did it - there is no authenticated trail (OCSP re= sponse or CRL) that can be used in this case and this can lead, in some envi= ronments, to legal implications. I am curious about how do the authors addre= ss this point, maybe some considerations shall be made here. >>>>=20 >>>> Also the claim that: >>>>=20 >>>> " it is hard to justify why the CA or a delegate needs to both sig= n blob-1 (the certificate) and also sign blob-2 (the CRL or OCSP response) t= o tell relying parties that blob-1 is still valid." >>>>=20 >>>> is quite curious and, I might say, misleading. Although the revoca= tion status (either in the form of an OCSP or CRL) does not provide addition= al information besides the validity when the certificate is not revoked, it = does provide quite a lot of useful information when the certificate is revok= ed (e.g., when a compromised happened, the reason for revocation - e.g., key= compromise, a person has left the organization, a HW token is broken, etc.)= . I would prefer the authors to explain what they mean in more extensive and= engineering-appropriate form. This is another evidence that the two systems= are definitely NOT equivalent from a security perspective. >>>>=20 >>>> Another example about the fact that some form of revocation is sti= ll needed comes from the document itself (thus contradicting, IMO, the main = claim of the document - 5.1): >>>>=20 >>>> "No matter how short-term these short term certificates are, there= is a certain window of time when the attacker can use the certificate. Thi= s can often be mitigated with application-level measures." >>>>=20 >>>> this is "application-level measures =3D=3D application-level revocatio= n". This means that now, instead of having standardized ways to check for th= e status of certificates, each application need to implement a way to deal w= ith it on an ad-hoc basis and being able to distribute securely this informa= tion to all relying parties. Undoubtedly, for anybody who has ever had to de= al with such problems this becomes a quite costly and intractable problems v= ery quickly. Maybe some considerations about this should be added in the doc= ument as well. >>>>=20 >>>> Usability of Deployed Infrastructures >>>>=20 >>>> One important section that is missing is: how do these no-revocati= on PKIs look like? There are basically two main choices here: >>>>=20 >>>> Deploy a 2 level-only PKI. That means having a Trust Anchor that i= ssues directly the EE certificates. Besides all security considerations abou= t TAs being online (as required in short-lived environments), this makes it = very difficult to deploy. Important considerations should be made in this ca= se. >>>>=20 >>>> Deploy a 3+ level PKIs (current best practices). This approach inv= olves having (usually one) intermediate CAs (there can be more). In this cas= e, the TAs issue the intermediate CAs' certificates and the last intermediat= e CAs issue the EE ones. Obviously, intermediate CAs can not have the same s= hort validity period as the EE certs, therefore the need for revocation (at = least at the intermediate CAs level) is evident. Important considerations sh= all be made also in this case. >>>> Wrong Considerations about CRLs and OCSP Responses validity period= s >>>>=20 >>>> In the document, statements like the following shall be fixed and = expanded for clarity: >>>>=20 >>>> "If a CRL has a nextUpdate field that is 4 days in the future, a t= ypical system will not attempt to fetch a new one before those 4 days have e= lapsed." >>>>=20 >>>> And then it continue by stating the following: >>>> "For this reason, moving to STAR certificates provides a similar l= evel of security to what is generally practiced on the web." >>>>=20 >>>> Since the first statement is incomplete and, thus, misleading - th= e second statement does not hold. Let me explain further for the people that= are not familiar with how CRLs and OCSP are processed. Although there is a = validity period for revocation information, it is well-known that the expira= tion field indicates the time "within a new revocation status information wi= ll be made available" and it is NOT "this is the revocation status of the ta= rget certificate until the expiration" - common practice is that when a revo= cation event