From nobody Tue Sep 4 13:36:26 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9506B130F02; Tue, 4 Sep 2018 13:36:24 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Cc: lamps-chairs@ietf.org, ekr@rtfm.com, Russ Housley , housley@vigilsec.com, draft-ietf-lamps-rfc5751-bis@ietf.org, The IESG , spasm@ietf.org, rfc-editor@rfc-editor.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <153609338460.14283.9508573608161197122.idtracker@ietfa.amsl.com> Date: Tue, 04 Sep 2018 13:36:24 -0700 Archived-At: Subject: [lamps] Protocol Action: 'Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification' to Proposed Standard (draft-ietf-lamps-rfc5751-bis-11.txt) X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:36:24 -0000 The IESG has approved the following document: - 'Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification' (draft-ietf-lamps-rfc5751-bis-11.txt) as Proposed Standard This document is the product of the Limited Additional Mechanisms for PKIX and SMIME Working Group. The IESG contact persons are Benjamin Kaduk and Eric Rescorla. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5751-bis/ Technical Summary: This document specifies the message handling for S/MIME 4.0. The changes since S/MIME 3.2 include required support for authenticated encryption, increased RSA key sizes, moving old cryptographic algorithms to historic status, and requiring support for AES-256 GCM, ChaCha200-Poly1305, SHA-512, ECDSA with P-256, EdDSA, and Ed25519. Working Group Summary: There is strong consensus for this document in the LAMPS WG. Document Quality: S/MIME has wide support, and several implementers have said that they will implement the new features in this document. Personnel: Russ Housley is the document shepherd. Eric Rescorla is the responsible area director. From nobody Tue Sep 4 13:40:47 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 94E42130DCC; Tue, 4 Sep 2018 13:40:38 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153609363857.14247.3584080533976361039@ietfa.amsl.com> Date: Tue, 04 Sep 2018 13:40:38 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-hash-of-root-key-cert-extn-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:40:39 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Hash Of Root Key Certificate Extension Author : Russ Housley Filename : draft-ietf-lamps-hash-of-root-key-cert-extn-00.txt Pages : 8 Date : 2018-08-31 Abstract: This document specifies the Hash Of Root Key certificate extension. This certificate extension is carried in the self-signed certificate for a trust anchor, which is often called a Root Certification Authority (CA) certificate. This certificate extension unambiguously identifies the next public key that will be used by the trust anchor. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-hash-of-root-key-cert-extn/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-hash-of-root-key-cert-extn-00 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-hash-of-root-key-cert-extn-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Sep 4 13:41:15 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E8B1313104D; Tue, 4 Sep 2018 13:41:08 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153609366887.14267.13762082399234300487@ietfa.amsl.com> Date: Tue, 04 Sep 2018 13:41:08 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:41:13 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Use of the HSS/LMS Hash-based Signature Algorithm in the Cryptographic Message Syntax (CMS) Author : Russ Housley Filename : draft-ietf-lamps-cms-hash-sig-00.txt Pages : 13 Date : 2018-08-31 Abstract: This document specifies the conventions for using the the HSS/LMS hash-based signature algorithm with the Cryptographic Message Syntax (CMS). The HSS/LMS algorithm is one form of hash-based digital signature; it is described in [HASHSIG]. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-hash-sig/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-cms-hash-sig-00 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-hash-sig-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Sep 4 13:43:52 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C399127148; Tue, 4 Sep 2018 13:43:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153609381527.14287.7436809346028332620@ietfa.amsl.com> Date: Tue, 04 Sep 2018 13:43:35 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-rfc5751-bis-12.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:43:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification Authors : Jim Schaad Blake Ramsdell Sean Turner Filename : draft-ietf-lamps-rfc5751-bis-12.txt Pages : 59 Date : 2018-09-04 Abstract: This document defines Secure/Multipurpose Internet Mail Extensions (S/MIME) version 4.0. S/MIME provides a consistent way to send and receive secure MIME data. Digital signatures provide authentication, message integrity, and non-repudiation with proof of origin. Encryption provides data confidentiality. Compression can be used to reduce data size. This document obsoletes RFC 5751. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5751-bis/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-rfc5751-bis-12 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-rfc5751-bis-12 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-rfc5751-bis-12 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Sep 4 13:44:05 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 55B2F127148; Tue, 4 Sep 2018 13:43:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153609382832.14231.3232064065613822669@ietfa.amsl.com> Date: Tue, 04 Sep 2018 13:43:48 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-rfc5750-bis-08.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:43:49 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Secure/Multipurpose Internet Mail Extensions (S/ MIME) Version 4.0 Certificate Handling Authors : Jim Schaad Blake Ramsdell Sean Turner Filename : draft-ietf-lamps-rfc5750-bis-08.txt Pages : 26 Date : 2018-09-04 Abstract: This document specifies conventions for X.509 certificate usage by Secure/Multipurpose Internet Mail Extensions (S/MIME) v4.0 agents. S/MIME provides a method to send and receive secure MIME messages, and certificates are an integral part of S/MIME agent processing. S/MIME agents validate certificates as described in RFC 5280, the Internet X.509 Public Key Infrastructure Certificate and CRL Profile. S/MIME agents must meet the certificate processing requirements in this document as well as those in RFC 5280. This document obsoletes RFC 5750. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5750-bis/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-rfc5750-bis-08 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-rfc5750-bis-08 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-rfc5750-bis-08 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Sep 4 13:45:40 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A46C7127148 for ; Tue, 4 Sep 2018 13:45:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fROhYxNOKDR8 for ; Tue, 4 Sep 2018 13:45:35 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE35D130F66 for ; Tue, 4 Sep 2018 13:45:34 -0700 (PDT) Received: from Jude (50.252.25.182) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 4 Sep 2018 13:41:36 -0700 From: Jim Schaad To: References: <153609381549.14287.14111259983319605577.idtracker@ietfa.amsl.com> In-Reply-To: <153609381549.14287.14111259983319605577.idtracker@ietfa.amsl.com> Date: Tue, 4 Sep 2018 13:45:26 -0700 Message-ID: <07bc01d44490$36aa5920$a3ff0b60$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQDnGQ38DIk3rSYHANjhNFuUZ3tcRaa67ghQ Content-Language: en-us X-Originating-IP: [50.252.25.182] Archived-At: Subject: [lamps] FW: New Version Notification for draft-ietf-lamps-rfc5751-bis-12.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:45:39 -0000 This includes a comment with a request for the RFC Editor to pay = specific attention to a sentence in the document and see if they can do = a better job of writing it that has been done so far by committee. = Nobody seems happy with it at present. -----Original Message----- From: internet-drafts@ietf.org =20 Sent: Tuesday, September 4, 2018 1:44 PM To: Jim Schaad ; Blake Ramsdell = ; Sean Turner Subject: New Version Notification for = draft-ietf-lamps-rfc5751-bis-12.txt A new version of I-D, draft-ietf-lamps-rfc5751-bis-12.txt has been successfully submitted by Jim Schaad and posted to the IETF = repository. Name: draft-ietf-lamps-rfc5751-bis Revision: 12 Title: Secure/Multipurpose Internet Mail Extensions (S/MIME) Version = 4.0 Message Specification Document date: 2018-09-04 Group: lamps Pages: 59 URL: = https://www.ietf.org/internet-drafts/draft-ietf-lamps-rfc5751-bis-12.txt Status: = https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5751-bis/ Htmlized: = https://tools.ietf.org/html/draft-ietf-lamps-rfc5751-bis-12 Htmlized: = https://datatracker.ietf.org/doc/html/draft-ietf-lamps-rfc5751-bis Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-lamps-rfc5751-bis-12 Abstract: This document defines Secure/Multipurpose Internet Mail Extensions (S/MIME) version 4.0. S/MIME provides a consistent way to send and receive secure MIME data. Digital signatures provide authentication, message integrity, and non-repudiation with proof of origin. Encryption provides data confidentiality. Compression can be used to reduce data size. This document obsoletes RFC 5751. = =20 Please note that it may take a couple of minutes from the time of = submission until the htmlized version and diff are available at = tools.ietf.org. The IETF Secretariat From nobody Tue Sep 4 13:46:16 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1D95130F8E for ; Tue, 4 Sep 2018 13:46:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IW6TUvM7lgSu for ; Tue, 4 Sep 2018 13:46:12 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 713DA130F69 for ; Tue, 4 Sep 2018 13:46:12 -0700 (PDT) Received: from Jude (50.252.25.182) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 4 Sep 2018 13:42:15 -0700 From: Jim Schaad To: References: <153609382853.14231.9045426169697419973.idtracker@ietfa.amsl.com> In-Reply-To: <153609382853.14231.9045426169697419973.idtracker@ietfa.amsl.com> Date: Tue, 4 Sep 2018 13:46:04 -0700 Message-ID: <07bd01d44490$4df8d700$e9ea8500$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQGexId/DI/JIXDKLxvj9gu5sVYNqqVLl2zA Content-Language: en-us X-Originating-IP: [50.252.25.182] Archived-At: Subject: [lamps] FW: New Version Notification for draft-ietf-lamps-rfc5750-bis-08.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:46:14 -0000 This version updates a couple of IESG comments that were not addressed. -----Original Message----- From: internet-drafts@ietf.org =20 Sent: Tuesday, September 4, 2018 1:44 PM To: Jim Schaad ; Blake Ramsdell = ; Sean Turner Subject: New Version Notification for = draft-ietf-lamps-rfc5750-bis-08.txt A new version of I-D, draft-ietf-lamps-rfc5750-bis-08.txt has been successfully submitted by Jim Schaad and posted to the IETF = repository. Name: draft-ietf-lamps-rfc5750-bis Revision: 08 Title: Secure/Multipurpose Internet Mail Extensions (S/ MIME) Version = 4.0 Certificate Handling Document date: 2018-09-04 Group: lamps Pages: 26 URL: = https://www.ietf.org/internet-drafts/draft-ietf-lamps-rfc5750-bis-08.txt Status: = https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc5750-bis/ Htmlized: = https://tools.ietf.org/html/draft-ietf-lamps-rfc5750-bis-08 Htmlized: = https://datatracker.ietf.org/doc/html/draft-ietf-lamps-rfc5750-bis Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-lamps-rfc5750-bis-08 Abstract: This document specifies conventions for X.509 certificate usage by Secure/Multipurpose Internet Mail Extensions (S/MIME) v4.0 agents. S/MIME provides a method to send and receive secure MIME messages, and certificates are an integral part of S/MIME agent processing. S/MIME agents validate certificates as described in RFC 5280, the Internet X.509 Public Key Infrastructure Certificate and CRL Profile. S/MIME agents must meet the certificate processing requirements in this document as well as those in RFC 5280. This document obsoletes RFC 5750. = =20 Please note that it may take a couple of minutes from the time of = submission until the htmlized version and diff are available at = tools.ietf.org. The IETF Secretariat From nobody Tue Sep 4 13:54:14 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92D23130DEB for ; Tue, 4 Sep 2018 13:54:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7tejAw_Z_1Hg for ; Tue, 4 Sep 2018 13:54:11 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7EAF127148 for ; Tue, 4 Sep 2018 13:54:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D3DDB300A12 for ; Tue, 4 Sep 2018 16:54:08 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id sM2yYy5_YvSd for ; Tue, 4 Sep 2018 16:54:07 -0400 (EDT) Received: from a860b60074bd.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id DC9F33002AD for ; Tue, 4 Sep 2018 16:54:07 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 4 Sep 2018 16:54:08 -0400 References: <153609363883.14247.13911182814881981498.idtracker@ietfa.amsl.com> To: SPASM In-Reply-To: <153609363883.14247.13911182814881981498.idtracker@ietfa.amsl.com> Message-Id: <5CD02317-BBD4-4FE7-9103-258376DB2A6E@vigilsec.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] New Version Notification for draft-ietf-lamps-hash-of-root-key-cert-extn-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:54:13 -0000 Some text was added to the Security Considerations to address the = comments raised in the Montreal meeting. Please review and comment. Russ > On Sep 4, 2018, at 4:40 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A new version of I-D, = draft-ietf-lamps-hash-of-root-key-cert-extn-00.txt > has been successfully submitted by Russ Housley and posted to the > IETF repository. >=20 > Name: draft-ietf-lamps-hash-of-root-key-cert-extn > Revision: 00 > Title: Hash Of Root Key Certificate Extension > Document date: 2018-08-31 > Group: lamps > Pages: 8 > URL: = https://www.ietf.org/internet-drafts/draft-ietf-lamps-hash-of-root-key-cer= t-extn-00.txt > Status: = https://datatracker.ietf.org/doc/draft-ietf-lamps-hash-of-root-key-cert-ex= tn/ > Htmlized: = https://tools.ietf.org/html/draft-ietf-lamps-hash-of-root-key-cert-extn-00= > Htmlized: = https://datatracker.ietf.org/doc/html/draft-ietf-lamps-hash-of-root-key-ce= rt-extn >=20 >=20 > Abstract: > This document specifies the Hash Of Root Key certificate extension. > This certificate extension is carried in the self-signed certificate > for a trust anchor, which is often called a Root Certification > Authority (CA) certificate. This certificate extension unambiguously > identifies the next public key that will be used by the trust anchor. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 From nobody Tue Sep 4 13:55:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44362130F02 for ; Tue, 4 Sep 2018 13:55:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A0zSoAnrQ6C6 for ; Tue, 4 Sep 2018 13:55:18 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 678A0130DEB for ; Tue, 4 Sep 2018 13:55:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 54279300A12 for ; Tue, 4 Sep 2018 16:55:16 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Jr3a6Hl-dVe3 for ; Tue, 4 Sep 2018 16:55:15 -0400 (EDT) Received: from a860b60074bd.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 4AD883002AD for ; Tue, 4 Sep 2018 16:55:15 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 4 Sep 2018 16:55:15 -0400 References: <153609366946.14267.16426510024257902857.idtracker@ietfa.amsl.com> To: SPASM In-Reply-To: <153609366946.14267.16426510024257902857.idtracker@ietfa.amsl.com> Message-Id: <5AB05085-94A0-4ECB-BB57-2360087345D4@vigilsec.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] New Version Notification for draft-ietf-lamps-cms-hash-sig-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Sep 2018 20:55:20 -0000 Throughout the document, the terminology was changed to make it clear = that this hs about HSS/LMS hash-based signatures. Russ > A new version of I-D, draft-ietf-lamps-cms-hash-sig-00.txt > has been successfully submitted by Russ Housley and posted to the > IETF repository. >=20 > Name: draft-ietf-lamps-cms-hash-sig > Revision: 00 > Title: Use of the HSS/LMS Hash-based Signature = Algorithm in the Cryptographic Message Syntax (CMS) > Document date: 2018-08-31 > Group: lamps > Pages: 13 > URL: = https://www.ietf.org/internet-drafts/draft-ietf-lamps-cms-hash-sig-00.txt > Status: = https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-hash-sig/ > Htmlized: = https://tools.ietf.org/html/draft-ietf-lamps-cms-hash-sig-00 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-hash-sig >=20 >=20 > Abstract: > This document specifies the conventions for using the the HSS/LMS > hash-based signature algorithm with the Cryptographic Message Syntax > (CMS). The HSS/LMS algorithm is one form of hash-based digital > signature; it is described in [HASHSIG]. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 From nobody Wed Sep 5 08:20:16 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC850130DF4 for ; Wed, 5 Sep 2018 08:20:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wprWRkMVN30G for ; Wed, 5 Sep 2018 08:20:11 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5DD6130E3C for ; Wed, 5 Sep 2018 08:20:10 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Wed, 5 Sep 2018 08:16:07 -0700 From: Jim Schaad To: "'Dang, Quynh (Fed)'" CC: 'Russ Housley' , 'Tim Hollebeek' , "'Panos Kampanakis (pkampana)'" , References: <00b801d42b61$cf059a60$6d10cf20$@augustcellars.com> In-Reply-To: Date: Wed, 5 Sep 2018 08:19:56 -0700 Message-ID: <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_083A_01D444F1.3D2355C0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIojsMUXeIT61JfTuky7VuNmG9n7gEJS6YepDDvX8A= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] WGLC: draft-ietf-lamps-pkix-shake-02 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Sep 2018 15:20:15 -0000 ------=_NextPart_000_083A_01D444F1.3D2355C0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Mostly looks fine - one comment below From: Dang, Quynh (Fed) Sent: Wednesday, September 5, 2018 7:08 AM To: Jim Schaad Cc: 'Russ Housley' ; Tim Hollebeek ; Panos Kampanakis (pkampana) Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02 Hi Jim, We appreciate your review and comments. By the co-chairs' direction, let's try to improve the doc using your comments. _____ From: Jim Schaad > Sent: Friday, August 3, 2018 3:40 PM To: draft-ietf-lamps-pkix-shake@ietf.org Subject: WGLC: draft-ietf-lamps-pkix-shake-02 Not ready for progression. * Run the NITS on this document and fix them. Examples of problems are the fact that MUST language section is missing, possible incorrect references, and you have lines that are too long. Comment 1: correct. Will fix it. * Introduction - I have a problem with the cardinality of items in the second and third paragraphs here. I do not ask that you fix the problems that I have but you should be ready to address this is you get the same questions from the RFC Editor or the IESG. I would consider SHAKE to be a family of extendable-output hash functions and thus has a cardinality of one. The two specific hash functions have a cardinality of greater than one. The question of cardinality comes in terms of the usage of 'A', 'is', 'are'. Comment 2: "the SHAKE hash functions " in second paragraph in the intro. should be changed to "the SHAKEs" for a smooth read. A SHAKE is defined as one function with variable output length. * Introduction - paragraph 2 - I find the last sentence to be difficult to read. The usage of 'and' here seems to be incorrect and it may be difficult to figure out which pair comes first - resistance or function. Comment 3: It would read better if the sentence "The corresponding collision and preimage resistance security levels for SHAKE128 and SHAKE256 are respectively min(d/2,128) and min(d,128) and min(d/2,256) and min(d,256) bits." to be replaced with "The corresponding collision and second preimage resistance strengths for SHAKE128 are min(d/2,128) and min(d,128) respectively. And, the corresponding collision and second preimage resistance strengths for SHAKE256 are min(d/2,256) and min(d,256) bits respectively. " * Introduction - paragraph 3 - I am unaware that ECDSA has a mask generating function associated with it. This sentence needs to be cleaned up Comment 4: This sentence " SHAKEs can be used as the message digest function (to hash the message to be signed) and as the hash function in the mask generating functions in RSASSA-PSS and ECDSA." should be replaced with " SHAKEs can be used as the message digest function (to hash the message to be signed) in RSASSA-PSS and ECDSA and as the hash function in the mask generating functions in RSASSA-PSS." * Introduction - paragraph 3 - Consider putting in a reference to the algorithm identifiers that are not changing. Probably overkill but still useful Comment 5: Adding " see section 3 below" at the end of this sentence: "In this document, we define four new OIDs for RSASSA-PSS and ECDSA when SHAKE128 and SHAKE256 are used as hash functions.". * Identifiers - This section needs to nail down all parameters associated w/ the different SHAKE functions when used here. Otherwise you end up with the first assumption that I made which was d = 128 for SHAKE128 which would not produce an acceptable result. Comment 6: The specification of output lengths of the 2 SHAKEs is in Sections 4.1.1 and 4.1.2. Adding a sentence " See Sections 4.1.1 and 4.1.2 for specification of a required output length for each use of SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA." * Signatures - Para #3 - you refer to section 3 for OIDs, but they are not there for public keys. Comment 7: Adding this " Conforming CA implementations MUST specify the algorithms explicitly by using the OIDs specified in Section 3 when encoding public keys for RSASSA-PSS and ECDSA with SHAKE signatures in certificates and CRLs." as the first paragraph in Section 4.2 "Public keys". * IANA Considerations is incorrect and MUST be updated Comment 8: IANA Considerations is incorrect and will be updated. * Why is there no reference to deterministic ECDSA signatures in the document. Comment 9: Deterministic ECDSA has a different signing function because of the way k is generated. The working group has not adopted this option yet. Verification is the same. [JLS] If you want to say that it is a different signature algorithm that is fine. I'll call and raise. It should be that it is required that ECDSA w/ SHAKE implements deterministic ECDSA and MUST NOT use a random generator for k. * The ASN.1 module is absent and needs to be instantiated. Even doing so with TBD is sufficient for now. Comment 10: Yes. The ASN.1 module is absent and needs to be instantiated. Are you ok with the proposed resolutions ? Regards, Quynh. ------=_NextPart_000_083A_01D444F1.3D2355C0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Mostly looks fine – one comment = below

 

From: Dang, = Quynh (Fed) <quynh.dang@nist.gov>
Sent: Wednesday, = September 5, 2018 7:08 AM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: 'Russ Housley' = <housley@vigilsec.com>; Tim Hollebeek = <tim.hollebeek@digicert.com>; Panos Kampanakis (pkampana) = <pkampana@cisco.com>
Subject: Re: WGLC: = draft-ietf-lamps-pkix-shake-02

 

Hi = Jim,

 

We appreciate your review and = comments.

 

By the co-chairs' direction, = let's try to improve the doc using your = comments.

 

From: Jim Schaad <ietf@augustcellars.com>
= Sent: Friday, August 3, 2018 3:40 PM
To: draft-ietf-lamps-pki= x-shake@ietf.org
Subject: WGLC: = draft-ietf-lamps-pkix-shake-02

 

=

Not = ready for progression.

* Run the NITS on this document and fix = them.  Examples of problems are the
fact that MUST language = section is missing, possible incorrect references,
and you have lines = that are too long.

 

Comment 1: = correct. Will fix it.

 


*  Introduction - = I have a problem with the cardinality of items in the
second and = third paragraphs here.  I do not ask that you fix the = problems
that I have but you should be ready to address this is you = get the same
questions from the RFC Editor or the IESG.  I would = consider SHAKE to be a
family of extendable-output hash functions and = thus has a cardinality of
one.  The two specific hash functions = have a cardinality of greater than
one.  The question of = cardinality comes in terms of the usage of 'A', = 'is',
'are'.

 

Comment 2: = "the SHAKE hash functions " in second paragraph in the = intro. should be changed to "the SHAKEs" for a smooth = read.  A SHAKE is defined as one function with variable output = length. 



* Introduction - paragraph 2 - I find the = last sentence to be difficult to
read.  The usage of 'and' here = seems to be incorrect and it may be difficult
to figure out which = pair comes first - resistance or = function.

 

Comment = 3:

<= p class=3DMsoNormal>It would = read better if the sentence  "The corresponding collision = and preimage resistance security levels for SHAKE128 and SHAKE256 = are respectively
   min(d/2,128) and = min(d,128) and min(d/2,256) and min(d,256) bits."  to be = replaced with "The corresponding collision and second preimage = resistance strengths for SHAKE128 are min(d/2,128) and = min(d,128) respectively. And, the corresponding collision and = second preimage resistance strengths for SHAKE256 = are min(d/2,256) and min(d,256) bits respectively. = "

<= p class=3DMsoNormal>

* Introduction - = paragraph 3 - I am unaware that ECDSA has a mask generating
function = associated with it.  This sentence needs to be cleaned = up

 

 

Comment 4: = This sentence "

SHAKEs can = be used as the message digest function (to hash the
   message to be signed) = and as the hash function in the mask generating
   functions in = RSASSA-PSS and ECDSA." should be replaced with "

SHAKEs can = be used as the message digest function (to hash the
   message to be signed) = in RSASSA-PSS and ECDSA and as the hash function in the mask = generating functions in RSASSA-PSS."

=



* = Introduction - paragraph 3 - Consider putting in a reference to = the
algorithm identifiers that are not changing.  Probably = overkill but still
useful

 

Comment 5: = Adding " see section 3 below" at the end of this sentence: = "In this document, we define four new OIDs for RSASSA-PSS and = ECDSA when SHAKE128 and SHAKE256 are used as hash = functions.".

 


* Identifiers - This = section needs to nail down all parameters associated w/
the different = SHAKE functions when used here.  Otherwise you end up with = the
first assumption that I made which was d =3D 128 for SHAKE128 = which would not
produce an acceptable = result.

 

Comment 6: = The specification of output lengths of the 2 SHAKEs is in Sections 4.1.1 = and 4.1.2.  Adding a sentence " See Sections 4.1.1 and 4.1.2 = for specification of a required output length for each use of = SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA."

<= p class=3DMsoNormal> 



* Signatures - = Para #3 - you refer to section 3 for OIDs, but they are not
there for = public keys.

 

Comment 7: = Adding this "

<= p class=3DMsoNormal>Conforming CA implementations MUST = specify the algorithms explicitly
   by using the OIDs specified in Section = 3 when encoding  public keys for RSASSA-PSS = and ECDSA with SHAKE signatures in certificates = and CRLs." as the first paragraph in Section 4.2 = "Public keys". 



* IANA = Considerations is incorrect and MUST be = updated

 

 

Comment = 8: IANA Considerations is incorrect and will be = updated.

 


* Why is there no = reference to deterministic ECDSA signatures in = the
document.

 

Comment 9: = Deterministic ECDSA has a different signing function because of the way = k is generated. The working group has not adopted this option yet. = Verification is the same. 

 

[JLS] If you want to say that it is a different = signature algorithm that is fine.  I’ll call and raise.  = It should be that it is required that ECDSA w/ SHAKE implements = deterministic ECDSA and MUST NOT use a random generator for = k.



* The ASN.1 module is absent and needs to = be instantiated.  Even doing so
with TBD is sufficient for = now.

 

Comment 10: = Yes. 

The ASN.1 = module is absent and needs to be instantiated. 

 


Are you ok with the = proposed resolutions ?

 

Regards,

Quynh. 


------=_NextPart_000_083A_01D444F1.3D2355C0-- From nobody Wed Sep 5 10:44:16 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71115130DDA for ; Wed, 5 Sep 2018 10:44:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uhMop9AKCNzM for ; Wed, 5 Sep 2018 10:44:10 -0700 (PDT) Received: from GCC01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on071e.outbound.protection.outlook.com [IPv6:2a01:111:f400:fd00::71e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBE2D127AC2 for ; Wed, 5 Sep 2018 10:44:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6ZvtGNqR7qiealf4inMX9v176QtMowWcQaty/vhOpu0=; b=zoDtp9QcL+DeqSgS0pMso3xqpKvo5EVF41qlQcGRcRBldErbOHo1TmS/LW3gt8NMFIPbSbS3KL31VVAYbah/gZcAyNtmkzTPxzrmmSsdXev48K+VDuV2Kl9Vgs0i5BoZKX1oaPIlujP79AvxFCTaahb+/3qpbvx8RxqccK5kyFk= Received: from DM6PR09MB2746.namprd09.prod.outlook.com (20.176.97.156) by DM6PR09MB2748.namprd09.prod.outlook.com (20.176.97.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1080.15; Wed, 5 Sep 2018 17:44:08 +0000 Received: from DM6PR09MB2746.namprd09.prod.outlook.com ([fe80::dca7:b9ba:8b18:f6f5]) by DM6PR09MB2746.namprd09.prod.outlook.com ([fe80::dca7:b9ba:8b18:f6f5%2]) with mapi id 15.20.1080.019; Wed, 5 Sep 2018 17:44:08 +0000 From: "Dang, Quynh (Fed)" To: Jim Schaad CC: 'Russ Housley' , 'Tim Hollebeek' , "'Panos Kampanakis (pkampana)'" , "spasm@ietf.org" Thread-Topic: WGLC: draft-ietf-lamps-pkix-shake-02 Thread-Index: AdQrWI/gim0DHC1IRr6kopVYbZGOFwZx5lJ0AALvbgAABN0x1Q== Date: Wed, 5 Sep 2018 17:44:08 +0000 Message-ID: References: <00b801d42b61$cf059a60$6d10cf20$@augustcellars.com> , <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> In-Reply-To: <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=quynh.dang@nist.gov; x-originating-ip: [129.6.219.38] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM6PR09MB2748; 6:2ccIdj5l9WPLCu6mG9WbgDkRphokBrQiK3hM6w5G9Iw5WAQc3e0H4nwLcs10twMmC688BxopaUokj3XkHaThtx2EZONuYmE0jTQqIHJz+iznJ7pVg5ySuHIUBL122teHFJnZYL1vQvYnYbr8GqNxfSbJfpAznGm7tybPvLezs1WaEbk7p337s+wbaj2+IeRnqwzX+g3jl/nZZuSarC1hee2lBpNgi7bOWYKVPVfWWLXz4/giA7He4epUXTjHSadE0OjFoGVsF6urgxCTuEZNGVL1pNeeiRm5/ffepmb/PVdsWEXVQ1rCQFNnJ3AeInIdvIBKHJg7HsHBq2fSJq2jOfWR6Ae9Svj7hUYRDjr77A3WCeNRpqMbpd6hGOzJDr9c4Teb1Gi1/cqqmxRg5umueq4pbipASjZHrgH/Wj93r3dJFBbrT9OHTlzbllmjLImnAG2/BtEauLcCax0JiUbFBg==; 5:20AHjDMDp7i6dV+88lHW0nNRjKcnivcxzwaJkHkJH3XYQ/FxAlvouN4F74Vs0XqMTJW7exfrf0mf40dfEJmLVjMPBvPH2Ffz18ffdEUpcvGIw37pOiTn3zJFF8qo5s2IWqdaR4UnaeLJ5Yh3WGeiXmGQCixJ05K3fdYDSG7tHjE=; 7:XzACZChP0a3zSfwsAUuKArkcDWcYUQATakRui4dtwY8iqm04duWji+Ui5PkxzzISnTc2xcrkf29XOIRxW5uFB61o0c8u5ceKx675DewE73x2HT/OwedFkdvaSN+TtIxG8YnUS/fKxMfGqB6jp0uP5bR7K5hIHGcunZgxgUnc8MxcttkGdqOrQzDgu9q7oGg1lERUS5mX5d5Sd0h8KI9oKQXoiVSP8d1bM8cwXWjr49xLRqE4UxBhyvDapm0IfthP x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: f4d63e5a-b5cd-49bf-7489-08d613572ec4 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM6PR09MB2748; x-ms-traffictypediagnostic: DM6PR09MB2748: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637)(192374486261705)(95692535739014); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231311)(944501410)(52105095)(10201501046)(3002001)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123558120)(20161123564045)(201708071742011)(7699016); SRVR:DM6PR09MB2748; BCL:0; PCL:0; RULEID:; SRVR:DM6PR09MB2748; x-forefront-prvs: 078693968A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(136003)(346002)(366004)(376002)(39860400002)(189003)(199004)(14454004)(55016002)(11346002)(53936002)(236005)(74316002)(9686003)(54906003)(26005)(19627405001)(2906002)(97736004)(8936002)(229853002)(33656002)(7736002)(446003)(478600001)(81166006)(476003)(486006)(6436002)(316002)(105586002)(81156014)(186003)(6246003)(106356001)(54896002)(6916009)(99286004)(7696005)(5250100002)(6116002)(66066001)(76176011)(68736007)(6606003)(25786009)(8676002)(86362001)(4326008)(256004)(102836004)(3846002)(6506007)(2900100001)(14444005)(5660300001)(53546011); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR09MB2748; H:DM6PR09MB2746.namprd09.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts) x-microsoft-antispam-message-info: F9WK7fJokCdB59DScfs9ARXHk4YUwGMAQ8TclT4w9MqNedfSS6eQ0Bj6tCgbRjFdu0qKNrrh3rw3NoYC0XpBtrQ45Shs4e5FQeW/7xPbW8E8207Io7+2HiTAm5sycns+2MQC+XltKahyx0McdnKm8hz6RDIjdgYiUbQR0ime/JMLRgqlS3BlbezTWyvuv70OBFXq4Wb+K98econcrMTEBzOEBSmKiyq5HDCKejM/H0QAoDHQna+ajfX5u3qoWFg1TYHvy7OWC1z+mELfejqbevwX7CvBJnCbISC1fGxbycFecfuHj5RWz5mBSwgJ2VY7ZJXoXmgCW+IFxnhCiwSIaS4/WhIctdwkfZb6h4pno7g= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM6PR09MB2746F924F18EA9C1A105FBACF3020DM6PR09MB2746namp_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-Network-Message-Id: f4d63e5a-b5cd-49bf-7489-08d613572ec4 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Sep 2018 17:44:08.6532 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR09MB2748 Archived-At: Subject: Re: [lamps] WGLC: draft-ietf-lamps-pkix-shake-02 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Sep 2018 17:44:14 -0000 --_000_DM6PR09MB2746F924F18EA9C1A105FBACF3020DM6PR09MB2746namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I would have no problems with deterministic ECDSA. But, the adoption was fo= r the original ECDSA. We need advice from the chairs. Regards, Quynh. ________________________________ From: Jim Schaad Sent: Wednesday, September 5, 2018 11:19 AM To: Dang, Quynh (Fed) Cc: 'Russ Housley'; 'Tim Hollebeek'; 'Panos Kampanakis (pkampana)'; spasm@i= etf.org Subject: RE: WGLC: draft-ietf-lamps-pkix-shake-02 Mostly looks fine =96 one comment below From: Dang, Quynh (Fed) Sent: Wednesday, September 5, 2018 7:08 AM To: Jim Schaad Cc: 'Russ Housley' ; Tim Hollebeek ; Panos Kampanakis (pkampana) Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02 Hi Jim, We appreciate your review and comments. By the co-chairs' direction, let's try to improve the doc using your commen= ts. ________________________________ From: Jim Schaad > Sent: Friday, August 3, 2018 3:40 PM To: draft-ietf-lamps-pkix-shake@ietf.org Subject: WGLC: draft-ietf-lamps-pkix-shake-02 Not ready for progression. * Run the NITS on this document and fix them. Examples of problems are the fact that MUST language section is missing, possible incorrect references, and you have lines that are too long. Comment 1: correct. Will fix it. * Introduction - I have a problem with the cardinality of items in the second and third paragraphs here. I do not ask that you fix the problems that I have but you should be ready to address this is you get the same questions from the RFC Editor or the IESG. I would consider SHAKE to be a family of extendable-output hash functions and thus has a cardinality of one. The two specific hash functions have a cardinality of greater than one. The question of cardinality comes in terms of the usage of 'A', 'is', 'are'. Comment 2: "the SHAKE hash functions " in second paragraph in the intro. sh= ould be changed to "the SHAKEs" for a smooth read. A SHAKE is defined as o= ne function with variable output length. * Introduction - paragraph 2 - I find the last sentence to be difficult to read. The usage of 'and' here seems to be incorrect and it may be difficul= t to figure out which pair comes first - resistance or function. Comment 3: It would read better if the sentence "The corresponding collision and prei= mage resistance security levels for SHAKE128 and SHAKE256 are respectively min(d/2,128) and min(d,128) and min(d/2,256) and min(d,256) bits." to b= e replaced with "The corresponding collision and second preimage resistance= strengths for SHAKE128 are min(d/2,128) and min(d,128) respectively. And, = the corresponding collision and second preimage resistance strengths for SH= AKE256 are min(d/2,256) and min(d,256) bits respectively. " * Introduction - paragraph 3 - I am unaware that ECDSA has a mask generatin= g function associated with it. This sentence needs to be cleaned up Comment 4: This sentence " SHAKEs can be used as the message digest function (to hash the message to be signed) and as the hash function in the mask generating functions in RSASSA-PSS and ECDSA." should be replaced with " SHAKEs can be used as the message digest function (to hash the message to be signed) in RSASSA-PSS and ECDSA and as the hash function i= n the mask generating functions in RSASSA-PSS." * Introduction - paragraph 3 - Consider putting in a reference to the algorithm identifiers that are not changing. Probably overkill but still useful Comment 5: Adding " see section 3 below" at the end of this sentence: "In t= his document, we define four new OIDs for RSASSA-PSS and ECDSA when SHAKE12= 8 and SHAKE256 are used as hash functions.". * Identifiers - This section needs to nail down all parameters associated w= / the different SHAKE functions when used here. Otherwise you end up with th= e first assumption that I made which was d =3D 128 for SHAKE128 which would n= ot produce an acceptable result. Comment 6: The specification of output lengths of the 2 SHAKEs is in Sectio= ns 4.1.1 and 4.1.2. Adding a sentence " See Sections 4.1.1 and 4.1.2 for s= pecification of a required output length for each use of SHAKE128 or SHAKE2= 56 in RSASSA-PSS and ECDSA." * Signatures - Para #3 - you refer to section 3 for OIDs, but they are not there for public keys. Comment 7: Adding this " Conforming CA implementations MUST specify the algorithms explicitly by using the OIDs specified in Section 3 when encoding public keys for = RSASSA-PSS and ECDSA with SHAKE signatures in certificates and CRLs." as th= e first paragraph in Section 4.2 "Public keys". * IANA Considerations is incorrect and MUST be updated Comment 8: IANA Considerations is incorrect and will be updated. * Why is there no reference to deterministic ECDSA signatures in the document. Comment 9: Deterministic ECDSA has a different signing function because of = the way k is generated. The working group has not adopted this option yet. = Verification is the same. [JLS] If you want to say that it is a different signature algorithm that is= fine. I=92ll call and raise. It should be that it is required that ECDSA= w/ SHAKE implements deterministic ECDSA and MUST NOT use a random generato= r for k. * The ASN.1 module is absent and needs to be instantiated. Even doing so with TBD is sufficient for now. Comment 10: Yes. The ASN.1 module is absent and needs to be instantiated. Are you ok with the proposed resolutions ? Regards, Quynh. --_000_DM6PR09MB2746F924F18EA9C1A105FBACF3020DM6PR09MB2746namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

= I would have no problems with deterministic ECDSA. But, the adoption was fo= r the original ECDSA. 

=

= We need advice from the chairs. 


Regards,

Quynh. 



From: Jim Schaad <ietf@a= ugustcellars.com>
Sent: Wednesday, September 5, 2018 11:19 AM
To: Dang, Quynh (Fed)
Cc: 'Russ Housley'; 'Tim Hollebeek'; 'Panos Kampanakis (pkampana)'; = spasm@ietf.org
Subject: RE: WGLC: draft-ietf-lamps-pkix-shake-02
 

Mostly looks fine =96 one comment below

 

From: Dang, Quynh (Fed) <quynh.dang@nist= .gov>
Sent: Wednesday, September 5, 2018 7:08 AM
To: Jim Schaad <ietf@augustcellars.com>
Cc: 'Russ Housley' <housley@vigilsec.com>; Tim Hollebeek <t= im.hollebeek@digicert.com>; Panos Kampanakis (pkampana) <pkampana@cis= co.com>
Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02

 

Hi Jim,

 

We appreciate your review = and comments.

 

By the co-chairs' directio= n, let's try to improve the doc using your comments.

 

From: Jim Schaad <ie= tf@augustcellars.com>
Sent: Friday, August 3, 2018 3:40 PM
To: draft-ietf-lamps-pkix-shake@ietf.org
Subject: WGLC: draft-ietf-lamps-pkix-shake-02

&nbs= p;

Not ready for progress= ion.

* Run the NITS on this document and fix them.  Examples of problems ar= e the
fact that MUST language section is missing, possible incorrect references,<= br> and you have lines that are too long.

 

Commen= t 1: correct. Will fix it.

 


*  Introduction - I have a problem with the cardinality of items in th= e
second and third paragraphs here.  I do not ask that you fix the probl= ems
that I have but you should be ready to address this is you get the same
questions from the RFC Editor or the IESG.  I would consider SHAKE to = be a
family of extendable-output hash functions and thus has a cardinality of one.  The two specific hash functions have a cardinality of greater th= an
one.  The question of cardinality comes in terms of the usage of 'A', = 'is',
'are'.

 

Commen= t 2: "the SHAKE hash functions " in second paragraph in the = intro. should be changed to "the SHAKEs" for a smooth read. = A SHAKE is defined as one function with variable output length. 



* Introduction - paragraph 2 - I find the last sentence to be difficult to<= br> read.  The usage of 'and' here seems to be incorrect and it may be dif= ficult
to figure out which pair comes first - resistance or function.

 

Commen= t 3:

It wou= ld read better if the sentence  "The corresponding collision= and preimage resistance security levels for SHAKE128 and SHAKE256 are= respectively
   min(d/2,128= ) and min(d,128) and min(d/2,256) and min(d,256) bits."  to be re= placed with "The corresponding collision and second preimage resi= stance strengths for SHAKE128 are min(d/2,128) and min(d,128) res= pectively. And, the corresponding collision and second preimage resistance = strengths for SHAKE256 are min(d/2,256) and min(d,256) bits respe= ctively. "=



* Introduction - paragraph 3 - I am unaware that ECDSA has a mask generatin= g
function associated with it.  This sentence needs to be cleaned up

 

 

Commen= t 4: This sentence "

SHAKEs= can be used as the message digest function (to hash the
   message to = be signed) and as the hash function in the mask generating
   functions i= n RSASSA-PSS and ECDSA." should be replaced with "

SHAKEs= can be used as the message digest function (to hash the
   message to = be signed) in RSASSA-PSS and ECDSA and as the hash function in the mas= k generating functions in RSASSA-PSS."



* Introduction - paragraph 3 - Consider putting in a reference to the
algorithm identifiers that are not changing.  Probably overkill but st= ill
useful

 

Commen= t 5: Adding " see section 3 below" at the end of this sentence: &= quot;In this document, we define four new OIDs for RSASSA-PSS and ECDS= A when SHAKE128 and SHAKE256 are used as hash functions.".=

 


* Identifiers - This section needs to nail down all parameters associated w= /
the different SHAKE functions when used here.  Otherwise you end up wi= th the
first assumption that I made which was d =3D 128 for SHAKE128 which would n= ot
produce an acceptable result.

 

Commen= t 6: The specification of output lengths of the 2 SHAKEs is in Sections 4.1= .1 and 4.1.2.  Adding a sentence " See Sections 4.1.1 and 4.1.2 f= or specification of a required output length for each use of SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA."

 



* Signatures - Para #3 - you refer to section 3 for OIDs, but they are not<= br> there for public keys.

 

Commen= t 7: Adding this "

Confor= ming CA implementations MUST specify the algorithms explicitly
   by using the OIDs specified in Secti= on 3 when encoding  public keys for RSASSA-PSS and ECDS= A with SHAKE signatures in certificates and CRLs." as the fi= rst paragraph in Section 4.2 "Public keys". 



* IANA Considerations is incorrect and MUST be updated

 

 

Commen= t 8: IANA Considerations is incorrect and will be updated.

 


* Why is there no reference to deterministic ECDSA signatures in the
document.

 

Commen= t 9: Deterministic ECDSA has a different signing function because of the wa= y k is generated. The working group has not adopted this option yet. Verifi= cation is the same. 

 

[JLS] If you want to= say that it is a different signature algorithm that is fine.  I=92ll = call and raise.  It should be that it is required that ECDSA w/ SHAKE = implements deterministic ECDSA and MUST NOT use a random generator for k.



* The ASN.1 module is absent and needs to be instantiated.  Even doing= so
with TBD is sufficient for now.

 

Commen= t 10: Yes. 

The AS= N.1 module is absent and needs to be instantiated. 

 


Are you ok with the proposed resolutions ?

 

Regards,

Quynh. 


--_000_DM6PR09MB2746F924F18EA9C1A105FBACF3020DM6PR09MB2746namp_-- From nobody Mon Sep 10 07:56:54 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3791130E9F for ; Mon, 10 Sep 2018 07:56:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.7 X-Spam-Level: X-Spam-Status: No, score=-0.7 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YPdeQBKIKLDY for ; Mon, 10 Sep 2018 07:56:49 -0700 (PDT) Received: from smtpscan3.dandomain.dk (smtpscan3.dandomain.dk [194.150.112.163]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 958B5130DFD for ; Mon, 10 Sep 2018 07:56:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id AF4D14F2D for ; Mon, 10 Sep 2018 16:56:46 +0200 (CEST) Received: from smtpscan3.dandomain.dk ([127.0.0.1]) by localhost (smtpscan3.dandomain.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UAv1O9qEVR-H for ; Mon, 10 Sep 2018 16:56:45 +0200 (CEST) Received: from mail03.dandomain.dk (mail03.dandomain.dk [194.150.112.203]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id E45E1CE1FB for ; Mon, 10 Sep 2018 16:56:45 +0200 (CEST) Received: from Morten ([62.44.134.2]) by mail03.dandomain.dk (DanDomain Mailserver) with ASMTP id 3201809101656442409; Mon, 10 Sep 2018 16:56:44 +0200 From: "Erik Andersen" To: "Directory list" , "LAMPS" Date: Mon, 10 Sep 2018 16:56:42 +0200 Message-ID: <005a01d44916$7c9cb560$75d62020$@x500.eu> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_005B_01D44927.402621A0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNw== Content-Language: en-gb Archived-At: Subject: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 14:56:52 -0000 This is a multipart message in MIME format. ------=_NextPart_000_005B_01D44927.402621A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Folk, In ITU-T we have plans to allow for double signatures using the SIGNED parametrized data type defined in X.509 to cope with situation as described in the internet draft: "Multiple Public-Key Algorithm X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)" We suggest to enhance the SIGNED data type as shown below: SIGNED{ToBeSigned} ::= SEQUENCE { COMPONENTS OF SIGNATURE, ..., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL, altSignature BIT STRING OPTIONAL } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature ABSENT } ) We are open to comments. We know that IETF is not a heavy user of this data type. We have no intention to use this extended data type for certificates and CRLs. For your information, SIGNATURE is defined as: SIGNATURE ::= SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ... } Erik ------=_NextPart_000_005B_01D44927.402621A0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Folk,

 

In ITU-T we have plans to allow for double signatures = using the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: “Multiple Public-Key = Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)”

 

We suggest = to enhance the SIGNED data type as shown below:

 

SIGNED{ToBeSigned} = ::=3D SEQUENCE {

  COMPONENTS OF = SIGNATURE,

  ...,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 

We have no intention to use this extended data type = for certificates and CRLs.

 

For your = information, SIGNATURE is defined as:

 

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ... = }

 

Erik

------=_NextPart_000_005B_01D44927.402621A0-- From nobody Mon Sep 10 08:53:11 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E9B3124BE5 for ; Mon, 10 Sep 2018 08:53:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_BL=0.001, RCVD_IN_MSPIKE_L5=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rf2PujrPurn8 for ; Mon, 10 Sep 2018 08:53:06 -0700 (PDT) Received: from pdx1-sub0-mail-a20.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3CC2128B14 for ; Mon, 10 Sep 2018 08:53:06 -0700 (PDT) Received: from pdx1-sub0-mail-a20.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a20.g.dreamhost.com (Postfix) with ESMTP id 1AEFA7EAEC for ; Mon, 10 Sep 2018 08:53:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :references:in-reply-to:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=WEeb144oOYmGlBULyLNRGu3FgKM=; b= sRiScfnEX2fdVytMP4eGVyp5sXtY4PNWyQqpqFxuwydENM7aLrTvM3YorsO3imSi vwjnsKzfmi2wrP/bMiGaJ8x0KXzfroer5hdFx2vcnPTRV5UwIccQOW7olHJA4Ry3 ybAWvdhSFru5STR89jNV0oQz4HhNsIa80OKDEh/2cPU= Received: from mail-it0-f54.google.com (mail-it0-f54.google.com [209.85.214.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by pdx1-sub0-mail-a20.g.dreamhost.com (Postfix) with ESMTPSA id 0342181034 for ; Mon, 10 Sep 2018 08:53:05 -0700 (PDT) Received: by mail-it0-f54.google.com with SMTP id e14-v6so30162185itf.1 for ; Mon, 10 Sep 2018 08:53:04 -0700 (PDT) X-Gm-Message-State: APzg51BIVR407lIaKddp4kUCrwEBUEnwrrxh6t72tdishEYYsTu7VO0s 79i8NXsK3nJHlY8wnQDAPC2DFmtSHdheB+dDF0c= X-Google-Smtp-Source: ANB0VdYs2BSdp1DuJDkOetpKLwuId3q5yfhi9Jg/SXNbrdg1zzKlbGquKxAVelHT6azqN598f7SVBPXSeHlH0A36RPo= X-Received: by 2002:a02:89fc:: with SMTP id e57-v6mr19305932jak.44.1536594784398; Mon, 10 Sep 2018 08:53:04 -0700 (PDT) MIME-Version: 1.0 References: <005a01d44916$7c9cb560$75d62020$@x500.eu> In-Reply-To: <005a01d44916$7c9cb560$75d62020$@x500.eu> From: Ryan Sleevi Date: Mon, 10 Sep 2018 11:52:53 -0400 X-Gmail-Original-Message-ID: Message-ID: To: era@x500.eu Cc: x500standard@freelists.org, SPASM Content-Type: multipart/alternative; boundary="00000000000049b5940575865a02" Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 15:53:09 -0000 --00000000000049b5940575865a02 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen wrote: > Hi Folk, > > > > In ITU-T we have plans to allow for double signatures using the SIGNED > parametrized data type defined in X.509 to cope with situation as describ= ed > in the internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 Certi= ficates > (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D > > > > We suggest to enhance the SIGNED data type as shown below: > > > > *SIGNED{ToBeSigned} ::=3D SEQUENCE {* > > * COMPONENTS OF SIGNATURE,* > > * ...,* > > * altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} > OPTIONAL,* > > * altSignature BIT STRING OPTIONAL * > > *} (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature > PRESENT } |* > > * WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature > ABSENT } )* > > > > We are open to comments. We know that IETF is not a heavy user of this > data type. > > > > We have no intention to use this extended data type for certificates and > CRLs. > > > > For your information, SIGNATURE is defined as: > > > > *SIGNATURE ::=3D SEQUENCE {* > > * algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}},* > > * signature BIT STRING,* > > * ... }* > >From the discussions in London (101), there were a number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt - that fundamentally questioned that approach. Has the ITU-T addressed or resolved those concerns? Are they not applicable for some reason specific to ITU-T? > --00000000000049b5940575865a02 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> wrote:

Hi F= olk,

=C2=A0

In ITU-T we have plans to = allow for double signatures using the SIGNED parametrized data type defined= in X.509 to cope with situation as described in the internet draft: =E2=80= =9CMultiple Public-Key Algorithm X.509 Certificates (draft-truskovsky-lamps= -pq-hybrid-x509-01)=E2=80=9D

=C2=A0

We suggest to enhance the SIGNED d= ata type as shown below:

=C2= =A0

SIGNED{ToBeSigned} ::=3D SEQUENCE {

=C2=A0 COMPONENTS OF SIGNATURE,=

=C2=A0 ...,

= =C2=A0 altAlgorithmIdentifier=C2=A0 AlgorithmIdentifier{{SupportedAlgorithm= s}} OPTIONAL,

=C2=A0= altSignature=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 BIT STRING OPTIONAL=C2=A0

=C2=A0=C2=A0} (WITH COMPONENTS= {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } |

=C2=A0=C2=A0=C2=A0=C2=A0= WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT,=C2=A0 altSignature AB= SENT } )

=C2=A0=

We are open to comments. We know = that IETF is not a heavy user of this data type.

=C2=A0

We have no in= tention to use this extended data type for certificates and CRLs.=

=C2=A0

For your information, SIGNATURE is defined as:

=C2=A0

SIGNATURE ::=3D SEQ= UENCE {

=C2=A0 algorithmIden= tifier=C2=A0 AlgorithmIdentifier{{SupportedAlgorithms}},

=C2=A0 signature=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 BIT STRING,

=C2=A0 ... }


From the discussions in London (101), there were a number o= f challenges identified during the discussion -=C2=A0https://d= atatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt - th= at fundamentally questioned that approach.

Has the= ITU-T addressed or resolved those concerns? Are they not applicable for so= me reason specific to ITU-T?=C2=A0

=
--00000000000049b5940575865a02-- From nobody Mon Sep 10 10:07:15 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4F31128D0C for ; Mon, 10 Sep 2018 10:07:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jcjv0e1-gmk6 for ; Mon, 10 Sep 2018 10:07:10 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E1FA130ED9 for ; Mon, 10 Sep 2018 10:07:10 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 10 Sep 2018 10:03:05 -0700 From: Jim Schaad To: 'Ryan Sleevi' , CC: 'SPASM' , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> In-Reply-To: Date: Mon, 10 Sep 2018 10:06:58 -0700 Message-ID: <004a01d44928$b1500d40$13f027c0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_004B_01D448EE.04F33110" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwpkFUDHA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 17:07:13 -0000 ------=_NextPart_000_004B_01D448EE.04F33110 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm On Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM ; x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ..., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_004B_01D448EE.04F33110 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.=C2=A0 While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.=C2=A0 The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 8:53 AM
To: = era@x500.eu
Cc: SPASM <spasm@ietf.org>; = x500standard@freelists.org
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  = COMPONENTS OF SIGNATURE,

  = ...,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = ... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_004B_01D448EE.04F33110-- From nobody Mon Sep 10 10:18:04 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C68D130EEC for ; Mon, 10 Sep 2018 10:18:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zTfz-53ixBHd for ; Mon, 10 Sep 2018 10:18:01 -0700 (PDT) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5CB4130EE1 for ; Mon, 10 Sep 2018 10:18:00 -0700 (PDT) Received: by mail-qt0-x230.google.com with SMTP id n6-v6so25036585qtl.4 for ; Mon, 10 Sep 2018 10:18:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:thread-index:content-language; bh=bOr3JI8xoE57C2W3T5nrQkDgfRzsaOKBvVSPRHyc38g=; b=AVYbLqlTo0ekq4vBUP5iDoLBt0TPmlYR7WznXJILcCRZ/NeYaBihdF+YUYCbxr7/8D zAIFzz85Eql1iNMX9oasxjcYhNRfb1DSEGsKQORj3LjvmO9REAAv/KvXG9lCX3ISdSwc hcJk2muoSps9fCiLj1Il4ImuKE/GR9CBH10V2eIDayt5eha/6qGHesvQcyLMxLAV4+dG z2nFz0mhMjNQ/XDeWhW2ZxSBnz4y2ABa1US/nv7iylrCbFZ5b+LdkQGtq/YjKMcQG6jo pq6JtNBq93en3FwHiaf0xV6QRnRY5mRxDNhDqEjjPr7wABD/dnVbdBUDwdXwO/Lsi9ev 5Q9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:references:in-reply-to:subject:date :message-id:mime-version:thread-index:content-language; bh=bOr3JI8xoE57C2W3T5nrQkDgfRzsaOKBvVSPRHyc38g=; b=pAnH0h0iDMvYeSuf92ARsFsDdJ5Oc12ktGTKgwtORaLIYdNqRpXJ+I14NRtdH/lhna iF5LS0CeZMSeLu9BB6DnB5jIPiqywzXFfOGpIKWzCvpvj4aXrw663uLYio/eEm3M7XeZ yD3r0LY/oYczToz6oWmafTRLNYOl1cZIlJW7kpC75EKb0HrNqSN4aujL/V5QKQS1KlS9 G0RS9T6K5qglw1wlqbAg6puRynlbRuUMhaASqEa2ewkjY1Y/7ZZGyarQirkE1bdaLIJM HqtE8fy4DECOWilmdGtMCyRVh7CszmAd97a0uulOryWjOjw7nrbIuUjS82+KEQzJijGP +a5Q== X-Gm-Message-State: APzg51DgYsffsGUxURIGQhZtsDq0Yf86BWHZjOnWZq+PjzNSA2plrvp4 BlzSwFxUeb3XcWB0SDwod3QJFM8a X-Google-Smtp-Source: ANB0Vdb9mU9zRfDzClImAhTzbwK680/t4H/jOMNaFFcWXeN3GHWqZ4kqnFBGBxOwGgOoq3FjYMXyfg== X-Received: by 2002:ac8:3ac1:: with SMTP id x59-v6mr17054032qte.8.1536599880098; Mon, 10 Sep 2018 10:18:00 -0700 (PDT) Received: from SantoshBrain (pool-173-73-191-57.washdc.fios.verizon.net. [173.73.191.57]) by smtp.gmail.com with ESMTPSA id j129-v6sm10111454qke.56.2018.09.10.10.17.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 10 Sep 2018 10:17:59 -0700 (PDT) From: "Santosh Chokhani" To: "'Jim Schaad'" , "'Ryan Sleevi'" , Cc: "'SPASM'" , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> In-Reply-To: <004a01d44928$b1500d40$13f027c0$@augustcellars.com> Date: Mon, 10 Sep 2018 13:17:59 -0400 Message-ID: <04ce01d4492a$39400ce0$abc026a0$@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_04CF_01D44908.B230B6D0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxmmKXti4A== Content-Language: en-us Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 17:18:03 -0000 This is a multipart message in MIME format. ------=_NextPart_000_04CF_01D44908.B230B6D0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' ; era@x500.eu Cc: 'SPASM' ; x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ...., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, .... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_04CF_01D44908.B230B6D0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Why not let algorithm identifier dictate the = number of signatures and their syntax?

 

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 1:07 PM
To: = 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: = 'SPASM' <spasm@ietf.org>; = x500standard@freelists.org
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  COMPONENTS OF SIGNATURE,

  ....,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  .... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_04CF_01D44908.B230B6D0-- From nobody Mon Sep 10 12:00:59 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC8B3130F75 for ; Mon, 10 Sep 2018 12:00:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tIT7E3i5ZLZg for ; Mon, 10 Sep 2018 12:00:45 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A791A1310AD for ; Mon, 10 Sep 2018 12:00:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=20324; q=dns/txt; s=iport; t=1536606041; x=1537815641; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=H6mgj0M0UpphvneM6tcNJAUs9InDi7D/WfHAEmU7vWU=; b=JWIITLrnoHfeKbpIHmUx4DNII/Pajdb+nfweex+gHxlLBwp5wSJBdpW+ NvBNgiUULSEPt1ZmXoCq1GgOKIiNIKoMaI+tmyPEOMDrWzAf1q7qcmn2Z 8QhculZ7Y8MPQqX+sgmo+MZPfhGKgM6NJVDRMpoGd5o1qhCyL7UVCUEqj 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A4AgDNvpZb/5RdJa1cGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYJXSC9lfygKg2iUMoINkQGHLQslhEcCF4NjITgUAQIBAQI?= =?us-ascii?q?BAQJtHAyFOAEBAQEDIwpMEAIBCA4DBAEBKAMCAgIwFAkIAQEEDgUIE4MHgR1?= =?us-ascii?q?kD6UEgS6ELgGFTwWKZReBQT+BEYMTgxsCA4E7SRCCS4JXAo0yjlYJAoY3iUE?= =?us-ascii?q?fjnCLOogsAhEUgSU0IYFVcBWDJ4sVhT5vAYx4gR0BAQ?= X-IronPort-AV: E=Sophos;i="5.53,356,1531785600"; d="scan'208,217";a="232365228" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Sep 2018 19:00:40 +0000 Received: from XCH-RCD-009.cisco.com (xch-rcd-009.cisco.com [173.37.102.19]) by rcdn-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id w8AJ0eIG004616 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 10 Sep 2018 19:00:40 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-RCD-009.cisco.com (173.37.102.19) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 10 Sep 2018 14:00:39 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Mon, 10 Sep 2018 14:00:39 -0500 From: "Panos Kampanakis (pkampana)" To: Jim Schaad CC: "'SPASM'" , "x500standard@freelists.org" , "era@x500.eu" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwANHy+AAAKWWwAABp1lsA== Date: Mon, 10 Sep 2018 19:00:39 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> In-Reply-To: <004a01d44928$b1500d40$13f027c0$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.82.179.87] Content-Type: multipart/alternative; boundary="_000_a94fb26ed9aa46738bea040919bf96b7XCHALN010ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.19, xch-rcd-009.cisco.com X-Outbound-Node: rcdn-core-12.cisco.com Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 19:00:57 -0000 --_000_a94fb26ed9aa46738bea040919bf96b7XCHALN010ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmltLA0KSSB0aGluayB0aGUgaXNzdWVzIGJyb3VnaHQgdXAgYWJvdXQgZHJhZnQtdHJ1c2tv dnNreS1sYW1wcy1wcS1oeWJyaWQteDUwOSBhcmUgcHJldHR5IHNpbWlsYXIgZXZlbiBpZiB0aGUg YWx0U2lnIGluZm9ybWF0aW9uIGlzIGFkZGVkIGluIHRoZSBzaWduZWQgZGF0YSB0eXBlIGlmIHRo YXQgc2lnIGNvZXhpc3RzIHdpdGggdGhlIHRyYWRpdGlvbmFsIHNpZy4gQ2FuIHlvdSBlbGFib3Jh dGUgd2h5IGFyZSB5b3Ugc2F5aW5nIG90aGVyd2lzZT8NClBhbm9zDQoNCkZyb206IFNwYXNtIFtt YWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEppbSBTY2hhYWQNClNl bnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcgUE0NClRvOiAnUnlhbiBTbGVldmkn IDxyeWFuLWlldGZAc2xlZXZpLmNvbT47IGVyYUB4NTAwLmV1DQpDYzogJ1NQQVNNJyA8c3Bhc21A aWV0Zi5vcmc+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZw0KU3ViamVjdDogUmU6IFtsYW1w c10gRG91YmxlIHNpZ25hdHVyZXMNCg0KUnlhbiwNCg0KVGhlIGRpc2N1c3Npb24gaW4gTG9uZG9u IGRlYWx0IHdpdGggYSBjb21wbGV0ZWx5IGRpZmZlcmVudCBwcm9wb3NhbCB0aGFuIHRoaXMgb25l LiAgV2hpbGUgSSB0aGluayB0aGVyZSBhcmUgcHJvYmxlbXMgd2l0aCB0aGlzIHRoYXQgbmVlZCB0 byBiZSBkZWFsdCB3aXRoIHRoZXkgYXJlIG1vc3RseSBub3QgdGhlIHNhbWUgc2V0Lg0KDQpFcmlr LA0KDQpXaHkgaXMgdGhpcyBjb25zaWRlcmVkIHRvIGJlIGEgcHJlZmVycmVkIHNvbHV0aW9uIHRv IGRlZmluaW5nIGEgbmV3IHNpZ25hdHVyZSBhbGdvcml0aG0gd2hpY2ggY29udGFpbnMgYXMgdGhl IHBhcmFtZXRlciB0aGUgc2VxdWVuY2Ugb2YgYWxnb3JpdGhtIGlkZW50aWZpZXJzIGFuZCBhcyB0 aGUgc2lnbmF0dXJlIHZhbHVlIGEgc2VxdWVuY2Ugb2Ygc2lnbmF0dXJlIHZhbHVlcy4gIFRoZSBw cm9ibGVtIHdpdGgganVzdCBkZWZpbmluZyB0aGUgZXh0ZW5zaW9uIHRvIFNJR05FRCBpcyB0aGF0 IG9uZSBuZWVkcyB0byBtYWtlIHN1cmUgdGhhdCB0aGUgc2V0IG9mIHNpZ25hdHVyZSBhbGdvcml0 aG1zIGFuZCBwYXJhbWV0ZXJzIGFyZSBhbHNvIHBhcnQgb2YgdGhlIGRhdGEgdG8gYmUgc2lnbmVk IGFuZCBJIGFtIG5vdCBzZWVpbmcgdGhhdCBoaWdobGlnaHRlZCBoZXJlLg0KDQpKaW0NCg0KDQpG cm9tOiBTcGFzbSA8c3Bhc20tYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86c3Bhc20tYm91bmNlc0Bp ZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBSeWFuIFNsZWV2aQ0KU2VudDogTW9uZGF5LCBTZXB0ZW1i ZXIgMTAsIDIwMTggODo1MyBBTQ0KVG86IGVyYUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4N CkNjOiBTUEFTTSA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBz dGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4N ClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCg0KT24gTW9uLCBTZXAg MTAsIDIwMTggYXQgMTA6NTYgQU0gRXJpayBBbmRlcnNlbiA8ZXJhQHg1MDAuZXU8bWFpbHRvOmVy YUB4NTAwLmV1Pj4gd3JvdGU6DQpIaSBGb2xrLA0KDQpJbiBJVFUtVCB3ZSBoYXZlIHBsYW5zIHRv IGFsbG93IGZvciBkb3VibGUgc2lnbmF0dXJlcyB1c2luZyB0aGUgU0lHTkVEIHBhcmFtZXRyaXpl ZCBkYXRhIHR5cGUgZGVmaW5lZCBpbiBYLjUwOSB0byBjb3BlIHdpdGggc2l0dWF0aW9uIGFzIGRl c2NyaWJlZCBpbiB0aGUgaW50ZXJuZXQgZHJhZnQ6IOKAnE11bHRpcGxlIFB1YmxpYy1LZXkgQWxn b3JpdGhtIFguNTA5IENlcnRpZmljYXRlcyAoZHJhZnQtdHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJy aWQteDUwOS0wMSnigJ0NCg0KV2Ugc3VnZ2VzdCB0byBlbmhhbmNlIHRoZSBTSUdORUQgZGF0YSB0 eXBlIGFzIHNob3duIGJlbG93Og0KDQpTSUdORUR7VG9CZVNpZ25lZH0gOjo9IFNFUVVFTkNFIHsN CiAgQ09NUE9ORU5UUyBPRiBTSUdOQVRVUkUsDQogIC4uLi4sDQogIGFsdEFsZ29yaXRobUlkZW50 aWZpZXIgIEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSBPUFRJT05B TCwNCiAgYWx0U2lnbmF0dXJlICAgICAgICAgICAgQklUIFNUUklORyBPUFRJT05BTA0KICB9IChX SVRIIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRpZmllciBQUkVTRU5ULCBhbHRT aWduYXR1cmUgUFJFU0VOVCB9IHwNCiAgICAgV0lUSCBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29y aXRobUlkZW50aWZpZXIgQUJTRU5ULCAgYWx0U2lnbmF0dXJlIEFCU0VOVCB9ICkNCg0KV2UgYXJl IG9wZW4gdG8gY29tbWVudHMuIFdlIGtub3cgdGhhdCBJRVRGIGlzIG5vdCBhIGhlYXZ5IHVzZXIg b2YgdGhpcyBkYXRhIHR5cGUuDQoNCldlIGhhdmUgbm8gaW50ZW50aW9uIHRvIHVzZSB0aGlzIGV4 dGVuZGVkIGRhdGEgdHlwZSBmb3IgY2VydGlmaWNhdGVzIGFuZCBDUkxzLg0KDQpGb3IgeW91ciBp bmZvcm1hdGlvbiwgU0lHTkFUVVJFIGlzIGRlZmluZWQgYXM6DQoNClNJR05BVFVSRSA6Oj0gU0VR VUVOQ0Ugew0KICBhbGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBw b3J0ZWRBbGdvcml0aG1zfX0sDQogIHNpZ25hdHVyZSAgICAgICAgICAgIEJJVCBTVFJJTkcsDQog IC4uLi4gfQ0KDQpGcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSksIHRoZXJlIHdl cmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUgZGlzY3Vzc2lv biAtIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21p bnV0ZXMtMTAxLWxhbXBzLTAxLnR4dCAtIHRoYXQgZnVuZGFtZW50YWxseSBxdWVzdGlvbmVkIHRo YXQgYXBwcm9hY2guDQoNCkhhcyB0aGUgSVRVLVQgYWRkcmVzc2VkIG9yIHJlc29sdmVkIHRob3Nl IGNvbmNlcm5zPyBBcmUgdGhleSBub3QgYXBwbGljYWJsZSBmb3Igc29tZSByZWFzb24gc3BlY2lm aWMgdG8gSVRVLVQ/DQo= --_000_a94fb26ed9aa46738bea040919bf96b7XCHALN010ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIg Lz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVs YXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8 L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJF Ti1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlv bjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkhp IEppbSwgPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkkgdGhpbmsgdGhlIGlzc3VlcyBicm91Z2h0IHVwIGFib3V0 IGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDkgYXJlIHByZXR0eSBzaW1pbGFy IGV2ZW4gaWYgdGhlIGFsdFNpZyBpbmZvcm1hdGlvbiBpcyBhZGRlZCBpbiB0aGUgc2lnbmVkIGRh dGEgdHlwZSBpZiB0aGF0IHNpZyBjb2V4aXN0cyB3aXRoIHRoZSB0cmFkaXRpb25hbCBzaWcuIENh bg0KIHlvdSBlbGFib3JhdGUgd2h5IGFyZSB5b3Ugc2F5aW5nIG90aGVyd2lzZT88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+UGFub3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAx LjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PkZyb206PC9iPiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIDxiPk9uIEJl aGFsZiBPZg0KPC9iPkppbSBTY2hhYWQ8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBTZXB0ZW1i ZXIgMTAsIDIwMTggMTowNyBQTTxicj4NCjxiPlRvOjwvYj4gJ1J5YW4gU2xlZXZpJyAmbHQ7cnlh bi1pZXRmQHNsZWV2aS5jb20mZ3Q7OyBlcmFAeDUwMC5ldTxicj4NCjxiPkNjOjwvYj4gJ1NQQVNN JyAmbHQ7c3Bhc21AaWV0Zi5vcmcmZ3Q7OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Unlhbiw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhlIGRpc2N1c3Npb24gaW4gTG9uZG9uIGRlYWx0IHdpdGggYSBjb21wbGV0ZWx5IGRpZmZl cmVudCBwcm9wb3NhbCB0aGFuIHRoaXMgb25lLiZuYnNwOyBXaGlsZSBJIHRoaW5rIHRoZXJlIGFy ZSBwcm9ibGVtcyB3aXRoIHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUg bW9zdGx5IG5vdCB0aGUgc2FtZSBzZXQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkVyaWssPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPldoeSBpcyB0aGlzIGNvbnNpZGVyZWQgdG8gYmUgYSBwcmVm ZXJyZWQgc29sdXRpb24gdG8gZGVmaW5pbmcgYSBuZXcgc2lnbmF0dXJlIGFsZ29yaXRobSB3aGlj aCBjb250YWlucyBhcyB0aGUgcGFyYW1ldGVyIHRoZSBzZXF1ZW5jZSBvZiBhbGdvcml0aG0gaWRl bnRpZmllcnMgYW5kIGFzIHRoZSBzaWduYXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1 cmUgdmFsdWVzLiZuYnNwOyBUaGUgcHJvYmxlbSB3aXRoIGp1c3QNCiBkZWZpbmluZyB0aGUgZXh0 ZW5zaW9uIHRvIFNJR05FRCBpcyB0aGF0IG9uZSBuZWVkcyB0byBtYWtlIHN1cmUgdGhhdCB0aGUg c2V0IG9mIHNpZ25hdHVyZSBhbGdvcml0aG1zIGFuZCBwYXJhbWV0ZXJzIGFyZSBhbHNvIHBhcnQg b2YgdGhlIGRhdGEgdG8gYmUgc2lnbmVkIGFuZCBJIGFtIG5vdCBzZWVpbmcgdGhhdCBoaWdobGln aHRlZCBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KaW08bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZy b206PC9iPiBTcGFzbSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmci PnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5SeWFu IFNsZWV2aTxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4OjUz IEFNPGJyPg0KPGI+VG86PC9iPiA8YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPmVyYUB4NTAw LmV1PC9hPjxicj4NCjxiPkNjOjwvYj4gU1BBU00gJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBp ZXRmLm9yZyI+c3Bhc21AaWV0Zi5vcmc8L2E+Jmd0OzsgPGEgaHJlZj0ibWFpbHRvOng1MDBzdGFu ZGFyZEBmcmVlbGlzdHMub3JnIj4NCng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9hPjxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIFNlcCAxMCwgMjAxOCBhdCAxMDo1NiBBTSBFcmlrIEFu ZGVyc2VuICZsdDs8YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPmVyYUB4NTAwLmV1PC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIGxhbmc9IkRBIj5IaSBGb2xrLDwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5n PSJEQSI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5JbiBJVFUtVCB3 ZSBoYXZlIHBsYW5zIHRvIGFsbG93IGZvciBkb3VibGUgc2lnbmF0dXJlcyB1c2luZyB0aGUgU0lH TkVEIHBhcmFtZXRyaXplZCBkYXRhIHR5cGUgZGVmaW5lZCBpbiBYLjUwOSB0byBjb3BlIHdpdGgg c2l0dWF0aW9uIGFzIGRlc2NyaWJlZCBpbiB0aGUgaW50ZXJuZXQNCiBkcmFmdDog4oCcTXVsdGlw bGUgUHVibGljLUtleSBBbGdvcml0aG0gWC41MDkgQ2VydGlmaWNhdGVzIChkcmFmdC10cnVza292 c2t5LWxhbXBzLXBxLWh5YnJpZC14NTA5LTAxKeKAnTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPldl IHN1Z2dlc3QgdG8gZW5oYW5jZSB0aGUgU0lHTkVEIGRhdGEgdHlwZSBhcyBzaG93biBiZWxvdzo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9 IkVOLUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5TSUdORUR7VG9CZVNpZ25lZH0gOjo9IFNFUVVF TkNFIHs8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsg Q09NUE9ORU5UUyBPRiBTSUdOQVRVUkUsPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7IC4uLi48c3BhbiBzdHlsZT0iY29sb3I6I0MwMDAwMCI+LDwvc3Bh bj48L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOnJlZCI+ Jm5ic3A7IGFsdEFsZ29yaXRobUlkZW50aWZpZXImbmJzcDsgQWxnb3JpdGhtSWRlbnRpZmllcnt7 U3VwcG9ydGVkQWxnb3JpdGhtc319IE9QVElPTkFMLDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4t R0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6cmVkIj4mbmJzcDsgYWx0U2lnbmF0dXJlJm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IEJJVCBTVFJJTkcgT1BUSU9OQUwmbmJzcDsNCjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0Ii PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6cmVkIj4mbmJzcDsmbmJzcDs8L3NwYW4+PC9iPjxiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij59PHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+DQogKFdJVEggQ09NUE9O RU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQ UkVTRU5UIH0gfDwvc3Bhbj48L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7O2NvbG9yOnJlZCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFdJVEggQ09NUE9ORU5UUyB7 Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIEFCU0VOVCwmbmJzcDsgYWx0U2lnbmF0dXJlIEFC U0VOVCB9ICk8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDs8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBhcmUgb3BlbiB0byBj b21tZW50cy4gV2Uga25vdyB0aGF0IElFVEYgaXMgbm90IGEgaGVhdnkgdXNlciBvZiB0aGlzIGRh dGEgdHlwZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBoYXZlIG5vIGludGVudGlvbiB0byB1 c2UgdGhpcyBleHRlbmRlZCBkYXRhIHR5cGUgZm9yIGNlcnRpZmljYXRlcyBhbmQgQ1JMcy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVO LUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIGxhbmc9IkVOLUdCIj5Gb3IgeW91ciBpbmZvcm1hdGlvbiwgU0lHTkFUVVJFIGlzIGRl ZmluZWQgYXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+U0lHTkFUVVJFIDo6PSBTRVFV RU5DRSB7PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7 IGFsZ29yaXRobUlkZW50aWZpZXImbmJzcDsgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVk QWxnb3JpdGhtc319LDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyBzaWduYXR1cmUmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQklUIFNUUklORyw8L3NwYW4+PC9iPjxzcGFuIGxh bmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgLi4uLiB9PC9zcGFuPjwvYj48c3BhbiBs YW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZyb20gdGhlIGRpc2N1c3Np b25zIGluIExvbmRvbiAoMTAxKSwgdGhlcmUgd2VyZSBhIG51bWJlciBvZiBjaGFsbGVuZ2VzIGlk ZW50aWZpZWQgZHVyaW5nIHRoZSBkaXNjdXNzaW9uIC0mbmJzcDs8YSBocmVmPSJodHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTAxL21hdGVyaWFscy9taW51dGVzLTEwMS1sYW1w cy0wMS50eHQiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJp YWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4dDwvYT4NCiAtIHRoYXQgZnVuZGFtZW50YWxseSBx dWVzdGlvbmVkIHRoYXQgYXBwcm9hY2guPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhhcyB0aGUgSVRVLVQgYWRkcmVzc2VkIG9yIHJlc29sdmVk IHRob3NlIGNvbmNlcm5zPyBBcmUgdGhleSBub3QgYXBwbGljYWJsZSBmb3Igc29tZSByZWFzb24g c3BlY2lmaWMgdG8gSVRVLVQ/Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_a94fb26ed9aa46738bea040919bf96b7XCHALN010ciscocom_-- From nobody Mon Sep 10 12:42:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D3E5130F5C for ; Mon, 10 Sep 2018 12:42:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ENtOLWfoYDwt for ; Mon, 10 Sep 2018 12:42:18 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8649130F59 for ; Mon, 10 Sep 2018 12:42:17 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 10 Sep 2018 12:38:13 -0700 From: Jim Schaad To: "'Panos Kampanakis (pkampana)'" CC: 'SPASM' , , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> In-Reply-To: Date: Mon, 10 Sep 2018 12:42:07 -0700 Message-ID: <006501d4493e$5dc09850$1941c8f0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0066_01D44903.B163BC20" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkB+phnTaYZzkSQ Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Sep 2018 19:42:21 -0000 ------=_NextPart_000_0066_01D44903.B163BC20 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable First =E2=80=93 they say that this is not going to done in certificates = which means that all of the questions dealing with certificates have = gone out the window. =20 Second =E2=80=93 the issue around semantics of multiple parallel = signatures is always dependent on the application being used. This is = how things are defined for CMS which has the same issue (RFC 5752). = Since this is not for certificates, that is not immediately a problem = for the IETF. If one did the define a signature algorithm, one could = even encode much of these semantic rules into the algorithm definition = either directly in the OID or as parameters. =20 Third =E2=80=93 processing issues for this are quite simple. The = version that was presented in LAMPs had a lot of problems in doing the = order of signing and building the resulting item as there needed to be = at least two different passes of encoding which needed to do the same = things. That is not an issue here as the exact same bytes are signed by = all of the signature algorithms in question. =20 Jim =20 =20 From: Panos Kampanakis (pkampana) =20 Sent: Monday, September 10, 2018 12:01 PM To: Jim Schaad Cc: 'SPASM' ; x500standard@freelists.org; era@x500.eu Subject: RE: [lamps] Double signatures =20 Hi Jim,=20 I think the issues brought up about = draft-truskovsky-lamps-pq-hybrid-x509 are pretty similar even if the = altSig information is added in the signed data type if that sig coexists = with the traditional sig. Can you elaborate why are you saying = otherwise? Panos =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' >; = era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ...., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, .... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_0066_01D44903.B163BC20 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

First = =E2=80=93 they say that this is not going to done in certificates which = means that all of the questions dealing with certificates =C2=A0have = gone out the window.

 

Second = =E2=80=93 the issue around semantics of multiple parallel signatures is = always dependent on the application being used.=C2=A0 =C2=A0This is how = things are defined for CMS which has the same issue (RFC 5752).=C2=A0 = Since this is not for certificates, that is not immediately a problem = for the IETF.=C2=A0 If one did the define a signature algorithm, one = could even encode much of these semantic rules into the algorithm = definition either directly in the OID or as parameters.

 

Third = =E2=80=93 processing issues for this are quite simple.=C2=A0 The version = that was presented in LAMPs had a lot of problems in doing the order of = signing and building the resulting item as there needed to be at least = two different passes of encoding which needed to do the same = things.=C2=A0 That is not an issue here as the exact same bytes are = signed by all of the signature algorithms in question.

 

Jim

 

 

From: Panos = Kampanakis (pkampana) <pkampana@cisco.com>
Sent: = Monday, September 10, 2018 12:01 PM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: 'SPASM' = <spasm@ietf.org>; x500standard@freelists.org; = era@x500.eu
Subject: RE: [lamps] Double = signatures

 

Hi Jim,

I think the issues = brought up about draft-truskovsky-lamps-pq-hybrid-x509 are pretty = similar even if the altSig information is added in the signed data type = if that sig coexists with the traditional sig. Can you elaborate why are = you saying otherwise?

Panos

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Jim Schaad
Sent: Monday, September 10, = 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  = COMPONENTS OF SIGNATURE,

  = ....,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = .... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_0066_01D44903.B163BC20-- From nobody Tue Sep 11 00:01:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 745FC130E39 for ; Tue, 11 Sep 2018 00:01:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZsimIWmuirKz for ; Tue, 11 Sep 2018 00:01:18 -0700 (PDT) Received: from smtpscan3.dandomain.dk (smtpscan3.dandomain.dk [194.150.112.163]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B33E1277CC for ; Tue, 11 Sep 2018 00:01:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 1C8D3932E7 for ; Tue, 11 Sep 2018 09:01:16 +0200 (CEST) Received: from smtpscan3.dandomain.dk ([127.0.0.1]) by localhost (smtpscan3.dandomain.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NdyKnS42P4t2 for ; Tue, 11 Sep 2018 09:01:14 +0200 (CEST) Received: from mail04.dandomain.dk (mail04.dandomain.dk [194.150.112.204]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 3F875B8BD0 for ; Tue, 11 Sep 2018 09:01:14 +0200 (CEST) Received: from Morten ([62.44.134.2]) by mail04.dandomain.dk (DanDomain Mailserver) with ASMTP id 4201809110901111953; Tue, 11 Sep 2018 09:01:11 +0200 From: "Erik Andersen" To: "'SPASM'" , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> In-Reply-To: <004a01d44928$b1500d40$13f027c0$@augustcellars.com> Date: Tue, 11 Sep 2018 09:01:10 +0200 Message-ID: <003101d4499d$388e9af0$a9abd0d0$@x500.eu> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0032_01D449AD.FC176AF0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxmmKmJB4A== Content-Language: en-gb Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 07:01:21 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0032_01D449AD.FC176AF0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable HI Jim, =20 You have a good point here that also been bothering me for the last = couple of days. I am still trying to find a way. =20 Erik =20 Fra: Jim Schaad [mailto:ietf@augustcellars.com]=20 Sendt: 10 September 2018 19:07 Til: 'Ryan Sleevi' ; era@x500.eu Cc: 'SPASM' ; x500standard@freelists.org Emne: RE: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ..., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_0032_01D449AD.FC176AF0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

HI = Jim,

 

You have a good point = here that also been bothering me for the last couple of days. I am still = trying to find a way.

 

Erik=

 

Fra: Jim Schaad = [mailto:ietf@augustcellars.com]
Sendt: 10 September 2018 = 19:07
Til: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; = x500standard@freelists.org
Emne: RE: [lamps] Double = signatures

 

Ryan,

 

The discussion in London dealt with a completely different = proposal than this one.  While I think there are problems with this = that need to be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this considered to be a preferred solution to = defining a new signature algorithm which contains as the parameter the = sequence of algorithm identifiers and as the signature value a sequence = of signature values.  The problem with just defining the extension = to SIGNED is that one needs to make sure that the set of signature = algorithms and parameters are also part of the data to be signed and I = am not seeing that highlighted here.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM = Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

 <= /o:p>

We suggest = to enhance the SIGNED data type as shown below:

 <= /o:p>

SIGNED{ToBeSigned} = ::=3D SEQUENCE {

  COMPONENTS OF = SIGNATURE,

  ...,

  = altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 <= /o:p>

We have no = intention to use this extended data type for certificates and = CRLs.

 <= /o:p>

For your = information, SIGNATURE is defined as:

 <= /o:p>

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ... = }

 

From the discussions in London = (101), there were a number of challenges identified during the = discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved = those concerns? Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_0032_01D449AD.FC176AF0-- From nobody Tue Sep 11 00:10:24 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D2E0130E53 for ; Tue, 11 Sep 2018 00:10:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-LrUHyYvobR for ; Tue, 11 Sep 2018 00:10:19 -0700 (PDT) Received: from smtpscan3.dandomain.dk (smtpscan3.dandomain.dk [194.150.112.163]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 133DA130E42 for ; Tue, 11 Sep 2018 00:10:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id CA8C2C59BE for ; Tue, 11 Sep 2018 09:10:17 +0200 (CEST) Received: from smtpscan3.dandomain.dk ([127.0.0.1]) by localhost (smtpscan3.dandomain.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QZOynnq4xJBu for ; Tue, 11 Sep 2018 09:10:16 +0200 (CEST) Received: from mail04.dandomain.dk (mail04.dandomain.dk [194.150.112.204]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id C6699C59AD for ; Tue, 11 Sep 2018 09:10:16 +0200 (CEST) Received: from Morten ([62.44.134.2]) by mail04.dandomain.dk (DanDomain Mailserver) with ASMTP id 4201809110910145706; Tue, 11 Sep 2018 09:10:14 +0200 From: "Erik Andersen" To: "'SPASM'" , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> In-Reply-To: <04ce01d4492a$39400ce0$abc026a0$@gmail.com> Date: Tue, 11 Sep 2018 09:10:14 +0200 Message-ID: <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0037_01D449AF.401724B0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthKYXUpIQ Content-Language: en-gb Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 07:10:22 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0037_01D449AF.401724B0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' ; 'Ryan Sleevi' = ; era@x500.eu Cc: 'SPASM' ; x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' >; = era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ...., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, .... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_0037_01D449AF.401724B0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi = Santosh,

 

You have proposed = something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik=

 

Fra: Spasm = [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 19:18
Til: 'Jim = Schaad' <ietf@augustcellars.com>; 'Ryan Sleevi' = <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' = <spasm@ietf.org>; x500standard@freelists.org
Emne: Re: = [lamps] Double signatures

 

Why not let algorithm identifier = dictate the number of signatures and their = syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Jim Schaad
Sent: Monday, September 10, = 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The discussion in London dealt with a completely different = proposal than this one.  While I think there are problems with this = that need to be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this considered to be a preferred solution to = defining a new signature algorithm which contains as the parameter the = sequence of algorithm identifiers and as the signature value a sequence = of signature values.  The problem with just defining the extension = to SIGNED is that one needs to make sure that the set of signature = algorithms and parameters are also part of the data to be signed and I = am not seeing that highlighted here.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM = Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

 <= /o:p>

We suggest = to enhance the SIGNED data type as shown below:

 <= /o:p>

SIGNED{ToBeSigned} = ::=3D SEQUENCE {

  COMPONENTS OF = SIGNATURE,

  ....,

  = altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 <= /o:p>

We have no = intention to use this extended data type for certificates and = CRLs.

 <= /o:p>

For your = information, SIGNATURE is defined as:

 <= /o:p>

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  .... = }

 

From the discussions in London = (101), there were a number of challenges identified during the = discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved = those concerns? Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_0037_01D449AF.401724B0-- From nobody Tue Sep 11 07:02:51 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B7C6130DDB for ; Tue, 11 Sep 2018 07:02:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qt3wqIY0YNE9 for ; Tue, 11 Sep 2018 07:02:44 -0700 (PDT) Received: from mail1.bemta23.messagelabs.com (mail1.bemta23.messagelabs.com [67.219.246.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C047130DC6 for ; Tue, 11 Sep 2018 07:02:44 -0700 (PDT) Received: from [67.219.246.196] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-3.bemta.az-c.us-east-1.aws.symcld.net id C0/E4-30461-30BC79B5; Tue, 11 Sep 2018 14:02:43 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFLsWRWlGSWpSXmKPExsVyXm+xmC7T6en RBgv3iVlM6v7MaDHvWrLF+uuTWR2YPU5dlPJYsuQnk8fhie+YApijWDPzkvIrElgz1p1+wlbw 4xJjxdnbp1gaGNcdZuxi5OJgEehhlnh44QGYIyQwgUli4pvjUM4DRol/89qZuhg5OdgEDCSu7 T0OZosIlEr8WPmEGcQWFlCT2DP7MDtEXF1i7sIFbBC2n8S7M3uABnEArVCVOLYlDCTMKxArse fKKaj5HUwShzYuBpvDKWAmsXXLVrA5jAJiEt9PrQHbxSwgLnHryXwwW0JAROLhxdNsELaoxMv H/1gh6mMk5n4+BBWXk2h4uYkFwpaVuDS/G2yZhMB+doljZ/9BFelKfJg6lRnC9pVY93gbE0TR JUaJBw2djBAJLYnm9d1Qm3Mk9vxrgmqIkdi59w8TzLZVvQ9ZIJq3Mku8n30PqllGonHiDqjVH WwSd58/BesQEkiRmLIK5FaQxARmiVu3b7BNYNSaheTXWUA5ZoEFjBLrvt5ingUONUGJkzOfsE AURUncej+fFcLWkpi69hVUXFti2cLXQPUcQLamxLHLSqjC7EC2jcSWFIioosSU7ofsELaZRNu 5j2wLGLlXMZomFWWmZ5TkJmbm6BoaGOgaGhrpmulaGuslVukm65UW66YmFpfoGuollhfrFVfm Juek6OWllmxiBKbKlAK22B2MG7vSDzFKcjApifJuzp0eLcSXlJ9SmZFYnBFfVJqTWnyIUYaDQ 0mCN/sUUE6wKDU9tSItMweYtGHSEhw8SiK8KSBp3uKCxNzizHSI1ClGe45zKydNYuY4cm8KkL wAJv+8nzqJWYglLz8vVUqcVxWkTQCkLaM0D24oLMtcYpSVEuZlZGBgEOIpSC3KzSxBlX/FKM7 BqCQMcRtPZl4J3O5XQGcxAZ217vwUkLNKEhFSUg2MDekr5qzYMjd7y+dHzAV1VhN/n2KurSqq z5s35fDbxd1akba2MWu6l39qjV9SUjXvOOPThBrrv1lO7DPnaIh6WYmvYfP9X+95bsq6pdUfp ts+cH0pdlTaIiWUb0Lffg4GuVnVa5mnr/yrUFb1jD0/yvn59oQNrh0CPD43wtacZzzHON8652 aDEktxRqKhFnNRcSIAjtSnJy0EAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-35.tower-404.messagelabs.com!1536674561!166705!1 X-Originating-IP: [207.46.163.22] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.14.24; banners=-,-,- X-VirusChecked: Checked Received: (qmail 8444 invoked from network); 11 Sep 2018 14:02:42 -0000 Received: from mail-dm3nam03lp0022.outbound.protection.outlook.com (HELO NAM03-DM3-obe.outbound.protection.outlook.com) (207.46.163.22) by server-35.tower-404.messagelabs.com with AES256-SHA256 encrypted SMTP; 11 Sep 2018 14:02:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=l2TMvXUtx9cSVEEJjPBNRtGkElWm9iqaBef3AVEii54=; b=QcZtZwMVAn9/XDho5NKz9/UHWU8QoFVWCk9Sv68gHirlpB/ie0CnBmpviAqJ2zz9IvnR+4NfAhU8igLEDaExNp5dL3HWydRuThYjceK8l8d1H9kZKXqv6SJHwNM5cRwOf/Sz6WFXcXvbtHThVzrtQx3HRc8pgi6EbqqEwuHqwZY= Received: from BN6PR14MB1106.namprd14.prod.outlook.com (10.173.161.15) by BN6PR14MB1106.namprd14.prod.outlook.com (10.173.161.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1122.15; Tue, 11 Sep 2018 14:02:37 +0000 Received: from BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::b48d:a35d:7a5e:abf9]) by BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::b48d:a35d:7a5e:abf9%11]) with mapi id 15.20.1122.020; Tue, 11 Sep 2018 14:02:37 +0000 From: Tim Hollebeek To: Erik Andersen , 'SPASM' , "x500standard@freelists.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwACpPmAAAKWXAAAAGJ/gAAdEOUAAA5DsMA= Date: Tue, 11 Sep 2018 14:02:37 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> In-Reply-To: <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [8.46.76.26] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN6PR14MB1106; 6:ydtMLc1iQuGvHPTlmuHoFWYA/QUl6PjOt/Zz1DVVSZh7pCCsZ/hLdLtGwtHzsflpXtXyTzSDQOl0a0fBZcxQICF5j2SyTXLUDMj+IIpxmDhWxauYhllk85qMCT85wUDvZt4JSsw/ZcGvjMikXJ2oqirWa/DoC7WUBnNCksT1gzluUS3c60hkTZP6x0Q0sejjX+k0gXeDkF/7DSh/ohW5RDxx3iVtvX5LNsh+yh4q9vZhK3Y+5mHc/k0cYxDO5ccMd4lQr6j9M8R14CbdRCAKL0919JgumXCUP2C0Hf34BLhxGVd8m8tzuy9QqF61dLVXaBmEcqYWOCTAxSr83KL91zSxz9/NObIAnL17tFdBcW9X0Wu1diLJXZnRlZv2BOCearcj1ZMGqe6Dzg8QabTzyiZNcOifn8wgevFqccNoRNL3lxiPsCZssTAjG4/Km7p4XSryRS6hQdIZXcsuq8PLuQ==; 5:+2sYBHIF2lclngy4ZRUUrTRy4DQV2JlzWXxd3uMEXCmGhYWxIRzvdakWdSFrXd6OTdKFi6fq8jMa2iU2do6fQJGQZ/JL/4h759YltcgkXvbKW3ls9CqbJcS5Ru75/jYtJri1rtRlcoPTakwJ4boHwonZx36exxtqO7PW7VEiWYQ=; 7:5JGeTKlOHcLkwzFHQTZAR/NuM0XN6S7kNGdc7igIip7n8I1i1T3HWcb58Xn6qfPEZRqHOMu63LItWXu/0FuVCjESKqi7+Tvcm5u7CBWA1IdFdBTETvLfZSLa03njizUDLwteipofw4pcrZXzbKAm03SIPQ7cutxCbEGpUSPSF77lljYKG47F+gjb9F3b40XlOSfLgapOWypxrjH+30Erw045B4/wsyxPeqHaRcd3faxJmaAF9HdmtLr8YscnU2Mn x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: abc6016e-e245-41d9-dd28-08d617ef3b17 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:BN6PR14MB1106; x-ms-traffictypediagnostic: BN6PR14MB1106: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(120809045254105)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(3231311)(944501410)(52105095)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(201708071742011)(7699050); SRVR:BN6PR14MB1106; BCL:0; PCL:0; RULEID:; SRVR:BN6PR14MB1106; x-forefront-prvs: 0792DBEAD0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(346002)(396003)(136003)(366004)(376002)(189003)(199004)(55016002)(8936002)(6306002)(54896002)(105586002)(9686003)(106356001)(6436002)(561944003)(66066001)(2906002)(236005)(6246003)(8676002)(81156014)(81166006)(33656002)(53936002)(93886005)(14454004)(606006)(5250100002)(478600001)(966005)(97736004)(2501003)(68736007)(25786009)(86362001)(3846002)(74316002)(790700001)(316002)(110136005)(6116002)(256004)(7736002)(7696005)(99286004)(26005)(186003)(76176011)(44832011)(486006)(11346002)(2900100001)(446003)(102836004)(476003)(6506007)(53546011)(229853002)(99936001)(5660300001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR14MB1106; H:BN6PR14MB1106.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: g6U3/8MXR/PC1XGRFl7rjrAiZD+g4au5P84L55ZzBJ1jrb/4a50dztdr8mn37G3l3Ob3OkPZLECBhVjkzwpctk46gwfzVJsQBXK2lahtTYSkS99yTAyGuQ7X/XuhJapkc9PmE7HaZOr29nus9s80rXqZvVQd6AFgAAEj3yhQoWG0Y4uWD2FjfahOVuYZhW7Jrt3mEsScmCzkLqNPl5U4znEIYhGKx+CzXh2ngy5zO9S/avyG2bG5Qdl44Y0x3bLtdBAGtJ08kkaLNYWBBcXfAIAcsjdHkLq3i26SXbt0Ca5+TXXyOlCbARpx6yK9K+nEid2TEQcme0APUkCvxOOQjVWbnWHf/bk2vidLLklSgGc= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_03B3_01D449B6.831935D0" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: abc6016e-e245-41d9-dd28-08d617ef3b17 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Sep 2018 14:02:37.3744 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR14MB1106 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 14:02:49 -0000 ------=_NextPart_000_03B3_01D449B6.831935D0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_03B4_01D449B6.831935D0" ------=_NextPart_001_03B4_01D449B6.831935D0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm On Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' ; x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' >; 'Ryan Sleevi' >; era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' >; = era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ...., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, .... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_001_03B4_01D449B6.831935D0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?

 

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 

I=E2=80=99m not really looking forward to trying to = allocate or manage O(N_c x N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From: Spasm = <spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 3:10 = AM
To: 'SPASM' <spasm@ietf.org>; = x500standard@freelists.org
Subject: Re: [lamps] Double = signatures

 

Hi Santosh,

 

You have = proposed something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org]= P=C3=A5 vegne af Santosh Chokhani
Sendt: 10 September = 2018 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; = 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Emne: Re: [lamps] Double = signatures

 

Why not let algorithm identifier dictate the = number of signatures and their syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Jim Schaad
Sent: Monday, September 10, = 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  = COMPONENTS OF SIGNATURE,

  = ....,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = .... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_001_03B4_01D449B6.831935D0-- ------=_NextPart_000_03B3_01D449B6.831935D0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwOTExMTQwMjEzWjAvBgkqhkiG9w0BCQQxIgQgCc3XamtLJDBsMu3dnfXcwVlUu6qp brVAtnQaKiQpi7QwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBACJYdDZFckAivE2xyytKpMuX3UritxumfxhyhlZFSBJX3i4ll00g0l0rgMFXpebYxq8o5lzA s2sg6VxKOUX4yXxsa9RSOC4KAXSs2/J8bq6bDjEDl2KKfKj+lUrKTpl1OjsyOen1rmQ4CAQzph4a v8MORkiLI2Wof5wwlafASbAWC1686+VgTYgO0bhWMaOudx97QrsdK0ta6zcC1lLMAWQsfPYcSyeY eV67ib9y7CzTv3JF4uk1c8cvXGo5KhiwBmZCKMCtg45s5wPeIFacPpAGtNLE5nWxCRI8FSdR9KFM WsanoabRl+bMwhIkOX92091R64dvHicK2n/KoOrxSOAAAAAAAAA= ------=_NextPart_000_03B3_01D449B6.831935D0-- From nobody Tue Sep 11 07:29:04 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5995D130DDB for ; Tue, 11 Sep 2018 07:29:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fMu5LNWU4Cc3 for ; Tue, 11 Sep 2018 07:29:00 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 395B9130DDA for ; Tue, 11 Sep 2018 07:29:00 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id h138-v6so16852352qke.8 for ; Tue, 11 Sep 2018 07:29:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:references:in-reply-to:subject:date:message-id:mime-version :thread-index:content-language; bh=WLJ5cIJpjN84e5u3exfpZQwRZh4KwYW0EsH8CQ6U6gg=; b=M3ciA1ndUwwbDPxXLuDlOAP1pg4evRK1dp0/QA3eU4cncJqTA79eIqxN3uB3mWq0Sw tttDgLIGq2/lHEJ+HJN709d0e0ECmvgcKfnc86YWOXA3hTIwqHJShduI4B/NN7/NuWqq VdIWRzUuBbmzAxMQMMxf9MK6HWlcGwRO4shBuXc6+epfjsKvefLjWW6rb1WZ4zyXsRGh Cn8nx8701NbOgQjvTLAJYmS9Q7T23ko1wUEQX+rZfNqOv268jjiXAHUC5SV6+wa2WOhQ Up5SZnJnuB6UV+GrP7CZUpch69J/8ozwnCUGzTERRBes1S0uh/6ywZ2LCF3pO7yvIANI ZCAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:references:in-reply-to:subject:date :message-id:mime-version:thread-index:content-language; bh=WLJ5cIJpjN84e5u3exfpZQwRZh4KwYW0EsH8CQ6U6gg=; b=DdkbG12qDngtU/E7Krd6Y9zw2qZk6gMHSlim3xMUUPaxaUfi8TbrMPTFJcfyqas7Ft jMJBTAanDVTOpAN9bSqtH2jrMbj/d/IA7SJZdvmZlz47yj1l/7TVNdOi6A+YEvr54CKh NTJi5K5MC2MftN7IWXB440FYLnIUvl/0ASeuZksOjLnfh6D2kH6BKy7KmwC1H1yJIA68 siL5n9Mth+uOb0CBs5IymtjAQfaHnYE4n5W//zkRw3ACKAhEhGcfeZHZjBtxcsPUtT+V 2EnOK1l87UCFCJVv7NXbnoKJx+eitvPonaO54TEHR51/s2ahzhEomu0nNECAgOrvzjau SJPQ== X-Gm-Message-State: APzg51CK8fe3imtH0nqrXIkIYELEinuzuJ8/AM1tTdrpCawh71qsVd+P 5iw1cz7D8UKEdO0+l+rRS/g= X-Google-Smtp-Source: ANB0VdZ/4c1YYWHtFbsMFVuGmtNdlPZbSdpzL2tDk+YSbrCgjewlpjgEOntsfMSJ5gVu0WzA+rJFuQ== X-Received: by 2002:a37:a05:: with SMTP id 5-v6mr19112559qkk.325.1536676139270; Tue, 11 Sep 2018 07:28:59 -0700 (PDT) Received: from SantoshBrain (pool-173-73-191-57.washdc.fios.verizon.net. [173.73.191.57]) by smtp.gmail.com with ESMTPSA id o23-v6sm11860097qtb.23.2018.09.11.07.28.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Sep 2018 07:28:58 -0700 (PDT) From: "Santosh Chokhani" To: "'Tim Hollebeek'" , "'Erik Andersen'" , "'SPASM'" , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> In-Reply-To: Date: Tue, 11 Sep 2018 10:28:58 -0400 Message-ID: <087c01d449db$c78e6350$56ab29f0$@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_087D_01D449BA.407EBF20" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQyl7KP6AA== Content-Language: en-us Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 14:29:03 -0000 This is a multipart message in MIME format. ------=_NextPart_000_087D_01D449BA.407EBF20 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen ; 'SPASM' ; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm > On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' >; 'Ryan Sleevi' >; era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' >; = era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ....., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ..... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_000_087D_01D449BA.407EBF20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks Tim.

 

There are ways to = accommodate your concern.

 

One way to handle this = is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and = define the relying party rules in terms of its ability to process one or = all ALG IDs.

 

Another way to do this = is not every combination needs to be covered and the user community = defines its own =C2=A0Alg ID Xi which maps to a SEQUENCE of ALG = IDs.

 

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 10:03 = AM
To: Erik Andersen <era@x500.eu>; 'SPASM' = <spasm@ietf.org>; x500standard@freelists.org
Subject: = Re: [lamps] Double signatures

 

Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?