occurs, new CRLs and OCSP responses for the revoked certificate= s are made available immediately or within few hours at most. >>>> It is an important distinction that highlights also why the lack o= f revocation information makes the system less secure. Although it is quite = evident why and since this is not addressed in the document, it might be use= ful to spell it out. >>>>=20 >>>> In a multi-party environment, different applications might have (a= ) different strategies when it comes to caching of the revocation informatio= n and/or (b) check the revocation information at different times. Let's make= the case of 2 parties checking the rev info for the same certificate. If pa= rty A accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, par= ty B retrieves it at {time2} and caches it until {time2+delta}. Let's assume= that time2 > time1 and that new revocation status information is already av= ailable at {time2}. This means that, although party A is still vulnerable un= til {time1+delta}, party B is not. In a short-lived cert environment w/out r= evocation ALL parties are VULNERABLE until the compromised {key+certificate}= expires. >>>>=20 >>>> It seems quite clear that the two environments (short-lived w/ no = revo and any-lived w/ revo) do not have the same security properties. >>>>=20 >>>> Therefore I think that the authors ought to demonstrate the equiva= lence of security levels (not just assume it as hypothesis - given I just di= sproved it) or to remove all claims that the two environments are actually e= quivalent from as security perspective and to add specific considerations fo= r short-lived-no-revo about the the fact that not supporting revocation is i= nherently weaker because it potentially exposes all parties to attacks (e.g.= , MITM, un-authorized access to resources, etc.) that can not be stopped (un= less you implement application-level revocation.. and, therefore, re-introdu= ce revocation from the backdoor in a non-standardized, ad-hoc, hard-to-manag= e across application fashion). >>>>=20 >>>> Final Considerations >>>>=20 >>>> I am not opposed at the concept of this document to be considered = for BCP, however all the above issues MUST, IMO, be addressed before the doc= ument can be considered further. I think I already raised these consideratio= ns at the last IETF, but I do not think the authors missed or have not consi= dered the provided feedback. I hope that a more explicit and written feedbac= k might be taken into considerations. >>>>=20 >>>> Just my 2 cents form an old barnacle... :D >>>>=20 >>>> Cheers, >>>> Max >>>> --=20 >>>> Best Regards, >>>> Massimiliano Pala, Ph.D. >>>> OpenCA Labs Director >>>> >>>> _______________________________________________ >>>> Spasm mailing list >>>> Spasm@ietf.org >>>> https://www.ietf.org/mailman/listinfo/spasm >>>=20 >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> Spasm mailing list >>> Spasm@ietf.org >>> https://www.ietf.org/mailman/listinfo/spasm >>>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >>=20 >>=20 >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm =20 =20 From nobody Thu Mar 29 12:04:56 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E2351242EA for ; Thu, 29 Mar 2018 12:04:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EGcG_B5_K-NP for ; Thu, 29 Mar 2018 12:04:51 -0700 (PDT) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.207]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77DF8120725 for ; Thu, 29 Mar 2018 12:04:51 -0700 (PDT) Received: from [216.82.241.100] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-15.bemta-8.messagelabs.com id FB/D6-22406-2D83DBA5; Thu, 29 Mar 2018 19:04:50 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WSf0yMcRzH7/v8uof1tKe76ONWfhxtFteK2Q4 zmeJsyEabpeE5Pbrj7mr3nJZhimxRhHVThxL5lcqk/EgZN4oi+XVETI5wMZEx5Oaeey4//nt9 n/fr+/l8vs8+NK7ooVQ0n2XjrRbOpKaGEo9H19dq7mqbkmMeu0Hredsp15a6VmnPOZ2E9mhzH xZH6PbltlO6i45ncl1FxXdMV9n1hVxEJJNGiz49ayVpuLVlG8o4WYGyOoo7yGyUU4B2oKE0wX 7EoKG+lRQPCtaOQfYeJyEdXiDwbG/zaUNoio0BV1MLJnIoOw9K6/f7GWdnQlnDblJkJbsEHrU XEpKTBM97dgV8PXw4csZfh2Aj4fT+236HYVPAc6RDLjU7jkP/g8/+C0N8RWs6y+UiI3Y4fGut CjQLgyevyvwMbCh0322jJB4G79xeUvJT4GC/M/BdDTXvuwJ+BNwry/e/Gdg6DG46upEUaKDPb sclXgC9zVsoSXqJoMp+gpSCKLhz2Bm4sBa+5jkC0i4E3eWX5dKhAgfXuRuBfuFgv9KCS4GTgs