 

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 

I=E2=80=99m not really looking forward to trying to = allocate or manage O(N_c x N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Erik Andersen
Sent: Tuesday, September 11, = 2018 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Hi Santosh,

 

You have = proposed something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org]= P=C3=A5 vegne af Santosh Chokhani
Sendt: 10 September = 2018 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; = 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Emne: Re: [lamps] Double = signatures

 

Why not let algorithm identifier dictate the = number of signatures and their syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Jim Schaad
Sent: Monday, September 10, = 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  COMPONENTS OF SIGNATURE,

  .....,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ..... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_000_087D_01D449BA.407EBF20-- From nobody Tue Sep 11 07:38:43 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31AFE130DDB for ; Tue, 11 Sep 2018 07:38:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v10o-E6_5dsr for ; Tue, 11 Sep 2018 07:38:28 -0700 (PDT) Received: from mail1.bemta24.messagelabs.com (mail1.bemta24.messagelabs.com [67.219.250.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0687C1292AD for ; Tue, 11 Sep 2018 07:38:27 -0700 (PDT) Received: from [67.219.250.196] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-4.bemta.az-b.us-west-2.aws.symcld.net id 55/48-28473-263D79B5; Tue, 11 Sep 2018 14:38:26 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA1WTf0wTZxjHee+u19PReZa6Pnawac3UdV5DK5I mW+L+cam/0H8VzDzoSZu1hfTKqPqHMOem1m1YWsESZolEAqmKRN1wMLeWYGSLWyHDZUEigtlA QQkxxA1/3N1bnP5xbz7P831+vnmPIbUtagMjBPyCz8u7jfRC6s9ll7QcP1BXmPvostUWCs4gW 7LpO8L27WCJ7fzNWtWHlL0vZbB3Rm+p7c3Njwl78vgUsZ3aqXJ5i8sCu1XOI/Wry1NPUSBedw ZVoblxdBQtZCj2GAldPZOKoWVrCDiUbKKxcRvB/dZpyVjA0GwuDHZfI2RBx7YguNt9VBGy2JX Q1ZBUy6xjV0FjU4zGXAijtQ1IZop9B+oaPlP8GnYXdB48ROAOX5IQCg5RsrCAtcGRuWGlEGLf gNm+OCEzyerhr7FTCgOrg5HULzTmJTA++lSF44ugcSaR9r8FVeMdFOYc6D8VVHYD9qoahv9tT wdx8DASITFvhQt97SQO6kdQNVmPsGCCJw/+SbMbTiZi6nnu+rlHNd+t7asRCidfIuHclf/SQj ZUH/8+3TpCQ/toTGmnZR0QbkvQWKghoXfiD3UNMkVf2hVzDMHhmbyocmmL4frJMQr7d8KJ0/d VmE0QOTuR9r8HZ5rukVHESPwu9A4YX3WrJf4ALjqwdzmEgyNqzPnwxY1pOoZea0O2Yp+r1On3 8C43Z8nN5SwWK2dZK31568z8Pq7YXCFylYLo56xmvlI0i3s9JW6H2Sv4O5D0RB3ln0srT7WUJ tBShjAu0TT/Wleofb24zLHXyYvOj30VbkFMoGyGMYLmSUrSFvuEUiGwx+WW3vm8DEymUacZk2 WNWM57RFcplvrQemaqNRQimZ7hsHT+rpxzDyIhUkt5y7yCQa+5K6excpqzwvui6Pz/049yDFk alJGRoc0sF3wel/9VfQLpGWTM0qzpl6pkurz+F70npLEIaaxzv4Xlsfz8/5KhCvXO5ng6w58+ O6a17nckl/7o3Rw+gc7n3dozvIL+u/pAfcmOwE8qPju4aJc1Xvnwwo3rQ9Y7BRuJLTXVBwcyu E+67xXUFuZnvt9hnF0+mL1Jl+qIfzO5rZFeX3tRv4HZ+vabvqGij3Sn1+nHFum/XjHXGjUVOT uD0fjuH6ZR/gZ7Qb2REp28xUT6RP45q9ioeToEAAA= X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-14.tower-344.messagelabs.com!1536676704!4618063!1 X-Originating-IP: [216.32.181.18] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 30164 invoked from network); 11 Sep 2018 14:38:25 -0000 Received: from mail-co1nam03lp0018.outbound.protection.outlook.com (HELO NAM03-CO1-obe.outbound.protection.outlook.com) (216.32.181.18) by server-14.tower-344.messagelabs.com with AES256-SHA256 encrypted SMTP; 11 Sep 2018 14:38:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mJtPgBAf+H7wJ5xhomhJJqMaEkrmETf8j3BP/N34r34=; b=e+NF4BqVLLym7ebbpQXhDOXXZCMkF7QEYtrnL0m+SIp7RtUSBz2ujOvjv4glbeXD37jjxtP23fx3qUx1UclFXVXh5t5zx2BJhZK+hUu7FZ4bRua+kZa/RWbPXeJbXOXuitL9YaUeXnqvL1UUj0Ivyn2YqRKoo3Id2gmDeJGNSmQ= Received: from BN6PR14MB1106.namprd14.prod.outlook.com (10.173.161.15) by BN6PR14MB1588.namprd14.prod.outlook.com (10.172.149.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1122.17; Tue, 11 Sep 2018 14:38:22 +0000 Received: from BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::b48d:a35d:7a5e:abf9]) by BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::b48d:a35d:7a5e:abf9%11]) with mapi id 15.20.1122.020; Tue, 11 Sep 2018 14:38:22 +0000 From: Tim Hollebeek To: Santosh Chokhani , 'Erik Andersen' , 'SPASM' , "x500standard@freelists.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwACpPmAAAKWXAAAAGJ/gAAdEOUAAA5DsMAAAQ7lAAAACX/A Date: Tue, 11 Sep 2018 14:38:22 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> In-Reply-To: <087c01d449db$c78e6350$56ab29f0$@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [8.46.76.26] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN6PR14MB1588; 6:OJbK+tO53u2S7yv4Lm3GEBA7Nw9VYSFXN9eOK9vwwhQ9ZDdi9Gw7RvOezeYIjcMVjNih3M+VXOAFtP2XVF1o4gH5XquoPxzYDCYNDJp4JdSs0eOJ2WvMl+bYphHfCwedfo4vXccMKyYO83+Z41C6VaECztbV6V89ytFJp2H2GXl4Ai3AHcvQJ92rH2xLrDzkA7p+1kWbhXJqLdrdkr4WEmh/rJwnPbQWCK4XHghTJEYQH4T5oDwvOxfzQfzfL/1TzHTl6zZ4NKoIohjMSJUABOrz7kW7nvXlQtGVkiBpRbj8B9qmJCoOxa+QZf7FdAzfwvdREdSzZ0fH1Nu7uG/JGRKOrT0pGjIwKw3UsANNdUIJWYJo1scuQXriLDHUtmOmxhfnHyxhOIAh2owQA5+oOPNG0GsguSorOA71cWyS4r27CH3l3VmFQFSVEm1Q23yjdi2PjM2Qn8/4mhg5Hr/6Hw==; 5:Tgw3NCZHhAWpOKCT7KBWjMy5F+CHoBEwaeJlLnRcSYX+iNLR568wM2GcEJDNZZGfRnLpp2Vhls7nSOANv6SIGgzhaegxjIqJveJ4a6HUCtUR05+96MTOndjg3jRFDc92nTnNcnNaqcZrnwfRVCGtZXuTql4CwoxEhHzK7Eocv8E=; 7:jkFI4zr1oRXKBZfCUAa1HBgTfuqkv00sil0S5wVaLkyZGBkD5xJLX/9gB/HTImv0KIVh5rgw98IpBLLlyb7NPcE/zLpi9TpvsBMg5IgxWpPXIc9ni8LNTrQWdpFPCuHMQvLXt46Nd1KY1buxPGqWQqEUnwhtHSfeMYT0s26TUxdPdUyCQtGXUBL2STq13e2hCV898ETfP63a562QnfWzCMrcmxoL0eaOWvoRHZjbC7ha0lQytSIIVyBgbyUzTu92 x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 786b2d2e-7f5c-41ac-24c3-08d617f43978 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:BN6PR14MB1588; x-ms-traffictypediagnostic: BN6PR14MB1588: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(120809045254105)(85827821059158)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231311)(944501410)(52105095)(10201501046)(3002001)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201708071742011)(7699050); SRVR:BN6PR14MB1588; BCL:0; PCL:0; RULEID:; SRVR:BN6PR14MB1588; x-forefront-prvs: 0792DBEAD0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(136003)(376002)(396003)(346002)(39860400002)(199004)(189003)(39060400002)(446003)(81166006)(14454004)(81156014)(26005)(8676002)(93886005)(5250100002)(2501003)(25786009)(11346002)(8936002)(478600001)(476003)(7736002)(256004)(68736007)(3846002)(790700001)(966005)(6116002)(606006)(102836004)(6506007)(53546011)(2900100001)(9686003)(6306002)(86362001)(186003)(66066001)(53936002)(229853002)(6246003)(5660300001)(44832011)(97736004)(7696005)(6436002)(76176011)(236005)(54896002)(33656002)(486006)(561944003)(2906002)(316002)(105586002)(74316002)(106356001)(110136005)(99936001)(99286004)(55016002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR14MB1588; H:BN6PR14MB1106.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: rs0aCauBSPCzjuczxex1T56hto7hDQ1BWvU5MmHFuEIUXA/ZnI+PQvM12S6YgFG20v7I/w3fWvU/jTkg65YU+BJ7JUedcC3DqJkkZnmtySt2HcCxVenciwV2Et92E7sK0Tx4PcjXh9fpNdZCTOE3UIQQQd2SjIWfpIjEVzCquHP+I2b3M2AcWrHxAYgebRqeWwHngwHTwE3JQjCKHSHUElaC2BGLQiw3hyzxduLkVQ687wbi4ET3mSBKE4qB4zucqr6r5kKNBq//dgMVjQ10e6o+R3K4UUgYdrPJ3JA3Yz364nCwbnIuaoZAylKNnhFH/Rk5x+RvzaUD+bTVOsXVGZS2yFRzASqbu6ANccA4ZTs= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_03CE_01D449BB.7FB83E40" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 786b2d2e-7f5c-41ac-24c3-08d617f43978 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Sep 2018 14:38:22.1256 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR14MB1588 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 14:38:34 -0000 ------=_NextPart_000_03CE_01D449BB.7FB83E40 Content-Type: multipart/alternative; boundary="----=_NextPart_001_03CF_01D449BB.7FB83E40" ------=_NextPart_001_03CF_01D449BB.7FB83E40 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani =20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek ; 'Erik Andersen' = ; 'SPASM' ; x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen >; 'SPASM' = >; x500standard@freelists.org = =20 Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm > On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' >; 'Ryan Sleevi' >; era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' >; = era@x500.eu =20 Cc: 'SPASM' >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm > On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu =20 Cc: SPASM >; = x500standard@freelists.org =20 Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ....., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL =20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ..... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 ------=_NextPart_001_03CF_01D449BB.7FB83E40 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Unfortunately, =E2=80=9Cnot every combination needs to = be covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees.=C2=A0 I would rather avoid all those = discussions and the unnecessary work they represent.

 

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.=C2=A0 For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 

-Tim

 

From: = Santosh Chokhani <santosh.chokhani@gmail.com>
Sent: = Tuesday, September 11, 2018 10:29 AM
To: Tim Hollebeek = <tim.hollebeek@digicert.com>; 'Erik Andersen' <era@x500.eu>; = 'SPASM' <spasm@ietf.org>; = x500standard@freelists.org
Subject: RE: [lamps] Double = signatures

 

Thanks Tim.

 

There are ways to = accommodate your concern.

 

One way to handle this = is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and = define the relying party rules in terms of its ability to process one or = all ALG IDs.

 

Another way to do this = is not every combination needs to be covered and the user community = defines its own  Alg ID Xi which maps to a SEQUENCE of ALG = IDs.

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Tim Hollebeek
Sent: Tuesday, September = 11, 2018 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?

 

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 

I=E2=80=99m not really looking forward to trying to = allocate or manage O(N_c x N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Erik Andersen
Sent: Tuesday, September 11, = 2018 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Hi Santosh,

 

You have = proposed something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org]= P=C3=A5 vegne af Santosh Chokhani
Sendt: 10 September = 2018 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; = 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Emne: Re: [lamps] Double = signatures

 

Why not let algorithm identifier dictate the = number of signatures and their syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Jim Schaad
Sent: Monday, September 10, = 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Ryan Sleevi
Sent: Monday, September 10, = 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org=
Subject: Re: [lamps] Double = signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using = the SIGNED parametrized data type defined in X.509 to cope with = situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  = COMPONENTS OF SIGNATURE,

  = .....,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know that IETF is not a heavy = user of this data type.

 

We have no intention to use this extended data type for = certificates and CRLs.

 

For your information, SIGNATURE is defined = as:

 

SIGNATURE ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = ..... }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-10= 1-lamps-01.txt - that fundamentally questioned that = approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

------=_NextPart_001_03CF_01D449BB.7FB83E40-- ------=_NextPart_000_03CE_01D449BB.7FB83E40 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwOTExMTQzNzU1WjAvBgkqhkiG9w0BCQQxIgQgAeiV7I0rBLxXXsg++qHuj2KCPCyw IGgE2KsEFFHFgLswgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAEe2elkK+btkFX1QKueHAldgcqkgburQxqNZX1oRjZ9XN4RgtNzrLpuuTONiIWnJcXWo98a2 DvILlxxS557RRwehJ1+qOVJ1PjCEj8KENAZEYuiSpJeCNpnDw0H05ZTaikhqtfcTOAcVCT7pjrEK Y/I+ZyG0uG17eHGQco8W/g3ZF/ph2C0luJWimPWyKfoxUl6TZGihQ25ZUHXiT4V+zOWT/BPcfJAr 2d2uE6RrBua+FLItjD/mmr7l2og8UIcvCfKm0iX+O7CL1+nPyJEqcozRU7Dth71Q96DbwG7E+vC7 /myYfZ4GCyxNwvR4VxMvxpfGcvy8HJWpdKa3CeWRUOsAAAAAAAA= ------=_NextPart_000_03CE_01D449BB.7FB83E40-- From nobody Tue Sep 11 13:45:50 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81FBE130EB5 for ; Tue, 11 Sep 2018 13:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cablelabs.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6VFCQfhnoIa5 for ; Tue, 11 Sep 2018 13:45:44 -0700 (PDT) Received: from NAM05-CO1-obe.outbound.protection.outlook.com (mail-co1nam05on0717.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe50::717]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BBD0130DE4 for ; Tue, 11 Sep 2018 13:45:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cablelabs.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BIGnciRCCfC2TTRcVu7d7sDEkF0igfR4TwAILBiwJPU=; b=Lxrz04FJDYGOeZ9htQ9YSfDXHWD2VzkCAe7w5K8T6rxgz5nW09VQHf3oNNG1WEDRqrwDhA7xU0GFev4UCYclSsa3zvthZuNJfcz25voPzA6HC4ojyCdbsld+T3BBM5B3nCl5wP24s539SqnaSQrC9sSfDnx/lq7Ce5ygTGvIyVo= Received: from SN6PR06MB3888.namprd06.prod.outlook.com (52.132.125.161) by SN6PR06MB4765.namprd06.prod.outlook.com (52.135.117.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1122.18; Tue, 11 Sep 2018 20:45:41 +0000 Received: from SN6PR06MB3888.namprd06.prod.outlook.com ([fe80::8d2f:1182:1ded:7ba0]) by SN6PR06MB3888.namprd06.prod.outlook.com ([fe80::8d2f:1182:1ded:7ba0%5]) with mapi id 15.20.1122.019; Tue, 11 Sep 2018 20:45:41 +0000 From: Max Pala To: Tim Hollebeek CC: Santosh Chokhani , Erik Andersen , SPASM , "x500standard@freelists.org" Thread-Topic: [lamps] Double signatures Thread-Index: AQHUShBhJkT9zFJJ00iNdlz6b4VNfA== Date: Tue, 11 Sep 2018 20:45:41 +0000 Message-ID: <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=M.Pala@cablelabs.com; x-originating-ip: [2607:fb90:a6e5:8560:acfd:b9c5:119a:6fe8] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; SN6PR06MB4765; 20:zmaD4sAxNGpkhFu4WkFiW+2NimYaE+mzTQL0ETsL5VOn/l+wn+VLcSq7F/smNfvY5E4cObeXz1qjoySwz6CJlEItSsfcPXwsWNi5TM/eq5svZGnbGrwjWYPxQ/rnSw3PB2f8iNMlCkNXvRpf86UCZpTHUCI8cdQGLn1T18HB2pE= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 742cd635-5c61-408e-515d-08d6182789ef x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:SN6PR06MB4765; x-ms-traffictypediagnostic: SN6PR06MB4765: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(120809045254105)(85827821059158); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231311)(944501410)(52105095)(10201501046)(3002001)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123558120)(20161123564045)(20161123562045)(201708071742011)(7699050); SRVR:SN6PR06MB4765; BCL:0; PCL:0; RULEID:; SRVR:SN6PR06MB4765; x-forefront-prvs: 0792DBEAD0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(39850400004)(136003)(376002)(346002)(396003)(189003)(53754006)(199004)(7736002)(229853002)(105586002)(5660300001)(6436002)(6486002)(14454004)(99286004)(25786009)(966005)(6246003)(4326008)(36756003)(2616005)(476003)(86362001)(14444005)(2906002)(11346002)(256004)(68736007)(97736004)(8676002)(83716003)(6916009)(446003)(46003)(486006)(5250100002)(54906003)(33656002)(561944003)(6506007)(82746002)(53546011)(81156014)(606006)(2900100001)(316002)(81166006)(6306002)(8936002)(6512007)(478600001)(236005)(72206003)(39060400002)(53936002)(76176011)(186003)(6116002)(93886005)(790700001)(102836004)(54896002)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR06MB4765; H:SN6PR06MB3888.namprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cablelabs.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: kAu2xsV6kRTkh3Y3XVn+uuuvKJGwlLYW4sXfCv2Q3qPyI7xykBrpbGO1MzmyZs3CPgiZeByEAWG9lj0UgcEhuYFXHg8yRHNqzgCleM1UJtVazSVRH2rilK1Tx9I8uCCzFoxoBm1FFjBJhx2Da2vObkVNqeJukISFf3HPy4kMaM1VkGVipu40IOwM5wSG/tZ5EelSrqxQk1O/ScPx6olubmaddEROg7lfyGVHWqeyjYm1xVFnWTaZzY8fcyk75XyxQPgzXgU3AvYJPTVV8bEL4IIbmtuT6VBkzi1ppjIxZVMyzlzy6S+BUwUqjE9YoEutTiow6DLenWTCMjHWdine2TPYEM3UX4Y2H64MwMSwQHo= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_9A1A8BFC967042EA8D8DB3DC2494CB95cablelabscom_" MIME-Version: 1.0 X-OriginatorOrg: cablelabs.com X-MS-Exchange-CrossTenant-Network-Message-Id: 742cd635-5c61-408e-515d-08d6182789ef X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Sep 2018 20:45:41.5036 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: ce4fbcd1-1d81-4af0-ad0b-2998c441e160 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR06MB4765 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 20:45:49 -0000 --_000_9A1A8BFC967042EA8D8DB3DC2494CB95cablelabscom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQWxsLA0KDQpJIGFtIHdvcmtpbmcgb24gYSBzaW1pbGFyIC0gYnV0IGRpZmZlcmVudCAtIHNv bHV0aW9uLCBpbiBwYXJ0aWN1bGFyIEkgc29sdmUgdGhlIGlzc3VlIG9mIChhKSBiZWluZyBhYmxl IHRvIGNvbWJpbmUgbW9yZSB0aGFuIG9uZSBwdWJsaWMga2V5LCAoYikgb25seSBvbmUgKGFjdHVh bGx5IHR3bykgT0lEcyByZXF1aXJlZCwgYW5kIChjKSBzaW1wbHkgdGhlIHByb2Nlc3NpbmcgYnkg cmUtdXRpbGl6aW5nIHRoZSBzYW1lIGRhdGEgc3RydWN0dXJlcyB3ZSBoYXZlIHRvZGF5Lg0KDQpJ IHBhcnRpY3VsYXIsIEkgZGVmaW5lIGEg4oCcY29tcG9zaXRlIHB1YmxpYyBrZXnigJ0gYW5kIOKA nGNvbXBvc2l0ZSBzaWduYXR1cmXigJ0uDQoNClRoZSBmaXJzdCBvbmUgZW5jb2RlcyBpbiB0aGUg a2V5IHZhbHVl4oCZcyBCSVRTVFJJTkcgdGhlIERFUiB2YWx1ZSBvZiB0aGUgU0VRVUVOQ0Ugb2Yg cHVibGljIGtleXMgKGVhY2ggb2Ygd2hpY2ggaXMgYSB0aGUgc3ViamVjdFB1YmxpY0tleUluZm8g c3RydWN0dXJlKSBhbmQgdXNlcyBhIHNwZWNpZmljIE9JRCB0aGF0IGlkZW50aWZpZXMgdGhlIHB1 YmxpYyBrZXkgdHlwZS4gVGhlIHBhcmFtZXRlcnMgb2YgdGhlIGNvbXBvc2l0ZUtleSBhbGdvcml0 aG0gY2FuIGJlIHVzZWQgdG8gZW5jb2RlIHRoZSBrZXlVc2FnZSBhbmQgdGhlIGV4dGVuZGVkS2V5 VXNhZ2UgZm9yIGVhY2ggb2YgdGhlIGtleXMgaW4gdGhlIGNvbXBvc2l0ZSBrZXkuDQoNClRoZSBz YW1lIGFwcHJvYWNoIGlzIHVzZWQgZm9yIHRoZSDigJxDb21wb3NpdGUgU2lnbmF0dXJl4oCdIGNh c2Ugd2hlcmUgdGhlIHZhbHVlIG9mIHRoZSBzaWduYXR1cmUgaXMgdGhlIERFUiByZXByZXNlbnRh dGlvbiBvZiB0aGUgU0VRVUVOQ0Ugb2Ygc2lnbmF0dXJlcyBtYWRlIHdpdGggZWFjaCBvZiB0aGUg a2V5cy4NCg0KQXMgc29vbiBhcyBJIGhhdmUgc29tZSBzcGFyZSB0aW1lLCBJIHdpbGwgc3VibWl0 IHRoZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUgZGlzY3Vzc2VkIGluIEJhbmdrb2s/DQoN ClRoaXMgc2ltcGxlIGlkZWEgYWxsb3dzIHVzIHRvIGhhdmUgYWxsIHRoZSBvdGhlciBwcm9jZWR1 cmVzIHJlbGF0ZWQgdG8gUEtJcyB3b3JrIC0gdGhpcyBtZWFucyB3ZSBjYW4gY29tYmluZSBFQ0Mg d2l0aCBSU0Egb3Igd2l0aCBhIFF1YW50dW0tUmVzaXN0YW50IGFsZ29yaXRobSAod2hlbiBmaW5h bGx5IGF2YWlsYWJsZSBhbmQgc3RhbmRhcmRpemVkKS4gQSBzdGVwIGZvcndhcmQgZm9yIHRoZSBk ZXBsb3ltZW50IG9mIGh5YnJpZC1QS0lzIHdoZXJlIG11bHRpcGxlIExhZ29zIGZvciBrZXlzIGNh biBiZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBkYXRhLCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRhLCBl dGMuLi4gd2UgcGxhbiB0byB1c2UgdGhpcyBpbiBvdXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHByb3Zp ZGUgYSB0cmFuc2l0aW9uYWwgcGF0aCBmb3IgcG9zdC1RdWFudHVtIHRyYW5zaXRpb24gYW5kIHRv IGZ1cnRoZXIgaW1wcm92ZSB0aGUgYWxnb3JpdGhtLWFnaWxpdHkgY2FwYWJpbGl0eSBvZiBQS0lz Lg0KDQpXaGF0IGRvIHlvdSB0aGluaz8NCg0KQ2hlZXJzLA0KTWF4DQoNCg0KDQoNCi0tLQ0KDQpD aGVlcnMsDQpNYXgNCk9uIFNlcCAxMSwgMjAxOCwgYXQgODozOCBBTSwgVGltIEhvbGxlYmVlayA8 dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208bWFpbHRvOnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQu Y29tPj4gd3JvdGU6DQoNClVuZm9ydHVuYXRlbHksIOKAnG5vdCBldmVyeSBjb21iaW5hdGlvbiBu ZWVkcyB0byBiZSBjb3ZlcmVk4oCdIGludHJvZHVjZXMgYSBsb3Qgb2YgcG9saXRpY3MgYXJvdW5k IGNob29zaW5nIHdoaWNoIGNvbWJpbmF0aW9ucyDigJxuZWVkIHRvIGJlIGNvdmVyZWTigJ0sIGEg c3ViamVjdCBvbiB3aGljaCBpbmV2aXRhYmx5IG5vdCBldmVyeW9uZSBhZ3JlZXMuICBJIHdvdWxk IHJhdGhlciBhdm9pZCBhbGwgdGhvc2UgZGlzY3Vzc2lvbnMgYW5kIHRoZSB1bm5lY2Vzc2FyeSB3 b3JrIHRoZXkgcmVwcmVzZW50Lg0KDQpJIHBlcnNvbmFsbHkgZG9u4oCZdCB0aGluayBhIHNpbmds ZSBBbGdJRCB3aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBpcyBhbiBpbXByb3Zl bWVudCBvdmVyIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcywgb3IgaXRzIG1vcmFsIGVxdWl2YWxlbnQu ICBGb3Igc2ltcGxlIGh5YnJpZCB1c2UgY2FzZXMsIHRoZXJlIGlzIGFsc28gYSBsb3Qgb2YgdmFs dWUgaW4gaGF2aW5nIHRoZSBjbGFzc2ljYWwgYWxnb3JpdGhtIElEIGJlaW5nIHRoZSBzYW1lIGFz IGl0IHVzdWFsbHkgaXMsIHRvIGFsbG93IGVhc2llciBpbnRlcm9wZXJhYmlsaXR5IHdpdGggb2xk ZXIgc3lzdGVtcyB0aGF0IGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgbmV3ZXIgYWxnb3JpdGhtcyAo YW5kIGNhbiBibGlzc2Z1bGx5IGlnbm9yZSB0aGVtKS4NCg0KLVRpbQ0KDQpGcm9tOiBTYW50b3No IENob2toYW5pIDxzYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbTxtYWlsdG86c2FudG9zaC5jaG9r aGFuaUBnbWFpbC5jb20+Pg0KU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDEwOjI5 IEFNDQpUbzogVGltIEhvbGxlYmVlayA8dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208bWFpbHRv OnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPj47ICdFcmlrIEFuZGVyc2VuJyA8ZXJhQHg1MDAu ZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pj47ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpz cGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0 YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSRTogW2xhbXBzXSBEb3VibGUgc2lnbmF0 dXJlcw0KDQpUaGFua3MgVGltLg0KDQpUaGVyZSBhcmUgd2F5cyB0byBhY2NvbW1vZGF0ZSB5b3Vy IGNvbmNlcm4uDQoNCk9uZSB3YXkgdG8gaGFuZGxlIHRoaXMgaXMgZGVmaW5pbmcgYSBzaW5nbGUg QWxnIElEIEEgd2hpY2ggaW1wbGllcyBhIFNFUVVFTkNFIG9mIEFMRyBJRHMgYW5kIGRlZmluZSB0 aGUgcmVseWluZyBwYXJ0eSBydWxlcyBpbiB0ZXJtcyBvZiBpdHMgYWJpbGl0eSB0byBwcm9jZXNz IG9uZSBvciBhbGwgQUxHIElEcy4NCg0KQW5vdGhlciB3YXkgdG8gZG8gdGhpcyBpcyBub3QgZXZl cnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZCBhbmQgdGhlIHVzZXIgY29tbXVuaXR5 IGRlZmluZXMgaXRzIG93biAgQWxnIElEIFhpIHdoaWNoIG1hcHMgdG8gYSBTRVFVRU5DRSBvZiBB TEcgSURzLg0KDQpGcm9tOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIE9u IEJlaGFsZiBPZiBUaW0gSG9sbGViZWVrDQpTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIw MTggMTA6MDMgQU0NClRvOiBFcmlrIEFuZGVyc2VuIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1 MDAuZXU+PjsgJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47 IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3Rz Lm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCkRvZXNu4oCZ dCB0aGUgY29tYmluYXRvcmljIGV4cGxvc2lvbiByZW5kZXIgdGhpcyBjb21wbGV0ZWx5IGltcHJh Y3RpY2FsPw0KDQpZb3UgbmVlZCBOX2MgeCBOX3BxIGFsZ29yaXRobSBpZGVudGlmaWVycyBqdXN0 IHRvIGhhbmRsZSB0aGUgc2ltcGxlIGh5YnJpZCB1c2UgY2FzZSB3aGVyZSBhIHNpbmdsZSBjbGFz c2ljYWwgYWxnb3JpdGhtIGlzIGJlaW5nIHVzZWQgaW4gY29uanVuY3Rpb24gd2l0aCBhIHNpbmds ZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtLg0KDQpBbmQgdGhlcmUgYXJlIHBlb3BsZSB3aG8gd2Fu dCB0byB1c2UgbXVsdGlwbGUgcG9zdC1xdWFudHVtIGFsZ29yaXRobXMgdG8gaGVkZ2UgYWdhaW5z dCBwb3RlbnRpYWwgeWV0IHRvIGJlIGRpc2NvdmVyZWQgd2Vha25lc3NlcyBpbiBwb3N0LXF1YW50 dW0gYWxnb3JpdGhtcy4NCg0KSeKAmW0gbm90IHJlYWxseSBsb29raW5nIGZvcndhcmQgdG8gdHJ5 aW5nIHRvIGFsbG9jYXRlIG9yIG1hbmFnZSBPKE5fYyB4IE5fcHFeMykgYWxnb3JpdGhtIGlkZW50 aWZpZXJz4oCmDQoNCi1UaW0NCg0KRnJvbTogU3Bhc20gPHNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8 bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgRXJpayBBbmRlcnNl bg0KU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDM6MTAgQU0NClRvOiAnU1BBU00n IDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZy ZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDog UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KSGkgU2FudG9zaCwNCg0KWW91IGhhdmUg cHJvcG9zZWQgc29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUuIEl0IHN0aWxsIHB1enpsaW5nIGlu IG15IGJyYWluLiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVpcmVzIHRoYXQgd2UgZGVmaW5lIGEg cGFydGljdWxhciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJhbWV0ZXIgdGhhdCBpbmNsdWRlcyB0 aGUgdGhpbmdzIHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkgdG8gYmUgYW5hbHlzZWQuDQoNCkVy aWsNCg0KRnJhOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIFDDpSB2ZWdu ZSBhZiBTYW50b3NoIENob2toYW5pDQpTZW5kdDogMTAgU2VwdGVtYmVyIDIwMTggMTk6MTgNClRp bDogJ0ppbSBTY2hhYWQnIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPG1haWx0bzppZXRmQGF1Z3Vz dGNlbGxhcnMuY29tPj47ICdSeWFuIFNsZWV2aScgPHJ5YW4taWV0ZkBzbGVldmkuY29tPG1haWx0 bzpyeWFuLWlldGZAc2xlZXZpLmNvbT4+OyBlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+ DQpDYzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1 MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9y Zz4NCkVtbmU6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCldoeSBub3QgbGV0IGFs Z29yaXRobSBpZGVudGlmaWVyIGRpY3RhdGUgdGhlIG51bWJlciBvZiBzaWduYXR1cmVzIGFuZCB0 aGVpciBzeW50YXg/DQoNCkZyb206IFNwYXNtIFttYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9y Z10gT24gQmVoYWxmIE9mIEppbSBTY2hhYWQNClNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAy MDE4IDE6MDcgUE0NClRvOiAnUnlhbiBTbGVldmknIDxyeWFuLWlldGZAc2xlZXZpLmNvbTxtYWls dG86cnlhbi1pZXRmQHNsZWV2aS5jb20+PjsgZXJhQHg1MDAuZXU8bWFpbHRvOmVyYUB4NTAwLmV1 Pg0KQ2M6ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4 NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5v cmc+DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpSeWFuLA0KDQpU aGUgZGlzY3Vzc2lvbiBpbiBMb25kb24gZGVhbHQgd2l0aCBhIGNvbXBsZXRlbHkgZGlmZmVyZW50 IHByb3Bvc2FsIHRoYW4gdGhpcyBvbmUuICBXaGlsZSBJIHRoaW5rIHRoZXJlIGFyZSBwcm9ibGVt cyB3aXRoIHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUgbW9zdGx5IG5v dCB0aGUgc2FtZSBzZXQuDQoNCkVyaWssDQoNCldoeSBpcyB0aGlzIGNvbnNpZGVyZWQgdG8gYmUg YSBwcmVmZXJyZWQgc29sdXRpb24gdG8gZGVmaW5pbmcgYSBuZXcgc2lnbmF0dXJlIGFsZ29yaXRo bSB3aGljaCBjb250YWlucyBhcyB0aGUgcGFyYW1ldGVyIHRoZSBzZXF1ZW5jZSBvZiBhbGdvcml0 aG0gaWRlbnRpZmllcnMgYW5kIGFzIHRoZSBzaWduYXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBz aWduYXR1cmUgdmFsdWVzLiAgVGhlIHByb2JsZW0gd2l0aCBqdXN0IGRlZmluaW5nIHRoZSBleHRl bnNpb24gdG8gU0lHTkVEIGlzIHRoYXQgb25lIG5lZWRzIHRvIG1ha2Ugc3VyZSB0aGF0IHRoZSBz ZXQgb2Ygc2lnbmF0dXJlIGFsZ29yaXRobXMgYW5kIHBhcmFtZXRlcnMgYXJlIGFsc28gcGFydCBv ZiB0aGUgZGF0YSB0byBiZSBzaWduZWQgYW5kIEkgYW0gbm90IHNlZWluZyB0aGF0IGhpZ2hsaWdo dGVkIGhlcmUuDQoNCkppbQ0KDQoNCkZyb206IFNwYXNtIDxzcGFzbS1ib3VuY2VzQGlldGYub3Jn PG1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFJ5YW4gU2xlZXZp DQpTZW50OiBNb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4OjUzIEFNDQpUbzogZXJhQHg1MDAu ZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pg0KQ2M6IFNQQVNNIDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86 c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBz dGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25h dHVyZXMNCg0KDQpPbiBNb24sIFNlcCAxMCwgMjAxOCBhdCAxMDo1NiBBTSBFcmlrIEFuZGVyc2Vu IDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PiB3cm90ZToNCkhpIEZvbGssDQoNCklu IElUVS1UIHdlIGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRvdWJsZSBzaWduYXR1cmVzIHVzaW5n IHRoZSBTSUdORUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBkZWZpbmVkIGluIFguNTA5IHRvIGNv cGUgd2l0aCBzaXR1YXRpb24gYXMgZGVzY3JpYmVkIGluIHRoZSBpbnRlcm5ldCBkcmFmdDog4oCc TXVsdGlwbGUgUHVibGljLUtleSBBbGdvcml0aG0gWC41MDkgQ2VydGlmaWNhdGVzIChkcmFmdC10 cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZC14NTA5LTAxKeKAnQ0KDQpXZSBzdWdnZXN0IHRvIGVu aGFuY2UgdGhlIFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24gYmVsb3c6DQoNClNJR05FRHtUb0Jl U2lnbmVkfSA6Oj0gU0VRVUVOQ0Ugew0KICBDT01QT05FTlRTIE9GIFNJR05BVFVSRSwNCiAgLi4u Li4uLA0KICBhbHRBbGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBw b3J0ZWRBbGdvcml0aG1zfX0gT1BUSU9OQUwsDQogIGFsdFNpZ25hdHVyZSAgICAgICAgICAgIEJJ VCBTVFJJTkcgT1BUSU9OQUwNCiAgfSAoV0lUSCBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRo bUlkZW50aWZpZXIgUFJFU0VOVCwgYWx0U2lnbmF0dXJlIFBSRVNFTlQgfSB8DQogICAgIFdJVEgg Q09NUE9ORU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIEFCU0VOVCwgIGFsdFNpZ25h dHVyZSBBQlNFTlQgfSApDQoNCldlIGFyZSBvcGVuIHRvIGNvbW1lbnRzLiBXZSBrbm93IHRoYXQg SUVURiBpcyBub3QgYSBoZWF2eSB1c2VyIG9mIHRoaXMgZGF0YSB0eXBlLg0KDQpXZSBoYXZlIG5v IGludGVudGlvbiB0byB1c2UgdGhpcyBleHRlbmRlZCBkYXRhIHR5cGUgZm9yIGNlcnRpZmljYXRl cyBhbmQgQ1JMcy4NCg0KRm9yIHlvdXIgaW5mb3JtYXRpb24sIFNJR05BVFVSRSBpcyBkZWZpbmVk IGFzOg0KDQpTSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHsNCiAgYWxnb3JpdGhtSWRlbnRpZmllciAg QWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxnb3JpdGhtc319LA0KICBzaWduYXR1cmUg ICAgICAgICAgICBCSVQgU1RSSU5HLA0KICAuLi4uLi4gfQ0KDQpGcm9tIHRoZSBkaXNjdXNzaW9u cyBpbiBMb25kb24gKDEwMSksIHRoZXJlIHdlcmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVu dGlmaWVkIGR1cmluZyB0aGUgZGlzY3Vzc2lvbiAtIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v cmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4dCAtIHRoYXQg ZnVuZGFtZW50YWxseSBxdWVzdGlvbmVkIHRoYXQgYXBwcm9hY2guDQoNCkhhcyB0aGUgSVRVLVQg YWRkcmVzc2VkIG9yIHJlc29sdmVkIHRob3NlIGNvbmNlcm5zPyBBcmUgdGhleSBub3QgYXBwbGlj YWJsZSBmb3Igc29tZSByZWFzb24gc3BlY2lmaWMgdG8gSVRVLVQ/DQo= --_000_9A1A8BFC967042EA8D8DB3DC2494CB95cablelabscom_ Content-Type: text/html; charset="utf-8" Content-ID: <4B3909D824137C4BAFC4E4C6C0D206FC@cablelab.onmicrosoft.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IGRpcj0iYXV0byI+DQo8 ZGl2PjxzcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+SGkgQWxsLA0KPGRpdj48YnI+DQo8L2Rpdj4N CjxkaXY+SSBhbSB3b3JraW5nIG9uIGEgc2ltaWxhciAtIGJ1dCBkaWZmZXJlbnQgLSBzb2x1dGlv biwgaW4gcGFydGljdWxhciBJIHNvbHZlIHRoZSBpc3N1ZSBvZiAoYSkgYmVpbmcgYWJsZSB0byBj b21iaW5lIG1vcmUgdGhhbiBvbmUgcHVibGljIGtleSwgKGIpIG9ubHkgb25lIChhY3R1YWxseSB0 d28pIE9JRHMgcmVxdWlyZWQsIGFuZCAoYykgc2ltcGx5IHRoZSBwcm9jZXNzaW5nIGJ5IHJlLXV0 aWxpemluZyB0aGUgc2FtZSBkYXRhIHN0cnVjdHVyZXMNCiB3ZSBoYXZlIHRvZGF5LjwvZGl2Pg0K PGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+SSBwYXJ0aWN1bGFyLCBJIGRlZmluZSBhIOKAnGNvbXBv c2l0ZSBwdWJsaWMga2V54oCdIGFuZCDigJxjb21wb3NpdGUgc2lnbmF0dXJl4oCdLjwvZGl2Pg0K PGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+VGhlIGZpcnN0IG9uZSBlbmNvZGVzIGluIHRoZSBrZXkg dmFsdWXigJlzIEJJVFNUUklORyB0aGUgREVSIHZhbHVlIG9mIHRoZSBTRVFVRU5DRSBvZiBwdWJs aWMga2V5cyAoZWFjaCBvZiB3aGljaCBpcyBhIHRoZSBzdWJqZWN0UHVibGljS2V5SW5mbyBzdHJ1 Y3R1cmUpIGFuZCB1c2VzIGEgc3BlY2lmaWMgT0lEIHRoYXQgaWRlbnRpZmllcyB0aGUgcHVibGlj IGtleSB0eXBlLiBUaGUgcGFyYW1ldGVycyBvZiB0aGUgY29tcG9zaXRlS2V5IGFsZ29yaXRobQ0K IGNhbiBiZSB1c2VkIHRvIGVuY29kZSB0aGUga2V5VXNhZ2UgYW5kIHRoZSBleHRlbmRlZEtleVVz YWdlIGZvciBlYWNoIG9mIHRoZSBrZXlzIGluIHRoZSBjb21wb3NpdGUga2V5LjwvZGl2Pg0KPGRp dj48YnI+DQo8L2Rpdj4NCjxkaXY+VGhlIHNhbWUgYXBwcm9hY2ggaXMgdXNlZCBmb3IgdGhlIOKA nENvbXBvc2l0ZSBTaWduYXR1cmXigJ0gY2FzZSB3aGVyZSB0aGUgdmFsdWUgb2YgdGhlIHNpZ25h dHVyZSBpcyB0aGUgREVSIHJlcHJlc2VudGF0aW9uIG9mIHRoZSBTRVFVRU5DRSBvZiBzaWduYXR1 cmVzIG1hZGUgd2l0aCBlYWNoIG9mIHRoZSBrZXlzLjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4N CjxkaXY+QXMgc29vbiBhcyBJIGhhdmUgc29tZSBzcGFyZSB0aW1lLCBJIHdpbGwgc3VibWl0IHRo ZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUgZGlzY3Vzc2VkIGluIEJhbmdrb2s/PC9kaXY+ DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5UaGlzIHNpbXBsZSBpZGVhIGFsbG93cyB1cyB0byBo YXZlIGFsbCB0aGUgb3RoZXIgcHJvY2VkdXJlcyByZWxhdGVkIHRvIFBLSXMgd29yayAtIHRoaXMg bWVhbnMgd2UgY2FuIGNvbWJpbmUgRUNDIHdpdGggUlNBIG9yIHdpdGggYSBRdWFudHVtLVJlc2lz dGFudCBhbGdvcml0aG0gKHdoZW4gZmluYWxseSBhdmFpbGFibGUgYW5kIHN0YW5kYXJkaXplZCku IEEgc3RlcCBmb3J3YXJkIGZvciB0aGUgZGVwbG95bWVudCBvZiBoeWJyaWQtUEtJcw0KIHdoZXJl IG11bHRpcGxlIExhZ29zIGZvciBrZXlzIGNhbiBiZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBkYXRh LCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRhLCBldGMuLi4gd2UgcGxhbiB0byB1c2UgdGhpcyBpbiBv dXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHByb3ZpZGUgYSB0cmFuc2l0aW9uYWwgcGF0aCBmb3IgcG9z dC1RdWFudHVtIHRyYW5zaXRpb24gYW5kIHRvIGZ1cnRoZXIgaW1wcm92ZSB0aGUgYWxnb3JpdGht LWFnaWxpdHkgY2FwYWJpbGl0eSBvZg0KIFBLSXMuPC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0K PGRpdj5XaGF0IGRvIHlvdSB0aGluaz88YnI+DQo8ZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxk aXY+Q2hlZXJzLA0KPGRpdj5NYXg8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pjxicj4NCjwv ZGl2Pg0KPGRpdj48YnI+DQo8YnI+DQo8YnI+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUi Pi0tLQ0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+Q2hlZXJzLA0KPGRpdj5NYXg8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQpPbiBTZXAgMTEsIDIwMTgsIGF0IDg6MzggQU0sIFRpbSBIb2xsZWJlZWsg Jmx0OzxhIGhyZWY9Im1haWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+dGltLmhvbGxl YmVla0BkaWdpY2VydC5jb208L2E+Jmd0OyB3cm90ZTo8YnI+DQo8YnI+DQo8L2Rpdj4NCjxkaXY+ PHNwYW4+PC9zcGFuPjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+DQo8ZGl2Pg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUx OQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4 dDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1h aWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5V bmZvcnR1bmF0ZWx5LCDigJxub3QgZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJl ZOKAnSBpbnRyb2R1Y2VzIGEgbG90IG9mIHBvbGl0aWNzIGFyb3VuZCBjaG9vc2luZyB3aGljaCBj b21iaW5hdGlvbnMg4oCcbmVlZCB0byBiZSBjb3ZlcmVk4oCdLCBhIHN1YmplY3Qgb24gd2hpY2gg aW5ldml0YWJseSBub3QgZXZlcnlvbmUgYWdyZWVzLiZuYnNwOyBJIHdvdWxkIHJhdGhlciBhdm9p ZCBhbGwgdGhvc2UgZGlzY3Vzc2lvbnMNCiBhbmQgdGhlIHVubmVjZXNzYXJ5IHdvcmsgdGhleSBy ZXByZXNlbnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgcGVyc29uYWxseSBkb27igJl0IHRo aW5rIGEgc2luZ2xlIEFsZ0lEIHdoaWNoIGltcGxpZXMgYSBTRVFVRU5DRSBvZiBBTEcgSURzIGlz IGFuIGltcHJvdmVtZW50IG92ZXIgYSBTRVFVRU5DRSBvZiBBTEcgSURzLCBvciBpdHMgbW9yYWwg ZXF1aXZhbGVudC4mbmJzcDsgRm9yIHNpbXBsZSBoeWJyaWQgdXNlIGNhc2VzLCB0aGVyZSBpcyBh bHNvIGEgbG90IG9mIHZhbHVlIGluIGhhdmluZyB0aGUgY2xhc3NpY2FsIGFsZ29yaXRobQ0KIElE IGJlaW5nIHRoZSBzYW1lIGFzIGl0IHVzdWFsbHkgaXMsIHRvIGFsbG93IGVhc2llciBpbnRlcm9w ZXJhYmlsaXR5IHdpdGggb2xkZXIgc3lzdGVtcyB0aGF0IGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUg bmV3ZXIgYWxnb3JpdGhtcyAoYW5kIGNhbiBibGlzc2Z1bGx5IGlnbm9yZSB0aGVtKS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+LVRpbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206 PC9iPiBTYW50b3NoIENob2toYW5pICZsdDs8YSBocmVmPSJtYWlsdG86c2FudG9zaC5jaG9raGFu aUBnbWFpbC5jb20iPnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tPC9hPiZndDsNCjxicj4NCjxi PlNlbnQ6PC9iPiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMTA6MjkgQU08YnI+DQo8Yj5U bzo8L2I+IFRpbSBIb2xsZWJlZWsgJmx0OzxhIGhyZWY9Im1haWx0bzp0aW0uaG9sbGViZWVrQGRp Z2ljZXJ0LmNvbSI+dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208L2E+Jmd0OzsgJ0VyaWsgQW5k ZXJzZW4nICZsdDs8YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPmVyYUB4NTAwLmV1PC9hPiZn dDs7ICdTUEFTTScgJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21AaWV0 Zi5vcmc8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9y ZyI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJF OiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+VGhhbmtzIFRpbS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlRoZXJlIGFyZSB3YXlzIHRvIGFjY29tbW9k YXRlIHlvdXIgY29uY2Vybi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPk9u ZSB3YXkgdG8gaGFuZGxlIHRoaXMgaXMgZGVmaW5pbmcgYSBzaW5nbGUgQWxnIElEIEEgd2hpY2gg aW1wbGllcyBhIFNFUVVFTkNFIG9mIEFMRyBJRHMgYW5kIGRlZmluZSB0aGUgcmVseWluZyBwYXJ0 eSBydWxlcyBpbiB0ZXJtcyBvZiBpdHMgYWJpbGl0eSB0byBwcm9jZXNzIG9uZSBvciBhbGwgQUxH IElEcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkFub3RoZXIgd2F5IHRv IGRvIHRoaXMgaXMgbm90IGV2ZXJ5IGNvbWJpbmF0aW9uIG5lZWRzIHRvIGJlIGNvdmVyZWQgYW5k IHRoZSB1c2VyIGNvbW11bml0eSBkZWZpbmVzIGl0cyBvd24gJm5ic3A7QWxnIElEIFhpIHdoaWNo IG1hcHMgdG8gYSBTRVFVRU5DRSBvZiBBTEcgSURzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFNwYXNtIFs8YSBocmVmPSJtYWlsdG86c3Bh c20tYm91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0K PGI+T24gQmVoYWxmIE9mIDwvYj5UaW0gSG9sbGViZWVrPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNk YXksIFNlcHRlbWJlciAxMSwgMjAxOCAxMDowMyBBTTxicj4NCjxiPlRvOjwvYj4gRXJpayBBbmRl cnNlbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij5lcmFAeDUwMC5ldTwvYT4mZ3Q7 OyAnU1BBU00nICZsdDs8YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPnNwYXNtQGlldGYu b3JnPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmci Png1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTog W2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+RG9lc27igJl0IHRoZSBjb21iaW5hdG9yaWMgZXhwbG9zaW9uIHJlbmRlciB0aGlz IGNvbXBsZXRlbHkgaW1wcmFjdGljYWw/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllvdSBuZWVk IE5fYyB4IE5fcHEgYWxnb3JpdGhtIGlkZW50aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRoZSBzaW1w bGUgaHlicmlkIHVzZSBjYXNlIHdoZXJlIGEgc2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0aG0gaXMg YmVpbmcgdXNlZCBpbiBjb25qdW5jdGlvbiB3aXRoIGEgc2luZ2xlIHBvc3QtcXVhbnR1bSBhbGdv cml0aG0uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFuZCB0aGVyZSBhcmUgcGVvcGxlIHdobyB3 YW50IHRvIHVzZSBtdWx0aXBsZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcyB0byBoZWRnZSBhZ2Fp bnN0IHBvdGVudGlhbCB5ZXQgdG8gYmUgZGlzY292ZXJlZCB3ZWFrbmVzc2VzIGluIHBvc3QtcXVh bnR1bSBhbGdvcml0aG1zLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBub3QgcmVhbGx5 IGxvb2tpbmcgZm9yd2FyZCB0byB0cnlpbmcgdG8gYWxsb2NhdGUgb3IgbWFuYWdlIE8oTl9jIHgg Tl9wcV4zKSBhbGdvcml0aG0gaWRlbnRpZmllcnPigKY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ LVRpbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEu NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBTcGFzbSAmbHQ7PGEg aHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPnNwYXNtLWJvdW5jZXNAaWV0Zi5v cmc8L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5FcmlrIEFuZGVyc2VuPGJyPg0KPGI+U2Vu dDo8L2I+IFR1ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAxOCAzOjEwIEFNPGJyPg0KPGI+VG86PC9i PiAnU1BBU00nICZsdDs8YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPnNwYXNtQGlldGYu b3JnPC9hPiZndDs7IDxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+ DQp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGkgU2Fu dG9zaCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+WW91IGhhdmUgcHJvcG9zZWQgc29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUu IEl0IHN0aWxsIHB1enpsaW5nIGluIG15IGJyYWluLiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVp cmVzIHRoYXQgd2UgZGVmaW5lIGEgcGFydGljdWxhciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJh bWV0ZXIgdGhhdCBpbmNsdWRlcyB0aGUgdGhpbmdzIHlvdSBzdWdnZXN0Lg0KIEl0IGlzIHdvcnRo eSB0byBiZSBhbmFseXNlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+RXJpazxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkRBIj5GcmE6PC9zcGFu PjwvYj48c3BhbiBsYW5nPSJEQSI+IFNwYXNtIFs8YSBocmVmPSJtYWlsdG86c3Bhc20tYm91bmNl c0BpZXRmLm9yZyI+bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0KPGI+UMOlIHZl Z25lIGFmIDwvYj5TYW50b3NoIENob2toYW5pPGJyPg0KPGI+U2VuZHQ6PC9iPiAxMCBTZXB0ZW1i ZXIgMjAxOCAxOToxODxicj4NCjxiPlRpbDo8L2I+ICdKaW0gU2NoYWFkJyAmbHQ7PGEgaHJlZj0i bWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20iPmlldGZAYXVndXN0Y2VsbGFycy5jb208L2E+ Jmd0OzsgJ1J5YW4gU2xlZXZpJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJ5YW4taWV0ZkBzbGVldmku Y29tIj5yeWFuLWlldGZAc2xlZXZpLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmVyYUB4 NTAwLmV1Ij5lcmFAeDUwMC5ldTwvYT48YnI+DQo8Yj5DYzo8L2I+ICdTUEFTTScgJmx0OzxhIGhy ZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21AaWV0Zi5vcmc8L2E+Jmd0OzsgPGEgaHJl Zj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj4NCng1MDBzdGFuZGFyZEBmcmVl bGlzdHMub3JnPC9hPjxicj4NCjxiPkVtbmU6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0 dXJlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPldoeSBub3Qg bGV0IGFsZ29yaXRobSBpZGVudGlmaWVyIGRpY3RhdGUgdGhlIG51bWJlciBvZiBzaWduYXR1cmVz IGFuZCB0aGVpciBzeW50YXg/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj5Gcm9tOjwvYj4gU3Bhc20gWzxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGll dGYub3JnIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvYT5dDQo8Yj5PbiBCZWhhbGYg T2YgPC9iPkppbSBTY2hhYWQ8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBTZXB0ZW1iZXIgMTAs IDIwMTggMTowNyBQTTxicj4NCjxiPlRvOjwvYj4gJ1J5YW4gU2xlZXZpJyAmbHQ7PGEgaHJlZj0i bWFpbHRvOnJ5YW4taWV0ZkBzbGVldmkuY29tIj5yeWFuLWlldGZAc2xlZXZpLmNvbTwvYT4mZ3Q7 Ow0KPGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij5lcmFAeDUwMC5ldTwvYT48YnI+DQo8Yj5D Yzo8L2I+ICdTUEFTTScgJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21A aWV0Zi5vcmc8L2E+Jmd0OzsgPGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMu b3JnIj4NCng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9i PiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Unlhbiw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGRpc2N1c3Np b24gaW4gTG9uZG9uIGRlYWx0IHdpdGggYSBjb21wbGV0ZWx5IGRpZmZlcmVudCBwcm9wb3NhbCB0 aGFuIHRoaXMgb25lLiZuYnNwOyBXaGlsZSBJIHRoaW5rIHRoZXJlIGFyZSBwcm9ibGVtcyB3aXRo IHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUgbW9zdGx5IG5vdCB0aGUg c2FtZSBzZXQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkVyaWssPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPldoeSBpcyB0aGlzIGNvbnNpZGVyZWQgdG8gYmUgYSBwcmVmZXJyZWQgc29sdXRpb24g dG8gZGVmaW5pbmcgYSBuZXcgc2lnbmF0dXJlIGFsZ29yaXRobSB3aGljaCBjb250YWlucyBhcyB0 aGUgcGFyYW1ldGVyIHRoZSBzZXF1ZW5jZSBvZiBhbGdvcml0aG0gaWRlbnRpZmllcnMgYW5kIGFz IHRoZSBzaWduYXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1cmUgdmFsdWVzLiZuYnNw OyBUaGUgcHJvYmxlbSB3aXRoIGp1c3QNCiBkZWZpbmluZyB0aGUgZXh0ZW5zaW9uIHRvIFNJR05F RCBpcyB0aGF0IG9uZSBuZWVkcyB0byBtYWtlIHN1cmUgdGhhdCB0aGUgc2V0IG9mIHNpZ25hdHVy ZSBhbGdvcml0aG1zIGFuZCBwYXJhbWV0ZXJzIGFyZSBhbHNvIHBhcnQgb2YgdGhlIGRhdGEgdG8g YmUgc2lnbmVkIGFuZCBJIGFtIG5vdCBzZWVpbmcgdGhhdCBoaWdobGlnaHRlZCBoZXJlLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5KaW08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBi bHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBTcGFzbSAm bHQ7PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPnNwYXNtLWJvdW5jZXNA aWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5SeWFuIFNsZWV2aTxicj4NCjxi PlNlbnQ6PC9iPiBNb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4OjUzIEFNPGJyPg0KPGI+VG86 PC9iPiA8YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPmVyYUB4NTAwLmV1PC9hPjxicj4NCjxi PkNjOjwvYj4gU1BBU00gJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21A aWV0Zi5vcmc8L2E+Jmd0OzsgPGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMu b3JnIj4NCng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9i PiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBNb24sIFNlcCAxMCwgMjAxOCBhdCAxMDo1NiBBTSBFcmlrIEFuZGVyc2VuICZsdDs8YSBo cmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPmVyYUB4NTAwLmV1PC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0 b206NS4uMHB0O21hcmdpbi1ib3R0b206NS4uMHB0O21hcmdpbi1ib3R0b206NS4uMHB0O21hcmdp bi1ib3R0b206NS4uMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBsYW5nPSJEQSI+SGkgRm9sayw8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iREEiPiZu YnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+SW4gSVRVLVQgd2UgaGF2ZSBw bGFucyB0byBhbGxvdyBmb3IgZG91YmxlIHNpZ25hdHVyZXMgdXNpbmcgdGhlIFNJR05FRCBwYXJh bWV0cml6ZWQgZGF0YSB0eXBlIGRlZmluZWQgaW4gWC41MDkgdG8gY29wZSB3aXRoIHNpdHVhdGlv biBhcyBkZXNjcmliZWQgaW4gdGhlIGludGVybmV0DQogZHJhZnQ6IOKAnE11bHRpcGxlIFB1Ymxp Yy1LZXkgQWxnb3JpdGhtIFguNTA5IENlcnRpZmljYXRlcyAoZHJhZnQtdHJ1c2tvdnNreS1sYW1w cy1wcS1oeWJyaWQteDUwOS0wMSnigJ08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBzdWdnZXN0 IHRvIGVuaGFuY2UgdGhlIFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24gYmVsb3c6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+U0lHTkVEe1RvQmVTaWduZWR9IDo6PSBTRVFVRU5DRSB7PC9z cGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7IENPTVBPTkVO VFMgT0YgU0lHTkFUVVJFLDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPiZuYnNwOyAuLi4uLi48c3BhbiBzdHlsZT0iY29sb3I6I0MwMDAwMCI+LDwvc3Bhbj48L3Nw YW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOnJlZCI+Jm5ic3A7 IGFsdEFsZ29yaXRobUlkZW50aWZpZXImbmJzcDsgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9y dGVkQWxnb3JpdGhtc319IE9QVElPTkFMLDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDs7Y29sb3I6cmVkIj4mbmJzcDsgYWx0U2lnbmF0dXJlJm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJJVCBT VFJJTkcgT1BUSU9OQUwmbmJzcDsNCjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDs7Y29sb3I6cmVkIj4mbmJzcDsmbmJzcDs8L3NwYW4+PC9iPjxiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij59PHNwYW4gc3R5bGU9ImNvbG9yOnJlZCI+DQogKFdJVEggQ09NUE9ORU5UUyB7 Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQUkVTRU5U IH0gfDwvc3Bhbj48L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOnJlZCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFdJVEggQ09NUE9ORU5UUyB7Li4uLCBh bHRBbGdvcml0aG1JZGVudGlmaWVyIEFCU0VOVCwmbmJzcDsgYWx0U2lnbmF0dXJlIEFCU0VOVCB9 ICk8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3Nw YW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBhcmUgb3BlbiB0byBjb21tZW50 cy4gV2Uga25vdyB0aGF0IElFVEYgaXMgbm90IGEgaGVhdnkgdXNlciBvZiB0aGlzIGRhdGEgdHlw ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxh bmc9IkVOLUdCIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5XZSBoYXZlIG5vIGludGVudGlvbiB0byB1c2UgdGhp cyBleHRlbmRlZCBkYXRhIHR5cGUgZm9yIGNlcnRpZmljYXRlcyBhbmQgQ1JMcy48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4m bmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IGxhbmc9IkVOLUdCIj5Gb3IgeW91ciBpbmZvcm1hdGlvbiwgU0lHTkFUVVJFIGlzIGRlZmluZWQg YXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBs YW5nPSJFTi1HQiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+U0lHTkFUVVJFIDo6PSBTRVFVRU5DRSB7 PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7IGFsZ29y aXRobUlkZW50aWZpZXImbmJzcDsgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxnb3Jp dGhtc319LDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNw OyBzaWduYXR1cmUmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgQklUIFNUUklORyw8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVO LUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgLi4uLi4uIH08L3NwYW4+PC9iPjxzcGFuIGxhbmc9 IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RnJvbSB0aGUgZGlzY3Vzc2lvbnMg aW4gTG9uZG9uICgxMDEpLCB0aGVyZSB3ZXJlIGEgbnVtYmVyIG9mIGNoYWxsZW5nZXMgaWRlbnRp ZmllZCBkdXJpbmcgdGhlIGRpc2N1c3Npb24gLSZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vZGF0YXRy YWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAx LnR4dCI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5nLzEwMS9tYXRlcmlhbHMv bWludXRlcy0xMDEtbGFtcHMtMDEudHh0PC9hPg0KIC0gdGhhdCBmdW5kYW1lbnRhbGx5IHF1ZXN0 aW9uZWQgdGhhdCBhcHByb2FjaC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SGFzIHRoZSBJVFUtVCBhZGRyZXNzZWQgb3IgcmVzb2x2ZWQgdGhv c2UgY29uY2VybnM/IEFyZSB0aGV5IG5vdCBhcHBsaWNhYmxlIGZvciBzb21lIHJlYXNvbiBzcGVj aWZpYyB0byBJVFUtVD8mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_9A1A8BFC967042EA8D8DB3DC2494CB95cablelabscom_-- From nobody Tue Sep 11 19:04:32 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67BD9130E14 for ; Tue, 11 Sep 2018 19:04:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wG_cFGRHm3i4 for ; Tue, 11 Sep 2018 19:04:28 -0700 (PDT) Received: from mail-qt0-x241.google.com (mail-qt0-x241.google.com [IPv6:2607:f8b0:400d:c0d::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6C12130E0A for ; Tue, 11 Sep 2018 19:04:27 -0700 (PDT) Received: by mail-qt0-x241.google.com with SMTP id r37-v6so367603qtc.0 for ; Tue, 11 Sep 2018 19:04:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xgMAO81zYalBcwmvw2XkedNWh2adTxNrmGNhDPg+kpE=; b=KAsjZHk8XgKu50hNmsIyTJ5REK1o6OvtaFwBO9CB4OqqeBIprB51jsXTtX0F6k5v92 peqO1BmtldI0/hPhvc3uFuZ4dcVCjSUN/p5PwhLov50+h9m1tR/F7psBcn4hZ5AsIf0k 33IJ8OaeSOzrQmHmgeQIii9izBXd09HLvf1+Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xgMAO81zYalBcwmvw2XkedNWh2adTxNrmGNhDPg+kpE=; b=sI9OnRmF8c1+938fKVm87Oq4YfOYIPJODey0BISDRpRYTMQku9+BHgvKB8mfFzwyLn k659WN7AJcu75TFWusH3m4E9ZUlFruckuJU6rM3o+dCVq379gyWhLZSqf0CrTvcwcx/Q 68U5zH5QuACYrcUlVgno210NKCDH+gVLB+Y7ACMe7Ug5HR6Ju5RpnsXeqhJpFVURIlZY +o/7p0H3rSAajWagSoCbWFzdjzAuKP4sOwJhe7bLLlwnp08+YKQoKcZfiLADAGjylHOU pXNak/X2Em/FwWOZyNaRlTSRv0adaYUeslJVGBpIWGgLyvKv1FVhtPQlPi2edrwG7der AvEA== X-Gm-Message-State: APzg51Ckvu5kfxRm5B7/uIswP1TombE8cE/ToMAlsNoOfyT+HI6Amjwd otoqnuk/ayxdrqR1803VN4uftxiQ5Gk= X-Google-Smtp-Source: ANB0VdaRb14sijOc45xhAFyyJurEQknXzXUOsUvU3KGKHFbaKlTKtAcGEWkIZ4petXnFWVNM6kiJlA== X-Received: by 2002:ac8:2a13:: with SMTP id k19-v6mr21563687qtk.245.1536717866951; Tue, 11 Sep 2018 19:04:26 -0700 (PDT) Received: from [172.16.0.18] ([96.231.216.107]) by smtp.gmail.com with ESMTPSA id f129-v6sm10883270qkb.40.2018.09.11.19.04.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Sep 2018 19:04:25 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Sean Turner In-Reply-To: <003101d4499d$388e9af0$a9abd0d0$@x500.eu> Date: Tue, 11 Sep 2018 22:04:23 -0400 Cc: SPASM , x500standard@freelists.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <003101d4499d$388e9af0$a9abd0d0$@x500.eu> To: Erik Andersen X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 02:04:30 -0000 Erik, A couple of points I=E2=80=99m hoping you might clarify: 1. You said =E2=80=9CWe have no intention to use this extended data type = for certificates and CRLs.=E2=80=9D In X.509-2016, Certificate and = CertificateList use the following ASN.1: =20 Certificate ::=3D SIGNED{TBSCertificate} =20 CertificateList ::=3D SIGNED{CertificateListContent} So to pull off what you=E2=80=99re suggesting (i.e., never using these = with Certificate and CertificateList) what exactly are going to do - = redefine Certificate and CertificateList, put some kind of constraint on = ToBeSigned in SIGNED, =E2=80=A6 ? 2. You also said "We know that IETF is not a heavy user of this data = type=E2=80=9D, where this is SIGNED. That=E2=80=99s a true statement = because the IETF initially didn=E2=80=99t make use of the = AuthenticationFramework SIGNED parameterized types because RFC 5280 uses = the =E2=80=9988 modules and parameterized types were=E2=80=99t a thing = in =E2=80=9988; in =E2=80=9988 it was a SIGNED MACRO and it was a pain = so it was redefined in a bits-on-the-wire compatible way. For those = IETF RFCs that prefer to use the =E2=80=9902 and =E2=80=9908 syntax, a = SIGNED parameterized type is defined in RFC 5912 and is used in RFCs = 5911, 5912, and 6268 (and maybe others) to define 30+ ASN.1 modules. So = while "SIGNED=E2=80=9D is not used much in the context of the 8000+ RFCs = it can be used by just about every RFC that uses ASN.1. Despite the fact SIGNED wasn=E2=80=99t defined exactly the same, they = still resulted in the same encoding, namely algorithm parameters = (OID+parameters) and signature (a bit string); same as the earlier =E2=80=99= 88 syntaxes. I have this sinking feeling that making a change to this = is going to cause some problems somewhere despite the fact we can do = fancy things with the ASN.1. spt > On Sep 11, 2018, at 03:01, Erik Andersen wrote: >=20 > HI Jim, > =20 > You have a good point here that also been bothering me for the last = couple of days. I am still trying to find a way. > =20 > Erik > =20 > Fra: Jim Schaad [mailto:ietf@augustcellars.com]=20 > Sendt: 10 September 2018 19:07 > Til: 'Ryan Sleevi' ; era@x500.eu > Cc: 'SPASM' ; x500standard@freelists.org > Emne: RE: [lamps] Double signatures > =20 > Ryan, > =20 > The discussion in London dealt with a completely different proposal = than this one. While I think there are problems with this that need to = be dealt with they are mostly not the same set. > =20 > Erik, > =20 > Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. > =20 > Jim > =20 > =20 > From: Spasm On Behalf Of Ryan Sleevi > Sent: Monday, September 10, 2018 8:53 AM > To: era@x500.eu > Cc: SPASM ; x500standard@freelists.org > Subject: Re: [lamps] Double signatures > =20 > =20 >=20 > On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen wrote: >> Hi Folk, >> =20 >> In ITU-T we have plans to allow for double signatures using the = SIGNED parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D >> =20 >> We suggest to enhance the SIGNED data type as shown below: >> =20 >> SIGNED{ToBeSigned} ::=3D SEQUENCE { >> COMPONENTS OF SIGNATURE, >> ..., >> altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, >> altSignature BIT STRING OPTIONAL =20 >> } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, = altSignature PRESENT } | >> WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, = altSignature ABSENT } ) >> =20 >> We are open to comments. We know that IETF is not a heavy user of = this data type. >> =20 >> We have no intention to use this extended data type for certificates = and CRLs. >> =20 >> For your information, SIGNATURE is defined as: >> =20 >> SIGNATURE ::=3D SEQUENCE { >> algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, >> signature BIT STRING, >> ... } > =20 > =46rom the discussions in London (101), there were a number of = challenges identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.tx= t - that fundamentally questioned that approach. > =20 > Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Wed Sep 12 05:13:06 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB33512872C for ; Wed, 12 Sep 2018 05:13:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CvoAm8VqujS7 for ; Wed, 12 Sep 2018 05:13:01 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55C54130DFE for ; Wed, 12 Sep 2018 05:13:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 1EACD300A4E for ; Wed, 12 Sep 2018 08:12:59 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id g2W3V1LQK5Td for ; Wed, 12 Sep 2018 08:12:55 -0400 (EDT) Received: from [172.26.8.157] (unknown [104.129.194.133]) by mail.smeinc.net (Postfix) with ESMTPSA id 2DB92300266; Wed, 12 Sep 2018 08:12:55 -0400 (EDT) From: Russ Housley Message-Id: <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_40BBE6F9-90AA-4514-866A-0C3CA6BD3863" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 12 Sep 2018 08:12:49 -0400 In-Reply-To: <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> Cc: SPASM , Erik Andersen To: Massimiliano Pala References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 12:13:05 -0000 --Apple-Mail=_40BBE6F9-90AA-4514-866A-0C3CA6BD3863 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Max: During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. Russ > On Sep 11, 2018, at 4:45 PM, Max Pala wrote: >=20 > Hi All, >=20 > I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. >=20 > I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. >=20 > The first one encodes in the key value=E2=80=99s BITSTRING the DER = value of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. >=20 > The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. >=20 > As soon as I have some spare time, I will submit the draft - maybe = this could be discussed in Bangkok? >=20 > This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. >=20 > What do you think? >=20 > Cheers, > Max >=20 >=20 >=20 >=20 > --- >=20 > Cheers, > Max > On Sep 11, 2018, at 8:38 AM, Tim Hollebeek > wrote: >=20 >> Unfortunately, =E2=80=9Cnot every combination needs to be covered=E2=80= =9D introduces a lot of politics around choosing which combinations = =E2=80=9Cneed to be covered=E2=80=9D, a subject on which inevitably not = everyone agrees. I would rather avoid all those discussions and the = unnecessary work they represent. >> =20 >> I personally don=E2=80=99t think a single AlgID which implies a = SEQUENCE of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its = moral equivalent. For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that don=E2=80=99t= understand the newer algorithms (and can blissfully ignore them). >> =20 >> -Tim >> =20 >> From: Santosh Chokhani >=20 >> Sent: Tuesday, September 11, 2018 10:29 AM >> To: Tim Hollebeek >; 'Erik Andersen' >; 'SPASM' >; = x500standard@freelists.org >> Subject: RE: [lamps] Double signatures >> =20 >> Thanks Tim. >> =20 >> There are ways to accommodate your concern. >> =20 >> One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. >> =20 >> Another way to do this is not every combination needs to be covered = and the user community defines its own Alg ID Xi which maps to a = SEQUENCE of ALG IDs. >> =20 >> From: Spasm [mailto:spasm-bounces@ietf.org = ] On Behalf Of Tim Hollebeek >> Sent: Tuesday, September 11, 2018 10:03 AM >> To: Erik Andersen >; 'SPASM' = >; x500standard@freelists.org = >> Subject: Re: [lamps] Double signatures >> =20 >> Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? >> =20 >> You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. >> =20 >> And there are people who want to use multiple post-quantum algorithms = to hedge against potential yet to be discovered weaknesses in = post-quantum algorithms. >> =20 >> I=E2=80=99m not really looking forward to trying to allocate or = manage O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 >> =20 >> -Tim >> =20 >> From: Spasm > = On Behalf Of Erik Andersen >> Sent: Tuesday, September 11, 2018 3:10 AM >> To: 'SPASM' >; = x500standard@freelists.org >> Subject: Re: [lamps] Double signatures >> =20 >> Hi Santosh, >> =20 >> You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. >> =20 >> Erik >> =20 >> Fra: Spasm [mailto:spasm-bounces@ietf.org = ] P=C3=A5 vegne af Santosh Chokhani >> Sendt: 10 September 2018 19:18 >> Til: 'Jim Schaad' >; 'Ryan Sleevi' >; era@x500.eu >> Cc: 'SPASM' >; = x500standard@freelists.org >> Emne: Re: [lamps] Double signatures >> =20 >> Why not let algorithm identifier dictate the number of signatures and = their syntax? >> =20 >> From: Spasm [mailto:spasm-bounces@ietf.org = ] On Behalf Of Jim Schaad >> Sent: Monday, September 10, 2018 1:07 PM >> To: 'Ryan Sleevi' >; era@x500.eu >> Cc: 'SPASM' >; = x500standard@freelists.org >> Subject: Re: [lamps] Double signatures >> =20 >> Ryan, >> =20 >> The discussion in London dealt with a completely different proposal = than this one. While I think there are problems with this that need to = be dealt with they are mostly not the same set. >> =20 >> Erik, >> =20 >> Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. >> =20 >> Jim >> =20 >> =20 >> From: Spasm > = On Behalf Of Ryan Sleevi >> Sent: Monday, September 10, 2018 8:53 AM >> To: era@x500.eu >> Cc: SPASM >; = x500standard@freelists.org >> Subject: Re: [lamps] Double signatures >> =20 >> =20 >>=20 >> On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > wrote: >> Hi Folk, >> =20 >> In ITU-T we have plans to allow for double signatures using the = SIGNED parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D >> =20 >> We suggest to enhance the SIGNED data type as shown below: >> =20 >> SIGNED{ToBeSigned} ::=3D SEQUENCE { >> COMPONENTS OF SIGNATURE, >> ......, >> altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, >> altSignature BIT STRING OPTIONAL=20 >> } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, = altSignature PRESENT } | >> WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, = altSignature ABSENT } ) >> =20 >> We are open to comments. We know that IETF is not a heavy user of = this data type. >> =20 >> We have no intention to use this extended data type for certificates = and CRLs. >> =20 >> For your information, SIGNATURE is defined as: >> =20 >> SIGNATURE ::=3D SEQUENCE { >> algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, >> signature BIT STRING, >> ...... } >> =20 >> =46rom the discussions in London (101), there were a number of = challenges identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.tx= t = - that fundamentally questioned that approach. >> =20 >> Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm = --Apple-Mail=_40BBE6F9-90AA-4514-866A-0C3CA6BD3863 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Max:

During= a transition to quantum-resistant signatures, a signer wants to put a = traditional signature and a quantum-resistant signature on an object. =  Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set.  How does a client know if = just one or both signatures must be valid?

As Jim Schaad already said, = RFC 5752 talks about this issue when a CMS SignedData contains more = than one SignerInfo.

Russ


On Sep = 11, 2018, at 4:45 PM, Max Pala <M.Pala@cablelabs.com> wrote:

Hi All,

I am working on a similar - but = different - solution, in particular I solve the issue of (a) being able = to combine more than one public key, (b) only one (actually two) OIDs = required, and (c) simply the processing by re-utilizing the same data = structures we have today.

I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D= and =E2=80=9Ccomposite signature=E2=80=9D.

The first one encodes in the key = value=E2=80=99s BITSTRING the DER value of the SEQUENCE of public keys = (each of which is a the subjectPublicKeyInfo structure) and uses a = specific OID that identifies the public key type. The parameters of the = compositeKey algorithm can be used to encode the keyUsage and the = extendedKeyUsage for each of the keys in the composite key.

The same approach is = used for the =E2=80=9CComposite Signature=E2=80=9D case where the value = of the signature is the DER representation of the SEQUENCE of signatures = made with each of the keys.

As soon as I have some spare time, I will submit the draft - = maybe this could be discussed in Bangkok?

This simple idea allows us to have all = the other procedures related to PKIs work - this means we can combine = ECC with RSA or with a Quantum-Resistant algorithm (when finally = available and standardized). A step forward for the deployment of = hybrid-PKIs where multiple Lagos for keys can be used to authenticate = data, certs, revocation data, etc... we plan to use this in our = infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

What do = you think?

Cheers,
Max




---

Cheers,
Max
On Sep 11, 2018, = at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com>= wrote:

Unfortunately, =E2=80=9Cnot = every combination needs to be covered=E2=80=9D introduces a lot of = politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.
 
I personally don=E2=80=99t think a = single AlgID which implies a SEQUENCE of ALG IDs is an improvement over = a SEQUENCE of ALG IDs, or its moral equivalent.  For simple hybrid = use cases, there is also a lot of value in having the classical = algorithm ID being the same as it usually is, to allow easier = interoperability with older systems that don=E2=80=99t understand the = newer algorithms (and can blissfully ignore them).
 
-Tim
 
From: Santosh Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: RE: [lamps] Double = signatures
 
Thanks = Tim.
 
There are = ways to accommodate your concern.
 
One way to handle this is defining a single Alg ID A = which implies a SEQUENCE of ALG IDs and define the relying party rules = in terms of its ability to process one or all ALG IDs.
 
Another = way to do this is not every combination needs to be covered and the user = community defines its own  Alg ID Xi which maps to a SEQUENCE of = ALG IDs.
 
From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf = Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double = signatures
 
Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?
 
You need N_c x N_pq algorithm identifiers just to handle the = simple hybrid use case where a single classical algorithm is being used = in conjunction with a single post-quantum algorithm.
 
And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.
 
I=E2=80=99m not really looking forward to trying to allocate = or manage O(N_c x N_pq^3) algorithm identifiers=E2=80=A6
 
-Tim
 
From: Spasm <spasm-bounces@ietf.org> On Behalf = Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double = signatures
 
Hi Santosh,
 
You have proposed something like this before. It still = puzzling in my brain. As I understand, it requires that we define a = particular algorithm that has a parameter that includes the things you = suggest. It is worthy to be analysed.
 
Erik
 
Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne = af Santosh = Chokhani
Sendt: 10 September 2018 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; = 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne: Re: [lamps] Double = signatures
 
Why not = let algorithm identifier dictate the number of signatures and their = syntax?
 
From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf = Of Jim Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double = signatures
 
Ryan,
 
The discussion in London dealt with a completely different = proposal than this one.  While I think there are problems with this = that need to be dealt with they are mostly not the same set.
 
Erik,
 
Why is = this considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.
 
Jim
 
 
From: Spasm <spasm-bounces@ietf.org> On Behalf = Of Ryan Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: era@x500.eu
Cc: SPASM= <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double = signatures
 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik = Andersen <era@x500.eu> wrote:
Hi = Folk,
 
In ITU-T we have plans to allow for double = signatures using the SIGNED parametrized data type defined in X.509 to = cope with situation as described in the internet draft: =E2=80=9CMultiple = Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D
 
We = suggest to enhance the SIGNED data type as shown below:
 
SIGNED{ToBeSigned} ::=3D SEQUENCE {
  COMPONENTS OF SIGNATURE,
  ......,
  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,
  = altSignature          &n= bsp; BIT STRING OPTIONAL 
  } (WITH COMPONENTS {..., = altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |
     = WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT,  altSignature = ABSENT } )
 
We are open to comments. We = know that IETF is not a heavy user of this data type.
 
We have = no intention to use this extended data type for certificates and = CRLs.
 
For your information, SIGNATURE is defined = as:
 
SIGNATURE ::=3D SEQUENCE = {
  algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},
  = signature           = ; BIT STRING,
  ...... }
 
=46rom the discussions in London (101), there were a number = of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-101-= lamps-01.txt - = that fundamentally questioned that approach.
 
Has the ITU-T addressed or resolved = those concerns? Are they not applicable for some reason specific to = ITU-T? 
_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

= --Apple-Mail=_40BBE6F9-90AA-4514-866A-0C3CA6BD3863-- From nobody Wed Sep 12 07:59:47 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A43C51292AD for ; Wed, 12 Sep 2018 07:59:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SvPIdSJxsTc5 for ; Wed, 12 Sep 2018 07:59:42 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 990E7130DC6 for ; Wed, 12 Sep 2018 07:59:41 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Wed, 12 Sep 2018 07:55:39 -0700 From: Jim Schaad To: 'Russ Housley' , 'Massimiliano Pala' CC: 'SPASM' , 'Erik Andersen' References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> In-Reply-To: <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> Date: Wed, 12 Sep 2018 07:59:34 -0700 Message-ID: <018c01d44aa9$39b79cd0$ad26d670$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_018D_01D44A6E.8D5BF920" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheKWvEJQw Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 14:59:46 -0000 ------=_NextPart_000_018D_01D44A6E.8D5BF920 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Russ, =20 There are two easy ways to indicate this. The first would be to = allocate multiple oids =20 oid-One-Is-Ok-Multi-Sig oid-All-Required-Multi-Sig =20 The second would be to put a int value before the sequence of signature = oids with the number of signatures that needed to validate so you could = do 3 of n need to validate. =20 Jim =20 =20 From: Spasm On Behalf Of Russ Housley Sent: Wednesday, September 12, 2018 5:13 AM To: Massimiliano Pala Cc: SPASM ; Erik Andersen Subject: Re: [lamps] Double signatures =20 Max: =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 On Sep 11, 2018, at 4:45 PM, Max Pala > wrote: =20 Hi All, =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers, Max =20 --- =20 Cheers, Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ......, altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ...... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_000_018D_01D44A6E.8D5BF920 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Russ,

 

There are = two easy ways to indicate this.=C2=A0 The first would be to allocate = multiple oids

 

oid-One-Is-Ok-Multi-Sig

oid-All-Required-Multi-Sig

 

The second = would be to put a int value before the sequence of signature oids with = the number of signatures that needed to validate so you could do 3 of n = need to validate.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> On Behalf Of Russ = Housley
Sent: Wednesday, September 12, 2018 5:13 = AM
To: Massimiliano Pala = <M.Pala@cablelabs.com>
Cc: SPASM <spasm@ietf.org>; = Erik Andersen <era@x500.eu>
Subject: Re: [lamps] Double = signatures

 

Max:

 

During a transition to quantum-resistant signatures, a = signer wants to put a traditional signature and a quantum-resistant = signature on an object.  Given your description of keyUsage = and extendedKeyUsage, both would have the digitalSignature bit set. =  How does a client know if just one or both signatures must be = valid?

 

As Jim Schaad already said, RFC 5752 talks about = this issue when a CMS SignedData contains more than one = SignerInfo.

 

Russ

 



On Sep 11, 2018, at 4:45 PM, Max Pala <M.Pala@cablelabs.com> = wrote:

 

Hi = All,

 <= /o:p>

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 <= /o:p>

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 <= /o:p>

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 <= /o:p>

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 <= /o:p>

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 <= /o:p>

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 <= /o:p>

What do you = think?

 <= /o:p>

Cheers,=

Max

 <= /o:p>



---

 <= /o:p>

Cheers,=

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately, =E2=80=9Cnot every combination needs to = be covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees.  I would rather avoid all those = discussions and the unnecessary work they = represent.

 

I = personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 

-Tim

 

From: Santosh Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik = Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 

Thanks = Tim.

 

There are ways to = accommodate your concern.

 

One way to handle this = is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and = define the relying party rules in terms of its ability to process one or = all ALG IDs.

 

Another way to do this = is not every combination needs to be covered and the user community = defines its own  Alg ID Xi which maps to a SEQUENCE of ALG = IDs.

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?

 

You need N_c x N_pq algorithm identifiers just to = handle the simple hybrid use case where a single classical algorithm is = being used in conjunction with a single post-quantum = algorithm.

 

And there are people who want to use multiple = post-quantum algorithms to hedge against potential yet to be discovered = weaknesses in post-quantum algorithms.

 

I=E2=80=99m not really looking forward to trying to = allocate or manage O(N_c x N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Hi = Santosh,

 

You have = proposed something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; 'Ryan = Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 

Why not let algorithm = identifier dictate the number of signatures and their = syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Ryan,

 

The discussion in London dealt with a completely = different proposal than this one.  While I think there are problems = with this that need to be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this considered to be a preferred solution to = defining a new signature algorithm which contains as the parameter the = sequence of algorithm identifiers and as the signature value a sequence = of signature values.  The problem with just defining the extension = to SIGNED is that one needs to make sure that the set of signature = algorithms and parameters are also part of the data to be signed and I = am not seeing that highlighted here.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi = Folk,

 

In ITU-T we have plans to allow for = double signatures using the SIGNED parametrized data type defined in = X.509 to cope with situation as described in the internet draft: = =E2=80=9CMultiple Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED = data type as shown below:

 

SIGNED{ToBeSigned} = ::=3D SEQUENCE {

  COMPONENTS OF = SIGNATURE,

  ......,

  = altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH = COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know = that IETF is not a heavy user of this data = type.

 

We have no intention to use this = extended data type for certificates and = CRLs.

 

For your information, SIGNATURE is = defined as:

 

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ...... = }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials= /minutes-101-lamps-01.txt - that fundamentally = questioned that approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

------=_NextPart_000_018D_01D44A6E.8D5BF920-- From nobody Wed Sep 12 14:01:47 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B3B2130DD5 for ; Wed, 12 Sep 2018 14:01:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cablelabs.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ohauAqjsqFCw for ; Wed, 12 Sep 2018 14:01:38 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0094.outbound.protection.outlook.com [104.47.40.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20A2A130EA9 for ; Wed, 12 Sep 2018 14:01:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cablelabs.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EqGL1dsyM0osvIBhKjk7xdxl7haKHiTDs6ozqMW0gtg=; b=fmc8cRZYfod2xAUnLKyzLh71szis/YDhcMjvjvPevbnIuWly4ELHUrp2cUcouy8GL427i1320Wyll5o2dgMH4svvscgb4hv099ZK0L4gYxBXukQfQIaWNCmy6JROLkFnzBnjJTiY2VtCH04ulU1k7x5kNUd7U0X+py3buMNSgbw= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=M.Pala@cablelabs.com; Received: from Maxs-MacBook-Pro.local (192.160.73.16) by SN6PR06MB3886.namprd06.prod.outlook.com (2603:10b6:805:1c::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1122.17; Wed, 12 Sep 2018 21:01:32 +0000 To: Russ Housley Cc: SPASM , Erik Andersen References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> From: Massimiliano Pala Openpgp: preference=signencrypt Autocrypt: addr=m.pala@cablelabs.com; prefer-encrypt=mutual; keydata= xsFNBFpzbjkBEADcaK4LIm2K+btBx3RBL1mbxkiXd2lY6B0aUiliykcth1WlbajO5JpI2DjA xacE3ynOeQslva3Y2WoBSMEcTqF4d+c09Uw/+GqtKQvSO6rPvuyT1/4ibeipUQhBD4SAWDii HAJS30jtFWPqWLMyjemFROxJnJAHf8rvMppq1ZinCRADFvuTUipV5OzD4KThH63bRsmH/yfh nPfaGDGcIkhX1K8ooXhjQuCoARMPCz7KWjjqdabxY+kdB9JkZxTMezcWUphNoXqrvvUo2igp RXpF40QDbJVC+5c5VEA7C6VfWSJuTeS2YmiahLdUDvz8R/VRoi0eQcQP4hugECUcb+T/+r9R dNcVnOl4Wv4ZDvGWmaiNupm3L4T3RmODfvdeNlAfdpFUhr6+phBqUYXeI3WmeHAj3Da0t+Lj eUemMGPkxlxuH6npbUYP2KngA8yYKZw6h48POzriF19U+QfrIeJxLfH9Bpe82OeG6W9srEVb UedG/0I1depD6EHb415ap5dktYlgQvp0tpI4p4XYf8HQJ4I0lCEPsKpG8hfrFppSS8EpskEC hIXJjwaTlI7ve5mMLEiVp60h48/sCAvBhx6AEHZt+UEX8FND2FO8+g8qB9mSgv+S3/4D7TCw FtWu6fV91StDtEW9sw7nr08gra2jz9Xd/Ept7et9xyb/LBmTMwARAQABzShNYXNzaW1pbGlh bm8gUGFsYSA8bS5wYWxhQGNhYmxlbGFicy5jb20+wsGUBBMBCAA+FiEE7tpc4hFswtYW7GFR QznkRk1SfM8FAlpzbjkCGyMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQQznk Rk1SfM87IA/9GeQoGwHvPi4wVK92jbQlVF91UTks8rSlP8VBkuMAqYKJ7Ex08E6uav3+rnw3 AnM3YMvSVQWefD2O1sdSr4p9ZqqYVz15FR1N0pfbnfKu6QoXkPKdeh8Lsg5ZPIo5Kgf+Ijvg YCoCYv8OGKsr5/pS5W3DHrRWo37JgecQPVS0mBnmmYVXmVO/OudEUQvjGiaKx/AkmBSRq4se 6D+q8sfNtInUOmFVT6dV04v7qZn3fq8UqiOlxBRjxJ/SJfPUXbqMAS8vJgmtNiSHQCwQ5xOy PyAMfBYLUgbUAQNNVBJjtBSd+6eAvUuHmC/P8lvQzT+n4gQ/WA21xF5trXksOE+eEuED4Y9B dS5XdSkikMBJy7JNxzdceLGevPXObe/4lt9mTxUCG3/7g+UMH0HPgsShHBycDEmrY4x05g5H D0c+qvTBNTk2NjjU8ZPjWRPfEqB+w85thbFeEB1PUk8hK4A+YzFbwm3ixJGEI4Jcep3WvK3Q ua3DOcprbFzFeoc9kjdXyQaciR3i/I6tvYcPfSImCajndaeDyIKOb1xAhd6nw8vds4GByXCT /VzWiUlKYGIem8CVYWfageTugxSSDtkpDGn+xCYwJKXkU6uRUpMxtdMQ4go76PHzJqWm+p3D Q11LV2tBxOyYA6TrnxAgFehc/BiejJZowUUerWJ627PCXWvOwU0EWnNuOQEQANLmB7iOz1ol CR5FRU8v/beWcJqymqKDEAoJQ7u0FsHsjvfQmdc0kZs/JxB5OG3Qvg1RknOy64g1+BYJ3+uT gBNH95Q9W1iVtdfyNiH/4LjNSZN4qH8rJ+nft/nm3ixWkYfw2jRssXpCZ4kSVplSURZuYIk5 f9LYey0BH2Tvo69tCPD/qhtzcppD5nCk8Wxxi2CU05de1nok4Jmk1XTMNHdHfOzqWJUXVU0T aUKjJICbIaEsid5rUZZbSJHk5x0ewI4++xWyBHFWpgtqiaD4aDY+WDcT+zBcoxMvYokC4T28 SrRL0RaQHH7VKB1dEwULGQt4r4lA+u8psxUB497LxYkRX/DLzcDX9w410VAQWG2Li9yDIAUD O1EVoJzU5xvGBmRYJuycJ9drUduhlu/Uqr5rT515S4ysO8DlpIpDhhslF9MVwr6nUbCBWAUm +qSTRpoBPnvY8wN8kmQ1vu+xpMybBsMrVB73PKZs1w5qB7G6YZcFwY+22dXPpp2jg58rozz0 BAq7YhRHuTzKQwlJVN0q28RCZamTnYucdotJ/51fST3XokdTcUj/JzdyWTWKJHVRtWhxgxem izomaDC7AFN/EXEVopRbwaIKGs9Vft0Ufr7j1HnDSIUZjQkO1bIXNhhJQYLgxc51MAZFzbPb M21y8h4tSlRb3f5lHcKp0tpFABEBAAHCwXwEGAEIACYWIQTu2lziEWzC1hbsYVFDOeRGTVJ8 zwUCWnNuOQIbDAUJCWYBgAAKCRBDOeRGTVJ8z9BYD/4lTTc5YXbMzSTOtkfhdYO2MYNv2QfU FTN1af0JjcReNZm4T1aGFijsy5xM31P/Wqnq9T+H+AnPQ9er22gtyw3dcUvQ/x+16i0utzsd zQJNTPty5K22cUrGBOQvaOdc8uSYPC94VYTFCQ9lMmPWMZKcAgwE03YzzAeks06QHJHIUbv0 /iabu6VO2emNvnCVuNbrbzMGpYihlvKJS+H+QcQueZ6CU+YypS/yyf3FHnp1xPJmRWtYc7vh 7VpIPSQYReeQ0eZwZvRxuCUjg5td7qqBz7AKw3PxQu1wnn/3mO+ofy3tfotbEm2kRDt9G/gq 4Qn7GwvDLPzDEdF/dPBOMxNFhr4vmJ36AwgkOajw97Lie2Q+P9r5/rwhgbFTjc5Bm4Kr5SPn 3Q3td2frq4tF0E/6R71SiLoGhZKt2QPjp7zv30Ogzy0FkAsCsjFo6hy3XmRd+/NY0Ye1auQJ YZtGgM5YDaj87iqj/7tKrcwGtMSuXK+bvsni3FB4zJShiQicqYifSCnXeRk4CSM/U8bW4JZO GBIduSJ9In2mx/e0m2YAT+kuprqQcFL60i6qaTi9dLm3Qu40+kgLu39/O9D0b5biuvzxIIsd +O+s8s6OVH+XCG5DSX6b9jRrKb/62JD1O2wOAuA/zmGfNXrEgSDiUBLMkD0UUTyjkrWRVrWn PZ7WIw== Organization: CableLabs Message-ID: Date: Wed, 12 Sep 2018 15:01:25 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030502080809000507070707" X-Originating-IP: [192.160.73.16] X-ClientProxiedBy: MWHPR20CA0040.namprd20.prod.outlook.com (2603:10b6:300:ed::26) To SN6PR06MB3886.namprd06.prod.outlook.com (2603:10b6:805:1c::31) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 02340667-eedb-446f-299b-08d618f2ec2b X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:SN6PR06MB3886; X-Microsoft-Exchange-Diagnostics: 1; SN6PR06MB3886; 3:sVHFnn8aUod4OMBDKxpOfSnXpvfWrRgMIRokdUJKSe4u8FiQvhD+7uWrBe3VSfYPzgwww3szbqSb0EeKmU46y946c+QraQAWYvMVTXgzvcaTeoXl1ZXx12uqLnSmbDLpTzEicQ2ZNvbvljrIXGKSfzhtqOgLQqR3n5dL9TQ292hlwJGrQG7qrGQi1pY0ONtvWGIcdLro4cjCzMKI3mSh3c6tkHgygnxKNs8avlYmc3n2maNHbvS5BK88x4z/o8uc; 25:Fv2xurgzgp/W/9vemXS54yxc/GgQHbPu+mHbeHx1SOxQ4EaUxajl8mozGreAUx9QAt0w1ti50TyzcwgbEQjHro11J1R7QaMLv97fk1H+AeNTX35ic8NGj1c8zGA16h97YNVbV4HwPUD4IsW8DlKwvtctZodWnV2ySEGCv/L0TjVJfXhmaceYaSsjK4V8nXHCHLBYrynFTVCk9g+uN/0mFGKV6JzahMFBqdyB1Wv0H+wJ9dOKZR3ej+DC7s6gknwr27ljemxdJxaUeUqhYDMJV58bR4HcevvRFtmLitlkSApycDT+Rl9iSx2RvBvF8X+NATB8ybpFCztQkuG92UL3ew==; 31:7LRMPy5x1Vo7VJFmJXqc6CLNakLp65m/o/Alem1McK4KHaJmc3vYB4WUgREN3ayg7zO7xmEde26uc3C6QgdecP+HcWq6hvPFcFTJB8W+W2ioBTjKey3onZWNt/t5qAO8Iu+Pl1TYPj+XJLwilksq941XFrQqV1iNMRq/4h2wnDutCvD0ez6j4kP69NUvYXI11Bk+E4V/yZaBdmpt3LtHbn2HxaGAo4OrhVXZnTKxTLY= X-MS-TrafficTypeDiagnostic: SN6PR06MB3886: X-Microsoft-Exchange-Diagnostics: 1; SN6PR06MB3886; 20:HBOJzKuyjMu5CSloHHK/v02FBFNR8nR5ZGbikxXKcrdf4vsH7iuCSlX9Mq0E4hku2xKpcnLXXO3f+NQ1w/Se1X6peJw8PDw5Qg03631prFeh6Cuufm0M4Sm1S4CSooPYnauos48qW08F5g1MpYv4Ou/ZlC8wnalyWSFHvdWveCQ9U8yQipBlmTHkQ0Gl2rapKhkypmahLeKG71nKesCyhUlCvt7xBc1fjpbnbaX3ZF3PPm/db7jt/nYEfmgV8shZrTfwfVfAknXD8ADBifHVitD++V78iHluPH+TErNf6Ig1iY+zLNY8Xto05AbR5JTnzlxgKr/RpKor4MF2yhzrXBcPLtLIeceCKs7fzhUv/6adTojtSgO5sLIs18Tud641FRiTkGRR4fMZkTMGki0DJ/oRzX+hAw/HKmGjzBhDjcul1/JH11/jSbebJpYYgS2/l10NTvSCPD8RGYznzEzpqWfXHNYAvZfE4jZGbbuJ6CRNMVkaCMh9dc2WfyNLMvgJ; 4:zgxB/Y1JaOOxsg9xsVfOAwFujWQbn7bSM9WQAQ24jEUfibcj2BlQvHRwB/luNiNvMZslWxZcIHtlYtpzDAEgbRytyX0oprOJy9UROVU+ENVlaLko4akos3T6ADqa2wBREhyW0LXugy8yH2GwZYgykyARnMnHfBK6uyqAGe5bzk7Xz0nVIzzzv94GSFmLf05FYWCKgV1V5ryCC9lydkNKLTnt5r5QlV/nLQ0xZ8Pr0iQQcqgyAB+odElS31j2/0qHmQFUXvHQa5xt9QG9PvRr9a87rQVMmFXfS3wy/c1XkuXx3y573baLRQTXiC1LqElJaRIEdOA80PtyH1Nz7DtiC6DO9rDkvQcEiNmAo6Nrh4rNJXox4QRecSnK3A7mgHY2 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(120809045254105)(192374486261705)(85827821059158); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(102415395)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231311)(944501410)(52105095)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(201708071742011)(7699050); SRVR:SN6PR06MB3886; BCL:0; PCL:0; RULEID:; SRVR:SN6PR06MB3886; X-Forefront-PRVS: 07935ACF08 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(376002)(346002)(396003)(366004)(39850400004)(136003)(189003)(199004)(51444003)(53754006)(97736004)(16526019)(76176011)(6486002)(36916002)(33964004)(81156014)(966005)(478600001)(72206003)(52116002)(316002)(58126008)(8936002)(16586007)(68736007)(81166006)(54906003)(53936002)(236005)(54896002)(6306002)(54556002)(31686004)(66066001)(65806001)(106356001)(16200700003)(65956001)(53946003)(84326002)(6512007)(105586002)(6916009)(561944003)(26005)(6666003)(36756003)(733005)(2616005)(476003)(8676002)(956004)(486006)(25786009)(4326008)(31696002)(6246003)(86362001)(186003)(11346002)(2906002)(65826007)(5024004)(14444005)(3846002)(606006)(6116002)(5660300001)(446003)(7736002)(53546011)(6506007)(229853002)(93886005)(386003)(64126003)(568964002)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR06MB3886; H:Maxs-MacBook-Pro.local; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; Received-SPF: None (protection.outlook.com: cablelabs.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; SN6PR06MB3886; 23:2yuQMQp9wiB6AHuVT13+UgPVzrLUgRdBm4XlHloe9?= =?us-ascii?Q?kStZyfxt38E65I1rHVuEV+r+PYicC9Q1c6z2c/kgTLz74WSi0fvR5nGNUl9v?= =?us-ascii?Q?wikHf7mmAHPj7dHTqo3qMNUY3eKMRkNknSYWn4R6/f5cyXerAKe4r/3Pp164?= =?us-ascii?Q?loUX9MfBeAl4NP8IF949hyuq9vjHrVaIGiiF0YZ95OsZ4bDxz/5o1Ppg9szf?= =?us-ascii?Q?FHIZ+wwrRMx0Mk2nEfHxyleIKaZgcSNopRrUHtSYlIG3smiIbgPm7aEQt2+A?= =?us-ascii?Q?+KEUwGOMzgFxPuOqRgr+SyiokJx3vJG1qo/BKMUPepRvsOtm4ovFUkgu9+Ql?= =?us-ascii?Q?R6QiJqcXhhxdO8G0R+whH59gw5e7SvqUY2v6D07EHZ7R/aAVIXurQrkLtDi8?= =?us-ascii?Q?znGiT+vt8WX2D5/R3WPo+d67WG+5J8KLgnUYWOWZ4X/bVbg2CvJRVDBrs969?= =?us-ascii?Q?+dsChE7dx9/k2zt7O7T5245Rl7wdnoLRYwBzx+c4sJsEdO6p8JY26ExDHEhG?= =?us-ascii?Q?RSX26Mca+MrMIrjapDknGlwtf3LyvXMyEb/Ns/eHYmHRi03i1hOS/GfgNN4f?= =?us-ascii?Q?3RNmrZwvsT7ejYlKfapB4N15VyRT4Lqux+O5Q6SzRW1T+kHlX7/j/zx9eA1D?= =?us-ascii?Q?W8GczkkARzJ5WVgHWSY7mCSEv6sY/5QPQFY6zQa3FBf6jhbO31Uwh86uU+mh?= =?us-ascii?Q?aPzDO4NqOvurveypd9iRSLiJFCCr/WAQYNWb51wWkNPb+OdoKJhzpcx7oF7n?= =?us-ascii?Q?fmKHoLLTQTIZFY0VQ5rQWfZrjbMYZDkeI4vcNnMhYSPspxZ0EQwgCcZZS9tI?= =?us-ascii?Q?p2f4xXuM+7oB8VvbWp43GxAjmzuH4YSaqI5BSWyGvgqz6dYPvACFUVjwatQP?= =?us-ascii?Q?frBgLSwOY+t4YaKlna5j8qwnQmGG9yA7lRwwRrWPxh7lfO7nlsYbqH3Q5yGt?= =?us-ascii?Q?TyFxaGfsOgyWPewc2rZhE0drmadS0LqD4VJxoSTDj2C6i2lrHqrm1WJtoyOZ?= =?us-ascii?Q?zL/mhGEczBVh0DApwXK5nFILC8C6uOAI0Zm9ajMW3uOrul7QRxSrqpa/MIBo?= =?us-ascii?Q?CDHbFKaHhoSOBwLLny8VErD/eSlozOUt2kt4t89JsCNbc2cR5lyxki27ysrI?= =?us-ascii?Q?9j9ixcJ3xc+SdkkhuxHmfmHsyqw/qRrARwQzXABgqZnbsZMArPFPzk3Y1T72?= =?us-ascii?Q?gcj1Fts4x0LAVlVoGulp8J/709quefDmbCM7HS3t0AC/cWk5IvH3tGLzOEiR?= =?us-ascii?Q?nhw7YNOvRooMFE9/kI78RD1MBBoiJzWN+Urzc0h1cC7bcan7FAxyogrbWgZr?= =?us-ascii?Q?aTMC6wkEBOe3HL2argqCq+XfwG1maAJwKmGl7xgwtPC+wNPDBo/RGCEl0cDr?= =?us-ascii?Q?A7fTRtM9MF7oJA5DHJRoDBjbnc+oKmm6GlBAL0S+oOTNOZgxlWIHH7GSDHkt?= =?us-ascii?Q?ZKRnfDqZDxnjVyaB6+4e952+TIW2ckyn/iCRK7H1NxIJ4hXjb5IJFMoloxJ1?= =?us-ascii?Q?KWI7THCWaf/MzXPDFg9DtlfL/wpqCH1wfYMdkdxHUwpGkixylP5aQ409QY0W?= =?us-ascii?Q?RlBnhvFGx7jFmXDEQREnDwOEkNTf8LaNdT2Aciko827QG2QwZXpxW39JFQdP?= =?us-ascii?Q?MllacrrtPe1ai/u8J9t2OBPiTtA87Ga/KbQ47jFHki2AVttAS1T4dPe8jwAB?= =?us-ascii?Q?hzYpPA1TIGQlGcRiNl3zFTZi9q4F4QS5pWepIaT0cnKsnY=3D?= X-Microsoft-Antispam-Message-Info: q1eDFXmMIVbYImFcXyJTlKO/nf9pUQtNNul0ga2DCRCeReUyBwtTjPLgG7NtS53jsSndHNNu6MeE3+PrMMwNzlD0wggTNZQQxhbUs42UFgIpBdEez2bdDJbAQH/21wgtKzYA8HD5p1LrzKzGH4vbWh+Xj7kg27yV6uYgPxT/Tc7VBwjzPth6LQhx+jnL5yUh4mmoAKDxUA7P/U2B8BBgp8CvuDqyXkWnj7I5yomXiokNhDXEoH54KANAVZaJ6V1Ar32aXQcFyQZpBiBo0OLc49DZEhzllCSH0QMGfHXqkYQK0jlWeYO90Ya7eBfdj/CxS9ayBq3Rd+3vOaQDsov+dm/JMMUh/91Zb3un4DXoh+s= X-Microsoft-Exchange-Diagnostics: 1; SN6PR06MB3886; 6:BpdOvfoEjMRv/nBXDAUiWySAWOA0DuT4bbU55cU59gj9fRzf3+nu4LlhEiOYT40Gs+lVetWOseIA8wUYqggyaTlw+sMfgOY6O9IMDP8hjoObV0296TDJyEtDqhTCyoPSWcbtUuoCjEeJM6wg2wyh4qjgVLc/DVngpi5mv/auCk3oulNlsXasmm1+H1BvGgT/tqlmrWRP8MIldMKnHOBg7/V0ORZreJMEOVEWuhQXuHB873EzmSItPbXdjNV+1I7OC9iIXl0kP9+8bBqepcBzEVa2tO3Xgow1NgphWjvpYXjPPhyFb7AMZ1WFigJCeu3RjZmhJP9Am9wpZwMc6MfiYZ/yc6CHF9hUwG93LLYpkkSzNylVajnmcb/Wz1FwGLNu7HRNzwt96Q5qVwFT019yKo8Krt/5uuhW4hcedKdLH/lsE5BTdx6kc6jCwkdBHOg59OeSJmO1XSFFxo4lw9vRCg==; 5:wxBanq+AvQhzykvkDnGz/yoiKWOCQTPOPp/IV8qAd2qw80V3gFeeynCL9zNrCu+9CaO33uvEHnLxPBEi+2Ql0O0Pqp3afNck/z7rhwCsAP2GgzEKOKDR8n5IHKWGGx1/ndl4Spbvu1yHZfnMxt7+fZ5DJPAF4sPtlhYOGk1g3/c=; 7:LOt4GTsvdL/8lmJs6twqsHHP6VJs9ahz56F98nZFXcT5Fa/+9+61EFdFWrhPzjJEulD7iRgYCIHsK5R4pmX2BcPh6ehPO6EeP/bvi1cCQs5TIrOPy9T+v/pS+BGQkE+1+aQ9gJCZcsjNt9ns+ZIQYblJ7vmhtBxQpJskc393qHSAJXruoJNtRsQexc0mKr/2R85LIFJVVwW9tA5B+a63tcnOWemhDpA06Kej7yp1WNGxtEcilFjORKWAvcQd4L7y SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; SN6PR06MB3886; 20:ChGZ5VDlLV4MggelYwuXzfHJlLSrbs7BjV+CCTKRl593+RgngllydW6eUnsDK7dCe7/+eZ4E3f8E/Q0LsUUPVjcQ61JjxeICgRmiwqjn9sgolLZ5Ny6ONZEz6Qm9TnWA2JwTyKCBva9qmQPitjhwZIbAcMsPcfAysOjaRse7zoA= X-OriginatorOrg: cablelabs.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Sep 2018 21:01:32.3364 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 02340667-eedb-446f-299b-08d618f2ec2b X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: ce4fbcd1-1d81-4af0-ad0b-2998c441e160 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR06MB3886 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 21:01:45 -0000 --------------ms030502080809000507070707 Content-Type: multipart/alternative; boundary="------------71C2FCCEECC31262D8355D04" Content-Language: en-US This is a multi-part message in MIME format. --------------71C2FCCEECC31262D8355D04 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Russ, all, my personal position is that the signer MUST use all the keys that have digitalSignature set, the verifier shall verify all the signatures for which it does have support for. The rationale for this is that if I certify a public key in the certificate, you should be able to use the private key to generate the signature, therefore the approach is the same as usual: sign with your key. In this case, it just happens that to generate the signature you have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a question of what is the threshold that is acceptable for the application (in terms of risk) in case it does not support all of the algorithms that are used to generate the composite signature. Ideally it would verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could be a good idea - the use of the two OIDs is another way to go to codify the validation process required. Technically, that makes sense to me, however I am conflicted as this approach requires that the signer has an understanding of what the verifier's capabilities are... I think that defining two OIDs for the signatures could still be useful because the signer might then decide the "recommended"/"intended" verification behavior... I can see some use-cases that might have a composite key with { RSA, EC } and the "Must-Verify-All" OID for the signature, and another use-case where we have a composite key with { RSA, HASH-BASED } and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max On 9/12/18 6:12 AM, Russ Housley wrote: > Max: > > During a transition to quantum-resistant signatures, a signer wants to > put a traditional signature and a quantum-resistant signature on an > object. =C2=A0Given your description of=C2=A0keyUsage and extendedKeyUs= age, both > would have the digitalSignature bit set. =C2=A0How does a client know i= f > just one or both signatures must be valid? > > As Jim Schaad already said, RFC=C2=A05752 talks about this issue when a= CMS > SignedData contains more than one SignerInfo. > > Russ > > >> On Sep 11, 2018, at 4:45 PM, Max Pala > > wrote: >> >> Hi All, >> >> I am working on a similar - but different - solution, in particular I >> solve the issue of (a) being able to combine more than one public >> key, (b) only one (actually two) OIDs required, and (c) simply the >> processing by re-utilizing the same data structures we have today. >> >> I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and =E2= =80=9Ccomposite >> signature=E2=80=9D. >> >> The first one encodes in the key value=E2=80=99s BITSTRING the DER val= ue of >> the SEQUENCE of public keys (each of which is a the >> subjectPublicKeyInfo structure) and uses a specific OID that >> identifies the public key type. The parameters of the compositeKey >> algorithm can be used to encode the keyUsage and the extendedKeyUsage >> for each of the keys in the composite key. >> >> The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D= case where >> the value of the signature is the DER representation of the SEQUENCE >> of signatures made with each of the keys. >> >> As soon as I have some spare time, I will submit the draft - maybe >> this could be discussed in Bangkok? >> >> This simple idea allows us to have all the other procedures related >> to PKIs work - this means we can combine ECC with RSA or with a >> Quantum-Resistant algorithm (when finally available and >> standardized). A step forward for the deployment of hybrid-PKIs where >> multiple Lagos for keys can be used to authenticate data, certs, >> revocation data, etc... we plan to use this in our infrastructures to >> provide a transitional path for post-Quantum transition and to >> further improve the algorithm-agility capability of PKIs. >> >> What do you think? >> >> Cheers, >> Max >> >> >> >> >> --- >> >> Cheers, >> Max >> On Sep 11, 2018, at 8:38 AM, Tim Hollebeek >> > wrote= : >> >>> Unfortunately, =E2=80=9Cnot every combination needs to be covered=E2=80= =9D >>> introduces a lot of politics around choosing which combinations >>> =E2=80=9Cneed to be covered=E2=80=9D, a subject on which inevitably n= ot everyone >>> agrees.=C2=A0 I would rather avoid all those discussions and the >>> unnecessary work they represent. >>> =C2=A0 >>> I personally don=E2=80=99t think a single AlgID which implies a SEQUE= NCE of >>> ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral >>> equivalent.=C2=A0 For simple hybrid use cases, there is also a lot of= >>> value in having the classical algorithm ID being the same as it >>> usually is, to allow easier interoperability with older systems that >>> don=E2=80=99t understand the newer algorithms (and can blissfully ign= ore them). >>> =C2=A0 >>> -Tim >>> =C2=A0 >>> *From:*=C2=A0Santosh Chokhani >> >=C2=A0 >>> *Sent:*=C2=A0Tuesday, September 11, 2018 10:29 AM >>> *To:*=C2=A0Tim Hollebeek >> >; 'Erik Andersen' >> >; 'SPASM' >> >;=C2=A0x500standard@freelists.org >>> >>> *Subject:*=C2=A0RE: [lamps] Double signatures >>> =C2=A0 >>> Thanks Tim. >>> =C2=A0 >>> There are ways to accommodate your concern. >>> =C2=A0 >>> One way to handle this is defining a single Alg ID A which implies a >>> SEQUENCE of ALG IDs and define the relying party rules in terms of >>> its ability to process one or all ALG IDs. >>> =C2=A0 >>> Another way to do this is not every combination needs to be covered >>> and the user community defines its own =C2=A0Alg ID Xi which maps to = a >>> SEQUENCE of ALG IDs. >>> =C2=A0 >>> *From:*=C2=A0Spasm [mailto:spasm-bounces@ietf.org]=C2=A0*On Behalf Of= =C2=A0*Tim >>> Hollebeek >>> *Sent:*=C2=A0Tuesday, September 11, 2018 10:03 AM >>> *To:*=C2=A0Erik Andersen >; 'SPASM' >>> >;=C2=A0x500standard@freelists= =2Eorg >>> >>> *Subject:*=C2=A0Re: [lamps] Double signatures >>> =C2=A0 >>> Doesn=E2=80=99t the combinatoric explosion render this completely imp= ractical? >>> =C2=A0 >>> You need N_c x N_pq algorithm identifiers just to handle the simple >>> hybrid use case where a single classical algorithm is being used in >>> conjunction with a single post-quantum algorithm. >>> =C2=A0 >>> And there are people who want to use multiple post-quantum >>> algorithms to hedge against potential yet to be discovered >>> weaknesses in post-quantum algorithms. >>> =C2=A0 >>> I=E2=80=99m not really looking forward to trying to allocate or manag= e O(N_c >>> x N_pq^3) algorithm identifiers=E2=80=A6 >>> =C2=A0 >>> -Tim >>> =C2=A0 >>> *From:*=C2=A0Spasm >> >=C2=A0*On Behalf Of=C2=A0*Erik Anders= en >>> *Sent:*=C2=A0Tuesday, September 11, 2018 3:10 AM >>> *To:*=C2=A0'SPASM' >> >;=C2=A0x500standard@freelists.org >>> >>> *Subject:*=C2=A0Re: [lamps] Double signatures >>> =C2=A0 >>> Hi Santosh, >>> =C2=A0 >>> You have proposed something like this before. It still puzzling in >>> my brain. As I understand, it requires that we define a particular >>> algorithm that has a parameter that includes the things you suggest. >>> It is worthy to be analysed. >>> =C2=A0 >>> Erik >>> =C2=A0 >>> *Fra:*=C2=A0Spasm [mailto:spasm-bounces@ietf.org]=C2=A0*P=C3=A5 vegne= af=C2=A0*Santosh >>> Chokhani >>> *Sendt:*=C2=A010 September 2018 19:18 >>> *Til:*=C2=A0'Jim Schaad' >> >; 'Ryan Sleevi' >>> >;=C2=A0era@x500.e= u >>> >>> *Cc:*=C2=A0'SPASM' >> >;=C2=A0x500standard@freelists.org >>> >>> *Emne:*=C2=A0Re: [lamps] Double signatures >>> =C2=A0 >>> Why not let algorithm identifier dictate the number of signatures >>> and their syntax? >>> =C2=A0 >>> *From:*=C2=A0Spasm [mailto:spasm-bounces@ietf.org]=C2=A0*On Behalf Of= =C2=A0*Jim Schaad >>> *Sent:*=C2=A0Monday, September 10, 2018 1:07 PM >>> *To:*=C2=A0'Ryan Sleevi' >> >;=C2=A0era@x500.eu = >>> *Cc:*=C2=A0'SPASM' >> >;=C2=A0x500standard@freelists.org >>> >>> *Subject:*=C2=A0Re: [lamps] Double signatures >>> =C2=A0 >>> Ryan, >>> =C2=A0 >>> The discussion in London dealt with a completely different proposal >>> than this one.=C2=A0 While I think there are problems with this that = need >>> to be dealt with they are mostly not the same set. >>> =C2=A0 >>> Erik, >>> =C2=A0 >>> Why is this considered to be a preferred solution to defining a new >>> signature algorithm which contains as the parameter the sequence of >>> algorithm identifiers and as the signature value a sequence of >>> signature values.=C2=A0 The problem with just defining the extension = to >>> SIGNED is that one needs to make sure that the set of signature >>> algorithms and parameters are also part of the data to be signed and >>> I am not seeing that highlighted here. >>> =C2=A0 >>> Jim >>> =C2=A0 >>> =C2=A0 >>> *From:*=C2=A0Spasm >> >=C2=A0*On Behalf Of=C2=A0*Ryan Sleevi= >>> *Sent:*=C2=A0Monday, September 10, 2018 8:53 AM >>> *To:*=C2=A0era@x500.eu >>> *Cc:*=C2=A0SPASM >> >;=C2=A0x500standard@freelists.org >>> >>> *Subject:*=C2=A0Re: [lamps] Double signatures >>> =C2=A0 >>> >>> =C2=A0 >>> >>> On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen >> > wrote: >>> >>> Hi Folk, >>> =C2=A0 >>> In ITU-T we have plans to allow for double signatures using the >>> SIGNED parametrized data type defined in X.509 to cope with >>> situation as described in the internet draft: =E2=80=9CMultiple >>> Public-Key Algorithm X.509 Certificates >>> (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D >>> =C2=A0 >>> We suggest to enhance the SIGNED data type as shown below: >>> =C2=A0 >>> *SIGNED{ToBeSigned} ::=3D SEQUENCE {* >>> *=C2=A0 COMPONENTS OF SIGNATURE,* >>> *=C2=A0 ......,* >>> *=C2=A0 altAlgorithmIdentifier=C2=A0 >>> AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,* >>> *=C2=A0 altSignature=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 BIT STRING OPTIONAL=C2=A0* >>> *=C2=A0=C2=A0**}=C2=A0(WITH COMPONENTS {..., altAlgorithmIdentifi= er PRESENT, >>> altSignature PRESENT } |* >>> *=C2=A0=C2=A0=C2=A0=C2=A0 WITH COMPONENTS {..., altAlgorithmIdent= ifier ABSENT,=C2=A0 >>> altSignature ABSENT } )* >>> *=C2=A0* >>> We are open to comments. We know that IETF is not a heavy user >>> of this data type. >>> =C2=A0 >>> We have no intention to use this extended data type for >>> certificates and CRLs. >>> =C2=A0 >>> For your information, SIGNATURE is defined as: >>> =C2=A0 >>> *SIGNATURE ::=3D SEQUENCE {* >>> *=C2=A0 algorithmIdentifier=C2=A0 AlgorithmIdentifier{{SupportedA= lgorithms}},* >>> *=C2=A0 signature=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 BIT STRING,* >>> *=C2=A0 ...... }* >>> >>> =C2=A0 >>> From the discussions in London (101), there were a number of >>> challenges identified during the discussion >>> -=C2=A0https://datatracker.ietf.org/meeting/101/materials/minutes-101= -lamps-01.txt=C2=A0- >>> that fundamentally questioned that approach. >>> =C2=A0 >>> Has the ITU-T addressed or resolved those concerns? Are they not >>> applicable for some reason specific to ITU-T?=C2=A0 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm > --=20 Best Regards, Massimiliano Pala, Ph.D. CableLabs Principal Architect Security Services, R&D --------------71C2FCCEECC31262D8355D04 Content-Type: multipart/related; boundary="------------3F683B87D8887B932A2A98DA" --------------3F683B87D8887B932A2A98DA Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hi Russ, all,