OeIn+gYFOhqHJwwJ8Y1JUs2Y2iHP+8z+G7g7NlCAa6vJTD/6dC4GbJK0KSosBe7QnwBDhW3ot LPB2Kf1ylJB4DRfndcomnQO/1T+gQoivReIG3ZvJWTezkaL3VmGawmTmjSRMbo40284LApfEm Ti9Er0o31yLfzm2WydAF9KQl3olG0Jh6GJPa3pisCNanp643cIJhhXWdiRecKJym1cBM9e2mI sTKp/FZq40m3+IOxkAHqUOZaDFmhAzOLBjTpKgVaeiBur0FuIKwpFt4VRiDiRIrSoZ1lj8lBt f/HopQKRkkk8kUQRm81Wy0/Z97UBiN1EomVqwSZLTY/nTy+IbAfEOEbmwUh7BxfyNVNlLC65q iSbNHjrP8asJKEryXXLrFzQ0nml1504O/514vnKM/lJLEPh0xLe4kuan9/tjEhVWsITu1BP/R 2HZ2w6LIpUeVGZnx1Ulv3HPbepbXqoJHbW3cc967t++dbef50RMnadbMeDP/obsz8dvp1QdvP 5t11rss5+tC5gB2yo1/qEy4piYEAxcbhVsF7je+Jk0X+QMAAA== X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-13.tower-220.messagelabs.com!1522350288!198222802!1 X-Originating-IP: [216.32.181.178] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 4792 invoked from network); 29 Mar 2018 19:04:49 -0000 Received: from mail-by2nam01lp0178.outbound.protection.outlook.com (HELO NAM01-BY2-obe.outbound.protection.outlook.com) (216.32.181.178) by server-13.tower-220.messagelabs.com with AES256-GCM-SHA384 encrypted SMTP; 29 Mar 2018 19:04:49 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=RwcreAg0RI7YOFILVqPfE/PbqRrMMMJ2Jj+r0kSbFx8=; b=e9J0IYVTkCER1i8jhXPiMuAQd78MYmxiA1zDySveOFwCEAcQM+n+7QnvYcq0byrjWTVa56XF7gK8zp9ksE/IVzGKsG+qvCY/ZwZwhwG5GAL95tSn0rK15vy4wwoXK2BHMd5KcBL9tE2ROl7DHVBulHgdnXXQFHNhHm2bOFcuSYA= Received: from MWHPR14MB1376.namprd14.prod.outlook.com (10.173.232.139) by MWHPR14MB1711.namprd14.prod.outlook.com (10.171.147.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.631.10; Thu, 29 Mar 2018 19:04:45 +0000 Received: from MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd]) by MWHPR14MB1376.namprd14.prod.outlook.com ([fe80::ad66:bb50:b8e8:9dfd%17]) with mapi id 15.20.0609.012; Thu, 29 Mar 2018 19:04:45 +0000 From: Tim Hollebeek To: Stefan Santesson , Yoav Nir CC: LAMPS , Russ Housley Thread-Topic: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 Thread-Index: AQHTwRW4eNEoTpa7PEmoGQqs7AdAaKPkQq+AgAAB0ICAAEBQAIABfj2AgADK/ICAAJPQAIAAAGIAgAA8d6A= Date: Thu, 29 Mar 2018 19:04:45 +0000 Message-ID: References: <30637C44-5EF8-4286-A796-E5D8D91CD01A@vigilsec.com> <4843f85b-737b-5a01-bbd4-a081b55a045a@cs.tcd.ie> <746E17EC-9FBF-4110-8FB2-46F1D1A467D5@gmail.com> <5D8C173D-5EED-4518-927D-5B3C1D2BFE1D@aaa-sec.com> In-Reply-To: <5D8C173D-5EED-4518-927D-5B3C1D2BFE1D@aaa-sec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [98.111.253.132] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR14MB1711; 7:gvsZp6Pq/2dERyqKFaWfDc1ae/7ZC5IUMybNanuDDK33wHd53WqOAJSrxN3vMBFLhJV1g/YEJ4UFcU2AdfZLOnflfD90h5ndGZr/vYh1xoq5w7O6Z9/cEzqk+OBRKwi+6A/lQXyJFlWl94Ry0k7O1u5O+1ldPGdZ9jTUaUKFYhMjLTp3iH7yR5xhzkHiRv4wAkQEPxsevHx517A2gQ2FZRr9XCX0Nd07w1D+J7fixzFxutzAKhNReU3BvLqTPltM x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 3dfcb4c7-a016-4522-5f7b-08d595a7ef83 x-microsoft-antispam: UriScan:(32856632585715); BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(49563074)(7193020); SRVR:MWHPR14MB1711; x-ms-traffictypediagnostic: MWHPR14MB1711: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(158342451672863)(278428928389397)(209352067349851)(192374486261705)(85827821059158); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(3231221)(944501327)(52105095)(93006095)(93001095)(10201501046)(3002001)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(20161123564045)(6072148)(201708071742011); SRVR:MWHPR14MB1711; BCL:0; PCL:0; RULEID:; SRVR:MWHPR14MB1711; x-forefront-prvs: 0626C21B10 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(366004)(376002)(39860400002)(39380400002)(346002)(377424004)(53754006)(13464003)(51444003)(189003)(199004)(6506007)(316002)(3660700001)(6436002)(8676002)(7736002)(106356001)(9686003)(66066001)(59450400001)(81166006)(76176011)(53546011)(25786009)(7696005)(305945005)(55016002)(11346002)(68736007)(86362001)(966005)(4326008)(6246003)(74316002)(54906003)(110136005)(53936002)(97736004)(3846002)(6306002)(81156014)(6116002)(486005)(446003)(486005)(476003)(99286004)(39060400002)(102836004)(8936002)(229853002)(2906002)(99936001)(5250100002)(5660300001)(2900100001)(93886005)(26005)(3280700002)(33656002)(186003)(105586002)(478600001)(14454004); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR14MB1711; H:MWHPR14MB1376.