my personal position is that the signer MUST use all the keys that have digitalSignature set, the verifier shall verify all the signatures for which it does have support for.

The rationale for this is that if I certify a public key in the certificate, you should be able to use the private key to generate the signature, therefore the approach is the same as usual: sign with your key. In this case, it just happens that to generate the signature you have to generate multiple ones and then combine them together.

For the application that verifies those signatures, it is always a question of what is the threshold that is acceptable for the application (in terms of risk) in case it does not support all of the algorithms that are used to generate the composite signature. Ideally it would verify all, but it may decide to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I think it could be a good idea - the use of the two OIDs is another way to go to codify the validation process required. Technically, that makes sense to me, however I am conflicted as this approach requires that the signer has an understanding of what the verifier's capabilities are... I think that defining two OIDs for the signatures could still be useful because the signer might then decide the "recommended"/"intended" verification behavior... I can see some use-cases that might have a composite key with { RSA, EC } and the "Must-Verify-All" OID for the signature, and another use-case where we have a composite key with { RSA, HASH-BASED } and for the signature "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max


On 9/12/18 6:12 AM, Russ Housley wrote= :
Max:

During a transition to quantum-resistant signatures, a signer wants to put a traditional signature and a quantum-resistant signature on an object. =C2=A0Given your description of=C2=A0keyUsage and extendedKeyUsage, both would h= ave the digitalSignature bit set. =C2=A0How does a client know if j= ust one or both signatures must be valid?

As Jim Schaad already said, RFC=C2=A05752 talks a= bout this issue when a CMS SignedData contains more than one SignerInfo.

Russ


On Sep 11, 2018, at 4:45 PM, Max Pala <<= a href=3D"mailto:M.Pala@cablelabs.com" class=3D"" moz-do-not-send=3D"true">M.Pala@cablelabs.com> wrote:

Hi All,

I am working on a similar - but different - solution, in particular I solve the issue of (a) being able to combine more than one public key, (b) only one (actually two) OIDs required, and (c) simply the processing by re-utilizing the same data structures we have today.<= /div>

I particular, I define a =E2=80=9Ccompo= site public key=E2=80=9D and =E2=80=9Ccomposite signature=E2= =80=9D.

The first one encodes in the key value=E2= =80=99s BITSTRING the DER value of the SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo structure) and uses a specific OID that identifies the public key type. The parameters of the compositeKey algorithm can be used to encode the keyUsage and the extendedKeyUsage for each of the keys in the composite key.

The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D case where the = value of the signature is the DER representation of the SEQUENCE of signatures made with each of the keys.

As soon as I have some spare time, I will submit the draft - maybe this could be discussed in Bangkok?

This simple idea allows us to have all the other procedures related to PKIs work - this means we can combine ECC with RSA or with a Quantum-Resistant algorithm (when finally available and standardized). A step forward for the deployment of hybrid-PKIs where multiple Lagos for keys can be used to authenticate data, certs, revocation data, etc... we plan to use this in our infrastructures to provide a transitional path for post-Quantum transition and to further improve the algorithm-agility capability of PKIs.

What do you think?

Cheers,
Max




---

Cheers,
Max
On Sep 11, 2018, at 8:38 AM, Tim Hollebeek <t= im.hollebeek@digicert.com> wrote:

Unfortunately, =E2=80=9Cnot every combination= needs to be covered=E2=80=9D introduces a lot of po= litics around choosing which combinations =E2=80=9Cn= eed to be covered=E2=80=9D, a subject on which inevi= tably not everyone agrees.=C2=A0 I would rather avo= id all those discussions and the unnecessary work they represent.
=C2=A0
I personally don=E2=80=99t think a single Alg= ID which implies a SEQUENCE of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral equivalent.=C2=A0 For simple hybrid= use cases, there is also a lot of value in having the classical algorithm ID being the same as it usually is, to allow easier interoperability with older systems that don=E2=80=99t understand the newer algorithms= (and can blissfully ignore them).<= /o:p>
=C2=A0
-Tim
=C2=A0
From:=C2=A0= Santosh Chokhani <s= antosh.chokhani@gmail.com>=C2=A0=
Sent:=C2=A0= Tuesday, September 11, 2018 10:29 AM
To:=C2=A0= Tim Hollebeek <t= im.hollebeek@digicert.com>; 'Erik Andersen' <e= ra@x500.eu>; 'SPASM' <s= pasm@ietf.org>;=C2=A0= x= 500standard@freelists.org
Subject:=C2=A0= RE: [lamps] Double signatures
=C2=A0
Thanks Tim.
=C2=A0
There are ways to accommodate your concern.
=C2=A0
One way to handle this is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and define the relying party rules in terms of its ability to process one or all ALG IDs.
=C2=A0
Another way to do this is not every combination needs to be covered and the user community defines its own =C2=A0Alg ID Xi which maps to a SEQUENCE = of ALG IDs.
=C2=A0
From:=C2=A0= Spasm [m= ailto:spasm-bounces@ietf.org]=C2=A0= On Behalf Of=C2= =A0Tim Hollebeek
Sent:=C2=A0= Tuesday, September 11, 2018 10:03 AM
To:=C2=A0= Erik Andersen <e= ra@x500.eu>; 'SPASM' <s= pasm@ietf.org>;=C2=A0= x= 500standard@freelists.org
Subject:=C2=A0= Re: [lamps] Double signatures
=C2=A0
Doesn=E2=80=99t the combinatoric explosion = render this completely impractical?
=C2=A0
You need N_c x N_pq algorithm identifiers just to handle the simple hybrid use case where a single classical algorithm is being used in conjunction with a single post-quantum algorithm.
=C2=A0
And there are people who want to use multiple post-quantum algorithms to hedge against potential yet to be discovered weaknesses in post-quantum algorithms.
=C2=A0
I=E2=80=99m not really looking forward to t= rying to allocate or manage O(N_c x N_pq^3) algorithm identifiers=E2=80=A6
=C2=A0
-Tim
=C2=A0
From:=C2= =A0Spasm <spasm-bounces@ietf.org>=C2= =A0On Behalf Of=C2= =A0Erik Andersen
Sent:=C2= =A0Tuesday, September 11, 2018 3:10 AM
To:=C2= =A0'SPASM' <spasm@ietf.org>;=C2= =A0x500standard@freelists.org
Subject:=C2= =A0Re: [lamps] Double signatures
=C2=A0
Hi Santosh,
=C2=A0
You have proposed something like this before. It still puzzling in my brain. As I understand, it requires that we define a particular algorithm that has a parameter that includes the things you suggest. It is worthy to be analysed.
=C2=A0
Erik
=C2=A0
Fra:=C2= =A0Spasm [mailto:spasm-bounces@ietf.org]=C2= =A0P=C3=A5 vegne af=C2=A0Santosh Chokhani
Sendt:=C2= =A010 September 2018 19:18
= Til:=C2= =A0'Jim Schaad' <ietf@augustcellars.com>; 'Ryan Sleevi' <ryan-ietf@sleevi.com>;=C2= =A0era@x500.eu
Cc:=C2= =A0'SPASM' <spasm@ietf.org>;=C2= =A0x500standard@freelists.org
Emne:=C2= =A0Re: [lamps] Double signatures
=C2=A0
Why not let algorithm identifier dictate the number of signatures and their syntax?
=C2=A0=
From:=C2= =A0Spasm [mailto:spasm-bounces@ietf.org]=C2= =A0On Behalf Of=C2= =A0Jim Schaad
Sent:=C2= =A0Monday, September 10, 2018 1:07 PM
To:=C2= =A0'Ryan Sleevi' <ryan-ietf@sleevi.com>;=C2= =A0era@x500.eu
Cc:=C2= =A0'SPASM' <spasm@ietf.org>;=C2= =A0x500standard@freelists.org
Subject:=C2= =A0Re: [lamps] Double signatures
=C2=A0
Ryan,
=C2=A0
The discussion in London dealt with a completely different proposal than this one.=C2=A0 While I think there are proble= ms with this that need to be dealt with they are mostly not the same set.
=C2=A0
Erik,
=C2=A0
Why is this considered to be a preferred solution to defining a new signature algorithm which contains as the parameter the sequence of algorithm identifiers and as the signature value a sequence of signature values.=C2=A0 The problem with just defining the extension to SIGNED is that one needs to make sure that the set of signature algorithms and parameters are also part of the data to be signed and I am not seeing that highlighted here.
=C2=A0
Jim
=C2=A0
=C2=A0
From:=C2= =A0Spasm <spasm-bounces@ietf.org>=C2= =A0On Behalf Of=C2=A0Ryan Sleevi
Sent:=C2= =A0Monday, September 10, 2018 8:53 AM
To:=C2= =A0era@x500.eu
Cc:=C2= =A0SPASM <spasm@ietf.org>;=C2= =A0x500standard@freelists.org
Subject:=C2= =A0Re: [lamps] Double signatures
=C2=A0

= =C2=A0

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@= x500.eu> wrote:
Hi Folk,
=C2=A0
In ITU-T w= e have plans to allow for double signatures using the SIGNED parametrized data type defined in X.509 to cope with situation as described in the internet draft: =E2=80=9CMultiple Public-= Key Algorithm X.509 Certificates (draft-truskovsky-lamps-p= q-hybrid-x509-01)=E2=80=9D
=C2=A0
We suggest= to enhance the SIGNED data type as shown below:
=C2=A0
SIGNED{T= oBeSigned} ::=3D SEQUENCE {=
=C2=A0 COMPONENTS OF SIGNATURE,
=C2=A0 .= =2E....,
=C2=A0 altAlgorithmIdentifier=C2= =A0 AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,
=C2=A0 altSignature=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 BIT STRING OPTIONAL=C2=A0=
=C2=A0=C2= =A0}=C2=A0(WITH COMPONENTS {..., altAlgorithmIdentifie= r PRESENT, altSignature PRESENT } |=
=C2=A0=C2= =A0=C2=A0=C2=A0 WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT,=C2=A0 altSignat= ure ABSENT } )
=C2=A0
We are ope= n to comments. We know that IETF is not a heavy user of this data type.
=C2=A0
We have no= intention to use this extended data type for certificates and CRLs.
=C2=A0
For your information, SIGNATURE is defined as:
=C2=A0
SIGNATUR= E ::=3D SEQUENCE {=
=C2=A0 algorithmIdentifier=C2=A0= AlgorithmIdentifier{{Su= pportedAlgorithms}},
=C2=A0 signature=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 BIT STRING,<= span class=3D"" lang=3D"EN-GB"= >
=C2=A0 .= =2E.... }
=C2=A0
From the discussions in London (101), there were a number of challenges identified during the discussion -=C2=A0http= s://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt=C2=A0- that fundamentally questio= ned that approach.<= /o:p>
=C2=A0
Has the ITU-T addressed or resolved those concerns? Are they not applicable for some reason specific to ITU-T?=C2=A0=
________________________= _______________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/l= istinfo/spasm


--
Best Regards,
Massimiliano Pala, Ph.D.
3D"CableLabs"
Principal Architect
Security Services, R&D
--------------3F683B87D8887B932A2A98DA Content-Type: image/png; name="onfaljhbanohkmil.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="onfaljhbanohkmil.png" iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURB VFjDldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZY kUSr2FxBIC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9 GQJJtNLTINfoodpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6M tN1XWkVq4Z5rgvNyskJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoX fEXABSGJIX6Xh3tgXWR+DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTO McuxqLHE1Y7X2Q1WglYWR6eEaAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/ O9Ivc7rTY7oRpmkua7lvkBC9jdZfoe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejt x3pqZru5FtuckzcJNYkiXWKgk/zHCmtVRTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4 us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KCCUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4 OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd18qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1h EpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVOAzvzklKjFTTQ6B6Xp/X1ISdY4OwG yAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX30M3N7jA4hqSNGGCSF03R1gRz Yln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNOyOjn1ri5kaX7nI2sSo9Y 5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZTxhtVgxOe5SpNC6t J6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75eNl6lvq4HXvc l05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfgKPBHXXPJ TT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21+gev b+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6y tRFDUGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/ g/XqABXZVr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0Yz O+xCc30ty+1kUtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTI aJcvwxO0tKURt5dob4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXu jaG1TJeycYH+jcI7xi2xPO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2 QiPygEuc54kDhxQSlyu0VGmcKaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD 0+dWqcG5lsa3o2W0irHmN5GEQy2NPnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKz xgMoqdJKReZEQYOkfi43AdSux2Ng/pAk0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7 RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZVRfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M 9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOqjEt/JzYpi2GWKHCp7mbWlUZREtKiGKbc kEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719RrdFmMtAS1BC0LaHIM95vQGfu7xaKrJ varOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlYVkc9bTQ2vRASF3nD8yoUOUuF W+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHLB+n5aOcyrWw21/fcYqAC 75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinSxTmG6Wy7xRZ4R1dX mWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkAAAAASUVORK5C YII= --------------3F683B87D8887B932A2A98DA-- --------------71C2FCCEECC31262D8355D04-- --------------ms030502080809000507070707 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CyEwggUzMIIEG6ADAgECAhATnkhzdWn0ywJFdVf2rIxeMA0GCSqGSIb3DQEBCwUAMIGXMQsw CQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxm b3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJTQSBD bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xODA1MjEwMDAw MDBaFw0xOTA1MjEyMzU5NTlaMCUxIzAhBgkqhkiG9w0BCQEWFG0ucGFsYUBjYWJsZWxhYnMu Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA69RrkFnA/CSKdHQ2mPDYnHFG oR2PbTcqUIN60c/xi8EbzmrvaI602cHGG4AiGuCgNLmEJEIurEH6MvHVcPoQ6ZFSRPc8VCAE 7iQwQPn7TNSn6K7wULDcDf1R+JQ/YaDwi4ReKTpiQds6K+IXle3S7RhUs0blz8H+9awH5S5l VLNsf1IAuORJgpAVwxjmQRasF/ctBoXHmsUzXFEnvJTpsmtBv0xgVIY0LFw/I1B0e7L6AtoG 3mji/8B9kDyiijq0XTwn5fbJtlyhW7iuiwpbaKnS4iC/Rm9j9XXUTamdWzZHZNNcFDetDb8h DlLBVJDgHv/+jJNenK7ZAhp82RbhawIDAQABo4IB6jCCAeYwHwYDVR0jBBgwFoAUgq9sjPjF /pZhfOgfPStxSF7Ei8AwHQYDVR0OBBYEFDSbzaKD5rO9kWU3bvC2B9Oxo1RpMA4GA1UdDwEB /wQEAwIFoDAMBgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsGAQUFBwMEBgsrBgEEAbIxAQMF AjARBglghkgBhvhCAQEEBAMCBSAwRgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggr BgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUuY29tb2RvLm5ldC9DUFMwWgYDVR0fBFMwUTBPoE2g S4ZJaHR0cDovL2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBQ2xpZW50QXV0aGVudGljYXRp b25hbmRTZWN1cmVFbWFpbENBLmNybDCBiwYIKwYBBQUHAQEEfzB9MFUGCCsGAQUFBzAChklo dHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5j b20wHwYDVR0RBBgwFoEUbS5wYWxhQGNhYmxlbGFicy5jb20wDQYJKoZIhvcNAQELBQADggEB AA3iulH4NjqgiYUFV69xmNR92R2kpegVIxkdkdBiMins9xfoqcRv4Xq3EZwqF+Arp4Xuce4V OZ+k3Za+ndj0hE63DWOunipTqPEMccXQIXTUTrkzC1JSW4R4iahhaRzTA6RIO5TP0gZuz1FH mqe1uX9kmoZ01EyhG7diWJyP5ALOVzl6ibhDu1AHTYH5po6NkeKRrki6YZJEw7T4mDSR734n v030PJ8rHEn4SiTNRqrHdiHAqeAfNE7whz7p4a7gWUlESl4MZlrlC0lr17AtWrLp0fi8Ig8Q gbz2LFkaqa9Y5iBWqTx7Z452GJsAdi8P/koz4u1bMUsPstTOwdtYI5kwggXmMIIDzqADAgEC AhBqm+E4O/8ra58B1dm4p1JWMA0GCSqGSIb3DQEBDAUAMIGFMQswCQYDVQQGEwJHQjEbMBkG A1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFD T01PRE8gQ0EgTGltaXRlZDErMCkGA1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1 dGhvcml0eTAeFw0xMzAxMTAwMDAwMDBaFw0yODAxMDkyMzU5NTlaMIGXMQswCQYDVQQGEwJH QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYD VQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJTQSBDbGllbnQgQXV0 aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAL6znlesKHZ1QBbHOAOY08YYdiFQ8yV5C0y1oNF9Olg+nKcxLqf2NHbZhGra 0D00SOTq9bus3/mxgUsg/Wh/eXQ0pnp8tZ8XZWAnlyKMpjL+qUByRjXCA6RQyDMqVaVUkbIr 5SU0RDX/kSsKwer3H1pT/HUrBN0X8sKtPTdGX8XAWt/VdMLBrZBlgvnkCos+KQWWCo63OTTq Rvaq8aWccm+KOMjTcE6s2mj6RkalweyDI7X+7U5lNo6jzC8RTXtVV4/Vwdax720YpMPJQaDa ElmOupyTf1Qib+cpukNJnQmwygjD8m046DQkLnpXNCAGjuJy1F5NATksUsbfJAr7FLUCAwEA AaOCATwwggE4MB8GA1UdIwQYMBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSC r2yM+MX+lmF86B89K3FIXsSLwDAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIB ADARBgNVHSAECjAIMAYGBFUdIAAwTAYDVR0fBEUwQzBBoD+gPYY7aHR0cDovL2NybC5jb21v ZG9jYS5jb20vQ09NT0RPUlNBQ2VydGlmaWNhdGlvbkF1dGhvcml0eS5jcmwwcQYIKwYBBQUH AQEEZTBjMDsGCCsGAQUFBzAChi9odHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9SU0FB ZGRUcnVzdENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0G CSqGSIb3DQEBDAUAA4ICAQB4XLKBKDRPPO5fVs6fl1bsj6JrF/bz9kkIBtTYLzXN30D+03Hj 6OxCDBEaIeNmsBhrJmuubvyE7HtoSmR809AgcYboW+rcTNZ/8u/Hv+GTrNI/AhqX2/kiQNxm gUPt/eJPs92Qclj0HnVyy9TnSvGkSDU7I5Px+TbO+88G4zipA2psZaWeEykgzClZlPz1FjTC kk77ZXp5cQYYexE6zeeN4/0OqqoAloFrjAF4o50YJafX8mnahjp3I2Y2mkjhk0xQfhNqbzlL WPoT3m7j7U26u7zg6swjOq8hITYc3/np5tM5aVyu6t99p17bTbY7+1RTWBviN9YJzK8HxzOb XYWBf/L+VGOYNsQDTxAk0Hbvb1j6KjUhg7fO294F29QIhhmiNOr84JHoy+fNLpfvYc/Q9EtF OI5ISYgOxLk3nD/whbUe9rmEQXLp8MB933Ij474gwwCPUpwv9mj2PMnXoc7mbrS22XUSeTwx CTP9bcmUdp4jmIoWfhQm7X9w/Zgddg+JZ/YnIHOwsGsaTUgj7fIvxqith7DoJC91WJ8Lce3C VJqb1XWeKIJ84F7YLXZN0oa7TktYgDdmQVxYkZo1c5noaDKH9Oq9cbm/vOYRUM1cWcef20Wk yk5S/GFyyPJwG0fR1nRas3DqAf4cXxMiEKcff7PNa4M3RGTqH0pWR8p6EjGCBDUwggQxAgEB MIGsMIGXMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09N T0RPIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQE55I c3Vp9MsCRXVX9qyMXjANBglghkgBZQMEAgEFAKCCAlkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3 DQEHATAcBgkqhkiG9w0BCQUxDxcNMTgwOTEyMjEwMTI1WjAvBgkqhkiG9w0BCQQxIgQgZkJl bFoFdtunU1GYySImgfKz3y8AaH0W0H8oexZUM6YwbAYJKoZIhvcNAQkPMV8wXTALBglghkgB ZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG 9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBvQYJKwYBBAGCNxAEMYGvMIGsMIGX MQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT YWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJT QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQE55Ic3Vp9MsC RXVX9qyMXjCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQI ExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9E TyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlv biBhbmQgU2VjdXJlIEVtYWlsIENBAhATnkhzdWn0ywJFdVf2rIxeMA0GCSqGSIb3DQEBAQUA BIIBAMyAgxCwCEK3757RKLT5uiFF4TxjEiLteBX8SA/9LouPvteWO8dtShkkAGaR/yQv5sZ4 zMcLOKg0Lw0EBEMUl0dZbpjms72tjCkxp7HAR325bOVYKQ7wNmsnoDXSf+jlHaJB0zaT0E1Z cIxpkcTw30hii5kXViazuUQ0GL1JC+qVCs2YNApuLYId/AXNRNXak7b/NNzOvqlXkd9/mQU3 Z34wkQNHWaZ6ShnG0c4HeGKqPrfGTZ8tWh3c0MA5ixlMv5kb9JVQB6GHOHYSoPyyQWYVeuga r02PoCrzXkatkFeAkATzE19Y8mgXH7a9dkvKWKp1FxcJy65od2osmXTSUssAAAAAAAA= --------------ms030502080809000507070707-- From nobody Wed Sep 12 14:13:27 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96ABE130E76 for ; Wed, 12 Sep 2018 14:13:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NsnoY-kwy38t for ; Wed, 12 Sep 2018 14:13:22 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26710130DFA for ; Wed, 12 Sep 2018 14:13:22 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 5325ABE3E for ; Wed, 12 Sep 2018 22:13:20 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vtTm_j50szWr for ; Wed, 12 Sep 2018 22:13:18 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B06D3BE39 for ; Wed, 12 Sep 2018 22:13:18 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1536786798; bh=9jlXeb8xyibZo0glCaRZtUBQiYUc8Fj1zjRqY21LMHA=; h=Subject:To:References:From:Date:In-Reply-To:From; b=OtCCd6KSxtyP1Hj49QyVLH3o3jOljfKM9zmSyN2ZwiRFy89cneuXMBPYGIGlLSAah Z+1SnxO6KIEKN0mPYxCr9hd0PifzjBYQYVOqEIat0jr1iJDd8ljwq8/qnbtl3l6jDZ NhNGthKeaxc6pmzpytLT3IFIaGYY2Wer6PzEaaSQ= To: LAMPS References: <005a01d44916$7c9cb560$75d62020$@x500.eu> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 12 Sep 2018 22:13:18 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <005a01d44916$7c9cb560$75d62020$@x500.eu> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LI4A9Xql272tLyGjiMeKYCzVsu5EvxF7w" Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 21:13:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LI4A9Xql272tLyGjiMeKYCzVsu5EvxF7w Content-Type: multipart/mixed; boundary="UIA774sxD1KD3CNwgY4tluLTkI1hM3ko6"; protected-headers="v1" From: Stephen Farrell To: LAMPS Message-ID: Subject: Re: [lamps] Double signatures References: <005a01d44916$7c9cb560$75d62020$@x500.eu> In-Reply-To: <005a01d44916$7c9cb560$75d62020$@x500.eu> --UIA774sxD1KD3CNwgY4tluLTkI1hM3ko6 Content-Type: multipart/mixed; boundary="------------461BB881419B92ED3A263CF4" Content-Language: en-GB This is a multi-part message in MIME format. --------------461BB881419B92ED3A263CF4 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Not really replying to Erik (though I agree with Sean's comments), but before adopting any work on multiple signatures in x.509, I'd much prefer for the IETF to consider whether there are other/better ways to handle these issues. TBH, that's partly because I'm pretty bored with x.509 (the first code I wrote for x.509 was >25 years ago;-), but substantively, it may be that other solutions could be better. For example, CT as-deployed didn't really try to solve the problem of mis-issuance from within the x.509 framework, and has arguably been one of the most positive developments in PKI in recent years. S. On 10/09/18 15:56, Erik Andersen wrote: > Hi Folk, >=20 > =20 >=20 > In ITU-T we have plans to allow for double signatures using the SIGNED > parametrized data type defined in X.509 to cope with situation as descr= ibed > in the internet draft: "Multiple Public-Key Algorithm X.509 Certificate= s > (draft-truskovsky-lamps-pq-hybrid-x509-01)" >=20 > =20 >=20 > We suggest to enhance the SIGNED data type as shown below: >=20 > =20 >=20 > SIGNED{ToBeSigned} ::=3D SEQUENCE { >=20 > COMPONENTS OF SIGNATURE, >=20 > ..., >=20 > altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} > OPTIONAL, >=20 > altSignature BIT STRING OPTIONAL =20 >=20 > } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature= > PRESENT } | >=20 > WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature= > ABSENT } ) >=20 > =20 >=20 > We are open to comments. We know that IETF is not a heavy user of this = data > type. >=20 > =20 >=20 > We have no intention to use this extended data type for certificates an= d > CRLs. >=20 > =20 >=20 > For your information, SIGNATURE is defined as: >=20 > =20 >=20 > SIGNATURE ::=3D SEQUENCE { >=20 > algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, >=20 > signature BIT STRING, >=20 > ... } >=20 > =20 >=20 > Erik >=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm >=20 --------------461BB881419B92ED3A263CF4 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------461BB881419B92ED3A263CF4-- --UIA774sxD1KD3CNwgY4tluLTkI1hM3ko6-- --LI4A9Xql272tLyGjiMeKYCzVsu5EvxF7w Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAluZgW4ACgkQWrL68XsX K+p9iA/+O885xih+Eriqjesp3iYQAM0gAmehyoAMcZtS1ERzpyPtYolE1CQ+l2/4 C9tY1aHHMjJRyKrf6IPSd1BcO8AJhY6Dale7vUfETP3Xz6p1vlH0CD4H++8xEk8o SnkUQlLn4kVKfatBAYkfBUSpTjcdr952lgjLWkxm7COPNAJ2RpiI6yBZAwUWXY8o RGzTM7nLskdi/2dic2U4WDa4lQyGwqqfkDcZuzw1+VzSrfv0CRiLYaK/I+MxcCnv IpbVcMq4U1bO8o+Fyyncw4FC2CKkw4r67teNh1EciLRONctUwzRIACrwkgJ8pQI3 xxP9VT/RWwy8uUemW8IS6hwWU74vN+T4RH7fLm9mVME5YtwP+iwjV3vJmfUST5fy /dbtqF3ywUG0+XxCNMnCfbasGfkzwx0kya4Db8k7BS2j18B0M8qpiw/knJHULyD6 sgEm2VO/Jy8RgFDyJ9O4ww+Imu4Nr1fCGQ5Jp8ypgiV1eEfi2tNFejcyLxnL9UcF Ze3sUjI1jeuO97d1qPgG79Vkav22O2XU1NWP+WydAn3qN+/DV4pO3MuJlb7DCPoc YJDFzCENuex3BVlONf1owDdgQyWo554gMZBDr3pU0wxnyQpTHD+oohyhE/GokiMy JKQivB2Z79qRp+gAmWt1AMyCKUFL6K+Jj8QtxAKXfNborLPQ69M= =oW9f -----END PGP SIGNATURE----- --LI4A9Xql272tLyGjiMeKYCzVsu5EvxF7w-- From nobody Wed Sep 12 14:47:34 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABC45130D7A for ; Wed, 12 Sep 2018 14:47:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T4r70v-eQms0 for ; Wed, 12 Sep 2018 14:47:30 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6FEE126F72 for ; Wed, 12 Sep 2018 14:47:29 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id z125-v6so2069100qkb.12 for ; Wed, 12 Sep 2018 14:47:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:thread-index:content-language; bh=adeTu7iQyJIs3f8IhFTTv7TTYVbWzcfzKpFpdF3+Gts=; b=m0pl23JbS6qRxdPyPGTaoGIvEczkyqgKhz3KikT4NKha8afKKI9L9uIlPl1+oLMq7V 2H2fHk6zSwJgIvogBJ3mKyj7PUa1og0Otwz0FmNLOon0m0moTuSg6F9ppJ85EVm8hjD7 sLh6hFaHCqSn9I6jRJH1APyj4Buck+APzJe0jbEsA4raYrWnjSYDajzhPw/X8DiHpIwo aZp/fxGo3Ycv4kRnn7/pD12pP4jgWi88aEcXCWPqWmIucqT2sHUwCQKMP4tJbNgD5LQg qpFroOxrVX7VBAjgdjqdkmx1KUEQqktvTswM2GhtE1EtKJpbNxiGTwk/bavyzQIqFsrl 9TYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:references:in-reply-to:subject:date :message-id:mime-version:thread-index:content-language; bh=adeTu7iQyJIs3f8IhFTTv7TTYVbWzcfzKpFpdF3+Gts=; b=dZKAVm7DnyiWv7MrSYQ5Lhrgeoq+bgttVcNTlVtIJKDcA8/VEbMAE2y4fGtxhdaLhZ sPB5jPFHmxwt0urs8U+pAFY8OvJuRlMI/chYhzp76pkEGHq8mdC4rLJ/2hi6gPZSTiKD jqDR5CtVrccsV5P7GZZ7MdBdUs48KISb/f1WEA0PmuTtjQT22NIbsX7G+xhwhMl6kJ0c OIEYEGZyRRrWqwdjRFn2W9PTXCh5wLxeosAXcik/yWbGsk9/zI8AWawI0mCCTIg2sswM Wutn1dOpLimnGiV2WLBJoS16D1ZXxhMqBCA4LKccuWRIBC0lvY14mJWtbcJN/m2zYjh7 HPzg== X-Gm-Message-State: APzg51Bf0CC0inbEA0EVZlB2tc4Xtk0akJQJ8FhOVOeCI9I4S4bq2F9U XYyPOfLVFp5n34bYPsldMaygsqVh X-Google-Smtp-Source: ANB0VdYpRGFjeWmzco7IuqXjgnYBmRyq9L3yL1cLfdpMSV/jHrzhFKbsdXs99a7JafxW1bsO8qjc8A== X-Received: by 2002:a37:71c7:: with SMTP id m190-v6mr3058037qkc.275.1536788848713; Wed, 12 Sep 2018 14:47:28 -0700 (PDT) Received: from SantoshBrain (pool-173-73-191-57.washdc.fios.verizon.net. [173.73.191.57]) by smtp.gmail.com with ESMTPSA id 45-v6sm1366618qtt.89.2018.09.12.14.47.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 12 Sep 2018 14:47:27 -0700 (PDT) From: "Santosh Chokhani" To: "'Jim Schaad'" , "'Russ Housley'" , "'Massimiliano Pala'" Cc: "'SPASM'" , "'Erik Andersen'" References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <018c01d44aa9$39b79cd0$ad26d670$@augustcellars.com> In-Reply-To: <018c01d44aa9$39b79cd0$ad26d670$@augustcellars.com> Date: Wed, 12 Sep 2018 17:47:26 -0400 Message-ID: <000001d44ae2$328c5930$97a50b90$@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01D44AC0.AB81E520" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheAFr+tbqpaQfvYA= Content-Language: en-us Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 21:47:33 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0001_01D44AC0.AB81E520 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable You can also add a bit map in the composite alg OID parameters field for = which ones must be verified.=20 =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Wednesday, September 12, 2018 11:00 AM To: 'Russ Housley' ; 'Massimiliano Pala' = Cc: 'SPASM' ; 'Erik Andersen' Subject: Re: [lamps] Double signatures =20 Russ, =20 There are two easy ways to indicate this. The first would be to = allocate multiple oids =20 oid-One-Is-Ok-Multi-Sig oid-All-Required-Multi-Sig =20 The second would be to put a int value before the sequence of signature = oids with the number of signatures that needed to validate so you could = do 3 of n need to validate. =20 Jim =20 =20 From: Spasm > On = Behalf Of Russ Housley Sent: Wednesday, September 12, 2018 5:13 AM To: Massimiliano Pala > Cc: SPASM >; Erik Andersen = > Subject: Re: [lamps] Double signatures =20 Max: =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 =20 On Sep 11, 2018, at 4:45 PM, Max Pala > wrote: =20 Hi All, =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers, Max =20 =20 --- =20 Cheers, Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ......, altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ...... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_000_0001_01D44AC0.AB81E520 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

You can also add a bit map in the composite alg = OID parameters field for which ones must be verified. =

 

From: Spasm = [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Wednesday, September 12, 2018 11:00 = AM
To: 'Russ Housley' <housley@vigilsec.com>; = 'Massimiliano Pala' <M.Pala@cablelabs.com>
Cc: 'SPASM' = <spasm@ietf.org>; 'Erik Andersen' = <era@x500.eu>
Subject: Re: [lamps] Double = signatures

 

Russ,

 

There are = two easy ways to indicate this.  The first would be to allocate = multiple oids

 

oid-One-Is-Ok-Multi-Sig

oid-All-Required-Multi-Sig

 

The second = would be to put a int value before the sequence of signature oids with = the number of signatures that needed to validate so you could do 3 of n = need to validate.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> = On Behalf Of Russ Housley
Sent: Wednesday, September = 12, 2018 5:13 AM
To: Massimiliano Pala <M.Pala@cablelabs.com>
C= c: SPASM <spasm@ietf.org>; Erik Andersen = <era@x500.eu>
Subject: Re: = [lamps] Double signatures

 

Max:

 

During a transition to quantum-resistant signatures, a = signer wants to put a traditional signature and a quantum-resistant = signature on an object.  Given your description of keyUsage = and extendedKeyUsage, both would have the digitalSignature bit set. =  How does a client know if just one or both signatures must be = valid?

 

As Jim Schaad already said, RFC 5752 talks about = this issue when a CMS SignedData contains more than one = SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max Pala <M.Pala@cablelabs.com> = wrote:

 

Hi = All,

 <= /o:p>

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 <= /o:p>

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 <= /o:p>

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 <= /o:p>

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 <= /o:p>

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 <= /o:p>

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 <= /o:p>

What do you = think?

 <= /o:p>

Cheers,=

Max

 <= /o:p>

 <= /o:p>

---

 <= /o:p>

Cheers,=

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately, =E2=80=9Cnot every combination needs to = be covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees.  I would rather avoid all those = discussions and the unnecessary work they = represent.

 

I = personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 

-Tim

 

From: Santosh Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik = Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 

Thanks = Tim.

 

There are ways to = accommodate your concern.

 

One way to handle this = is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and = define the relying party rules in terms of its ability to process one or = all ALG IDs.

 

Another way to do this = is not every combination needs to be covered and the user community = defines its own  Alg ID Xi which maps to a SEQUENCE of ALG = IDs.

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Doesn=E2=80=99t the combinatoric explosion render this = completely impractical?

 

You need N_c x N_pq algorithm identifiers just to = handle the simple hybrid use case where a single classical algorithm is = being used in conjunction with a single post-quantum = algorithm.

 

And there are people who want to use multiple = post-quantum algorithms to hedge against potential yet to be discovered = weaknesses in post-quantum algorithms.

 

I=E2=80=99m not really looking forward to trying to = allocate or manage O(N_c x N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Hi = Santosh,

 

You have = proposed something like this before. It still puzzling in my brain. As I = understand, it requires that we define a particular algorithm that has a = parameter that includes the things you suggest. It is worthy to be = analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; 'Ryan = Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 

Why not let algorithm = identifier dictate the number of signatures and their = syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Ryan,

 

The discussion in London dealt with a completely = different proposal than this one.  While I think there are problems = with this that need to be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this considered to be a preferred solution to = defining a new signature algorithm which contains as the parameter the = sequence of algorithm identifiers and as the signature value a sequence = of signature values.  The problem with just defining the extension = to SIGNED is that one needs to make sure that the set of signature = algorithms and parameters are also part of the data to be signed and I = am not seeing that highlighted here.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi Folk,

 

In ITU-T we have plans to allow for = double signatures using the SIGNED parametrized data type defined in = X.509 to cope with situation as described in the internet draft: = =E2=80=9CMultiple Public-Key Algorithm X.509 Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest to enhance the SIGNED = data type as shown below:

 

SIGNED{ToBeSigned} = ::=3D SEQUENCE {

  COMPONENTS OF = SIGNATURE,

  ......,

  = altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH = COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open to comments. We know = that IETF is not a heavy user of this data = type.

 

We have no intention to use this = extended data type for certificates and = CRLs.

 

For your information, SIGNATURE is = defined as:

 

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ...... = }

 

From the discussions in London (101), there were a = number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials= /minutes-101-lamps-01.txt - that fundamentally = questioned that approach.

 

Has the ITU-T addressed or resolved those concerns? = Are they not applicable for some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

------=_NextPart_000_0001_01D44AC0.AB81E520-- From nobody Fri Sep 14 05:20:34 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEEA9130E36 for ; Fri, 14 Sep 2018 05:20:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id azo6jFEPDLrE for ; Fri, 14 Sep 2018 05:20:30 -0700 (PDT) Received: from smtpscan3.dandomain.dk (smtpscan3.dandomain.dk [194.150.112.163]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3978130E35 for ; Fri, 14 Sep 2018 05:20:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 60B9FCE698 for ; Fri, 14 Sep 2018 14:20:25 +0200 (CEST) Received: from smtpscan3.dandomain.dk ([127.0.0.1]) by localhost (smtpscan3.dandomain.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3XeWvW_Vc4ah for ; Fri, 14 Sep 2018 14:20:24 +0200 (CEST) Received: from mail02.dandomain.dk (mail02.dandomain.dk [194.150.112.202]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 75B1FCF146 for ; Fri, 14 Sep 2018 14:20:24 +0200 (CEST) Received: from Morten ([62.44.134.2]) by mail02.dandomain.dk (DanDomain Mailserver) with ASMTP id 2201809141420226551; Fri, 14 Sep 2018 14:20:22 +0200 From: "Erik Andersen" To: "'SPASM'" , Cc: "'SPASM'" , References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <003101d4499d$388e9af0$a9abd0d0$@x500.eu> In-Reply-To: Date: Fri, 14 Sep 2018 14:20:20 +0200 Message-ID: <000601d44c25$4e31bb50$ea9531f0$@x500.eu> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 15.0 Content-Language: en-gb Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkBVFrfMwIDk0E+phSybjA= Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Sep 2018 12:20:33 -0000 Hi Sean, What I meant was that the optional addition to the SIGNED data type = shall be absent for the two cases. However, I am slowly coming to the = opinion that we should define a new data type and leave the SIGNED data = type as it is to avoid confusion. Best regards, Erik -----Oprindelig meddelelse----- Fra: Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Sean Turner Sendt: 12 September 2018 04:04 Til: Erik Andersen Cc: SPASM ; x500standard@freelists.org Emne: Re: [lamps] Double signatures Erik, A couple of points I=E2=80=99m hoping you might clarify: 1. You said =E2=80=9CWe have no intention to use this extended data type = for certificates and CRLs.=E2=80=9D In X.509-2016, Certificate and = CertificateList use the following ASN.1: =20 Certificate ::=3D SIGNED{TBSCertificate} =20 CertificateList ::=3D SIGNED{CertificateListContent} So to pull off what you=E2=80=99re suggesting (i.e., never using these = with Certificate and CertificateList) what exactly are going to do - = redefine Certificate and CertificateList, put some kind of constraint on = ToBeSigned in SIGNED, =E2=80=A6 ? 2. You also said "We know that IETF is not a heavy user of this data = type=E2=80=9D, where this is SIGNED. That=E2=80=99s a true statement = because the IETF initially didn=E2=80=99t make use of the = AuthenticationFramework SIGNED parameterized types because RFC 5280 uses = the =E2=80=9988 modules and parameterized types were=E2=80=99t a thing = in =E2=80=9988; in =E2=80=9988 it was a SIGNED MACRO and it was a pain = so it was redefined in a bits-on-the-wire compatible way. For those = IETF RFCs that prefer to use the =E2=80=9902 and =E2=80=9908 syntax, a = SIGNED parameterized type is defined in RFC 5912 and is used in RFCs = 5911, 5912, and 6268 (and maybe others) to define 30+ ASN.1 modules. So = while "SIGNED=E2=80=9D is not used much in the context of the 8000+ RFCs = it can be used by just about every RFC that uses ASN.1. Despite the fact SIGNED wasn=E2=80=99t defined exactly the same, they = still resulted in the same encoding, namely algorithm parameters = (OID+parameters) and signature (a bit string); same as the earlier = =E2=80=9988 syntaxes. I have this sinking feeling that making a change = to this is going to cause some problems somewhere despite the fact we = can do fancy things with the ASN.1. spt > On Sep 11, 2018, at 03:01, Erik Andersen wrote: >=20 > HI Jim, > =20 > You have a good point here that also been bothering me for the last = couple of days. I am still trying to find a way. > =20 > Erik > =20 > Fra: Jim Schaad [mailto:ietf@augustcellars.com]=20 > Sendt: 10 September 2018 19:07 > Til: 'Ryan Sleevi' ; era@x500.eu > Cc: 'SPASM' ; x500standard@freelists.org > Emne: RE: [lamps] Double signatures > =20 > Ryan, > =20 > The discussion in London dealt with a completely different proposal = than this one. While I think there are problems with this that need to = be dealt with they are mostly not the same set. > =20 > Erik, > =20 > Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. > =20 > Jim > =20 > =20 > From: Spasm On Behalf Of Ryan Sleevi > Sent: Monday, September 10, 2018 8:53 AM > To: era@x500.eu > Cc: SPASM ; x500standard@freelists.org > Subject: Re: [lamps] Double signatures > =20 > =20 >=20 > On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen wrote: >> Hi Folk, >> =20 >> In ITU-T we have plans to allow for double signatures using the = SIGNED parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D >> =20 >> We suggest to enhance the SIGNED data type as shown below: >> =20 >> SIGNED{ToBeSigned} ::=3D SEQUENCE { >> COMPONENTS OF SIGNATURE, >> ..., >> altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, >> altSignature BIT STRING OPTIONAL =20 >> } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, = altSignature PRESENT } | >> WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, = altSignature ABSENT } ) >> =20 >> We are open to comments. We know that IETF is not a heavy user of = this data type. >> =20 >> We have no intention to use this extended data type for certificates = and CRLs. >> =20 >> For your information, SIGNATURE is defined as: >> =20 >> SIGNATURE ::=3D SEQUENCE { >> algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, >> signature BIT STRING, >> ... } > =20 > From the discussions in London (101), there were a number of = challenges identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. > =20 > Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm _______________________________________________ Spasm mailing list Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm From nobody Fri Sep 14 08:49:35 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1B7D1200D7 for ; Fri, 14 Sep 2018 08:49:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.589 X-Spam-Level: X-Spam-Status: No, score=-2.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lgVK_ZonTei8 for ; Fri, 14 Sep 2018 08:49:28 -0700 (PDT) Received: from smtpscan3.dandomain.dk (smtpscan3.dandomain.dk [194.150.112.163]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5BA61200D6 for ; Fri, 14 Sep 2018 08:49:27 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 6BF843CA35 for ; Fri, 14 Sep 2018 17:49:24 +0200 (CEST) Received: from smtpscan3.dandomain.dk ([127.0.0.1]) by localhost (smtpscan3.dandomain.dk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JAOhiqCZeB8M for ; Fri, 14 Sep 2018 17:49:22 +0200 (CEST) Received: from mail02.dandomain.dk (mail02.dandomain.dk [194.150.112.202]) by smtpscan3.dandomain.dk (Postfix) with ESMTP id 9A5B43BD8A for ; Fri, 14 Sep 2018 17:49:22 +0200 (CEST) Received: from Morten ([62.44.134.2]) by mail02.dandomain.dk (DanDomain Mailserver) with ASMTP id 2201809141749209512; Fri, 14 Sep 2018 17:49:20 +0200 From: "Erik Andersen" To: "'SPASM'" , "Directory list" References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> In-Reply-To: Date: Fri, 14 Sep 2018 17:49:19 +0200 Message-ID: <002001d44c42$80388fd0$80a9af70$@x500.eu> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_0021_01D44C53.43C4BB30" X-Mailer: Microsoft Outlook 15.0 Content-Language: en-gb Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheAIUS8OepaGdCHA= Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Sep 2018 15:49:32 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0021_01D44C53.43C4BB30 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0022_01D44C53.43C4BB30" ------=_NextPart_001_0022_01D44C53.43C4BB30 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The double signature is intended as a migration tool. =20 In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle it. = Legacy systems will ignore this alternative signature. After the = migration period, there will be no alternative signature and the new = stronger signature will be the native signature. =20 Does that make sense? =20 Erik =20 Fra: Massimiliano Pala [mailto:m.pala@cablelabs.com]=20 Sendt: 12 September 2018 23:01 Til: Russ Housley Cc: SPASM ; Erik Andersen Emne: Re: [lamps] Double signatures =20 Hi Russ, all, my personal position is that the signer MUST use all the keys that have = digitalSignature set, the verifier shall verify all the signatures for = which it does have support for. The rationale for this is that if I certify a public key in the = certificate, you should be able to use the private key to generate the = signature, therefore the approach is the same as usual: sign with your = key. In this case, it just happens that to generate the signature you = have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a = question of what is the threshold that is acceptable for the application = (in terms of risk) in case it does not support all of the algorithms = that are used to generate the composite signature. Ideally it would = verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could = be a good idea - the use of the two OIDs is another way to go to codify = the validation process required. Technically, that makes sense to me, = however I am conflicted as this approach requires that the signer has an = understanding of what the verifier's capabilities are... I think that = defining two OIDs for the signatures could still be useful because the = signer might then decide the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the signature, and = another use-case where we have a composite key with { RSA, HASH-BASED } = and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max =20 On 9/12/18 6:12 AM, Russ Housley wrote: Max:=20 =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 On Sep 11, 2018, at 4:45 PM, Max Pala > wrote: =20 Hi All,=20 =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers,=20 Max =20 ---=20 =20 Cheers,=20 Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ......, altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ...... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 =20 --=20 Best Regards,=20 Massimiliano Pala, Ph.D. Principal Architect Security Services, R&D ------=_NextPart_001_0022_01D44C53.43C4BB30 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

The double signature is intended as a = migration tool.

 

In the normal operation, only one signature = is used (the native signature). When it is realized that the signature = algorithm will be too week i some future, the migration period starts = and an alternative, assuming stronger signature is provided for those = able to handle it.=C2=A0 Legacy systems will ignore this alternative = signature. After the migration period, there will be no alternative = signature and the new stronger signature will be the native = signature.

 

Does that make = sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala@cablelabs.com]
Sendt: = 12 September 2018 23:01
Til: Russ Housley = <housley@vigilsec.com>
Cc: SPASM <spasm@ietf.org>; = Erik Andersen <era@x500.eu>
Emne: Re: [lamps] Double = signatures

 

Hi Russ, = all,

my personal position is that the signer MUST use = all the keys that have digitalSignature set, the verifier shall verify = all the signatures for which it does have support = for.

The rationale for this is that if I certify a = public key in the certificate, you should be able to use the private key = to generate the signature, therefore the approach is the same as usual: = sign with your key. In this case, it just happens that to generate the = signature you have to generate multiple ones and then combine them = together.

For the application that verifies those = signatures, it is always a question of what is the threshold that is = acceptable for the application (in terms of risk) in case it does not = support all of the algorithms that are used to generate the composite = signature. Ideally it would verify all, but it may decide to verify less = (at least one).

I also saw the other e-mail from Jim on = this topic and I think it could be a good idea - the use of the two OIDs = is another way to go to codify the validation process required. = Technically, that makes sense to me, however I am conflicted as this = approach requires that the signer has an understanding of what the = verifier's capabilities are... I think that defining two OIDs for the = signatures could still be useful because the signer might then decide = the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the = signature, and another use-case where we have a composite key with { = RSA, HASH-BASED } and for the signature = "Must-Verify-At-Least-One".

Does this make = sense?

Cheers,
Max

 

On = 9/12/18 6:12 AM, Russ Housley wrote:

Max: =

 

During a transition to quantum-resistant signatures, a = signer wants to put a traditional signature and a quantum-resistant = signature on an object.  Given your description of keyUsage = and extendedKeyUsage, both would have the digitalSignature bit set. =  How does a client know if just one or both signatures must be = valid?

 

As Jim Schaad already said, RFC 5752 talks about = this issue when a CMS SignedData contains more than one = SignerInfo.

 

Russ

 



On Sep 11, 2018, at 4:45 PM, Max Pala <M.Pala@cablelabs.com> = wrote:

 

Hi All, =

 <= /o:p>

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 <= /o:p>

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 <= /o:p>

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 <= /o:p>

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 <= /o:p>

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 <= /o:p>

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 <= /o:p>

What do you = think?

 <= /o:p>

Cheers, =

Max

 <= /o:p>



--- =

 <= /o:p>

Cheers, =

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately= , =E2=80=9Cnot every combination needs to be covered=E2=80=9D introduces = a lot of politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.

 

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 

-Tim

 

From:<= /b> = Santosh = Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik = Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 

Thanks Tim.

 

There are ways to accommodate your concern.

 

One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs.

 

Another way to do this is not every combination needs to be covered and = the user community defines its own  Alg ID Xi which maps to a = SEQUENCE of ALG IDs.

 

From:<= /b> = Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Doesn=E2=80=99= t the combinatoric explosion render this completely = impractical?

 

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 

I=E2=80=99m = not really looking forward to trying to allocate or manage O(N_c x = N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From:<= /b> = Spasm <spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed.

 

Erik

 

Fra: = Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; 'Ryan = Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 

Why not let algorithm identifier dictate the number of signatures and = their syntax?

 

From:<= /b> = Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From:<= /b> = Spasm <spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

 

On Mon, Sep = 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi = Folk,

 =

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest = to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  = COMPONENTS OF SIGNATURE,

  = ......,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 

We have no = intention to use this extended data type for certificates and = CRLs.

 

For your = information, SIGNATURE is defined as:

 

SIGNATURE = ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = ...... }

 

From the = discussions in London (101), there were a number of challenges = identified during the discussion - https://datatracker.ietf.org/meeting/101/materials= /minutes-101-lamps-01.txt - that fundamentally = questioned that approach.

 

Has the = ITU-T addressed or resolved those concerns? Are they not applicable for = some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

 

-- =

Best = Regards,

Massimiliano Pala, Ph.D.

3DCableLabs
Principal Architect
Security Services, = R&D

------=_NextPart_001_0022_01D44C53.43C4BB30-- ------=_NextPart_000_0021_01D44C53.43C4BB30 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= ------=_NextPart_000_0021_01D44C53.43C4BB30-- From stie@itk.swiss Fri Sep 14 09:00:24 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27C96130F52 for ; Fri, 14 Sep 2018 09:00:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.59 X-Spam-Level: X-Spam-Status: No, score=-2.59 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3BMA0SCa-mE for ; Fri, 14 Sep 2018 09:00:19 -0700 (PDT) Received: from mail2.protonmail.ch (mail2.protonmail.ch [185.70.40.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C51CB130F2F for ; Fri, 14 Sep 2018 09:00:18 -0700 (PDT) Date: Fri, 14 Sep 2018 16:00:01 +0000 Authentication-Results: mail1.protonmail.ch; dkim=none To: era@x500.eu, spasm@ietf.org, x500standard@freelists.org From: Stiepan Reply-To: Stiepan Message-ID: In-Reply-To: <002001d44c42$80388fd0$80a9af70$@x500.eu> References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> Feedback-ID: wnsnnc8Us3MVqt1IALGduDJl-d16B_hEkg50pF7qo11mpeysEHmUOGy-yvw8MEApAPX3TXcPDHQwu7hti-kzSw==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_438b295c7fbdc64d572c5b884c212b6f" Archived-At: X-Mailman-Approved-At: Sat, 15 Sep 2018 06:37:46 -0700 Subject: Re: [lamps] [x500standard] SV: Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Sep 2018 17:05:26 -0000 This is a multi-part message in MIME format. --b1_438b295c7fbdc64d572c5b884c212b6f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 SSB0aGluayB0aGlzIG1ha2VzIGZ1bGx5IHNlbnNlIEVyaWs6CgpMZWF2aW5nIHRvbyBtdWNoIGNo b2ljZSBpcyB3aGF0IHRoZW4gbGVhZHMgdG8gYWxsIHNvcnRzIG9mIGRvd25ncmFkaW5nIGF0dGFj a3MuCgpCZXN0IHJlZ2FyZHMsClN0aWVwYW4KClN0aWVwYW4gQS4gS292YWMKUHJlc2lkZW50Cml0 ayBBVnRvYnZTIFNBUkwKSnVzc3kgKyBGcmlib3VyZwoKRW52b3nDqSBkZXB1aXMgUHJvdG9uTWFp bCBtb2JpbGUKCi0tLS0tLS0tIE1lc3NhZ2UgZCdvcmlnaW5lIC0tLS0tLS0tCk9uIDE0IHNlcHQu IDIwMTggw6AgMTc6NDksIEVyaWsgQW5kZXJzZW4gYSDDqWNyaXQgOgoKPiBUaGUgZG91YmxlIHNp Z25hdHVyZSBpcyBpbnRlbmRlZCBhcyBhIG1pZ3JhdGlvbiB0b29sLgo+Cj4gSW4gdGhlIG5vcm1h bCBvcGVyYXRpb24sIG9ubHkgb25lIHNpZ25hdHVyZSBpcyB1c2VkICh0aGUgbmF0aXZlIHNpZ25h dHVyZSkuIFdoZW4gaXQgaXMgcmVhbGl6ZWQgdGhhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB3 aWxsIGJlIHRvbyB3ZWVrIGkgc29tZSBmdXR1cmUsIHRoZSBtaWdyYXRpb24gcGVyaW9kIHN0YXJ0 cyBhbmQgYW4gYWx0ZXJuYXRpdmUsIGFzc3VtaW5nIHN0cm9uZ2VyIHNpZ25hdHVyZSBpcyBwcm92 aWRlZCBmb3IgdGhvc2UgYWJsZSB0byBoYW5kbGUgaXQuICBMZWdhY3kgc3lzdGVtcyB3aWxsIGln bm9yZSB0aGlzIGFsdGVybmF0aXZlIHNpZ25hdHVyZS4gQWZ0ZXIgdGhlIG1pZ3JhdGlvbiBwZXJp b2QsIHRoZXJlIHdpbGwgYmUgbm8gYWx0ZXJuYXRpdmUgc2lnbmF0dXJlIGFuZCB0aGUgbmV3IHN0 cm9uZ2VyIHNpZ25hdHVyZSB3aWxsIGJlIHRoZSBuYXRpdmUgc2lnbmF0dXJlLgo+Cj4gRG9lcyB0 aGF0IG1ha2Ugc2Vuc2U/Cj4KPiBFcmlrCj4KPiBGcmE6IE1hc3NpbWlsaWFubyBQYWxhIFttYWls dG86bS5wYWxhQGNhYmxlbGFicy5jb21dCj4gU2VuZHQ6IDEyIFNlcHRlbWJlciAyMDE4IDIzOjAx Cj4gVGlsOiBSdXNzIEhvdXNsZXkgPGhvdXNsZXlAdmlnaWxzZWMuY29tPgo+IENjOiBTUEFTTSA8 c3Bhc21AaWV0Zi5vcmc+OyBFcmlrIEFuZGVyc2VuIDxlcmFAeDUwMC5ldT4KPiBFbW5lOiBSZTog W2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcwo+Cj4gSGkgUnVzcywgYWxsLAo+Cj4gbXkgcGVyc29u YWwgcG9zaXRpb24gaXMgdGhhdCB0aGUgc2lnbmVyIE1VU1QgdXNlIGFsbCB0aGUga2V5cyB0aGF0 IGhhdmUgZGlnaXRhbFNpZ25hdHVyZSBzZXQsIHRoZSB2ZXJpZmllciBzaGFsbCB2ZXJpZnkgYWxs IHRoZSBzaWduYXR1cmVzIGZvciB3aGljaCBpdCBkb2VzIGhhdmUgc3VwcG9ydCBmb3IuCj4KPiBU aGUgcmF0aW9uYWxlIGZvciB0aGlzIGlzIHRoYXQgaWYgSSBjZXJ0aWZ5IGEgcHVibGljIGtleSBp biB0aGUgY2VydGlmaWNhdGUsIHlvdSBzaG91bGQgYmUgYWJsZSB0byB1c2UgdGhlIHByaXZhdGUg a2V5IHRvIGdlbmVyYXRlIHRoZSBzaWduYXR1cmUsIHRoZXJlZm9yZSB0aGUgYXBwcm9hY2ggaXMg dGhlIHNhbWUgYXMgdXN1YWw6IHNpZ24gd2l0aCB5b3VyIGtleS4gSW4gdGhpcyBjYXNlLCBpdCBq dXN0IGhhcHBlbnMgdGhhdCB0byBnZW5lcmF0ZSB0aGUgc2lnbmF0dXJlIHlvdSBoYXZlIHRvIGdl bmVyYXRlIG11bHRpcGxlIG9uZXMgYW5kIHRoZW4gY29tYmluZSB0aGVtIHRvZ2V0aGVyLgo+Cj4g Rm9yIHRoZSBhcHBsaWNhdGlvbiB0aGF0IHZlcmlmaWVzIHRob3NlIHNpZ25hdHVyZXMsIGl0IGlz IGFsd2F5cyBhIHF1ZXN0aW9uIG9mIHdoYXQgaXMgdGhlIHRocmVzaG9sZCB0aGF0IGlzIGFjY2Vw dGFibGUgZm9yIHRoZSBhcHBsaWNhdGlvbiAoaW4gdGVybXMgb2YgcmlzaykgaW4gY2FzZSBpdCBk b2VzIG5vdCBzdXBwb3J0IGFsbCBvZiB0aGUgYWxnb3JpdGhtcyB0aGF0IGFyZSB1c2VkIHRvIGdl bmVyYXRlIHRoZSBjb21wb3NpdGUgc2lnbmF0dXJlLiBJZGVhbGx5IGl0IHdvdWxkIHZlcmlmeSBh bGwsIGJ1dCBpdCBtYXkgZGVjaWRlIHRvIHZlcmlmeSBsZXNzIChhdCBsZWFzdCBvbmUpLgo+Cj4g SSBhbHNvIHNhdyB0aGUgb3RoZXIgZS1tYWlsIGZyb20gSmltIG9uIHRoaXMgdG9waWMgYW5kIEkg dGhpbmsgaXQgY291bGQgYmUgYSBnb29kIGlkZWEgLSB0aGUgdXNlIG9mIHRoZSB0d28gT0lEcyBp cyBhbm90aGVyIHdheSB0byBnbyB0byBjb2RpZnkgdGhlIHZhbGlkYXRpb24gcHJvY2VzcyByZXF1 aXJlZC4gVGVjaG5pY2FsbHksIHRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUsIGhvd2V2ZXIgSSBhbSBj b25mbGljdGVkIGFzIHRoaXMgYXBwcm9hY2ggcmVxdWlyZXMgdGhhdCB0aGUgc2lnbmVyIGhhcyBh biB1bmRlcnN0YW5kaW5nIG9mIHdoYXQgdGhlIHZlcmlmaWVyJ3MgY2FwYWJpbGl0aWVzIGFyZS4u LiBJIHRoaW5rIHRoYXQgZGVmaW5pbmcgdHdvIE9JRHMgZm9yIHRoZSBzaWduYXR1cmVzIGNvdWxk IHN0aWxsIGJlIHVzZWZ1bCBiZWNhdXNlIHRoZSBzaWduZXIgbWlnaHQgdGhlbiBkZWNpZGUgdGhl ICJyZWNvbW1lbmRlZCIvImludGVuZGVkIiB2ZXJpZmljYXRpb24gYmVoYXZpb3IuLi4gSSBjYW4g c2VlIHNvbWUgdXNlLWNhc2VzIHRoYXQgbWlnaHQgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7 IFJTQSwgRUMgfSBhbmQgdGhlICJNdXN0LVZlcmlmeS1BbGwiIE9JRCBmb3IgdGhlIHNpZ25hdHVy ZSwgYW5kIGFub3RoZXIgdXNlLWNhc2Ugd2hlcmUgd2UgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0 aCB7IFJTQSwgSEFTSC1CQVNFRCB9IGFuZCBmb3IgdGhlIHNpZ25hdHVyZSAiTXVzdC1WZXJpZnkt QXQtTGVhc3QtT25lIi4KPgo+IERvZXMgdGhpcyBtYWtlIHNlbnNlPwo+Cj4gQ2hlZXJzLAo+IE1h eAo+Cj4gT24gOS8xMi8xOCA2OjEyIEFNLCBSdXNzIEhvdXNsZXkgd3JvdGU6Cj4KPj4gTWF4Ogo+ Pgo+PiBEdXJpbmcgYSB0cmFuc2l0aW9uIHRvIHF1YW50dW0tcmVzaXN0YW50IHNpZ25hdHVyZXMs IGEgc2lnbmVyIHdhbnRzIHRvIHB1dCBhIHRyYWRpdGlvbmFsIHNpZ25hdHVyZSBhbmQgYSBxdWFu dHVtLXJlc2lzdGFudCBzaWduYXR1cmUgb24gYW4gb2JqZWN0LiAgR2l2ZW4geW91ciBkZXNjcmlw dGlvbiBvZiBrZXlVc2FnZSBhbmQgZXh0ZW5kZWRLZXlVc2FnZSwgYm90aCB3b3VsZCBoYXZlIHRo ZSBkaWdpdGFsU2lnbmF0dXJlIGJpdCBzZXQuICBIb3cgZG9lcyBhIGNsaWVudCBrbm93IGlmIGp1 c3Qgb25lIG9yIGJvdGggc2lnbmF0dXJlcyBtdXN0IGJlIHZhbGlkPwo+Pgo+PiBBcyBKaW0gU2No YWFkIGFscmVhZHkgc2FpZCwgUkZDIDU3NTIgdGFsa3MgYWJvdXQgdGhpcyBpc3N1ZSB3aGVuIGEg Q01TIFNpZ25lZERhdGEgY29udGFpbnMgbW9yZSB0aGFuIG9uZSBTaWduZXJJbmZvLgo+Pgo+PiBS dXNzCj4+Cj4+PiBPbiBTZXAgMTEsIDIwMTgsIGF0IDQ6NDUgUE0sIE1heCBQYWxhIDxNLlBhbGFA Y2FibGVsYWJzLmNvbT4gd3JvdGU6Cj4+Pgo+Pj4gSGkgQWxsLAo+Pj4KPj4+IEkgYW0gd29ya2lu ZyBvbiBhIHNpbWlsYXIgLSBidXQgZGlmZmVyZW50IC0gc29sdXRpb24sIGluIHBhcnRpY3VsYXIg SSBzb2x2ZSB0aGUgaXNzdWUgb2YgKGEpIGJlaW5nIGFibGUgdG8gY29tYmluZSBtb3JlIHRoYW4g b25lIHB1YmxpYyBrZXksIChiKSBvbmx5IG9uZSAoYWN0dWFsbHkgdHdvKSBPSURzIHJlcXVpcmVk LCBhbmQgKGMpIHNpbXBseSB0aGUgcHJvY2Vzc2luZyBieSByZS11dGlsaXppbmcgdGhlIHNhbWUg ZGF0YSBzdHJ1Y3R1cmVzIHdlIGhhdmUgdG9kYXkuCj4+Pgo+Pj4gSSBwYXJ0aWN1bGFyLCBJIGRl ZmluZSBhIOKAnGNvbXBvc2l0ZSBwdWJsaWMga2V54oCdIGFuZCDigJxjb21wb3NpdGUgc2lnbmF0 dXJl4oCdLgo+Pj4KPj4+IFRoZSBmaXJzdCBvbmUgZW5jb2RlcyBpbiB0aGUga2V5IHZhbHVl4oCZ cyBCSVRTVFJJTkcgdGhlIERFUiB2YWx1ZSBvZiB0aGUgU0VRVUVOQ0Ugb2YgcHVibGljIGtleXMg KGVhY2ggb2Ygd2hpY2ggaXMgYSB0aGUgc3ViamVjdFB1YmxpY0tleUluZm8gc3RydWN0dXJlKSBh bmQgdXNlcyBhIHNwZWNpZmljIE9JRCB0aGF0IGlkZW50aWZpZXMgdGhlIHB1YmxpYyBrZXkgdHlw ZS4gVGhlIHBhcmFtZXRlcnMgb2YgdGhlIGNvbXBvc2l0ZUtleSBhbGdvcml0aG0gY2FuIGJlIHVz ZWQgdG8gZW5jb2RlIHRoZSBrZXlVc2FnZSBhbmQgdGhlIGV4dGVuZGVkS2V5VXNhZ2UgZm9yIGVh Y2ggb2YgdGhlIGtleXMgaW4gdGhlIGNvbXBvc2l0ZSBrZXkuCj4+Pgo+Pj4gVGhlIHNhbWUgYXBw cm9hY2ggaXMgdXNlZCBmb3IgdGhlIOKAnENvbXBvc2l0ZSBTaWduYXR1cmXigJ0gY2FzZSB3aGVy ZSB0aGUgdmFsdWUgb2YgdGhlIHNpZ25hdHVyZSBpcyB0aGUgREVSIHJlcHJlc2VudGF0aW9uIG9m IHRoZSBTRVFVRU5DRSBvZiBzaWduYXR1cmVzIG1hZGUgd2l0aCBlYWNoIG9mIHRoZSBrZXlzLgo+ Pj4KPj4+IEFzIHNvb24gYXMgSSBoYXZlIHNvbWUgc3BhcmUgdGltZSwgSSB3aWxsIHN1Ym1pdCB0 aGUgZHJhZnQgLSBtYXliZSB0aGlzIGNvdWxkIGJlIGRpc2N1c3NlZCBpbiBCYW5na29rPwo+Pj4K Pj4+IFRoaXMgc2ltcGxlIGlkZWEgYWxsb3dzIHVzIHRvIGhhdmUgYWxsIHRoZSBvdGhlciBwcm9j ZWR1cmVzIHJlbGF0ZWQgdG8gUEtJcyB3b3JrIC0gdGhpcyBtZWFucyB3ZSBjYW4gY29tYmluZSBF Q0Mgd2l0aCBSU0Egb3Igd2l0aCBhIFF1YW50dW0tUmVzaXN0YW50IGFsZ29yaXRobSAod2hlbiBm aW5hbGx5IGF2YWlsYWJsZSBhbmQgc3RhbmRhcmRpemVkKS4gQSBzdGVwIGZvcndhcmQgZm9yIHRo ZSBkZXBsb3ltZW50IG9mIGh5YnJpZC1QS0lzIHdoZXJlIG11bHRpcGxlIExhZ29zIGZvciBrZXlz IGNhbiBiZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBkYXRhLCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRh LCBldGMuLi4gd2UgcGxhbiB0byB1c2UgdGhpcyBpbiBvdXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHBy b3ZpZGUgYSB0cmFuc2l0aW9uYWwgcGF0aCBmb3IgcG9zdC1RdWFudHVtIHRyYW5zaXRpb24gYW5k IHRvIGZ1cnRoZXIgaW1wcm92ZSB0aGUgYWxnb3JpdGhtLWFnaWxpdHkgY2FwYWJpbGl0eSBvZiBQ S0lzLgo+Pj4KPj4+IFdoYXQgZG8geW91IHRoaW5rPwo+Pj4KPj4+IENoZWVycywKPj4+Cj4+PiBN YXgKPj4+Cj4+PiAtLS0KPj4+Cj4+PiBDaGVlcnMsCj4+Pgo+Pj4gTWF4Cj4+PiBPbiBTZXAgMTEs IDIwMTgsIGF0IDg6MzggQU0sIFRpbSBIb2xsZWJlZWsgPHRpbS5ob2xsZWJlZWtAZGlnaWNlcnQu Y29tPiB3cm90ZToKPj4+Cj4+Pj4gVW5mb3J0dW5hdGVseSwg4oCcbm90IGV2ZXJ5IGNvbWJpbmF0 aW9uIG5lZWRzIHRvIGJlIGNvdmVyZWTigJ0gaW50cm9kdWNlcyBhIGxvdCBvZiBwb2xpdGljcyBh cm91bmQgY2hvb3Npbmcgd2hpY2ggY29tYmluYXRpb25zIOKAnG5lZWQgdG8gYmUgY292ZXJlZOKA nSwgYSBzdWJqZWN0IG9uIHdoaWNoIGluZXZpdGFibHkgbm90IGV2ZXJ5b25lIGFncmVlcy4gIEkg d291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNzaW9ucyBhbmQgdGhlIHVubmVjZXNz YXJ5IHdvcmsgdGhleSByZXByZXNlbnQuCj4+Pj4KPj4+PiBJIHBlcnNvbmFsbHkgZG9u4oCZdCB0 aGluayBhIHNpbmdsZSBBbGdJRCB3aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBp cyBhbiBpbXByb3ZlbWVudCBvdmVyIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcywgb3IgaXRzIG1vcmFs IGVxdWl2YWxlbnQuICBGb3Igc2ltcGxlIGh5YnJpZCB1c2UgY2FzZXMsIHRoZXJlIGlzIGFsc28g YSBsb3Qgb2YgdmFsdWUgaW4gaGF2aW5nIHRoZSBjbGFzc2ljYWwgYWxnb3JpdGhtIElEIGJlaW5n IHRoZSBzYW1lIGFzIGl0IHVzdWFsbHkgaXMsIHRvIGFsbG93IGVhc2llciBpbnRlcm9wZXJhYmls aXR5IHdpdGggb2xkZXIgc3lzdGVtcyB0aGF0IGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgbmV3ZXIg YWxnb3JpdGhtcyAoYW5kIGNhbiBibGlzc2Z1bGx5IGlnbm9yZSB0aGVtKS4KPj4+Pgo+Pj4+IC1U aW0KPj4+Pgo+Pj4+IEZyb206IFNhbnRvc2ggQ2hva2hhbmkgPHNhbnRvc2guY2hva2hhbmlAZ21h aWwuY29tPgo+Pj4+IFNlbnQ6IFR1ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAxOCAxMDoyOSBBTQo+ Pj4+IFRvOiBUaW0gSG9sbGViZWVrIDx0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbT47ICdFcmlr IEFuZGVyc2VuJyA8ZXJhQHg1MDAuZXU+OyAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZz47IHg1MDBz dGFuZGFyZEBmcmVlbGlzdHMub3JnCj4+Pj4gU3ViamVjdDogUkU6IFtsYW1wc10gRG91YmxlIHNp Z25hdHVyZXMKPj4+Pgo+Pj4+IFRoYW5rcyBUaW0uCj4+Pj4KPj4+PiBUaGVyZSBhcmUgd2F5cyB0 byBhY2NvbW1vZGF0ZSB5b3VyIGNvbmNlcm4uCj4+Pj4KPj4+PiBPbmUgd2F5IHRvIGhhbmRsZSB0 aGlzIGlzIGRlZmluaW5nIGEgc2luZ2xlIEFsZyBJRCBBIHdoaWNoIGltcGxpZXMgYSBTRVFVRU5D RSBvZiBBTEcgSURzIGFuZCBkZWZpbmUgdGhlIHJlbHlpbmcgcGFydHkgcnVsZXMgaW4gdGVybXMg b2YgaXRzIGFiaWxpdHkgdG8gcHJvY2VzcyBvbmUgb3IgYWxsIEFMRyBJRHMuCj4+Pj4KPj4+PiBB bm90aGVyIHdheSB0byBkbyB0aGlzIGlzIG5vdCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBi ZSBjb3ZlcmVkIGFuZCB0aGUgdXNlciBjb21tdW5pdHkgZGVmaW5lcyBpdHMgb3duICBBbGcgSUQg WGkgd2hpY2ggbWFwcyB0byBhIFNFUVVFTkNFIG9mIEFMRyBJRHMuCj4+Pj4KPj4+PiBGcm9tOiBT cGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBUaW0gSG9s bGViZWVrCj4+Pj4gU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDEwOjAzIEFNCj4+ Pj4gVG86IEVyaWsgQW5kZXJzZW4gPGVyYUB4NTAwLmV1PjsgJ1NQQVNNJyA8c3Bhc21AaWV0Zi5v cmc+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZwo+Pj4+IFN1YmplY3Q6IFJlOiBbbGFtcHNd IERvdWJsZSBzaWduYXR1cmVzCj4+Pj4KPj4+PiBEb2VzbuKAmXQgdGhlIGNvbWJpbmF0b3JpYyBl eHBsb3Npb24gcmVuZGVyIHRoaXMgY29tcGxldGVseSBpbXByYWN0aWNhbD8KPj4+Pgo+Pj4+IFlv dSBuZWVkIE5fYyB4IE5fcHEgYWxnb3JpdGhtIGlkZW50aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRo ZSBzaW1wbGUgaHlicmlkIHVzZSBjYXNlIHdoZXJlIGEgc2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0 aG0gaXMgYmVpbmcgdXNlZCBpbiBjb25qdW5jdGlvbiB3aXRoIGEgc2luZ2xlIHBvc3QtcXVhbnR1 bSBhbGdvcml0aG0uCj4+Pj4KPj4+PiBBbmQgdGhlcmUgYXJlIHBlb3BsZSB3aG8gd2FudCB0byB1 c2UgbXVsdGlwbGUgcG9zdC1xdWFudHVtIGFsZ29yaXRobXMgdG8gaGVkZ2UgYWdhaW5zdCBwb3Rl bnRpYWwgeWV0IHRvIGJlIGRpc2NvdmVyZWQgd2Vha25lc3NlcyBpbiBwb3N0LXF1YW50dW0gYWxn b3JpdGhtcy4KPj4+Pgo+Pj4+IEnigJltIG5vdCByZWFsbHkgbG9va2luZyBmb3J3YXJkIHRvIHRy eWluZyB0byBhbGxvY2F0ZSBvciBtYW5hZ2UgTyhOX2MgeCBOX3BxXjMpIGFsZ29yaXRobSBpZGVu dGlmaWVyc+KApgo+Pj4+Cj4+Pj4gLVRpbQo+Pj4+Cj4+Pj4gRnJvbTogU3Bhc20gPHNwYXNtLWJv dW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBFcmlrIEFuZGVyc2VuCj4+Pj4gU2VudDogVHVl c2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDM6MTAgQU0KPj4+PiBUbzogJ1NQQVNNJyA8c3Bhc21A aWV0Zi5vcmc+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZwo+Pj4+IFN1YmplY3Q6IFJlOiBb bGFtcHNdIERvdWJsZSBzaWduYXR1cmVzCj4+Pj4KPj4+PiBIaSBTYW50b3NoLAo+Pj4+Cj4+Pj4g WW91IGhhdmUgcHJvcG9zZWQgc29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUuIEl0IHN0aWxsIHB1 enpsaW5nIGluIG15IGJyYWluLiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVpcmVzIHRoYXQgd2Ug ZGVmaW5lIGEgcGFydGljdWxhciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJhbWV0ZXIgdGhhdCBp bmNsdWRlcyB0aGUgdGhpbmdzIHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkgdG8gYmUgYW5hbHlz ZWQuCj4+Pj4KPj4+PiBFcmlrCj4+Pj4KPj4+PiBGcmE6IFNwYXNtIFttYWlsdG86c3Bhc20tYm91 bmNlc0BpZXRmLm9yZ10gUMOlIHZlZ25lIGFmIFNhbnRvc2ggQ2hva2hhbmkKPj4+PiBTZW5kdDog MTAgU2VwdGVtYmVyIDIwMTggMTk6MTgKPj4+PiBUaWw6ICdKaW0gU2NoYWFkJyA8aWV0ZkBhdWd1 c3RjZWxsYXJzLmNvbT47ICdSeWFuIFNsZWV2aScgPHJ5YW4taWV0ZkBzbGVldmkuY29tPjsgZXJh QHg1MDAuZXUKPj4+PiBDYzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc+OyB4NTAwc3RhbmRhcmRA ZnJlZWxpc3RzLm9yZwo+Pj4+IEVtbmU6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzCj4+ Pj4KPj4+PiBXaHkgbm90IGxldCBhbGdvcml0aG0gaWRlbnRpZmllciBkaWN0YXRlIHRoZSBudW1i ZXIgb2Ygc2lnbmF0dXJlcyBhbmQgdGhlaXIgc3ludGF4Pwo+Pj4+Cj4+Pj4gRnJvbTogU3Bhc20g W21haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgSmltIFNjaGFhZAo+ Pj4+IFNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcgUE0KPj4+PiBUbzogJ1J5 YW4gU2xlZXZpJyA8cnlhbi1pZXRmQHNsZWV2aS5jb20+OyBlcmFAeDUwMC5ldQo+Pj4+IENjOiAn U1BBU00nIDxzcGFzbUBpZXRmLm9yZz47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnCj4+Pj4g U3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMKPj4+Pgo+Pj4+IFJ5YW4sCj4+ Pj4KPj4+PiBUaGUgZGlzY3Vzc2lvbiBpbiBMb25kb24gZGVhbHQgd2l0aCBhIGNvbXBsZXRlbHkg ZGlmZmVyZW50IHByb3Bvc2FsIHRoYW4gdGhpcyBvbmUuICBXaGlsZSBJIHRoaW5rIHRoZXJlIGFy ZSBwcm9ibGVtcyB3aXRoIHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUg bW9zdGx5IG5vdCB0aGUgc2FtZSBzZXQuCj4+Pj4KPj4+PiBFcmlrLAo+Pj4+Cj4+Pj4gV2h5IGlz IHRoaXMgY29uc2lkZXJlZCB0byBiZSBhIHByZWZlcnJlZCBzb2x1dGlvbiB0byBkZWZpbmluZyBh IG5ldyBzaWduYXR1cmUgYWxnb3JpdGhtIHdoaWNoIGNvbnRhaW5zIGFzIHRoZSBwYXJhbWV0ZXIg dGhlIHNlcXVlbmNlIG9mIGFsZ29yaXRobSBpZGVudGlmaWVycyBhbmQgYXMgdGhlIHNpZ25hdHVy ZSB2YWx1ZSBhIHNlcXVlbmNlIG9mIHNpZ25hdHVyZSB2YWx1ZXMuICBUaGUgcHJvYmxlbSB3aXRo IGp1c3QgZGVmaW5pbmcgdGhlIGV4dGVuc2lvbiB0byBTSUdORUQgaXMgdGhhdCBvbmUgbmVlZHMg dG8gbWFrZSBzdXJlIHRoYXQgdGhlIHNldCBvZiBzaWduYXR1cmUgYWxnb3JpdGhtcyBhbmQgcGFy YW1ldGVycyBhcmUgYWxzbyBwYXJ0IG9mIHRoZSBkYXRhIHRvIGJlIHNpZ25lZCBhbmQgSSBhbSBu b3Qgc2VlaW5nIHRoYXQgaGlnaGxpZ2h0ZWQgaGVyZS4KPj4+Pgo+Pj4+IEppbQo+Pj4+Cj4+Pj4g RnJvbTogU3Bhc20gPHNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBSeWFuIFNs ZWV2aQo+Pj4+IFNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDg6NTMgQU0KPj4+PiBU bzogZXJhQHg1MDAuZXUKPj4+PiBDYzogU1BBU00gPHNwYXNtQGlldGYub3JnPjsgeDUwMHN0YW5k YXJkQGZyZWVsaXN0cy5vcmcKPj4+PiBTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0 dXJlcwo+Pj4+Cj4+Pj4gT24gTW9uLCBTZXAgMTAsIDIwMTggYXQgMTA6NTYgQU0gRXJpayBBbmRl cnNlbiA8ZXJhQHg1MDAuZXU+IHdyb3RlOgo+Pj4+Cj4+Pj4+IEhpIEZvbGssCj4+Pj4+Cj4+Pj4+ IEluIElUVS1UIHdlIGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRvdWJsZSBzaWduYXR1cmVzIHVz aW5nIHRoZSBTSUdORUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBkZWZpbmVkIGluIFguNTA5IHRv IGNvcGUgd2l0aCBzaXR1YXRpb24gYXMgZGVzY3JpYmVkIGluIHRoZSBpbnRlcm5ldCBkcmFmdDog 4oCcTXVsdGlwbGUgUHVibGljLUtleSBBbGdvcml0aG0gWC41MDkgQ2VydGlmaWNhdGVzIChkcmFm dC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZC14NTA5LTAxKeKAnQo+Pj4+Pgo+Pj4+PiBXZSBz dWdnZXN0IHRvIGVuaGFuY2UgdGhlIFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24gYmVsb3c6Cj4+ Pj4+Cj4+Pj4+IFNJR05FRHtUb0JlU2lnbmVkfSA6Oj0gU0VRVUVOQ0Ugewo+Pj4+Pgo+Pj4+PiAg IENPTVBPTkVOVFMgT0YgU0lHTkFUVVJFLAo+Pj4+Pgo+Pj4+PiAgIC4uLi4uLiwKPj4+Pj4KPj4+ Pj4gICBhbHRBbGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0 ZWRBbGdvcml0aG1zfX0gT1BUSU9OQUwsCj4+Pj4+Cj4+Pj4+ICAgYWx0U2lnbmF0dXJlICAgICAg ICAgICAgQklUIFNUUklORyBPUFRJT05BTAo+Pj4+Pgo+Pj4+PiAgIH0gKFdJVEggQ09NUE9ORU5U UyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQUkVT RU5UIH0gfAo+Pj4+Pgo+Pj4+PiAgICAgIFdJVEggQ09NUE9ORU5UUyB7Li4uLCBhbHRBbGdvcml0 aG1JZGVudGlmaWVyIEFCU0VOVCwgIGFsdFNpZ25hdHVyZSBBQlNFTlQgfSApCj4+Pj4+Cj4+Pj4+ IFdlIGFyZSBvcGVuIHRvIGNvbW1lbnRzLiBXZSBrbm93IHRoYXQgSUVURiBpcyBub3QgYSBoZWF2 eSB1c2VyIG9mIHRoaXMgZGF0YSB0eXBlLgo+Pj4+Pgo+Pj4+PiBXZSBoYXZlIG5vIGludGVudGlv biB0byB1c2UgdGhpcyBleHRlbmRlZCBkYXRhIHR5cGUgZm9yIGNlcnRpZmljYXRlcyBhbmQgQ1JM cy4KPj4+Pj4KPj4+Pj4gRm9yIHlvdXIgaW5mb3JtYXRpb24sIFNJR05BVFVSRSBpcyBkZWZpbmVk IGFzOgo+Pj4+Pgo+Pj4+PiBTSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHsKPj4+Pj4KPj4+Pj4gICBh bGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0 aG1zfX0sCj4+Pj4+Cj4+Pj4+ICAgc2lnbmF0dXJlICAgICAgICAgICAgQklUIFNUUklORywKPj4+ Pj4KPj4+Pj4gICAuLi4uLi4gfQo+Pj4+Cj4+Pj4gRnJvbSB0aGUgZGlzY3Vzc2lvbnMgaW4gTG9u ZG9uICgxMDEpLCB0aGVyZSB3ZXJlIGEgbnVtYmVyIG9mIGNoYWxsZW5nZXMgaWRlbnRpZmllZCBk dXJpbmcgdGhlIGRpc2N1c3Npb24gLSBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRp bmcvMTAxL21hdGVyaWFscy9taW51dGVzLTEwMS1sYW1wcy0wMS50eHQgLSB0aGF0IGZ1bmRhbWVu dGFsbHkgcXVlc3Rpb25lZCB0aGF0IGFwcHJvYWNoLgo+Pj4+Cj4+Pj4gSGFzIHRoZSBJVFUtVCBh ZGRyZXNzZWQgb3IgcmVzb2x2ZWQgdGhvc2UgY29uY2VybnM/IEFyZSB0aGV5IG5vdCBhcHBsaWNh YmxlIGZvciBzb21lIHJlYXNvbiBzcGVjaWZpYyB0byBJVFUtVD8KPj4+Cj4+PiBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+Pj4gU3Bhc20gbWFpbGluZyBs aXN0U3Bhc21AaWV0Zi5vcmcKPj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vc3Bhc20KPgo+IC0tCj4KPiBCZXN0IFJlZ2FyZHMsCj4KPiBNYXNzaW1pbGlhbm8gUGFsYSwg UGguRC4KPiBbQ2FibGVMYWJzXQo+IFByaW5jaXBhbCBBcmNoaXRlY3QKPiBTZWN1cml0eSBTZXJ2 aWNlcywgUiZE --b1_438b295c7fbdc64d572c5b884c212b6f Content-Type: multipart/related; boundary="b2_438b295c7fbdc64d572c5b884c212b6f" --b2_438b295c7fbdc64d572c5b884c212b6f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 SSB0aGluayB0aGlzIG1ha2VzIGZ1bGx5IHNlbnNlIEVyaWs6PGJyPjxicj5MZWF2aW5nIHRvbyBt dWNoIGNob2ljZSBpcyB3aGF0IHRoZW4gbGVhZHMgdG8gYWxsIHNvcnRzIG9mIGRvd25ncmFkaW5n IGF0dGFja3MuPGJyPjxicj5CZXN0IHJlZ2FyZHMsPGJyPlN0aWVwYW48YnI+PGJyPjxicj5TdGll cGFuIEEuIEtvdmFjPGJyPlByZXNpZGVudDxicj5pdGsgQVZ0b2J2UyBTQVJMPGJyPkp1c3N5ICsg RnJpYm91cmc8YnI+PGJyPjxicj5FbnZvecOpIGRlcHVpcyBQcm90b25NYWlsIG1vYmlsZTxicj48 YnI+PGJyPjxicj4tLS0tLS0tLSBNZXNzYWdlIGQnb3JpZ2luZSAtLS0tLS0tLTxicj5PbiAxNCBz ZXB0LiAyMDE4IMOgIDE3OjQ5LCBFcmlrIEFuZGVyc2VuIDwgZXJhQHg1MDAuZXUgPiBhIMOpY3Jp dMKgOjxibG9ja3F1b3RlIGNsYXNzPSJwcm90b25tYWlsX3F1b3RlIj48YnI+PGh0bWwgeG1sbnM6 dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVybjpzY2hlbWFzLW1p Y3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0 LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9v ZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvVFIvUkVDLWh0bWw0 MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0 bWw7IGNoYXJzZXQ9dXRmLTgiPjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9z b2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPjwhLS1baWYgIW1zb10+PHN0eWxlPnZcOiog e2JlaGF2aW9yOnVybCgjZGVmYXVsdCNWTUwpO30NCm9cOioge2JlaGF2aW9yOnVybCgjZGVmYXVs dCNWTUwpO30NCndcOioge2JlaGF2aW9yOnVybCgjZGVmYXVsdCNWTUwpO30NCi5zaGFwZSB7YmVo YXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0KPC9zdHlsZT48IVtlbmRpZl0tLT48c3R5bGU+PCEt LQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpIZWx2 ZXRpY2E7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBc OyI7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyBjb2xvclw6IHJlZCI7DQoJcGFub3NlLTE6MCAwIDAgMCAw IDAgMCAwIDAgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4i LHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5l dyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxT dHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4w cHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT48L2hlYWQ+PGJvZHk+PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj48cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUyI+VGhlIGRvdWJsZSBzaWduYXR1cmUgaXMgaW50ZW5kZWQgYXMgYSBtaWdyYXRpb24g dG9vbC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SW4gdGhlIG5vcm1hbCBv cGVyYXRpb24sIG9ubHkgb25lIHNpZ25hdHVyZSBpcyB1c2VkICh0aGUgbmF0aXZlIHNpZ25hdHVy ZSkuIFdoZW4gaXQgaXMgcmVhbGl6ZWQgdGhhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB3aWxs IGJlIHRvbyB3ZWVrIGkgc29tZSBmdXR1cmUsIHRoZSBtaWdyYXRpb24gcGVyaW9kIHN0YXJ0cyBh bmQgYW4gYWx0ZXJuYXRpdmUsIGFzc3VtaW5nIHN0cm9uZ2VyIHNpZ25hdHVyZSBpcyBwcm92aWRl ZCBmb3IgdGhvc2UgYWJsZSB0byBoYW5kbGUgaXQuJm5ic3A7IExlZ2FjeSBzeXN0ZW1zIHdpbGwg aWdub3JlIHRoaXMgYWx0ZXJuYXRpdmUgc2lnbmF0dXJlLiBBZnRlciB0aGUgbWlncmF0aW9uIHBl cmlvZCwgdGhlcmUgd2lsbCBiZSBubyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUgYW5kIHRoZSBuZXcg c3Ryb25nZXIgc2lnbmF0dXJlIHdpbGwgYmUgdGhlIG5hdGl2ZSBzaWduYXR1cmUuPG86cD48L286 cD48L3NwYW4+PC9wPjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7 bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkRvZXMgdGhhdCBtYWtlIHNlbnNlPzxvOnA+PC9v OnA+PC9zcGFuPjwvcD48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5FcmlrPG86cD48L286cD48L3NwYW4+PC9wPjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PGRpdj48ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwY20gMGNtIDBjbSI+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0i REEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5GcmE6PC9zcGFuPjwvYj48c3BhbiBsYW5n PSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPiBNYXNzaW1pbGlhbm8gUGFsYSBbbWFp bHRvOm0ucGFsYUBjYWJsZWxhYnMuY29tXSA8YnI+PGI+U2VuZHQ6PC9iPiAxMiBTZXB0ZW1iZXIg MjAxOCAyMzowMTxicj48Yj5UaWw6PC9iPiBSdXNzIEhvdXNsZXkgJmx0O2hvdXNsZXlAdmlnaWxz ZWMuY29tJmd0Ozxicj48Yj5DYzo8L2I+IFNQQVNNICZsdDtzcGFzbUBpZXRmLm9yZyZndDs7IEVy aWsgQW5kZXJzZW4gJmx0O2VyYUB4NTAwLmV1Jmd0Ozxicj48Yj5FbW5lOjwvYj4gUmU6IFtsYW1w c10gRG91YmxlIHNpZ25hdHVyZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+PHA+SGkgUnVzcywgYWxsLDxv OnA+PC9vOnA+PC9wPjxwPm15IHBlcnNvbmFsIHBvc2l0aW9uIGlzIHRoYXQgdGhlIHNpZ25lciBN VVNUIHVzZSBhbGwgdGhlIGtleXMgdGhhdCBoYXZlIGRpZ2l0YWxTaWduYXR1cmUgc2V0LCB0aGUg dmVyaWZpZXIgc2hhbGwgdmVyaWZ5IGFsbCB0aGUgc2lnbmF0dXJlcyBmb3Igd2hpY2ggaXQgZG9l cyBoYXZlIHN1cHBvcnQgZm9yLjxvOnA+PC9vOnA+PC9wPjxwPlRoZSByYXRpb25hbGUgZm9yIHRo aXMgaXMgdGhhdCBpZiBJIGNlcnRpZnkgYSBwdWJsaWMga2V5IGluIHRoZSBjZXJ0aWZpY2F0ZSwg eW91IHNob3VsZCBiZSBhYmxlIHRvIHVzZSB0aGUgcHJpdmF0ZSBrZXkgdG8gZ2VuZXJhdGUgdGhl IHNpZ25hdHVyZSwgdGhlcmVmb3JlIHRoZSBhcHByb2FjaCBpcyB0aGUgc2FtZSBhcyB1c3VhbDog c2lnbiB3aXRoIHlvdXIga2V5LiBJbiB0aGlzIGNhc2UsIGl0IGp1c3QgaGFwcGVucyB0aGF0IHRv IGdlbmVyYXRlIHRoZSBzaWduYXR1cmUgeW91IGhhdmUgdG8gZ2VuZXJhdGUgbXVsdGlwbGUgb25l cyBhbmQgdGhlbiBjb21iaW5lIHRoZW0gdG9nZXRoZXIuPG86cD48L286cD48L3A+PHA+Rm9yIHRo ZSBhcHBsaWNhdGlvbiB0aGF0IHZlcmlmaWVzIHRob3NlIHNpZ25hdHVyZXMsIGl0IGlzIGFsd2F5 cyBhIHF1ZXN0aW9uIG9mIHdoYXQgaXMgdGhlIHRocmVzaG9sZCB0aGF0IGlzIGFjY2VwdGFibGUg Zm9yIHRoZSBhcHBsaWNhdGlvbiAoaW4gdGVybXMgb2YgcmlzaykgaW4gY2FzZSBpdCBkb2VzIG5v dCBzdXBwb3J0IGFsbCBvZiB0aGUgYWxnb3JpdGhtcyB0aGF0IGFyZSB1c2VkIHRvIGdlbmVyYXRl IHRoZSBjb21wb3NpdGUgc2lnbmF0dXJlLiBJZGVhbGx5IGl0IHdvdWxkIHZlcmlmeSBhbGwsIGJ1 dCBpdCBtYXkgZGVjaWRlIHRvIHZlcmlmeSBsZXNzIChhdCBsZWFzdCBvbmUpLjxvOnA+PC9vOnA+ PC9wPjxwPkkgYWxzbyBzYXcgdGhlIG90aGVyIGUtbWFpbCBmcm9tIEppbSBvbiB0aGlzIHRvcGlj IGFuZCBJIHRoaW5rIGl0IGNvdWxkIGJlIGEgZ29vZCBpZGVhIC0gdGhlIHVzZSBvZiB0aGUgdHdv IE9JRHMgaXMgYW5vdGhlciB3YXkgdG8gZ28gdG8gY29kaWZ5IHRoZSB2YWxpZGF0aW9uIHByb2Nl c3MgcmVxdWlyZWQuIFRlY2huaWNhbGx5LCB0aGF0IG1ha2VzIHNlbnNlIHRvIG1lLCBob3dldmVy IEkgYW0gY29uZmxpY3RlZCBhcyB0aGlzIGFwcHJvYWNoIHJlcXVpcmVzIHRoYXQgdGhlIHNpZ25l ciBoYXMgYW4gdW5kZXJzdGFuZGluZyBvZiB3aGF0IHRoZSB2ZXJpZmllcidzIGNhcGFiaWxpdGll cyBhcmUuLi4gSSB0aGluayB0aGF0IGRlZmluaW5nIHR3byBPSURzIGZvciB0aGUgc2lnbmF0dXJl cyBjb3VsZCBzdGlsbCBiZSB1c2VmdWwgYmVjYXVzZSB0aGUgc2lnbmVyIG1pZ2h0IHRoZW4gZGVj aWRlIHRoZSAicmVjb21tZW5kZWQiLyJpbnRlbmRlZCIgdmVyaWZpY2F0aW9uIGJlaGF2aW9yLi4u IEkgY2FuIHNlZSBzb21lIHVzZS1jYXNlcyB0aGF0IG1pZ2h0IGhhdmUgYSBjb21wb3NpdGUga2V5 IHdpdGggeyBSU0EsIEVDIH0gYW5kIHRoZSAiTXVzdC1WZXJpZnktQWxsIiBPSUQgZm9yIHRoZSBz aWduYXR1cmUsIGFuZCBhbm90aGVyIHVzZS1jYXNlIHdoZXJlIHdlIGhhdmUgYSBjb21wb3NpdGUg a2V5IHdpdGggeyBSU0EsIEhBU0gtQkFTRUQgfSBhbmQgZm9yIHRoZSBzaWduYXR1cmUgIk11c3Qt VmVyaWZ5LUF0LUxlYXN0LU9uZSIuPG86cD48L286cD48L3A+PHA+RG9lcyB0aGlzIG1ha2Ugc2Vu c2U/PG86cD48L286cD48L3A+PHA+Q2hlZXJzLDxicj5NYXg8bzpwPjwvbzpwPjwvcD48cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD48ZGl2PjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIDkvMTIvMTggNjoxMiBBTSwgUnVzcyBIb3VzbGV5IHdyb3RlOjxvOnA+PC9vOnA+PC9w PjwvZGl2PjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1heDogPG86cD48L286cD48L3A+PGRpdj48ZGl2 PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+RHVyaW5nIGEgdHJhbnNpdGlvbiB0byBxdWFudHVtLXJlc2lzdGFu dCBzaWduYXR1cmVzLCBhIHNpZ25lciB3YW50cyB0byBwdXQgYSB0cmFkaXRpb25hbCBzaWduYXR1 cmUgYW5kIGEgcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJlIG9uIGFuIG9iamVjdC4gJm5ic3A7 R2l2ZW4geW91ciBkZXNjcmlwdGlvbiBvZiZuYnNwO2tleVVzYWdlIGFuZCBleHRlbmRlZEtleVVz YWdlLCBib3RoIHdvdWxkIGhhdmUgdGhlIGRpZ2l0YWxTaWduYXR1cmUgYml0IHNldC4gJm5ic3A7 SG93IGRvZXMgYSBjbGllbnQga25vdyBpZiBqdXN0IG9uZSBvciBib3RoIHNpZ25hdHVyZXMgbXVz dCBiZSB2YWxpZD88bzpwPjwvbzpwPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMg SmltIFNjaGFhZCBhbHJlYWR5IHNhaWQsIFJGQyZuYnNwOzU3NTIgdGFsa3MgYWJvdXQgdGhpcyBp c3N1ZSB3aGVuIGEgQ01TIFNpZ25lZERhdGEgY29udGFpbnMgbW9yZSB0aGFuIG9uZSBTaWduZXJJ bmZvLjxvOnA+PC9vOnA+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj5SdXNzPG86cD48 L286cD48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj48YnI+PG86cD48L286cD48L3A+PGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+PGRp dj48cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBTZXAgMTEsIDIwMTgsIGF0IDQ6NDUgUE0sIE1heCBQ YWxhICZsdDs8YSBocmVmPSJtYWlsdG86TS5QYWxhQGNhYmxlbGFicy5jb20iPk0uUGFsYUBjYWJs ZWxhYnMuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+PC9kaXY+PHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+PGRpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkhpIEFsbCwgPG86cD48L286cD48L3NwYW4+PC9wPjxkaXY+ PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+SSBhbSB3b3JraW5nIG9uIGEgc2ltaWxhciAtIGJ1dCBkaWZmZXJlbnQgLSBzb2x1dGlvbiwg aW4gcGFydGljdWxhciBJIHNvbHZlIHRoZSBpc3N1ZSBvZiAoYSkgYmVpbmcgYWJsZSB0byBjb21i aW5lIG1vcmUgdGhhbiBvbmUgcHVibGljIGtleSwgKGIpIG9ubHkgb25lIChhY3R1YWxseSB0d28p IE9JRHMgcmVxdWlyZWQsIGFuZCAoYykgc2ltcGx5IHRoZSBwcm9jZXNzaW5nIGJ5IHJlLXV0aWxp emluZyB0aGUgc2FtZSBkYXRhIHN0cnVjdHVyZXMgd2UgaGF2ZSB0b2RheS48bzpwPjwvbzpwPjwv c3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIHBhcnRpY3VsYXIsIEkgZGVmaW5lIGEg4oCcY29tcG9z aXRlIHB1YmxpYyBrZXnigJ0gYW5kIOKAnGNvbXBvc2l0ZSBzaWduYXR1cmXigJ0uPG86cD48L286 cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhlIGZpcnN0IG9uZSBlbmNvZGVzIGluIHRoZSBr ZXkgdmFsdWXigJlzIEJJVFNUUklORyB0aGUgREVSIHZhbHVlIG9mIHRoZSBTRVFVRU5DRSBvZiBw dWJsaWMga2V5cyAoZWFjaCBvZiB3aGljaCBpcyBhIHRoZSBzdWJqZWN0UHVibGljS2V5SW5mbyBz dHJ1Y3R1cmUpIGFuZCB1c2VzIGEgc3BlY2lmaWMgT0lEIHRoYXQgaWRlbnRpZmllcyB0aGUgcHVi bGljIGtleSB0eXBlLiBUaGUgcGFyYW1ldGVycyBvZiB0aGUgY29tcG9zaXRlS2V5IGFsZ29yaXRo bSBjYW4gYmUgdXNlZCB0byBlbmNvZGUgdGhlIGtleVVzYWdlIGFuZCB0aGUgZXh0ZW5kZWRLZXlV c2FnZSBmb3IgZWFjaCBvZiB0aGUga2V5cyBpbiB0aGUgY29tcG9zaXRlIGtleS48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgc2FtZSBhcHByb2FjaCBpcyB1c2VkIGZvciB0 aGUg4oCcQ29tcG9zaXRlIFNpZ25hdHVyZeKAnSBjYXNlIHdoZXJlIHRoZSB2YWx1ZSBvZiB0aGUg c2lnbmF0dXJlIGlzIHRoZSBERVIgcmVwcmVzZW50YXRpb24gb2YgdGhlIFNFUVVFTkNFIG9mIHNp Z25hdHVyZXMgbWFkZSB3aXRoIGVhY2ggb2YgdGhlIGtleXMuPG86cD48L286cD48L3NwYW4+PC9w PjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+QXMgc29vbiBhcyBJIGhhdmUgc29tZSBzcGFyZSB0aW1lLCBJIHdpbGwg c3VibWl0IHRoZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUgZGlzY3Vzc2VkIGluIEJhbmdr b2s/PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+ PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhpcyBzaW1wbGUgaWRlYSBh bGxvd3MgdXMgdG8gaGF2ZSBhbGwgdGhlIG90aGVyIHByb2NlZHVyZXMgcmVsYXRlZCB0byBQS0lz IHdvcmsgLSB0aGlzIG1lYW5zIHdlIGNhbiBjb21iaW5lIEVDQyB3aXRoIFJTQSBvciB3aXRoIGEg UXVhbnR1bS1SZXNpc3RhbnQgYWxnb3JpdGhtICh3aGVuIGZpbmFsbHkgYXZhaWxhYmxlIGFuZCBz dGFuZGFyZGl6ZWQpLiBBIHN0ZXAgZm9yd2FyZCBmb3IgdGhlIGRlcGxveW1lbnQgb2YgaHlicmlk LVBLSXMgd2hlcmUgbXVsdGlwbGUgTGFnb3MgZm9yIGtleXMgY2FuIGJlIHVzZWQgdG8gYXV0aGVu dGljYXRlIGRhdGEsIGNlcnRzLCByZXZvY2F0aW9uIGRhdGEsIGV0Yy4uLiB3ZSBwbGFuIHRvIHVz ZSB0aGlzIGluIG91ciBpbmZyYXN0cnVjdHVyZXMgdG8gcHJvdmlkZSBhIHRyYW5zaXRpb25hbCBw YXRoIGZvciBwb3N0LVF1YW50dW0gdHJhbnNpdGlvbiBhbmQgdG8gZnVydGhlciBpbXByb3ZlIHRo ZSBhbGdvcml0aG0tYWdpbGl0eSBjYXBhYmlsaXR5IG9mIFBLSXMuPG86cD48L286cD48L3NwYW4+ PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+V2hhdCBkbyB5b3UgdGhpbms/PG86cD48L286cD48L3NwYW4+PC9w PjxkaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5DaGVlcnMsIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48ZGl2PjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk1heDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48 L2Rpdj48L2Rpdj48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pjxicj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4tLS0gPG86cD48L286cD48L3NwYW4+PC9wPjxkaXY+PHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjwv ZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLCA8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5NYXg8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PC9kaXY+PHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj5PbiBTZXAgMTEsIDIwMTgsIGF0IDg6MzggQU0sIFRpbSBIb2xsZWJlZWsgJmx0OzxhIGhy ZWY9Im1haWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPjxkaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPlVuZm9ydHVuYXRlbHksIOKAnG5vdCBldmVyeSBjb21iaW5hdGlv biBuZWVkcyB0byBiZSBjb3ZlcmVk4oCdIGludHJvZHVjZXMgYSBsb3Qgb2YgcG9saXRpY3MgYXJv dW5kIGNob29zaW5nIHdoaWNoIGNvbWJpbmF0aW9ucyDigJxuZWVkIHRvIGJlIGNvdmVyZWTigJ0s IGEgc3ViamVjdCBvbiB3aGljaCBpbmV2aXRhYmx5IG5vdCBldmVyeW9uZSBhZ3JlZXMuJm5ic3A7 IEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNzaW9ucyBhbmQgdGhlIHVubmVj ZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2Pjxk aXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPkkgcGVyc29uYWxseSBkb27igJl0IHRoaW5rIGEgc2luZ2xlIEFsZ0lEIHdoaWNoIGltcGxp ZXMgYSBTRVFVRU5DRSBvZiBBTEcgSURzIGlzIGFuIGltcHJvdmVtZW50IG92ZXIgYSBTRVFVRU5D RSBvZiBBTEcgSURzLCBvciBpdHMgbW9yYWwgZXF1aXZhbGVudC4mbmJzcDsgRm9yIHNpbXBsZSBo eWJyaWQgdXNlIGNhc2VzLCB0aGVyZSBpcyBhbHNvIGEgbG90IG9mIHZhbHVlIGluIGhhdmluZyB0 aGUgY2xhc3NpY2FsIGFsZ29yaXRobSBJRCBiZWluZyB0aGUgc2FtZSBhcyBpdCB1c3VhbGx5IGlz LCB0byBhbGxvdyBlYXNpZXIgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIG9sZGVyIHN5c3RlbXMgdGhh dCBkb27igJl0IHVuZGVyc3RhbmQgdGhlIG5ld2VyIGFsZ29yaXRobXMgKGFuZCBjYW4gYmxpc3Nm dWxseSBpZ25vcmUgdGhlbSkuPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi1UaW08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGNtIDBj bSAwY20gNC4wcHQiPjxkaXY+PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPjxkaXY+PHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U2FudG9zaCBDaG9raGFuaSAmbHQ7PGEgaHJlZj0ibWFp bHRvOnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5zYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+PGI+U2VudDo8L2I+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlR1ZXNkYXksIFNlcHRl bWJlciAxMSwgMjAxOCAxMDoyOSBBTTxicj48Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlRpbSBIb2xsZWJlZWsgJmx0OzxhIGhyZWY9Im1h aWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208L3NwYW4+PC9hPiZndDs7ICdFcmlrIEFuZGVy c2VuJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+Jmd0OzsgJ1NQQVNNJyAmbHQ7PGEgaHJlZj0i bWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5zcGFzbUBp ZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3Jn Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwv c3Bhbj48L2E+PGJyPjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj5SRTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9v OnA+PC9zcGFuPjwvcD48L2Rpdj48L2Rpdj48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+ PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5r cyBUaW0uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2 PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rp dj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5UaGVyZSBhcmUgd2F5cyB0byBhY2NvbW1vZGF0ZSB5b3VyIGNvbmNlcm4uPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5PbmUgd2F5IHRvIGhhbmRs ZSB0aGlzIGlzIGRlZmluaW5nIGEgc2luZ2xlIEFsZyBJRCBBIHdoaWNoIGltcGxpZXMgYSBTRVFV RU5DRSBvZiBBTEcgSURzIGFuZCBkZWZpbmUgdGhlIHJlbHlpbmcgcGFydHkgcnVsZXMgaW4gdGVy bXMgb2YgaXRzIGFiaWxpdHkgdG8gcHJvY2VzcyBvbmUgb3IgYWxsIEFMRyBJRHMuPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Bbm90aGVyIHdheSB0 byBkbyB0aGlzIGlzIG5vdCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBiZSBjb3ZlcmVkIGFu ZCB0aGUgdXNlciBjb21tdW5pdHkgZGVmaW5lcyBpdHMgb3duICZuYnNwO0FsZyBJRCBYaSB3aGlj aCBtYXBzIHRvIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcy48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20i PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20gWzxhIGhyZWY9Im1h aWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5t YWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlRpbSBIb2xsZWJlZWs8 YnI+PGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPlR1ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAxOCAxMDowMyBBTTxicj48Yj5Ubzo8L2I+ PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkVyaWsgQW5k ZXJzZW4gJmx0OzxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPiZndDs7ICdTUEFTTScgJmx0OzxhIGhyZWY9 Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+c3Bhc21A aWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9y ZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8 L3NwYW4+PC9hPjxicj48Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2 PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RG9lc27igJl0IHRoZSBjb21i aW5hdG9yaWMgZXhwbG9zaW9uIHJlbmRlciB0aGlzIGNvbXBsZXRlbHkgaW1wcmFjdGljYWw/PG86 cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPllvdSBuZWVkIE5fYyB4IE5fcHEgYWxnb3Jp dGhtIGlkZW50aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRoZSBzaW1wbGUgaHlicmlkIHVzZSBjYXNl IHdoZXJlIGEgc2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0aG0gaXMgYmVpbmcgdXNlZCBpbiBjb25q dW5jdGlvbiB3aXRoIGEgc2luZ2xlIHBvc3QtcXVhbnR1bSBhbGdvcml0aG0uPG86cD48L286cD48 L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZCB0aGVyZSBhcmUgcGVvcGxlIHdobyB3YW50IHRvIHVz ZSBtdWx0aXBsZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcyB0byBoZWRnZSBhZ2FpbnN0IHBvdGVu dGlhbCB5ZXQgdG8gYmUgZGlzY292ZXJlZCB3ZWFrbmVzc2VzIGluIHBvc3QtcXVhbnR1bSBhbGdv cml0aG1zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2Pjxk aXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5J4oCZbSBub3QgcmVhbGx5 IGxvb2tpbmcgZm9yd2FyZCB0byB0cnlpbmcgdG8gYWxsb2NhdGUgb3IgbWFuYWdlIE8oTl9jIHgg Tl9wcV4zKSBhbGdvcml0aG0gaWRlbnRpZmllcnPigKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9k aXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+LVRpbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwv ZGl2PjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7 cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+PGRpdj48ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+ PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TcGFzbSAmbHQ7PGEgaHJlZj0i bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5FcmlrIEFuZGVyc2VuPGJy PjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5UdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMzoxMCBBTTxicj48Yj5Ubzo8L2I+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPidTUEFTTScgJmx0 OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJl ZWxpc3RzLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVs aXN0cy5vcmc8L3NwYW4+PC9hPjxicj48Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVy ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdj48cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48 L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5IaSBTYW50b3NoLDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+WW91IGhhdmUgcHJvcG9zZWQgc29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUu IEl0IHN0aWxsIHB1enpsaW5nIGluIG15IGJyYWluLiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVp cmVzIHRoYXQgd2UgZGVmaW5lIGEgcGFydGljdWxhciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJh bWV0ZXIgdGhhdCBpbmNsdWRlcyB0aGUgdGhpbmdzIHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkg dG8gYmUgYW5hbHlzZWQuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5FcmlrPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD48L2Rpdj48ZGl2PjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj48ZGl2PjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyYTo8L3NwYW4+PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20g WzxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Qw6UgdmVnbmUg YWY8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlNh bnRvc2ggQ2hva2hhbmk8YnI+PGI+U2VuZHQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4xMCBTZXB0ZW1iZXIgMjAxOCAxOToxODxicj48Yj5UaWw6 PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nSmlt IFNjaGFhZCcgJmx0OzxhIGhyZWY9Im1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5pZXRmQGF1Z3VzdGNlbGxhcnMuY29tPC9zcGFuPjwvYT4m Z3Q7OyAnUnlhbiBTbGVldmknICZsdDs8YSBocmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5j b20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJ5YW4taWV0ZkBzbGVldmkuY29tPC9zcGFu PjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48YnI+PGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nU1BBU00nICZsdDs8YSBocmVmPSJtYWlsdG86 c3Bhc21AaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3Jn PC9zcGFuPjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwv YT48YnI+PGI+RW1uZTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXY+PHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+V2h5IG5vdCBsZXQgYWxnb3JpdGhtIGlkZW50aWZpZXIgZGljdGF0ZSB0aGUgbnVt YmVyIG9mIHNpZ25hdHVyZXMgYW5kIHRoZWlyIHN5bnRheD88L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PGRpdiBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAw Y20iPjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20gWzxhIGhyZWY9 Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPkppbSBTY2hhYWQ8 YnI+PGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPk1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcgUE08YnI+PGI+VG86PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nUnlhbiBTbGVl dmknICZsdDs8YSBocmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5jb20iPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPnJ5YW4taWV0ZkBzbGVldmkuY29tPC9zcGFuPjwvYT4mZ3Q7OzxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWls dG86ZXJhQHg1MDAuZXUiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9z cGFuPjwvYT48YnI+PGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj4nU1BBU00nICZsdDs8YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmci PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7 OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVm PSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwvYT48YnI+PGI+U3ViamVj dDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJl OiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2Pjwv ZGl2PjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPlJ5YW4sPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRo ZSBkaXNjdXNzaW9uIGluIExvbmRvbiBkZWFsdCB3aXRoIGEgY29tcGxldGVseSBkaWZmZXJlbnQg cHJvcG9zYWwgdGhhbiB0aGlzIG9uZS4mbmJzcDsgV2hpbGUgSSB0aGluayB0aGVyZSBhcmUgcHJv YmxlbXMgd2l0aCB0aGlzIHRoYXQgbmVlZCB0byBiZSBkZWFsdCB3aXRoIHRoZXkgYXJlIG1vc3Rs eSBub3QgdGhlIHNhbWUgc2V0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+ PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Fcmlr LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5XaHkgaXMgdGhpcyBjb25zaWRlcmVk IHRvIGJlIGEgcHJlZmVycmVkIHNvbHV0aW9uIHRvIGRlZmluaW5nIGEgbmV3IHNpZ25hdHVyZSBh bGdvcml0aG0gd2hpY2ggY29udGFpbnMgYXMgdGhlIHBhcmFtZXRlciB0aGUgc2VxdWVuY2Ugb2Yg YWxnb3JpdGhtIGlkZW50aWZpZXJzIGFuZCBhcyB0aGUgc2lnbmF0dXJlIHZhbHVlIGEgc2VxdWVu Y2Ugb2Ygc2lnbmF0dXJlIHZhbHVlcy4mbmJzcDsgVGhlIHByb2JsZW0gd2l0aCBqdXN0IGRlZmlu aW5nIHRoZSBleHRlbnNpb24gdG8gU0lHTkVEIGlzIHRoYXQgb25lIG5lZWRzIHRvIG1ha2Ugc3Vy ZSB0aGF0IHRoZSBzZXQgb2Ygc2lnbmF0dXJlIGFsZ29yaXRobXMgYW5kIHBhcmFtZXRlcnMgYXJl IGFsc28gcGFydCBvZiB0aGUgZGF0YSB0byBiZSBzaWduZWQgYW5kIEkgYW0gbm90IHNlZWluZyB0 aGF0IGhpZ2hsaWdodGVkIGhlcmUuPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkpp bTxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+PC9kaXY+PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1 ZSAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDQuMHB0Ij48ZGl2PjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjMuMHB0IDBj bSAwY20gMGNtO2JvcmRlci10b3AtY29sb3I6cmdiKDIyNSwgMjI1LA0KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgMjI1KSI+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5TcGFzbSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmci PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+ PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvYj5SeWFuIFNsZWV2aTxicj48Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TW9uZGF5LCBTZXB0ZW1iZXIgMTAsIDIwMTgg ODo1MyBBTTxicj48Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxicj48Yj5DYzo8L2I+PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlNQQVNNICZsdDs8YSBocmVm PSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNwYXNt QGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5v cmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3Jn PC9zcGFuPjwvYT48YnI+PGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPG86cD48 L286cD48L3NwYW4+PC9wPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRp dj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PGRpdj48ZGl2Pjxk aXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIFNlcCAxMCwg MjAxOCBhdCAxMDo1NiBBTSBFcmlrIEFuZGVyc2VuICZsdDs8YSBocmVmPSJtYWlsdG86ZXJhQHg1 MDAuZXUiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9zcGFuPjwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48L2Rpdj48YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRk aW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1sZWZ0LWNvbG9yOnJn YigyMDQsIDIwNCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAyMDQp Ij48ZGl2PjxkaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJEQSIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5IaSBGb2xrLDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkRBIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SW4gSVRV LVQgd2UgaGF2ZSBwbGFucyB0byBhbGxvdyBmb3IgZG91YmxlIHNpZ25hdHVyZXMgdXNpbmcgdGhl IFNJR05FRCBwYXJhbWV0cml6ZWQgZGF0YSB0eXBlIGRlZmluZWQgaW4gWC41MDkgdG8gY29wZSB3 aXRoIHNpdHVhdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhlIGludGVybmV0IGRyYWZ0OiDigJxNdWx0 aXBsZSBQdWJsaWMtS2V5IEFsZ29yaXRobSBYLjUwOSBDZXJ0aWZpY2F0ZXMgKGRyYWZ0LXRydXNr b3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDktMDEp4oCdPG86cD48L286cD48L3NwYW4+PC9wPjwv ZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPldlIHN1Z2dlc3QgdG8gZW5oYW5jZSB0aGUgU0lHTkVEIGRhdGEgdHlwZSBhcyBz aG93biBiZWxvdzo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rp dj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgOyZxdW90OyxzZXJpZiI+U0lHTkVEe1Rv QmVTaWduZWR9IDo6PSBTRVFVRU5DRSB7PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgOyZx dW90OyxzZXJpZiI+Jm5ic3A7IENPTVBPTkVOVFMgT0YgU0lHTkFUVVJFLDwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3IDsmcXVvdDssc2VyaWYiPiZuYnNwOyAuLi4uLi48L3NwYW4+PC9iPjxi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcgOyZxdW90OyxzZXJpZjtjb2xvcjojQzAwMDAwIj4sPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcgOyBjb2xvcjogcmVkJnF1b3Q7LHNlcmlmIj4mbmJzcDsgYWx0QWxnb3JpdGhtSWRlbnRp ZmllciZuYnNwOyBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0gT1BU SU9OQUwsPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48 L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgOyBjb2xvcjogcmVkJnF1b3Q7LHNl cmlmIj4mbmJzcDsgYWx0U2lnbmF0dXJlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJJVCBTVFJJTkcgT1BUSU9OQUwmbmJz cDs8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2 PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyA7IGNvbG9yOiByZWQmcXVvdDssc2VyaWYi PiZuYnNwOyZuYnNwOzwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyA7JnF1b3Q7LHNlcmlmIj59PC9zcGFuPjwvYj48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsmcXVvdDssc2VyaWY7Y29s b3I6cmVkIj4mbmJzcDs8L3NwYW4+PC9iPjwvc3Bhbj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsmcXVvdDssc2VyaWY7Y29sb3I6 cmVkIj4oV0lUSCBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRobUlkZW50aWZpZXIgUFJFU0VO VCwgYWx0U2lnbmF0dXJlIFBSRVNFTlQgfSB8PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcg OyBjb2xvcjogcmVkJnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgV0lUSCBD T01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRobUlkZW50aWZpZXIgQUJTRU5ULCZuYnNwOyBhbHRT aWduYXR1cmUgQUJTRU5UIH0gKTwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsmcXVvdDss c2VyaWYiPiZuYnNwOzwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldl IGFyZSBvcGVuIHRvIGNvbW1lbnRzLiBXZSBrbm93IHRoYXQgSUVURiBpcyBub3QgYSBoZWF2eSB1 c2VyIG9mIHRoaXMgZGF0YSB0eXBlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2Pjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3Nw YW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5X ZSBoYXZlIG5vIGludGVudGlvbiB0byB1c2UgdGhpcyBleHRlbmRlZCBkYXRhIHR5cGUgZm9yIGNl cnRpZmljYXRlcyBhbmQgQ1JMcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Rm9y IHlvdXIgaW5mb3JtYXRpb24sIFNJR05BVFVSRSBpcyBkZWZpbmVkIGFzOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD48L2Rpdj48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyA7JnF1b3Q7LHNlcmlmIj5TSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHs8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjxkaXY+PHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyA7JnF1b3Q7LHNlcmlmIj4mbmJzcDsgYWxnb3JpdGhtSWRlbnRp ZmllciZuYnNwOyBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0sPC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48ZGl2 PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgOyZxdW90OyxzZXJpZiI+Jm5ic3A7IHNpZ25hdHVy ZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyBCSVQgU1RSSU5HLDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsmcXVv dDssc2VyaWYiPiZuYnNwOyAuLi4uLi4gfTwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjxkaXY+PGRp dj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD48L2Rpdj48L2Rpdj48ZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Gcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSksIHRoZXJl IHdlcmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUgZGlzY3Vz c2lvbiAtJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5n LzEwMS9tYXRlcmlhbHMvbWludXRlcy0xMDEtbGFtcHMtMDEudHh0Ij48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTAxL21hdGVy aWFscy9taW51dGVzLTEwMS1sYW1wcy0wMS50eHQ8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tIHRoYXQgZnVuZGFtZW50YWxseSBxdWVz dGlvbmVkIHRoYXQgYXBwcm9hY2guPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2PjwvZGl2Pjxk aXY+PGRpdj48cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48L2Rpdj48ZGl2PjxkaXY+PHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5IYXMgdGhlIElUVS1UIGFkZHJlc3NlZCBvciByZXNvbHZlZCB0 aG9zZSBjb25jZXJucz8gQXJlIHRoZXkgbm90IGFwcGxpY2FibGUgZm9yIHNvbWUgcmVhc29uIHNw ZWNpZmljIHRvIElUVS1UPyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48L2Rpdj48L2Rpdj48 L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9k aXY+PC9kaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+U3Bhc20gbWFpbGluZyBs aXN0PGJyPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86U3Bhc21AaWV0Zi5vcmciPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6cHVycGxlIj5TcGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+PGJyPjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3NwYXNtIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zcGFzbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPjwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD48ZGl2PjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tIDxvOnA+PC9v OnA+PC9wPjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6Ny41cHQiPjxwIGNsYXNzPSJNc29Ob3JtYWwi PkJlc3QgUmVnYXJkcywgPG86cD48L286cD48L3A+PGRpdiBzdHlsZT0ibWFyZ2luLWJvdHRvbTo3 LjVwdCI+PHAgY2xhc3M9Ik1zb05vcm1hbCI+TWFzc2ltaWxpYW5vIFBhbGEsIFBoLkQuPG86cD48 L286cD48L3A+PC9kaXY+PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGltZyBib3JkZXI9IjAiIHdpZHRo PSIxMjAiIGhlaWdodD0iMTgiIGlkPSJfeDAwMDBfaTEwMjUiIHNyYz0iY2lkOmltYWdlMDAxLnBu Z0AwMUQ0NEM1MS5FODY2Q0MyMCIgYWx0PSJDYWJsZUxhYnMiPjxicj5QcmluY2lwYWwgQXJjaGl0 ZWN0PGJyPlNlY3VyaXR5IFNlcnZpY2VzLCBSJmFtcDtEPG86cD48L286cD48L3A+PC9kaXY+PC9k aXY+PC9kaXY+PC9ib2R5PjwvaHRtbD48L2Rpdj4= --b2_438b295c7fbdc64d572c5b884c212b6f Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename=image001.png iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= --b2_438b295c7fbdc64d572c5b884c212b6f-- --b1_438b295c7fbdc64d572c5b884c212b6f-- From nobody Mon Sep 17 02:41:04 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3436F130DE3 for ; Mon, 17 Sep 2018 02:41:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jr9bunMR1qI0 for ; Mon, 17 Sep 2018 02:40:57 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 819EE130DC1 for ; Mon, 17 Sep 2018 02:40:57 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 249B2300A9B for ; Mon, 17 Sep 2018 05:40:55 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id XharRVEx5qN4 for ; Mon, 17 Sep 2018 05:40:52 -0400 (EDT) Received: from new-host-6.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 4B0BD30025D; Mon, 17 Sep 2018 05:40:52 -0400 (EDT) From: Russ Housley Message-Id: <5F92CA69-D9A2-49C5-BE59-D4FE9AF1BE8D@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9EC6D095-459D-4852-8E04-8689951DF8D1" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 05:40:52 -0400 In-Reply-To: Cc: "spasm@ietf.org" To: Quynh Dang , Panos Kampanakis References: <00b801d42b61$cf059a60$6d10cf20$@augustcellars.com> <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] WGLC: draft-ietf-lamps-pkix-shake-02 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 09:41:02 -0000 --Apple-Mail=_9EC6D095-459D-4852-8E04-8689951DF8D1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Quynh and Panos: I have not heard anyone speak against Jim's suggestion for deterministic = ECDSA without a random generator for k. Let's go that way unless there = is a scream from the group now. Russ > On Sep 5, 2018, at 1:44 PM, Dang, Quynh (Fed) = wrote: >=20 > I would have no problems with deterministic ECDSA. But, the adoption = was for the original ECDSA.=20 >=20 > We need advice from the chairs.=20 >=20 > Regards, > Quynh.=20 >=20 >=20 > From: Jim Schaad > > Sent: Wednesday, September 5, 2018 11:19 AM > To: Dang, Quynh (Fed) > Cc: 'Russ Housley'; 'Tim Hollebeek'; 'Panos Kampanakis (pkampana)'; = spasm@ietf.org > Subject: RE: WGLC: draft-ietf-lamps-pkix-shake-02 > =20 > Mostly looks fine =E2=80=93 one comment below > =20 > From: Dang, Quynh (Fed) =20 > Sent: Wednesday, September 5, 2018 7:08 AM > To: Jim Schaad > > Cc: 'Russ Housley' >; Tim Hollebeek = >; Panos = Kampanakis (pkampana) > > Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02 > =20 > Hi Jim, > =20 > We appreciate your review and comments. > =20 > By the co-chairs' direction, let's try to improve the doc using your = comments. > =20 > From: Jim Schaad > > Sent: Friday, August 3, 2018 3:40 PM > To: draft-ietf-lamps-pkix-shake@ietf.org = > Subject: WGLC: draft-ietf-lamps-pkix-shake-02 > =20 > Not ready for progression. >=20 > * Run the NITS on this document and fix them. Examples of problems = are the > fact that MUST language section is missing, possible incorrect = references, > and you have lines that are too long. > =20 > Comment 1: correct. Will fix it. > =20 >=20 > * Introduction - I have a problem with the cardinality of items in = the > second and third paragraphs here. I do not ask that you fix the = problems > that I have but you should be ready to address this is you get the = same > questions from the RFC Editor or the IESG. I would consider SHAKE to = be a > family of extendable-output hash functions and thus has a cardinality = of > one. The two specific hash functions have a cardinality of greater = than > one. The question of cardinality comes in terms of the usage of 'A', = 'is', > 'are'. > =20 > Comment 2: "the SHAKE hash functions " in second paragraph in the = intro. should be changed to "the SHAKEs" for a smooth read. A SHAKE is = defined as one function with variable output length.=20 >=20 >=20 > * Introduction - paragraph 2 - I find the last sentence to be = difficult to > read. The usage of 'and' here seems to be incorrect and it may be = difficult > to figure out which pair comes first - resistance or function. > =20 > Comment 3: > It would read better if the sentence "The corresponding collision and = preimage resistance security levels for SHAKE128 and SHAKE256 are = respectively > min(d/2,128) and min(d,128) and min(d/2,256) and min(d,256) bits." = to be replaced with "The corresponding collision and second preimage = resistance strengths for SHAKE128 are min(d/2,128) and min(d,128) = respectively. And, the corresponding collision and second preimage = resistance strengths for SHAKE256 are min(d/2,256) and min(d,256) bits = respectively. " >=20 >=20 > * Introduction - paragraph 3 - I am unaware that ECDSA has a mask = generating > function associated with it. This sentence needs to be cleaned up > =20 > =20 > Comment 4: This sentence " > SHAKEs can be used as the message digest function (to hash the > message to be signed) and as the hash function in the mask = generating > functions in RSASSA-PSS and ECDSA." should be replaced with " > SHAKEs can be used as the message digest function (to hash the > message to be signed) in RSASSA-PSS and ECDSA and as the hash = function in the mask generating functions in RSASSA-PSS." >=20 >=20 > * Introduction - paragraph 3 - Consider putting in a reference to the > algorithm identifiers that are not changing. Probably overkill but = still > useful > =20 > Comment 5: Adding " see section 3 below" at the end of this sentence: = "In this document, we define four new OIDs for RSASSA-PSS and ECDSA when = SHAKE128 and SHAKE256 are used as hash functions.". > =20 >=20 > * Identifiers - This section needs to nail down all parameters = associated w/ > the different SHAKE functions when used here. Otherwise you end up = with the > first assumption that I made which was d =3D 128 for SHAKE128 which = would not > produce an acceptable result. > =20 > Comment 6: The specification of output lengths of the 2 SHAKEs is in = Sections 4.1..1 and 4.1.2. Adding a sentence " See Sections 4.1.1 and = 4.1.2 for specification of a required output length for each use of = SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA." > =20 >=20 >=20 > * Signatures - Para #3 - you refer to section 3 for OIDs, but they are = not > there for public keys. > =20 > Comment 7: Adding this " > Conforming CA implementations MUST specify the algorithms explicitly > by using the OIDs specified in Section 3 when encoding public keys = for RSASSA-PSS and ECDSA with SHAKE signatures in certificates and = CRLs." as the first paragraph in Section 4.2 "Public keys".=20 >=20 >=20 > * IANA Considerations is incorrect and MUST be updated > =20 > =20 > Comment 8: IANA Considerations is incorrect and will be updated. > =20 >=20 > * Why is there no reference to deterministic ECDSA signatures in the > document. > =20 > Comment 9: Deterministic ECDSA has a different signing function = because of the way k is generated. The working group has not adopted = this option yet. Verification is the same.=20 > =20 > [JLS] If you want to say that it is a different signature algorithm = that is fine. I=E2=80=99ll call and raise. It should be that it is = required that ECDSA w/ SHAKE implements deterministic ECDSA and MUST NOT = use a random generator for k. >=20 >=20 > * The ASN.1 module is absent and needs to be instantiated. Even doing = so > with TBD is sufficient for now. > =20 > Comment 10: Yes.=20 > The ASN.1 module is absent and needs to be instantiated.=20 > =20 >=20 > Are you ok with the proposed resolutions ? > =20 > Regards, > Quynh.=20 >=20 >=20 >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm = --Apple-Mail=_9EC6D095-459D-4852-8E04-8689951DF8D1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Quynh= and Panos:

I have = not heard anyone speak against Jim's suggestion for deterministic = ECDSA without a random generator for k.  Let's go that way unless = there is a scream from the group now.

Russ


On Sep 5, 2018, at 1:44 PM, Dang, Quynh (Fed) <quynh.dang@nist.gov>= wrote:

I would = have no problems with deterministic ECDSA. But, the adoption was for the = original ECDSA. 

We need advice from the chairs. 

Regards,
Quynh. 


From: Jim= Schaad <ietf@augustcellars.com>
Sent: Wednesday, September 5, = 2018 11:19 AM
To: Dang, Quynh (Fed)
Cc: 'Russ Housley'; 'Tim = Hollebeek'; 'Panos Kampanakis (pkampana)'; spasm@ietf.org
Subject: RE: WGLC: = draft-ietf-lamps-pkix-shake-02
 
Mostly looks = fine =E2=80=93 one comment below

 

From: Dang, Quynh (Fed) = <quynh.dang@nist..gov> 
Sent: Wednesday, September 5, = 2018 7:08 AM
To: Jim Schaad <ietf@augustcellars.com>
Cc: 'Russ= Housley' <housley@vigilsec.com>; Tim Hollebeek <tim.hollebeek@digicert.com>; Panos Kampanakis = (pkampana) <pkampana@cisco.com>
Subject: Re: WGLC: = draft-ietf-lamps-pkix-shake-02

 

Hi Jim,

 

We appreciate your review and comments.

 

By the co-chairs' direction, let's = try to improve the doc using your comments.
 
From: Jim Schaad = <ietf@augustcellars.com>
Sent: Friday, August 3, 2018 3:40 = PM
To: draft-ietf-lamps-pkix-shake@ietf.org
Subject: WGLC: = draft-ietf-lamps-pkix-shake-02

 

Not ready for progression.

* Run the NITS on this document and fix = them.  Examples of problems are the
fact that MUST = language section is missing, possible incorrect references,
and you have lines that are too long.

 

Comment 1: correct. = Will fix it.

 


*  Introduction - I have a problem with = the cardinality of items in the
second and third = paragraphs here.  I do not ask that you fix the problems
that I have but you should be ready to address this is you = get the same
questions from the RFC Editor or the = IESG.  I would consider SHAKE to be a
family of = extendable-output hash functions and thus has a cardinality of
one.  The two specific hash functions have a cardinality = of greater than
one.  The question of cardinality = comes in terms of the usage of 'A', 'is',
'are'.

 

Comment 2: "the SHAKE = hash functions " in second paragraph in the intro. should be = changed to "the SHAKEs" for a smooth read.  A SHAKE is defined as = one function with variable output length. 


* = Introduction - paragraph 2 - I find the last sentence to be difficult = to
read.  The usage of 'and' here seems to be = incorrect and it may be difficult
to figure out which pair = comes first - resistance or function.
 

Comment= 3:
It would read better if the = sentence  "The corresponding collision and preimage = resistance security levels for SHAKE128 and SHAKE256 are = respectively
   min(d/2,128) and min(d,128) and min(d/2,256) and = min(d,256) bits."  to be replaced with "The corresponding collision = and second preimage resistance strengths for SHAKE128 = are min(d/2,128) and min(d,128) respectively. And, the = corresponding collision and second preimage = resistance strengths for SHAKE256 are min(d/2,256) and = min(d,256) bits respectively. "


* Introduction - paragraph 3 - I am unaware = that ECDSA has a mask generating
function associated with = it.  This sentence needs to be cleaned up

 

 

Comment 4: This sentence "
SHAKEs = can be used as the message digest function (to hash the
   message = to be signed) and as the hash function in the mask = generating
   functions in RSASSA-PSS and ECDSA." should be = replaced with "
SHAKEs can be used as the message digest function (to = hash the
   message to be signed) in RSASSA-PSS and = ECDSA and as the hash function in the mask = generating functions in RSASSA-PSS."


* Introduction - paragraph 3 - = Consider putting in a reference to the
algorithm = identifiers that are not changing.  Probably overkill but still
useful

 

Comment= 5: Adding " see section 3 below" at the end of this sentence: "In this = document, we define four new OIDs for RSASSA-PSS and ECDSA when = SHAKE128 and SHAKE256 are used as hash functions.".

 


* Identifiers - = This section needs to nail down all parameters associated w/
the different SHAKE functions when used here.  Otherwise = you end up with the
first assumption that I made which was = d =3D 128 for SHAKE128 which would not
produce an = acceptable result.

 

Comment= 6: The specification of output lengths of the 2 SHAKEs is in Sections = 4.1..1 and 4.1.2.  Adding a sentence " See Sections 4.1.1 and 4.1.2 = for specification of a required output length for each use of = SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA."

 



* Signatures - Para #3 - you = refer to section 3 for OIDs, but they are not
there for = public keys.

 

Comment 7: Adding this = "
Conforming CA implementations MUST specify the = algorithms explicitly
   by using the OIDs specified in Section 3 when = encoding  public keys for RSASSA-PSS and ECDSA with = SHAKE signatures in certificates and CRLs." as the first = paragraph in Section 4.2 "Public = keys". 


* IANA Considerations is incorrect and MUST be = updated

 

 

Comment 8: IANA = Considerations is incorrect and will be updated.

 


* Why is there no reference to deterministic = ECDSA signatures in the
document.

 

Comment 9: Deterministic ECDSA has a different signing = function because of the way k is generated. The working group has not = adopted this option yet. Verification is the same. 

 

[JLS] If = you want to say that it is a different signature algorithm that is = fine.  I=E2=80=99ll call and raise.  It should be that it is = required that ECDSA w/ SHAKE implements deterministic ECDSA and MUST NOT = use a random generator for k.


* The ASN.1 module is absent = and needs to be instantiated.  Even doing so
with TBD = is sufficient for now.

 

Comment 10: Yes. 
The ASN.1 module is absent and needs to be = instantiated. 

 


Are you ok with the proposed resolutions = ?

 

Regards,

Quynh. 


_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

= --Apple-Mail=_9EC6D095-459D-4852-8E04-8689951DF8D1-- From nobody Mon Sep 17 02:47:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 319D0130DE3 for ; Mon, 17 Sep 2018 02:47:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m08poMdGdL7N for ; Mon, 17 Sep 2018 02:47:21 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBD9F130DC1 for ; Mon, 17 Sep 2018 02:47:20 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 5DDA1300A9B for ; Mon, 17 Sep 2018 05:47:18 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id tsbcDFs_chfS for ; Mon, 17 Sep 2018 05:47:16 -0400 (EDT) Received: from new-host-6.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 58A2630025D; Mon, 17 Sep 2018 05:47:16 -0400 (EDT) From: Russ Housley Message-Id: <8ACA0A0D-CCB4-44EF-8D10-00DAC3A949EE@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9EC79BBB-BD6E-4A85-9AA2-160E5C1C9946" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 05:47:16 -0400 In-Reply-To: <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> Cc: SPASM To: Jim Schaad , Panos Kampanakis , Quynh Dang References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 09:47:22 -0000 --Apple-Mail=_9EC79BBB-BD6E-4A85-9AA2-160E5C1C9946 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Sep 5, 2018, at 12:47 PM, Jim Schaad = wrote: >=20 > * Message Authentication Codes - Do we need to address a potential = request > from some of the IOT worlds such as SUIT where they want to use KMAC, = but > would be happy with a smaller authentication value? > =20 > Comment 6: Shorter tags are generally ok depending on each = application: what are the potential attacks/issues and how much data are = MACed under a random key.=20 > =20 > How small would you like for SUIT ? What is the maximum amount of data = that will ever be MACed under ONE random key ? > =20 > This is for CMS, I don't think there is a need to reduce the size. But = I could be wrong about this. =20 > [JLS] One of the message formats that SUIT was using the last time I = checked was CMS. This means that if SUIT wants it then yes it would be = for CMS. Russ =E2=80=93 do you think that they are going to want a = =E2=80=9Ctruncated=E2=80=9D tag for KMAC? SUIT will focus on COSE structures, but the charter allows a rfc4108bis. So far, size in SUIT has not been a sticking point. When the signature = value or authentication tag is compared to a software image, a few extra = octets is not a show stopper. Russ= --Apple-Mail=_9EC79BBB-BD6E-4A85-9AA2-160E5C1C9946 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Sep 5, 2018, at 12:47 PM, Jim Schaad <ietf@augustcellars.com> wrote:

* Message = Authentication Codes - Do we need to address a potential request
from some of the IOT worlds such as SUIT where they want to = use KMAC, but
would be happy with a smaller authentication = value?
 
Comment 6: Shorter = tags are generally ok depending on each application: what are the = potential attacks/issues and how much data are MACed under a random = key. 
 
How small would you = like for SUIT ? What is the maximum amount of data that will ever be = MACed under ONE random key ?
 
This is for CMS, I = don't think there is a need to reduce the size. But I could be wrong = about this.  
[JLS] One of the message formats that SUIT was using = the last time I checked was CMS.  This means that if SUIT wants it = then yes it would be for CMS.  Russ =E2=80=93 do you think that = they are going to want a =E2=80=9Ctruncated=E2=80=9D tag for = KMAC?

SUIT will focus on COSE structures, but the charter allows a = rfc4108bis.

So = far, size in SUIT has not been a sticking point.  When the = signature value or authentication tag is compared to a software image, a = few extra octets is not a show stopper.

Russ
= --Apple-Mail=_9EC79BBB-BD6E-4A85-9AA2-160E5C1C9946-- From nobody Mon Sep 17 02:53:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E91951277D2 for ; Mon, 17 Sep 2018 02:53:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u8JTxIjQECBZ for ; Mon, 17 Sep 2018 02:53:18 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20412130DEA for ; Mon, 17 Sep 2018 02:53:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D9C7A300A9C for ; Mon, 17 Sep 2018 05:53:15 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id dK-FcQpKp8pD for ; Mon, 17 Sep 2018 05:53:14 -0400 (EDT) Received: from new-host-6.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 3F9C530025D; Mon, 17 Sep 2018 05:53:14 -0400 (EDT) From: Russ Housley Message-Id: <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_525DE166-C0F3-4BC4-8BF3-ADF8ABC3CB02" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 05:53:14 -0400 In-Reply-To: Cc: SPASM To: Quynh Dang , Panos Kampanakis References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 09:53:20 -0000 --Apple-Mail=_525DE166-C0F3-4BC4-8BF3-ADF8ABC3CB02 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here is a part of a message to resolve the WG Last Call comments on = draft-ietf-lamps-cms-shakes-01 ... > * Message Digests - are the limits on the size only for CMS or do they = apply > everywhere that the algorithm is used. If it is everywhere how do we > reconcile with the usage in RSA-PSS?=20 > =20 > Comment 5: Only in CMS, when a message digest is generated. For = RSA-PSS, a SHAKE has 2 different output sizes for 2 different uses: = hashing a message to be signed and generating a masking value in MGF 1.=20= > [JLS] After looking at this a second time, I propose that this problem = be solved by creation of a new mask generation function MGF-V. We can = eliminate the counter from the operation as being un-needed and just = compute the mask length and generate that many bits of input from a = SHAKE function. > =20 > I thought about that. But that would be another standard function = which have not been defined yet. How could we go from here ? And this = route would take time. Using the existing MGF 1 would waste only 1 = division: to figure out counter number is zero: so there is only one = hash function execution.=20 > [JLS2] No it is more than that. It takes both the one division AND a = concatenation AND the strangeness for trying to decide how long the = SHAKE output is if one is placing it into an existing MGF1 piece of = code. If you define a new MGF-V then there is a new function that is = called =E2=80=93 which code should potentially be setup for =E2=80=93 = and zero extra work beyond that. The size of the mask is the size of = the output, no concatenation. It is much cleaner in my opinion. Does anyone think that using SHAKE in the RSA-PSS mask generation = function is the wrong approach? Russ --Apple-Mail=_525DE166-C0F3-4BC4-8BF3-ADF8ABC3CB02 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Here is a part of a message to resolve the WG Last Call = comments on draft-ietf-lamps-cms-shakes-01 ...

* Message Digests - are the limits on the size only for CMS = or do they apply
everywhere that the algorithm is = used.  If it is everywhere how do we
reconcile with = the usage in RSA-PSS? 

 

Comment 5: Only in CMS, when a message digest is = generated. For RSA-PSS,  a SHAKE has 2 different output sizes for 2 = different uses: hashing a message to be signed and generating a masking = value in MGF 1. 
[JLS] = After looking at this a second time, I propose that this problem be = solved by creation of a new mask generation function MGF-V.  =  We can eliminate the counter from the operation as being un-needed = and just compute the mask length and generate that many bits of input = from a SHAKE function.

 

I thought about that. But that would be another = standard function which have not been defined  yet. How could we go = from here ? And this route would take time. Using the existing MGF = 1 would waste only 1 division: to figure out counter number is = zero: so there is only one hash function execution. 
[JLS2] No it is more than = that.  It takes both the one division AND a concatenation AND the = strangeness for trying to decide how long the SHAKE output is if one is = placing it into an existing MGF1 piece of code.  If you define a = new MGF-V then there is a new function that is called =E2=80=93 which = code should potentially be setup for =E2=80=93 and zero extra work = beyond that.  The size of the mask is the size of the output, no = concatenation.  It is much cleaner in my = opinion.

Does = anyone think that using SHAKE in the RSA-PSS mask generation function is = the wrong approach?