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: yC0kYWFV5Yj4Lyd1lv1SSGhjQXu7Wlzy+QZufVUdj2u8olp3LH0BORvF9T/CG9oQqMxeqZ6XiiYvf7dwgx4YdRyHtHUaTO/Z5J7/yIxabqI1gJcx20Ggs7WP7LSsYsdmXTX8Inw1NRCiPrZYyPnhpuyT1QzopOmZpK838NZUzJvxK7cm1in+9FH37ZCKx9k+CCEd3mGqW66K3Fvwunmi5jyltqLh+Cetv6Arib3uQAZFSdivabvUb/ApZXm6EU2BRkzKoE924AkPyQjArtBR4Zq0l+fEUdE4Zwfkmv806pOl/Ub48iAnatTi8TlXV5ClKLojlRpvI0VajJK2fr6AnA== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0357_01D3C76F.42D61520" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3dfcb4c7-a016-4522-5f7b-08d595a7ef83 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2018 19:04:45.1443 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR14MB1711 Archived-At: Subject: Re: [lamps] Considerations and Clarifications about draft-nir-saag-star-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Mar 2018 19:04:55 -0000 ------=_NextPart_000_0357_01D3C76F.42D61520 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable One interesting point that I noticed yesterday is that eIDAS actually = requires that certificates contain a pointer to status information. So there may be some barriers to being able to use revocation free = Qualified Website Authentication Certificates. -Tim > -----Original Message----- > From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Stefan = Santesson > Sent: Thursday, March 29, 2018 11:26 AM > To: Yoav Nir > Cc: LAMPS ; Russ Housley > Subject: Re: [lamps] Considerations and Clarifications about = draft-nir-saag-star- > 01 >=20 > Fully agree. > I have never suggested that a CA should be required to provide a CRL. > I'm just saying that a CA should be allowed to if it has an interest = to support > legacy clients. >=20 > /Stefan >=20 >=20 > =EF=BB=BFOn 2018-03-29, 17:23, "Yoav Nir" wrote: >=20 > This is true, but any CA issuing such certificates will have to = maintain an > always-on server to serve those CRLs. If the CRL DP extension is not = there, they > don=E2=80=99t need that server. >=20 > Yoav >=20 > > On 29 Mar 2018, at 9:35, Stefan Santesson = wrote: > > > > Basically yes. > > > > At least that was the discussion. I have to check what the = outcome was. > > Also this discussion started as "Short-lived" certs, and ended = up as > "Revocation-free" certs. > > > > This way to deal with real implementations by using both = noRevAvail, > combined with a CRLDP and an empty CRL probably don't need a standard, = but > maybe a BCP or something. > > > > /Stefan > > > > > > > > =EF=BB=BFOn 2018-03-28, 20:29, "Russ Housley" = wrote: > > > > Stefan: > > > > Are us saying that it allows a relying party that does not = recognize the > non-critical noRevAvail extension to use the CRLDP extension to get an = empty > CRL? In this way, only the relying parties that do not recognize the = noRevAvail > extension will get the latency hit? > > > > Russ > > > > > >> On Mar 27, 2018, at 3:40 PM, Stefan Santesson = > wrote: > >> > >> We had a long discussion in ETSI about this. > >> > >> One aspect is that the absence of revocation information = actually breaks > several implementations. > >> One idea was to publish an empty CRL + an extension with the = semantics > =3D "You may skip the rev checking, because the CRL is empty" > >> > >> This way you would have the cake and eat it too. Old systems = would use > the CRL and work. New systems would understand the extension and skip = CRL > checking. > >> > >> But maybe this is to overcomplicate things. > >> > >> /Stefan > >> > >> > >> > >> > >> =EF=BB=BFOn 2018-03-27, 17:50, "Spasm on behalf of Stephen = Farrell" bounces@ietf.org on behalf of stephen.farrell@cs.tcd.ie> wrote: > >> > >> > >> > >> On 27/03/18 16:44, Russ Housley wrote: > >>> Trimming the distribution to the LAMPS mail list ... > >>> > >>> RFC 3281 includes the definition of noRevAvail certificate = extension. It is > defined in X.509, and the definition is repeated in RFC 3281, Section = 4.3.6. > >>> > >>> If the CA is not going to publish revocation information about = the > certificate, I think we should include this extension to tell relying = parties not to > bother looking for it. > >> > >> Makes sense to me too. It's non-critical so shouldn't > >> break anything. > >> > >> S. > >> > >>> > >>> Russ > >>> > >>> > >>>> On Mar 21, 2018, at 9:08 AM, Dr. Pala = wrote: > >>>> > >>>> Hi all, > >>>> > >>>> unfortunately I missed the sec-dispatch session, but I have = some > important considerations about the document. In general, short-lived > certificates have been around for many years and for many different > applications (nothing new here), however nobody who have been working = with > PKI long enough would actually made the case that the security levels = of short- > lived-no-revo and any-lived-plus-revo are the same (which seems the = life-motif > of the presentation and the document itself). > >>>> > >>>> Other aspects that I think shall be revisited are the lack of > considerations about the usability of deployed infrastructures (when = no > revocation is assumed) and some wrong considerations in the document = about > validity periods of OCSP Responses and CRLs (that clearly undermine = the > equivalence claim). > >>>> Equivalence of Short-Lived w/out Rev Support and Any-Lived w/ = Rev > Support > >>>> The statements that made me jump on my seat is the claim that = short- > lived certificates without revocation support (BTW, short-lived does = not > necessarily exclude revocation support) and certificates (short-lived = or not) vs. > any-lived certificates with revocation support have the same level of = security as > long as the validity period of the short-lived ones is equal or = shorter than CRLs > or OCSP validity. I find this quite a puzzling statement. For once, = there should > be considerations about the fact that if a key is compromised and it = is used by a > malicious entity to attack/disrupt/etc. another entity, the rightful = owner of the > certificate does not have any possibility to prove that someone else = did it - > there is no authenticated trail (OCSP response or CRL) that can be = used in this > case and this can lead, in some environments, to legal implications. I = am > curious about how do the authors address this point, maybe some > considerations shall be made here. > >>>> > >>>> Also the claim that: > >>>> > >>>> " it is hard to justify why the CA or a delegate needs to = both sign blob-1 > (the certificate) and also sign blob-2 (the CRL or OCSP response) to = tell relying > parties that blob-1 is still valid." > >>>> > >>>> is quite curious and, I might say, misleading. Although the = revocation > status (either in the form of an OCSP or CRL) does not provide = additional > information besides the validity when the certificate is not revoked, = it does > provide quite a lot of useful information when the certificate is = revoked (e.g., > when a compromised happened, the reason for revocation - e.g., key > compromise, a person has left the organization, a HW token is broken, = etc.). I > would prefer the authors to explain what they mean in more extensive = and > engineering-appropriate form. This is another evidence that the two = systems > are definitely NOT equivalent from a security perspective. > >>>> > >>>> Another example about the fact that some form of revocation = is still > needed comes from the document itself (thus contradicting, IMO, the = main > claim of the document - 5.1): > >>>> > >>>> "No matter how short-term these short term certificates are, = there is a > certain window of time when the attacker can use the certificate. = This can > often be mitigated with application-level measures." > >>>> > >>>> this is "application-level measures =3D=3D application-level = revocation". This > means that now, instead of having standardized ways to check for the = status of > certificates, each application need to implement a way to deal with it = on an ad- > hoc basis and being able to distribute securely this information to = all relying > parties. Undoubtedly, for anybody who has ever had to deal with such > problems this becomes a quite costly and intractable problems very = quickly. > Maybe some considerations about this should be added in the document = as > well. > >>>> > >>>> Usability of Deployed Infrastructures > >>>> > >>>> One important section that is missing is: how do these = no-revocation > PKIs look like? There are basically two main choices here: > >>>> > >>>> Deploy a 2 level-only PKI. That means having a Trust Anchor = that issues > directly the EE certificates. Besides all security considerations = about TAs being > online (as required in short-lived environments), this makes it very = difficult to > deploy. Important considerations should be made in this case. > >>>> > >>>> Deploy a 3+ level PKIs (current best practices). This = approach involves > having (usually one) intermediate CAs (there can be more). In this = case, the TAs > issue the intermediate CAs' certificates and the last intermediate CAs = issue the > EE ones. Obviously, intermediate CAs can not have the same short = validity > period as the EE certs, therefore the need for revocation (at least at = the > intermediate CAs level) is evident. Important considerations shall be = made also > in this case. > >>>> Wrong Considerations about CRLs and OCSP Responses validity = periods > >>>> > >>>> In the document, statements like the following shall be fixed = and > expanded for clarity: > >>>> > >>>> "If a CRL has a nextUpdate field that is 4 days in the = future, a typical > system will not attempt to fetch a new one before those 4 days have = elapsed." > >>>> > >>>> And then it continue by stating the following: > >>>> "For this reason, moving to STAR certificates provides a = similar level of > security to what is generally practiced on the web." > >>>> > >>>> Since the first statement is incomplete and, thus, misleading = - the > second statement does not hold. Let me explain further for the people = that are > not familiar with how CRLs and OCSP are processed. Although there is a = validity > period for revocation information, it is well-known that the = expiration field > indicates the time "within a new revocation status information will be = made > available" and it is NOT "this is the revocation status of the target = certificate > until the expiration" - common practice is that when a revocation = event occurs, > new CRLs and OCSP responses for the revoked certificates are made = available > immediately or within few hours at most. > >>>> It is an important distinction that highlights also why the = lack of > revocation information makes the system less secure. Although it is = quite > evident why and since this is not addressed in the document, it might = be useful > to spell it out. > >>>> > >>>> In a multi-party environment, different applications might = have (a) > different strategies when it comes to caching of the revocation = information > and/or (b) check the revocation information at different times. Let's = make the > case of 2 parties checking the rev info for the same certificate. If = party A > accesses OCSP/CRLs at {time1} and caches it until {time1 + delta}, = party B > retrieves it at {time2} and caches it until {time2+delta}. Let's = assume that time2 > > time1 and that new revocation status information is already = available at > {time2}. This means that, although party A is still vulnerable until = {time1+delta}, > party B is not. In a short-lived cert environment w/out revocation ALL = parties > are VULNERABLE until the compromised {key+certificate} expires. > >>>> > >>>> It seems quite clear that the two environments (short-lived = w/ no revo > and any-lived w/ revo) do not have the same security properties. > >>>> > >>>> Therefore I think that the authors ought to demonstrate the > equivalence of security levels (not just assume it as hypothesis - = given I just > disproved it) or to remove all claims that the two environments are = actually > equivalent from as security perspective and to add specific = considerations for > short-lived-no-revo about the the fact that not supporting revocation = is > inherently weaker because it potentially exposes all parties to = attacks (e.g., > MITM, un-authorized access to resources, etc.) that can not be stopped = (unless > you implement application-level revocation.. and, therefore, = re-introduce > revocation from the backdoor in a non-standardized, ad-hoc, = hard-to-manage > across application fashion). > >>>> > >>>> Final Considerations > >>>> > >>>> I am not opposed at the concept of this document to be = considered for > BCP, however all the above issues MUST, IMO, be addressed before the > document can be considered further. I think I already raised these > considerations at the last IETF, but I do not think the authors missed = or have > not considered the provided feedback. I hope that a more explicit and = written > feedback might be taken into considerations. > >>>> > >>>> Just my 2 cents form an old barnacle... :D > >>>> > >>>> Cheers, > >>>> Max > >>>> -- > >>>> Best Regards, > >>>> Massimiliano Pala, Ph.D. > >>>> OpenCA Labs Director > >>>> > >>>> _______________________________________________ > >>>> Spasm mailing list > >>>> Spasm@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/spasm > >>> > >>> > >>> > >>> > >>> _______________________________________________ > >>> Spasm mailing list > >>> Spasm@ietf.org > >>> https://www.ietf.org/mailman/listinfo/spasm > >>> > >> _______________________________________________ > >> Spasm mailing list > >> Spasm@ietf.org > >> https://www.ietf.org/mailman/listinfo/spasm > >> > >> > >> > >> _______________________________________________ > >> Spasm mailing list > >> Spasm@ietf.org > >> https://www.ietf.org/mailman/listinfo/spasm > > > > > > > > > > _______________________________________________ > > Spasm mailing list > > Spasm@ietf.org > > https://www.ietf.org/mailman/listinfo/spasm >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm ------=_NextPart_000_0357_01D3C76F.42D61520 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwMzI5MTkwNDQwWjAvBgkqhkiG9w0BCQQxIgQgdZHDqgxDtzl06BWkOdO660wwJKYn xmVhZZ5gNJ9lqgIwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAFRn9tN7P4KgyVJhLdzHTMD1Pmz32zYaDSqVAA+rGK4Zw78n3WkcaMqMzqfVhm1TkblFeZWw fFJmd6bZmnTDDlAZc2Wx8nq/Q+fCvQd/kuasczMj6YqwD4I5ypVFedre6Y+cigublMf1uMw8KpMs EQzzO7zTzEXS50jj+UhV88FF3XWkSlx52bDCJX8alzsECpIsfsYQEdcVcXe6xM30nAYSuVlj+Uga A73aczuawRPooyXBk98YMVe7IS7xCrAr4Bj0nrh2YKq19CsRQsuBg/SIBRgoMX3yYanoWUE3pGJO nTGp6Pz80McRiy3p/MstpjOHTZM1dKNpnu4z/qJT+lQAAAAAAAA= ------=_NextPart_000_0357_01D3C76F.42D61520-- From nobody Fri Mar 30 11:05:05 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27CA3126C2F for ; Fri, 30 Mar 2018 11:05:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p8slPU5VWCaS for ; Fri, 30 Mar 2018 11:05:02 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C23312420B for ; Fri, 30 Mar 2018 11:05:02 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id C76C0300548 for ; Fri, 30 Mar 2018 14:04:59 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id T_LaHuO2ernW for ; Fri, 30 Mar 2018 14:04:58 -0400 (EDT) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id B7B133004AA for ; Fri, 30 Mar 2018 14:04:58 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: <1D329233-AFCE-421B-81FE-EDDC30386260@vigilsec.com> Date: Fri, 30 Mar 2018 14:05:10 -0400 To: LAMPS X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [lamps] Potential Topics for LAMPS Recharter X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Mar 2018 18:05:04 -0000 Several things have come up over the last few weeks that might be added = to the LAMPS charter. First, two Iinternet-Drafts were directed to LAMPS during the = SECDISPATCH session at IETF 101 in London: 1) draft-nir-saag-star: SECDISPATCH suggested that the LAMPS WG take = on short-lived certificates as an additional work item. 2) draft-housley-cms-mts-hash-sig: SECDISPATCH suggested that the = LAMPS WG take on hash-based signatures for CMS as an additional work = item. Second, at the end of the LAMPS session at IETF 101 in London, three = topics were raised as possible new work items: 3) : the need for revocation request format. 4) draft-truskovsky-lamps-pq-hybrid-x509: certificate extensions for = quantum resistant keys and signatures. 5) draft-housley-cms-mix-with-psk: a way to mix a pre-shared key with = traditional key transport and key agreement algorithms. Third, the Security ADs have asked that we consider a document that was = headed for the independent stream: 6) draft-housley-hash-of-root-key-cert-extn: a way to manage key = rollover for a root CA. The current charter give some guidelines for the work items that belong = in LAMPS: The LAMPS (Limited Additional Mechanisms for PKIX and SMIME) Working=20= Group is chartered to make updates where there is a known = constituency=20 interested in real deployment and there is at least one sufficiently=20= well specified approach to the update so that the working group can=20= sensibly evaluate whether to adopt a proposal. Which of these potential work items have a "known constituency" and are = likely to see "real deployment"? Russ