Russ

= --Apple-Mail=_525DE166-C0F3-4BC4-8BF3-ADF8ABC3CB02-- From nobody Mon Sep 17 05:40:18 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 594F7130E5D for ; Mon, 17 Sep 2018 05:40:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=noekeon.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aowf2sV8ZC1Q for ; Mon, 17 Sep 2018 05:40:15 -0700 (PDT) Received: from ober.noekeon.org (ober.noekeon.org [91.134.133.203]) by ietfa.amsl.com (Postfix) with ESMTP id CB845130E59 for ; Mon, 17 Sep 2018 05:40:14 -0700 (PDT) Received: from Joans-MacBook-Pro.local (unknown [145.15.244.27]) by ober.noekeon.org (Postfix) with ESMTPSA id B0B0122388 for ; Mon, 17 Sep 2018 14:40:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=noekeon.org; s=mail; t=1537188012; bh=DFhdIsyVM/HuRsA4TosVk7e0jV5Q5kByLVInVwhQ7mU=; h=Subject:To:References:From:Date:In-Reply-To:From; b=ADRj7F1RI11BD6muzhD1ISxUuT7XMby7ohgBkW+1SIC2OfUdRzTBoTf9tALPCJd1z iT7WUCJN+FYOqCa/EA9tNfe3Mx5a+TgkxAIsBeBPj5MtV/OIl2Xkz9+ZfVavzfgk8u HFLDG2RDK3zIqof6OwGKg5CNqU07F8XQN2bRCUDo= To: spasm@ietf.org References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> From: Joan Daemen Openpgp: preference=signencrypt Autocrypt: addr=jda@noekeon.org; prefer-encrypt=mutual; keydata= xsFNBFpjJFgBEAC2FSj/4V5lLMCvc60Fyb3XUsOCPFdhNyBNh6KE8cfh3dzlS/Pzq0vcZlKc /+5n4x34Mp8JL+5muTSg7sRIGjm50FBUzZrSHPIvWlyCKyzt18y3dmfvQyuZMcboNA4tpWRy daOngLK28gUCvVf+A/t/KwKwDMM7OzSukl5bll2OOTxgApAzqS2Tx+HdExLILEqRHooT/Fqw EhXzZfOdGeKv5/YEBAnLfqD22lX7KXyWdai8iDxvSh6Cn01wRhLpIJ5hTY0j406s+EVedGVv a8zvWb+zzr0l52YuvKYBc3zlqMixcDnpJJDVpmDOFvTJPM721oTMRZ+neXhvPN44zgfo11fs ESo8pz3qSiiOJQT12rbHDQzwEWm9rZ3vOG7BvRjx2WmlwMlqytSmHkp5tJ0fDtw3ZqpARcEy PfwE+g1j3fpwOqRXRKjoc4pq6NMhX9+n6/ZfMYbo12epRdvZbF4oeQq7cz92b0tev4ai8qti myYIs47G7C7Ku7X/Bxcs3FiOX3bQ8xH03JUKYFYhI+9w93Trs2rmbgKarKl61R7YmgdQPYOi OprBEh3bH7a/Xz6jhpPcZ59kbO+J2Tr7c72vRNl+yGqvzOUfflISMI918ZeBusP6pVLh8X83 mz8YupHAz6QvQJi86M3NP0u6NSd3NsYtN5ai7+YAbCoIMdKh6wARAQABzR1Kb2FuIERhZW1l biA8amRhQG5vZWtlb24ub3JnPsLBlAQTAQgAPhYhBHaX/G8yAc2/EYS5X2B6rPjjt2wEBQJa YyRYAhsjBQkJZgGABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEGB6rPjjt2wEVhsP/3qs 1+Qi6CXkcgXSTkCMtk9tkmx8Q8uDKelQY3T5QpaowIq+HjZDAYGu2I642T93RmKigHwnqRVk OWNFV8ZJTLyZtPo+oyMiB62CC33rvGhLNlUJ4zXE9XCX4q4+7U8D8eFuzrOOP6cX3AipN3p5 XE9WNfalhx/bSgNFSx99qHqF7voDhGDJvkFezME0GvGnHqQjmQh3GTtT1OlMq5swlCqBHhQD nn8yEYXFAjYYFMPOkrQ4MIodsjlw856KFxoaNqgHkaLCkz2McKqQMIYmdAYXu5qW8oPSMGP1 bcXRKWTpZ3oJbXLW7B4yx4BPA6wDp/JL30aKgVK+IzmU44OXW6cvkGw1wpBECnE5tPRk5wJ4 LYxLdUYk4VQcjkRTRwJ9kXjIcX+kPdNxxJOv0JhfpeQW3sEStMjqfZn6piFnyIFC3btnr/II QH1ISeTWvPSNgR6j4VXW5hb6pUkq9t6kgxQiSPhZsFOtvCPTDBTZKsYpJEIC6+ImmfxtIL9X KLFzbj3RF4MoyRwBVicvDPg48dj0HJ+iVH1i7XUZr1zEgMc/f3+nqGzpFenCuirajBM4zlTD x8Tjp1nPidEfND3LQQmDCqOtksuFUWGWLwds7Xuh2H6Vwp6YH/aAUgMs27GuuCfKKnAnJUQb do9pYfZCakTfb1/M7il+InWXA7eCddO5zsFNBFpjJFgBEACn+CAANregkunPhcYsXwuUZOqY AQKuiy9hAzP+SrNYXMEjVNwe5yCns/thBS525/h0Fr9VNWgaUVyfW5GV1j1vAi1EU26nEcTq YHqwgHLti2FZLTLJBjOWblAmATmaNXRjMDdY50LXmOyMlp+pC/7Xsj/OrHMsDhNM0mLSJdt5 C22VnAxUcurBeDTz6c7t2ps8UxUCQmTXapOJm2IXqxdTTM5v5ZX6/M7Q47KX6LWsA8ij3jmn fLFQfEoBL35rZmR1ZQ06UuXRB2KTM1FpJeYPXAjGmSXDlDyqhraNY6SrNMlmO9H52TYIOqVh INzkhjDGykEJE/mK8BnfWhXXfK2U1ieuMh+YtjpGiZQmuAnRM4koJdTYRGjj40joCzNv62xE 3scA4kEUvR5oyOcmnnsZspGM2RxEsi1Un9AwX//Q5y6azddRIf3y5N9yhiFM1dBXJR+iryl9 9BosnEzXTrfnfYNVzMiyQCEsHFR2/buMfQd+fW+L7+5r/sUPF/KM4SjvBP0sVD2e7pSHO8VB TfBZ9/K/c/qpeZ8ISwNx2H0+A6jdwXkModRC34+/cVLltqZGbnCBBJ2LHnLj1r+kTUW5n75d yLxtN9SzrsAukGDUcKkG1vUpPbVDUHFW2yMnHk6zKgTx+PThjobhIZvPKAJ0Zt5ReSATMqwD /6Lwqr+djwARAQABwsF8BBgBCAAmFiEEdpf8bzIBzb8RhLlfYHqs+OO3bAQFAlpjJFgCGwwF CQlmAYAACgkQYHqs+OO3bAS5rQ/+M7XX2d5Bv6gP+Cl9fhEdsugt6ZtkaWUF9IIFIiyGexdW KYnx+tLMkumo3Ifn9/bGV28bTpVRVSFSUSBwOM66R6XomuAPqlczNJgDUWJCC9FG0wUbr15v 6b7IXbrmu0RJk++V0kblJJLgNRRlydgpJwtPTertyPP1xRemyxCrSSdycr9+zFkHrJFtuPV1 WSy8A0+3FiV2YYhM7Hpch84XuML9F1dpRwPx8NNzfkXthG3ur7vl4gTK1qUuIdo8NZ6tr50X 23N19dYIXCD+HXFFMxhsdXquabwc/Dw0lnsV38XwktP+TVQo+w44WErOyGZbMGcUsmOwTY7Y dDLFBUgLF+R4VhlesOlhbrWsfxbqZCzSRqA8Ossd2s/KpWv9wP6SXzjRn7z2nBynXw0I8C6K N2ZS/SCh5x8zuH9OKpVSJOKkyrNLV1UR3IfK3Uhk49xo54FwozqerPmgjFIgNbGs+cbsvsos WcIGnK2SVrQiTeRwBuZVDqy1Xyv1LGiJkQLIqFyE4+EaSfreiXH2t/HNukj7NyHWaRr7Lyz+ 63vBwdWwDh8eUU5Inj0CzsZXLtlKj/XWdDv9MmZT4Wvidrtw9+jd4UfuSehq9VlKZwKWf5FZ T1OONAwowduh92P8TS/uhdcttAZLTKjYZp9Wu16+e7Zp7a9j0lKBDyq2zigCo3I= Message-ID: Date: Mon, 17 Sep 2018 14:40:12 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 12:40:17 -0000 Hi all, On 17/09/2018 11:53, Russ Housley wrote: > Does anyone think that using SHAKE in the RSA-PSS mask generation > function is the wrong approach? On the contrary, using SHAKE (or cSHAKE if you wish) in the RSA-PSS mask generating function is THE sound approach. Kind regards, Joan Daemen From nobody Mon Sep 17 05:45:22 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD72B130E66 for ; Mon, 17 Sep 2018 05:45:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=noekeon.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nT6vGrOHF6u0 for ; Mon, 17 Sep 2018 05:45:09 -0700 (PDT) Received: from ober.noekeon.org (ober.noekeon.org [91.134.133.203]) by ietfa.amsl.com (Postfix) with ESMTP id D9F7F130EA5 for ; Mon, 17 Sep 2018 05:45:06 -0700 (PDT) Received: from Joans-MacBook-Pro.local (unknown [145.15.244.27]) by ober.noekeon.org (Postfix) with ESMTPSA id A1D7F22388 for ; Mon, 17 Sep 2018 14:45:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=noekeon.org; s=mail; t=1537188305; bh=MMl8n+ERtwMNfKjLAxqZ8fwkJ163hS1Ufk1uR3FRogY=; h=Subject:To:References:From:Date:In-Reply-To:From; b=H6Pesb8ErVPSpuDqhgKcqHp+jDbpTN4sJPYnJO9K1oEP/qqoRLbfqD5itMF/6j5pu eAbOQB8h1GRB+SneK3AtrIc73LOg6QSqIvo62Izv6a8v53E/zrafyFVlfHSCaaR3G1 MMnX9EtQ3eg8u54GnRzRLRs7RqIWB8XIvO74FNVo= To: spasm@ietf.org References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> From: Joan Daemen Openpgp: preference=signencrypt Autocrypt: addr=jda@noekeon.org; prefer-encrypt=mutual; keydata= xsFNBFpjJFgBEAC2FSj/4V5lLMCvc60Fyb3XUsOCPFdhNyBNh6KE8cfh3dzlS/Pzq0vcZlKc /+5n4x34Mp8JL+5muTSg7sRIGjm50FBUzZrSHPIvWlyCKyzt18y3dmfvQyuZMcboNA4tpWRy daOngLK28gUCvVf+A/t/KwKwDMM7OzSukl5bll2OOTxgApAzqS2Tx+HdExLILEqRHooT/Fqw EhXzZfOdGeKv5/YEBAnLfqD22lX7KXyWdai8iDxvSh6Cn01wRhLpIJ5hTY0j406s+EVedGVv a8zvWb+zzr0l52YuvKYBc3zlqMixcDnpJJDVpmDOFvTJPM721oTMRZ+neXhvPN44zgfo11fs ESo8pz3qSiiOJQT12rbHDQzwEWm9rZ3vOG7BvRjx2WmlwMlqytSmHkp5tJ0fDtw3ZqpARcEy PfwE+g1j3fpwOqRXRKjoc4pq6NMhX9+n6/ZfMYbo12epRdvZbF4oeQq7cz92b0tev4ai8qti myYIs47G7C7Ku7X/Bxcs3FiOX3bQ8xH03JUKYFYhI+9w93Trs2rmbgKarKl61R7YmgdQPYOi OprBEh3bH7a/Xz6jhpPcZ59kbO+J2Tr7c72vRNl+yGqvzOUfflISMI918ZeBusP6pVLh8X83 mz8YupHAz6QvQJi86M3NP0u6NSd3NsYtN5ai7+YAbCoIMdKh6wARAQABzR1Kb2FuIERhZW1l biA8amRhQG5vZWtlb24ub3JnPsLBlAQTAQgAPhYhBHaX/G8yAc2/EYS5X2B6rPjjt2wEBQJa YyRYAhsjBQkJZgGABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEGB6rPjjt2wEVhsP/3qs 1+Qi6CXkcgXSTkCMtk9tkmx8Q8uDKelQY3T5QpaowIq+HjZDAYGu2I642T93RmKigHwnqRVk OWNFV8ZJTLyZtPo+oyMiB62CC33rvGhLNlUJ4zXE9XCX4q4+7U8D8eFuzrOOP6cX3AipN3p5 XE9WNfalhx/bSgNFSx99qHqF7voDhGDJvkFezME0GvGnHqQjmQh3GTtT1OlMq5swlCqBHhQD nn8yEYXFAjYYFMPOkrQ4MIodsjlw856KFxoaNqgHkaLCkz2McKqQMIYmdAYXu5qW8oPSMGP1 bcXRKWTpZ3oJbXLW7B4yx4BPA6wDp/JL30aKgVK+IzmU44OXW6cvkGw1wpBECnE5tPRk5wJ4 LYxLdUYk4VQcjkRTRwJ9kXjIcX+kPdNxxJOv0JhfpeQW3sEStMjqfZn6piFnyIFC3btnr/II QH1ISeTWvPSNgR6j4VXW5hb6pUkq9t6kgxQiSPhZsFOtvCPTDBTZKsYpJEIC6+ImmfxtIL9X KLFzbj3RF4MoyRwBVicvDPg48dj0HJ+iVH1i7XUZr1zEgMc/f3+nqGzpFenCuirajBM4zlTD x8Tjp1nPidEfND3LQQmDCqOtksuFUWGWLwds7Xuh2H6Vwp6YH/aAUgMs27GuuCfKKnAnJUQb do9pYfZCakTfb1/M7il+InWXA7eCddO5zsFNBFpjJFgBEACn+CAANregkunPhcYsXwuUZOqY AQKuiy9hAzP+SrNYXMEjVNwe5yCns/thBS525/h0Fr9VNWgaUVyfW5GV1j1vAi1EU26nEcTq YHqwgHLti2FZLTLJBjOWblAmATmaNXRjMDdY50LXmOyMlp+pC/7Xsj/OrHMsDhNM0mLSJdt5 C22VnAxUcurBeDTz6c7t2ps8UxUCQmTXapOJm2IXqxdTTM5v5ZX6/M7Q47KX6LWsA8ij3jmn fLFQfEoBL35rZmR1ZQ06UuXRB2KTM1FpJeYPXAjGmSXDlDyqhraNY6SrNMlmO9H52TYIOqVh INzkhjDGykEJE/mK8BnfWhXXfK2U1ieuMh+YtjpGiZQmuAnRM4koJdTYRGjj40joCzNv62xE 3scA4kEUvR5oyOcmnnsZspGM2RxEsi1Un9AwX//Q5y6azddRIf3y5N9yhiFM1dBXJR+iryl9 9BosnEzXTrfnfYNVzMiyQCEsHFR2/buMfQd+fW+L7+5r/sUPF/KM4SjvBP0sVD2e7pSHO8VB TfBZ9/K/c/qpeZ8ISwNx2H0+A6jdwXkModRC34+/cVLltqZGbnCBBJ2LHnLj1r+kTUW5n75d yLxtN9SzrsAukGDUcKkG1vUpPbVDUHFW2yMnHk6zKgTx+PThjobhIZvPKAJ0Zt5ReSATMqwD /6Lwqr+djwARAQABwsF8BBgBCAAmFiEEdpf8bzIBzb8RhLlfYHqs+OO3bAQFAlpjJFgCGwwF CQlmAYAACgkQYHqs+OO3bAS5rQ/+M7XX2d5Bv6gP+Cl9fhEdsugt6ZtkaWUF9IIFIiyGexdW KYnx+tLMkumo3Ifn9/bGV28bTpVRVSFSUSBwOM66R6XomuAPqlczNJgDUWJCC9FG0wUbr15v 6b7IXbrmu0RJk++V0kblJJLgNRRlydgpJwtPTertyPP1xRemyxCrSSdycr9+zFkHrJFtuPV1 WSy8A0+3FiV2YYhM7Hpch84XuML9F1dpRwPx8NNzfkXthG3ur7vl4gTK1qUuIdo8NZ6tr50X 23N19dYIXCD+HXFFMxhsdXquabwc/Dw0lnsV38XwktP+TVQo+w44WErOyGZbMGcUsmOwTY7Y dDLFBUgLF+R4VhlesOlhbrWsfxbqZCzSRqA8Ossd2s/KpWv9wP6SXzjRn7z2nBynXw0I8C6K N2ZS/SCh5x8zuH9OKpVSJOKkyrNLV1UR3IfK3Uhk49xo54FwozqerPmgjFIgNbGs+cbsvsos WcIGnK2SVrQiTeRwBuZVDqy1Xyv1LGiJkQLIqFyE4+EaSfreiXH2t/HNukj7NyHWaRr7Lyz+ 63vBwdWwDh8eUU5Inj0CzsZXLtlKj/XWdDv9MmZT4Wvidrtw9+jd4UfuSehq9VlKZwKWf5FZ T1OONAwowduh92P8TS/uhdcttAZLTKjYZp9Wu16+e7Zp7a9j0lKBDyq2zigCo3I= Message-ID: <7e391712-ed70-4af9-a7de-58188cfe383c@noekeon.org> Date: Mon, 17 Sep 2018 14:45:03 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 12:45:17 -0000 Hi all, sorry for spamming but I see now that my previous message can be misinterpreted. What I mean is that one should replace (SHA1+MGF1) by SHAKE and one should certainly not replace (SHA1+MGF1) by (SHAKE+MGF1). Kind regards, Joan Daemen On 17/09/2018 14:40, Joan Daemen wrote: > Hi all, > > On 17/09/2018 11:53, Russ Housley wrote: >> Does anyone think that using SHAKE in the RSA-PSS mask generation >> function is the wrong approach? > On the contrary, using SHAKE (or cSHAKE if you wish) in the RSA-PSS mask > generating function is THE sound approach. > > Kind regards, > > Joan Daemen > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Mon Sep 17 08:39:13 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0139F130DE9 for ; Mon, 17 Sep 2018 08:39:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NSeeH8N3-489 for ; Mon, 17 Sep 2018 08:39:09 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B48DF130E4B for ; Mon, 17 Sep 2018 08:39:07 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 17 Sep 2018 08:34:41 -0700 From: Jim Schaad To: 'Russ Housley' , 'Quynh Dang' , 'Panos Kampanakis' CC: 'SPASM' References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> In-Reply-To: <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> Date: Mon, 17 Sep 2018 08:38:37 -0700 Message-ID: <019201d44e9c$827ad620$87708260$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0193_01D44E61.D61D5DB0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJBlyy+liKglkq7u8zG/FAVp0RX2gG+MegMAc2kTZ4B9RaUkwI16IbrAf6+i+YC1J79LaO1uNOA Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 15:39:12 -0000 ------=_NextPart_000_0193_01D44E61.D61D5DB0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Russ, =20 That is not the question that I was asking. I think that replacing = SHA-1 with SHAKE in the MFG function is correct. I was proposing = replacing the MFG function in its entirety with a new MFG function. =20 Jim =20 =20 From: Spasm On Behalf Of Russ Housley Sent: Monday, September 17, 2018 2:53 AM To: Quynh Dang ; Panos Kampanakis = Cc: SPASM Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 =20 Here is a part of a message to resolve the WG Last Call comments on = draft-ietf-lamps-cms-shakes-01 ... * Message Digests - are the limits on the size only for CMS or do they = apply everywhere that the algorithm is used. If it is everywhere how do we reconcile with the usage in RSA-PSS?=20 =20 Comment 5: Only in CMS, when a message digest is generated. For RSA-PSS, = a SHAKE has 2 different output sizes for 2 different uses: hashing a = message to be signed and generating a masking value in MGF 1.=20 [JLS] After looking at this a second time, I propose that this problem = be solved by creation of a new mask generation function MGF-V. We can = eliminate the counter from the operation as being un-needed and just = compute the mask length and generate that many bits of input from a = SHAKE function. =20 I thought about that. But that would be another standard function which = have not been defined yet. How could we go from here ? And this route = would take time. Using the existing MGF 1 would waste only 1 division: = to figure out counter number is zero: so there is only one hash function = execution.=20 [JLS2] No it is more than that. It takes both the one division AND a = concatenation AND the strangeness for trying to decide how long the = SHAKE output is if one is placing it into an existing MGF1 piece of = code. If you define a new MGF-V then there is a new function that is = called =E2=80=93 which code should potentially be setup for =E2=80=93 = and zero extra work beyond that. The size of the mask is the size of = the output, no concatenation. It is much cleaner in my opinion. =20 Does anyone think that using SHAKE in the RSA-PSS mask generation = function is the wrong approach? =20 Russ =20 =20 ------=_NextPart_000_0193_01D44E61.D61D5DB0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Russ,

 

That is not = the question that I was asking.=C2=A0 I think that replacing SHA-1 with = SHAKE in the MFG function is correct.=C2=A0 I was proposing replacing = the MFG function in its entirety with a new MFG = function.

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> On Behalf Of Russ = Housley
Sent: Monday, September 17, 2018 2:53 AM
To: = Quynh Dang <quynh.dang@nist.gov>; Panos Kampanakis = <pkampana@cisco.com>
Cc: SPASM = <spasm@ietf.org>
Subject: Re: [lamps] WGLC comments = draft-ietf-lamps-cms-shakes-01

 

Here is = a part of a message to resolve the WG Last Call comments = on draft-ietf-lamps-cms-shakes-01 ...



* Message Digests - = are the limits on the size only for CMS or do they apply
everywhere = that the algorithm is used.  If it is everywhere how do = we
reconcile with the usage in = RSA-PSS? 

 

Comment 5: = Only in CMS, when a message digest is generated. For RSA-PSS,  a = SHAKE has 2 different output sizes for 2 different uses: hashing a = message to be signed and generating a masking value in MGF = 1. 

[JLS] After looking at this a = second time, I propose that this problem be solved by creation of a new = mask generation function MGF-V.   We can eliminate the counter = from the operation as being un-needed and just compute the mask length = and generate that many bits of input from a SHAKE = function.

 

I thought = about that. But that would be another standard function which have = not been defined  yet. How could we go from here ? And this route = would take time. Using the existing MGF 1 would waste only 1 = division: to figure out counter number is zero: so there is only one = hash function execution. 

[JLS2] No it is more = than that.  It takes both the one division AND a concatenation AND = the strangeness for trying to decide how long the SHAKE output is if one = is placing it into an existing MGF1 piece of code.  If you define a = new MGF-V then there is a new function that is called =E2=80=93 which = code should potentially be setup for =E2=80=93 and zero extra work = beyond that.  The size of the mask is the size of the output, no = concatenation.  It is much cleaner in my = opinion.

<= /div>

 

Does anyone think that using SHAKE in the RSA-PSS mask = generation function is the wrong approach?

 

Russ

 

 

------=_NextPart_000_0193_01D44E61.D61D5DB0-- From nobody Mon Sep 17 08:50:20 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AA69126DBF for ; Mon, 17 Sep 2018 08:50:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M8ZRZ-U4WDVv for ; Mon, 17 Sep 2018 08:50:16 -0700 (PDT) Received: from mail1.bemta23.messagelabs.com (mail1.bemta23.messagelabs.com [67.219.246.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 608EA12F295 for ; Mon, 17 Sep 2018 08:50:16 -0700 (PDT) Received: from [67.219.247.52] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-4.bemta.az-d.us-east-1.aws.symcld.net id 2C/88-09304-73DCF9B5; Mon, 17 Sep 2018 15:50:15 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpil+JIrShJLcpLzFFi42K5obC1XNfs7Px og/lPtC3mXUt2YPRYsuQnUwBjFGtmXlJ+RQJrxvef85kLupIqdtzfwNLAuDemi5GLg0Wgh1ni 47cfLF2MnBxCAhOZJDqWVoEkhATuMkp8a/rICJJgEzCQuLb3OBOILSIgJfGmYyOYLSzgIHFh4 0I2iLijxKvGdkYI20ji+LwW9i5GDqANqhIHdnuBhHkFYiUaZmxkh9gVK7F/SgtYK6dAnMSmpT vB4owCYhLfT60BG88sIC5x68l8MFtCQETi4cXTbBC2qMTLx/9YIepjJOZ+PsQGskpCQEliY58 6RImsxKX53Ywgr0gIHGCXaL15hwUioSvxYepUZgjbV6Lpy102iKLLjBKHmhZBLdCW6Nl7lRXC zpO4tvgYO4QdI3Fs3XGoQXISq3ofskA0b2eW2NS5GqpBRmLTudNQDRdZJd480YX4OEViyqpDU NsmMEvMXXKPaQKj1iwkn84CyjELLGCUuD17G9sscJAJSpyc+YQFoihK4vn3WUwQtq7Ern0HmC FseYntb+dA2ToSbfdPQ9naEssWvgay2YFsG4ktKRBRRYkp3Q/ZIWwzibZzH9kWMHKvYjRNKsp MzyjJTczM0TU0MNA1NDTStdQ1NdRLrNJN0Sst1k1NLC7RBXLLi/WKK3OTc1L08lJLNjECU19K AafxDsbejvRDjJIcTEqivLGZ86OF+JLyUyozEosz4otKc1KLDzHKcHAoSfC+PQ2UEyxKTU+tS MvMASZhmLQEB4+SCG/8GaA0b3FBYm5xZjpE6hSjPce7lZMmMXMcuTcFSF4Ak3/eT53ELMSSl5 +XKiXOawHSJgDSllGaBzcUljUuMcpKCfMyMjAwCPEUpBblZpagyr9iFOdgVBLm/QFyG09mXgn c7ldAZzEBnZWxYQ7IWSWJCCmpBsZUzx+sti5Xyus29K19fsg5RK3t9I+ChbWibpuuGnza3p6g vJM34bC6hZ2WldTtpT8nFKzXf/jw6tnrXieX3UvmvpPJ9OgU59Ojpu9db2735e80+VPtJMHrE H+v27S3Np1r151Hau+S/9ul7rC++InlQQhPWk+k0YuT26/Wast1xNiHHZX6rqfEUpyRaKjFXF ScCADVFfnoFQQAAA== X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-20.tower-424.messagelabs.com!1537199414!108702!1 X-Originating-IP: [216.32.181.119] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.14.24; banners=-,-,- X-VirusChecked: Checked Received: (qmail 13067 invoked from network); 17 Sep 2018 15:50:14 -0000 Received: from mail-dm3nam05lp0119.outbound.protection.outlook.com (HELO NAM05-DM3-obe.outbound.protection.outlook.com) (216.32.181.119) by server-20.tower-424.messagelabs.com with AES256-SHA256 encrypted SMTP; 17 Sep 2018 15:50:14 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+wK2D4JMUByhhEngbZgitQz2R4hOhFHBrFDFWwdyouQ=; b=BSkAfnusZbFLVbLC5G8hSzD2hgksznuIKIU870bq2vzvDxA/bbZybZLtXxc0wQiX9dEvet/9NzLMT3iUqOYL6rQKK+xJ/ojrO+pllEczYNLLNb8px/YZ8VP4WuO7/mcdhuWM5Fu2f2cjM251FGtzBnqkvlUxjMNHpyIjZdm5GxE= Received: from BN6PR14MB1106.namprd14.prod.outlook.com (10.173.161.15) by BN6SPR00MB2451.namprd14.prod.outlook.com (10.171.181.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.18; Mon, 17 Sep 2018 15:50:13 +0000 Received: from BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::29f5:b1e:c591:e5fc]) by BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::29f5:b1e:c591:e5fc%7]) with mapi id 15.20.1143.017; Mon, 17 Sep 2018 15:50:12 +0000 From: Tim Hollebeek To: SPASM Thread-Topic: Call for adoption of draft-housley-cms-mix-with-psk Thread-Index: AdQbi+j7uWfkh4RtSC+OA7IVSzE2sAzEeKhA Date: Mon, 17 Sep 2018 15:50:12 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [108.39.138.247] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN6SPR00MB2451; 6:M15g9VwyH9eaFhZgpahldDl1LqgFrOBAoT48Em8ysUXe0A7pCtefRFR1YhssJZ48mLm3n/4sNIT9RFP1rBCmaTuVjUzwED/o4SINiC12AK648GlegqAW1B1nr7Id4+nenlgnGcRudtqFl+4J8R5Jn/YZiY/rnnY5tecKoXUjHeWHqTECshN0UXfKwutnhGZuax8xd3DdSDpsHQ5rOe2mLrQlcFWRwUslgUTJN1WXZoAWS0QPfPEW8E4taGyJLm0TJO7m2dnx8Btcahy7qWWc/BKSuLiUcc8KEJXZ1pwS6hTtZRUMdxspqtOmq5AFpEp+FRsKFyVb8EYxH/CNxMto80YQ4wMiURU+F8VgjrF/RVOEnNzsQgc63JfuS0ibNqGMaNdz+sxG3jjaUlxCvnTE0vY53qzKfH4+8z5rtXucQp0+HwCGk9q4sMuT03uuC6U9zTMj9miviocSW5/z4Hq5wA==; 5:aQYgjDn/b70yrCFa0Kx+z7gS8Ewb/2ls06gQ0AR2RRtmIxUsxlnVwcxKmoKb5780Xcij5rAwEbbrSlAsoizo3geoHdmUeO7fVucOmmSRVmT1El4U8SaMsWSqOWaSWkYeoCQ9j66x7ZSDNRwa42mL027wgW2icE2/38nS7Ygw1p0=; 7:rkcqGRq8PN3ZoXU9oClxMNC6LjKYcZyYtdw5qbpIFvcSdMjI3El29LguTog6nOggZT+R7Sv4XBNS/1uRKkBXvkUshLh8re9oVTgU36ftdGleY/4vHCDgbs3hHGCbqcJ3lISV3A5ZT1OkdnuBNLaOI7A22P4OFVbyrj5+61l2fNbrCnmVEudz+ClAMOFXGKQBQeuIFS0AbcIrOd5/AA98FEfyFvHUejdWHqKy/jp/S3F6mg/RVQhW3KLc9ZnOo+kN x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 61ea78f2-4227-4528-c945-08d61cb5412e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:BN6SPR00MB2451; x-ms-traffictypediagnostic: BN6SPR00MB2451: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(100405760836317)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(8121501046)(5005006)(3231355)(944501410)(52105095)(93006095)(93001095)(10201501046)(3002001)(149027)(150027)(6041310)(20161123560045)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(201708071742011)(7699050); SRVR:BN6SPR00MB2451; BCL:0; PCL:0; RULEID:; SRVR:BN6SPR00MB2451; x-forefront-prvs: 0798146F16 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(396003)(376002)(366004)(346002)(136003)(199004)(189003)(33656002)(11346002)(106356001)(105586002)(486006)(446003)(6436002)(99936001)(25786009)(6246003)(476003)(14454004)(316002)(2906002)(7696005)(76176011)(99286004)(44832011)(26005)(186003)(5660300001)(7736002)(229853002)(6916009)(81156014)(81166006)(8676002)(68736007)(790700001)(3846002)(6116002)(102836004)(53546011)(53936002)(55016002)(6506007)(97736004)(86362001)(74316002)(256004)(2900100001)(9686003)(6306002)(8936002)(478600001)(66066001)(54896002)(5250100002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6SPR00MB2451; H:BN6PR14MB1106.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: /FS31stmM2mVFKalFT4QwRT26Mtzdw/fltk8BxthNr4HQq6v+32nqXslPRKHzoiOskBoYd2AvYxkGRVjf2na7IHvBFZi6eAJdMGNgi9rJTibbQ1aYzO1vI6uM7eafUjfuZ6Kev5PqYVu/mmnPDmGwe7qL+Ssh3553bvDpXmleK9DmPT+pVhM3iYKbRKWSu/t+4Haxvp9taqEkWbatRyt1JFl/9B1QqwZhmxFu6Al1R1hN1uALDw9BjD4Eczi/eZ1WSpjH77zz/ctw7aHtBNhk3R0liXXYe5Y++xk1Dsy9sqO9/oWOJGmMr6pgKyJz18iCytVxXi90QpZZveAusO8bJnlkRU1h6kgGuPKlN/ad6U= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_045D_01D44E7C.953ED060" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 61ea78f2-4227-4528-c945-08d61cb5412e X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Sep 2018 15:50:12.6966 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6SPR00MB2451 Archived-At: Subject: Re: [lamps] Call for adoption of draft-housley-cms-mix-with-psk X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 15:50:19 -0000 ------=_NextPart_000_045D_01D44E7C.953ED060 Content-Type: multipart/alternative; boundary="----=_NextPart_001_045E_01D44E7C.953ED060" ------=_NextPart_001_045E_01D44E7C.953ED060 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit The consensus appears to be for the WG to adopt this draft. -Tim From: Tim Hollebeek Sent: Saturday, July 14, 2018 12:02 PM To: SPASM Subject: Call for adoption of draft-housley-cms-mix-with-psk The recently approved LAMPS WG Charter adds this work item: 4. Specify the use of a pre-shared key (PSK) along with other key management techniques with supported by the Cryptographic Message Syntax (CMS) as a mechanism to protect present day communication from the future invention of a large-scale quantum computer. The invention of a large-scale quantum computer poses a serious challenge for the key management algorithms that are widely deployed today, especially the key transport and key agreement algorithms used today with the CMS to protect S/MIME messages. It has been suggested that the WG adopt draft-housley-cms-mix-with-psk as the starting point for this work. Since Russ Housley is the author of this draft, Tim Hollebeek will judge consensus for this discussion. Please voice your support or concerns on the list. ------=_NextPart_001_045E_01D44E7C.953ED060 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The consensus appears to be for the WG to adopt this = draft.

 

-Tim

 

From: Tim = Hollebeek
Sent: Saturday, July 14, 2018 12:02 = PM
To: SPASM <spasm@ietf.org>
Subject: Call = for adoption of = draft-housley-cms-mix-with-psk

 

 

The = recently approved LAMPS WG Charter adds this work item:

 

4. = Specify the use of a pre-shared key (PSK) along with other key = management techniques with supported by the Cryptographic Message Syntax = (CMS) as a mechanism to protect present day communication from the = future invention of a large-scale quantum computer.  The invention = of a large-scale quantum computer poses a serious challenge for the key = management algorithms that are widely deployed today, especially the key = transport and key agreement algorithms used today with the CMS to = protect S/MIME messages.

 

It has = been suggested that the WG adopt draft-housley-cms-mix-with-psk as the = starting point for this work.  Since Russ Housley is the author of = this draft, Tim Hollebeek will judge consensus for this = discussion.  Please voice your support or concerns on the = list.

 

------=_NextPart_001_045E_01D44E7C.953ED060-- ------=_NextPart_000_045D_01D44E7C.953ED060 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwOTE3MTU1MDA4WjAvBgkqhkiG9w0BCQQxIgQgDGVoJEsaF5ggksi/pFzdSgqmFC// 4mWC/46QPGVYqLYwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBACm/idaoAPWJu9VwTXwA17ZtFszYI1ym9rI1Am6AL1M9JrwglZKSaGxEOBAdEks/4p5glJxc lPt+TeuSeYjUvLD1Ntzyos7kWMsxe7hr5YTarEAVjl71zBdsgb58bR8CN8brlFoRYaHPp6Ca3vFO TisZiZnbFnOjUoHb0dIu69oILFSmvrm4FZ4E8f+Mx+PnBRCyp8FMHD74NidahSUvCEWkvDxMR39l we8hoxK4E5z9O3jTBn2WFc7fVCX5YLccd4cRXXYWeEDJZlz/1g+wcECprEgsqGEZDYfWH1P/wDvH eJUIXp6ljTqSiCgL9XjPFYcM8R/JtLhYE3X74/a4DjsAAAAAAAA= ------=_NextPart_000_045D_01D44E7C.953ED060-- From nobody Mon Sep 17 10:32:11 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0721200D7; Mon, 17 Sep 2018 10:32:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153720552308.24615.17813637944141841856@ietfa.amsl.com> Date: Mon, 17 Sep 2018 10:32:03 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-cms-mix-with-psk-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 17:32:03 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Using Pre-Shared Key (PSK) in the Cryptographic Message Syntax (CMS) Author : Russell Housley Filename : draft-ietf-lamps-cms-mix-with-psk-00.txt Pages : 14 Date : 2018-09-17 Abstract: The invention of a large-scale quantum computer would pose a serious challenge for the cryptographic algorithms that are widely deployed today. The Cryptographic Message Syntax (CMS) supports key transport and key agreement algorithms that could be broken by the invention of such a quantum computer. By storing communications that are protected with the CMS today, someone could decrypt them in the future when a large-scale quantum computer becomes available. Once quantum-secure key management algorithms are available, the CMS will be extended to support them, if existing syntax the does not accommodated them. In the near-term, this document describes a mechanism to protect today's communication from the future invention of a large-scale quantum computer by mixing the output of key transport and key agreement algorithms with a pre-shared key. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-mix-with-psk/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-cms-mix-with-psk-00 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-mix-with-psk-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Sep 17 11:08:57 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D9091252B7 for ; Mon, 17 Sep 2018 11:08:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.509 X-Spam-Level: X-Spam-Status: No, score=-14.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kzR7ma5fSWbw for ; Mon, 17 Sep 2018 11:08:53 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E3BF130E3F for ; Mon, 17 Sep 2018 11:08:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=15086; q=dns/txt; s=iport; t=1537207733; x=1538417333; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=20ZpzgKQEFu7EcrrPcBf382/RkAHyNmU2dJ3ZUupops=; b=BEWxh4KLBO8CDfXCXxG/u+ez3+tIJYuTRYoyOGFyZ/+uEOaoVeB3FVib RmhtYffoZew/y71/Cezbf2xAa5JPFf46fh0k+W3tFyW4z5G1mVEpwG9Kx s+ASQqnY/ylZM3X5JzfDo2cbUG5RJ/rPHp9kF0WuvoC/EP/MNu+rW5Mp3 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CpAAC07J9b/5BdJa1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYJhSC9lfygKg2iUQIINkRCHNQuEbAIXg1shOBQBAwEBAgE?= =?us-ascii?q?BAm0ohTgBAQEBAyMKTBACAQgOAwQBASgDAgICMBQJCAIEAQ0FCIMagR1kpX6?= =?us-ascii?q?BLooHim0XgUE/gREBgxKFFQ8QgkuCVwKNTY53CQKQCx+PDZQoAhEUgSU0IYF?= =?us-ascii?q?VcBWDJ4IkGI4Xb4wvgR4BAQ?= X-IronPort-AV: E=Sophos;i="5.53,386,1531785600"; d="scan'208,217";a="443056176" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Sep 2018 18:08:52 +0000 Received: from XCH-ALN-009.cisco.com (xch-aln-009.cisco.com [173.36.7.19]) by rcdn-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id w8HI8pGj022475 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 17 Sep 2018 18:08:52 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-ALN-009.cisco.com (173.36.7.19) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 17 Sep 2018 13:08:51 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Mon, 17 Sep 2018 13:08:51 -0500 From: "Panos Kampanakis (pkampana)" To: Jim Schaad , "'Russ Housley'" CC: "'SPASM'" , "'Quynh Dang'" Thread-Topic: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 Thread-Index: AQHURSkaniClVRghDkKKYr/JNnv/R6TiOdIAgAAN+oCAAAggAIAAAx8AgBJO9ACAAGCAgP//rIFQ Date: Mon, 17 Sep 2018 18:08:51 +0000 Message-ID: References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> <019201d44e9c$827ad620$87708260$@augustcellars.com> In-Reply-To: <019201d44e9c$827ad620$87708260$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.82.172.227] Content-Type: multipart/alternative; boundary="_000_e1ebcfeb9d09415bad5647a0edad73c9XCHALN010ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.19, xch-aln-009.cisco.com X-Outbound-Node: rcdn-core-8.cisco.com Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 18:08:56 -0000 --_000_e1ebcfeb9d09415bad5647a0edad73c9XCHALN010ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB0aGluayB0aGF0IGZhbGxzIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgc3BlYyBhbmQgdGhl IExBTVBTIGNoYXJ0ZXIgdG8gYmUgaG9uZXN0Lg0KSSBtZWFuLCBpbnRyb2R1Y2luZyBhIG5ldyBN Rkcgc2hvdWxkIG5vdCBiZSB0YWtlbiBsaWdodGx5IGV2ZW4gaWYgaXQgaXMgc3RyYWlnaHRmb3J3 YXJkLg0KUGFub3MNCg0KRnJvbTogSmltIFNjaGFhZCBbbWFpbHRvOmlldGZAYXVndXN0Y2VsbGFy cy5jb21dDQpTZW50OiBNb25kYXksIFNlcHRlbWJlciAxNywgMjAxOCAxMTozOSBBTQ0KVG86ICdS dXNzIEhvdXNsZXknIDxob3VzbGV5QHZpZ2lsc2VjLmNvbT47ICdRdXluaCBEYW5nJyA8cXV5bmgu ZGFuZ0BuaXN0Lmdvdj47IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lz Y28uY29tPg0KQ2M6ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtsYW1w c10gV0dMQyBjb21tZW50cyBkcmFmdC1pZXRmLWxhbXBzLWNtcy1zaGFrZXMtMDENCg0KUnVzcywN Cg0KVGhhdCBpcyBub3QgdGhlIHF1ZXN0aW9uIHRoYXQgSSB3YXMgYXNraW5nLiAgSSB0aGluayB0 aGF0IHJlcGxhY2luZyBTSEEtMSB3aXRoIFNIQUtFIGluIHRoZSBNRkcgZnVuY3Rpb24gaXMgY29y cmVjdC4gIEkgd2FzIHByb3Bvc2luZyByZXBsYWNpbmcgdGhlIE1GRyBmdW5jdGlvbiBpbiBpdHMg ZW50aXJldHkgd2l0aCBhIG5ldyBNRkcgZnVuY3Rpb24uDQoNCkppbQ0KDQoNCkZyb206IFNwYXNt IDxzcGFzbS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnPj4g T24gQmVoYWxmIE9mIFJ1c3MgSG91c2xleQ0KU2VudDogTW9uZGF5LCBTZXB0ZW1iZXIgMTcsIDIw MTggMjo1MyBBTQ0KVG86IFF1eW5oIERhbmcgPHF1eW5oLmRhbmdAbmlzdC5nb3Y8bWFpbHRvOnF1 eW5oLmRhbmdAbmlzdC5nb3Y+PjsgUGFub3MgS2FtcGFuYWtpcyA8cGthbXBhbmFAY2lzY28uY29t PG1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20+Pg0KQ2M6IFNQQVNNIDxzcGFzbUBpZXRmLm9yZzxt YWlsdG86c3Bhc21AaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtsYW1wc10gV0dMQyBjb21tZW50 cyBkcmFmdC1pZXRmLWxhbXBzLWNtcy1zaGFrZXMtMDENCg0KSGVyZSBpcyBhIHBhcnQgb2YgYSBt ZXNzYWdlIHRvIHJlc29sdmUgdGhlIFdHIExhc3QgQ2FsbCBjb21tZW50cyBvbiBkcmFmdC1pZXRm LWxhbXBzLWNtcy1zaGFrZXMtMDEgLi4uDQoNCiogTWVzc2FnZSBEaWdlc3RzIC0gYXJlIHRoZSBs aW1pdHMgb24gdGhlIHNpemUgb25seSBmb3IgQ01TIG9yIGRvIHRoZXkgYXBwbHkNCmV2ZXJ5d2hl cmUgdGhhdCB0aGUgYWxnb3JpdGhtIGlzIHVzZWQuICBJZiBpdCBpcyBldmVyeXdoZXJlIGhvdyBk byB3ZQ0KcmVjb25jaWxlIHdpdGggdGhlIHVzYWdlIGluIFJTQS1QU1M/DQoNCg0KQ29tbWVudCA1 OiBPbmx5IGluIENNUywgd2hlbiBhIG1lc3NhZ2UgZGlnZXN0IGlzIGdlbmVyYXRlZC4gRm9yIFJT QS1QU1MsICBhIFNIQUtFIGhhcyAyIGRpZmZlcmVudCBvdXRwdXQgc2l6ZXMgZm9yIDIgZGlmZmVy ZW50IHVzZXM6IGhhc2hpbmcgYSBtZXNzYWdlIHRvIGJlIHNpZ25lZCBhbmQgZ2VuZXJhdGluZyBh IG1hc2tpbmcgdmFsdWUgaW4gTUdGIDEuDQpbSkxTXSBBZnRlciBsb29raW5nIGF0IHRoaXMgYSBz ZWNvbmQgdGltZSwgSSBwcm9wb3NlIHRoYXQgdGhpcyBwcm9ibGVtIGJlIHNvbHZlZCBieSBjcmVh dGlvbiBvZiBhIG5ldyBtYXNrIGdlbmVyYXRpb24gZnVuY3Rpb24gTUdGLVYuICAgV2UgY2FuIGVs aW1pbmF0ZSB0aGUgY291bnRlciBmcm9tIHRoZSBvcGVyYXRpb24gYXMgYmVpbmcgdW4tbmVlZGVk IGFuZCBqdXN0IGNvbXB1dGUgdGhlIG1hc2sgbGVuZ3RoIGFuZCBnZW5lcmF0ZSB0aGF0IG1hbnkg Yml0cyBvZiBpbnB1dCBmcm9tIGEgU0hBS0UgZnVuY3Rpb24uDQoNCg0KSSB0aG91Z2h0IGFib3V0 IHRoYXQuIEJ1dCB0aGF0IHdvdWxkIGJlIGFub3RoZXIgc3RhbmRhcmQgZnVuY3Rpb24gd2hpY2gg aGF2ZSBub3QgYmVlbiBkZWZpbmVkICB5ZXQuIEhvdyBjb3VsZCB3ZSBnbyBmcm9tIGhlcmUgPyBB bmQgdGhpcyByb3V0ZSB3b3VsZCB0YWtlIHRpbWUuIFVzaW5nIHRoZSBleGlzdGluZyBNR0YgMSB3 b3VsZCB3YXN0ZSBvbmx5IDEgZGl2aXNpb246IHRvIGZpZ3VyZSBvdXQgY291bnRlciBudW1iZXIg aXMgemVybzogc28gdGhlcmUgaXMgb25seSBvbmUgaGFzaCBmdW5jdGlvbiBleGVjdXRpb24uDQpb SkxTMl0gTm8gaXQgaXMgbW9yZSB0aGFuIHRoYXQuICBJdCB0YWtlcyBib3RoIHRoZSBvbmUgZGl2 aXNpb24gQU5EIGEgY29uY2F0ZW5hdGlvbiBBTkQgdGhlIHN0cmFuZ2VuZXNzIGZvciB0cnlpbmcg dG8gZGVjaWRlIGhvdyBsb25nIHRoZSBTSEFLRSBvdXRwdXQgaXMgaWYgb25lIGlzIHBsYWNpbmcg aXQgaW50byBhbiBleGlzdGluZyBNR0YxIHBpZWNlIG9mIGNvZGUuICBJZiB5b3UgZGVmaW5lIGEg bmV3IE1HRi1WIHRoZW4gdGhlcmUgaXMgYSBuZXcgZnVuY3Rpb24gdGhhdCBpcyBjYWxsZWQg4oCT IHdoaWNoIGNvZGUgc2hvdWxkIHBvdGVudGlhbGx5IGJlIHNldHVwIGZvciDigJMgYW5kIHplcm8g ZXh0cmEgd29yayBiZXlvbmQgdGhhdC4gIFRoZSBzaXplIG9mIHRoZSBtYXNrIGlzIHRoZSBzaXpl IG9mIHRoZSBvdXRwdXQsIG5vIGNvbmNhdGVuYXRpb24uICBJdCBpcyBtdWNoIGNsZWFuZXIgaW4g bXkgb3Bpbmlvbi4NCg0KRG9lcyBhbnlvbmUgdGhpbmsgdGhhdCB1c2luZyBTSEFLRSBpbiB0aGUg UlNBLVBTUyBtYXNrIGdlbmVyYXRpb24gZnVuY3Rpb24gaXMgdGhlIHdyb25nIGFwcHJvYWNoPw0K DQpSdXNzDQoNCg0K --_000_e1ebcfeb9d09415bad5647a0edad73c9XCHALN010ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLnh4bXNvbm9ybWFsLCBsaS54 eG1zb25vcm1hbCwgZGl2Lnh4bXNvbm9ybWFsDQoJe21zby1zdHlsZS1uYW1lOnhfeG1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHls ZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMUY0OTdEIj5JIHRoaW5rIHRoYXQgZmFsbHMgb3V0c2lkZSB0aGUgc2NvcGUgb2YgdGhpcyBz cGVjIGFuZCB0aGUgTEFNUFMgY2hhcnRlciB0byBiZSBob25lc3QuDQo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+ SSBtZWFuLCBpbnRyb2R1Y2luZyBhIG5ldyBNRkcgc2hvdWxkIG5vdCBiZSB0YWtlbiBsaWdodGx5 IGV2ZW4gaWYgaXQgaXMgc3RyYWlnaHRmb3J3YXJkLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlBhbm9zPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzoz LjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gSmlt IFNjaGFhZCBbbWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb21dIDxicj4NCjxiPlNlbnQ6PC9i PiBNb25kYXksIFNlcHRlbWJlciAxNywgMjAxOCAxMTozOSBBTTxicj4NCjxiPlRvOjwvYj4gJ1J1 c3MgSG91c2xleScgJmx0O2hvdXNsZXlAdmlnaWxzZWMuY29tJmd0OzsgJ1F1eW5oIERhbmcnICZs dDtxdXluaC5kYW5nQG5pc3QuZ292Jmd0OzsgUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpICZs dDtwa2FtcGFuYUBjaXNjby5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiAnU1BBU00nICZsdDtzcGFz bUBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtsYW1wc10gV0dMQyBjb21t ZW50cyBkcmFmdC1pZXRmLWxhbXBzLWNtcy1zaGFrZXMtMDE8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlJ1c3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYXQgaXMg bm90IHRoZSBxdWVzdGlvbiB0aGF0IEkgd2FzIGFza2luZy4mbmJzcDsgSSB0aGluayB0aGF0IHJl cGxhY2luZyBTSEEtMSB3aXRoIFNIQUtFIGluIHRoZSBNRkcgZnVuY3Rpb24gaXMgY29ycmVjdC4m bmJzcDsgSSB3YXMgcHJvcG9zaW5nIHJlcGxhY2luZyB0aGUgTUZHIGZ1bmN0aW9uIGluIGl0cyBl bnRpcmV0eSB3aXRoIGEgbmV3IE1GRyBmdW5jdGlvbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SmltPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBp biAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gU3Bhc20gJmx0OzxhIGhyZWY9Im1haWx0bzpz cGFzbS1ib3VuY2VzQGlldGYub3JnIj5zcGFzbS1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsNCjxi Pk9uIEJlaGFsZiBPZiA8L2I+UnVzcyBIb3VzbGV5PGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwg U2VwdGVtYmVyIDE3LCAyMDE4IDI6NTMgQU08YnI+DQo8Yj5Ubzo8L2I+IFF1eW5oIERhbmcgJmx0 OzxhIGhyZWY9Im1haWx0bzpxdXluaC5kYW5nQG5pc3QuZ292Ij5xdXluaC5kYW5nQG5pc3QuZ292 PC9hPiZndDs7IFBhbm9zIEthbXBhbmFraXMgJmx0OzxhIGhyZWY9Im1haWx0bzpwa2FtcGFuYUBj aXNjby5jb20iPnBrYW1wYW5hQGNpc2NvLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBTUEFT TSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj5zcGFzbUBpZXRmLm9yZzwvYT4m Z3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbbGFtcHNdIFdHTEMgY29tbWVudHMgZHJhZnQt aWV0Zi1sYW1wcy1jbXMtc2hha2VzLTAxPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGVyZSBpcyBhIHBhcnQgb2YgYSBtZXNzYWdlIHRvIHJlc29sdmUgdGhl IFdHIExhc3QgQ2FsbCBjb21tZW50cyBvbiZuYnNwO2RyYWZ0LWlldGYtbGFtcHMtY21zLXNoYWtl cy0wMSAuLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2IGlkPSJ4 X2RpdnRhZ2RlZmF1bHR3cmFwcGVyIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGlu IDBpbiA0LjBwdCI+DQo8ZGl2IGlkPSJ4X3hfZGl2dGFnZGVmYXVsdHdyYXBwZXIiPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4qIE1lc3NhZ2UgRGlnZXN0cyAtIGFyZSB0aGUgbGltaXRzIG9uIHRo ZSBzaXplIG9ubHkgZm9yIENNUyBvciBkbyB0aGV5IGFwcGx5PGJyPg0KZXZlcnl3aGVyZSB0aGF0 IHRoZSBhbGdvcml0aG0gaXMgdXNlZC4mbmJzcDsgSWYgaXQgaXMgZXZlcnl3aGVyZSBob3cgZG8g d2U8YnI+DQpyZWNvbmNpbGUgd2l0aCB0aGUgdXNhZ2UgaW4gUlNBLVBTUz8mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJ4eG1zb25v cm1hbCIgc3R5bGU9Im1hcmdpbjowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOnJlZCI+Q29tbWVudCA1OiBPbmx5IGluIENNUywgd2hlbiBhIG1lc3Nh Z2UgZGlnZXN0IGlzIGdlbmVyYXRlZC4gRm9yIFJTQS1QU1MsICZuYnNwO2EgU0hBS0UgaGFzIDIg ZGlmZmVyZW50IG91dHB1dCBzaXplcyBmb3IgMiBkaWZmZXJlbnQgdXNlczogaGFzaGluZyBhIG1l c3NhZ2UgdG8gYmUgc2lnbmVkIGFuZCBnZW5lcmF0aW5nIGEgbWFza2luZyB2YWx1ZQ0KIGluIE1H RiAxLiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOiMwMDcwQzAi PltKTFNdIEFmdGVyIGxvb2tpbmcgYXQgdGhpcyBhIHNlY29uZCB0aW1lLCBJIHByb3Bvc2UgdGhh dCB0aGlzIHByb2JsZW0gYmUgc29sdmVkIGJ5IGNyZWF0aW9uIG9mIGEgbmV3IG1hc2sgZ2VuZXJh dGlvbiBmdW5jdGlvbiBNR0YtVi4mbmJzcDsgJm5ic3A7V2UgY2FuIGVsaW1pbmF0ZSB0aGUgY291 bnRlciBmcm9tIHRoZSBvcGVyYXRpb24gYXMgYmVpbmcNCiB1bi1uZWVkZWQgYW5kIGp1c3QgY29t cHV0ZSB0aGUgbWFzayBsZW5ndGggYW5kIGdlbmVyYXRlIHRoYXQgbWFueSBiaXRzIG9mIGlucHV0 IGZyb20gYSBTSEFLRSBmdW5jdGlvbi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxw IGNsYXNzPSJ4eG1zb25vcm1hbCIgc3R5bGU9Im1hcmdpbjowaW47bWFyZ2luLWJvdHRvbTouMDAw MXB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOnJlZCI+SSB0aG91Z2h0IGFib3V0IHRoYXQuJm5ic3A7QnV0IHRoYXQg d291bGQgYmUgYW5vdGhlciBzdGFuZGFyZCBmdW5jdGlvbiB3aGljaCBoYXZlIG5vdCBiZWVuIGRl ZmluZWQmbmJzcDsgeWV0LiBIb3cgY291bGQgd2UgZ28gZnJvbSBoZXJlID8gQW5kIHRoaXMgcm91 dGUgd291bGQgdGFrZSB0aW1lLiBVc2luZyB0aGUgZXhpc3RpbmcgTUdGIDEmbmJzcDt3b3VsZCB3 YXN0ZQ0KIG9ubHkgMSBkaXZpc2lvbjogdG8gZmlndXJlIG91dCBjb3VudGVyIG51bWJlciBpcyB6 ZXJvOiBzbyB0aGVyZSBpcyBvbmx5IG9uZSBoYXNoIGZ1bmN0aW9uIGV4ZWN1dGlvbi4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+W0pMUzJdIE5vIGl0IGlzIG1vcmUgdGhhbiB0 aGF0LiZuYnNwOyBJdCB0YWtlcyBib3RoIHRoZSBvbmUgZGl2aXNpb24gQU5EIGEgY29uY2F0ZW5h dGlvbiBBTkQgdGhlIHN0cmFuZ2VuZXNzIGZvciB0cnlpbmcgdG8gZGVjaWRlIGhvdyBsb25nIHRo ZSBTSEFLRSBvdXRwdXQgaXMgaWYgb25lIGlzIHBsYWNpbmcgaXQgaW50byBhbiBleGlzdGluZyBN R0YxIHBpZWNlIG9mIGNvZGUuJm5ic3A7DQogSWYgeW91IGRlZmluZSBhIG5ldyBNR0YtViB0aGVu IHRoZXJlIGlzIGEgbmV3IGZ1bmN0aW9uIHRoYXQgaXMgY2FsbGVkIOKAkyB3aGljaCBjb2RlIHNo b3VsZCBwb3RlbnRpYWxseSBiZSBzZXR1cCBmb3Ig4oCTIGFuZCB6ZXJvIGV4dHJhIHdvcmsgYmV5 b25kIHRoYXQuJm5ic3A7IFRoZSBzaXplIG9mIHRoZSBtYXNrIGlzIHRoZSBzaXplIG9mIHRoZSBv dXRwdXQsIG5vIGNvbmNhdGVuYXRpb24uJm5ic3A7IEl0IGlzIG11Y2ggY2xlYW5lciBpbiBteSBv cGluaW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkRvZXMgYW55b25lIHRoaW5rIHRoYXQgdXNpbmcgU0hBS0UgaW4gdGhlIFJTQS1Q U1MgbWFzayBnZW5lcmF0aW9uIGZ1bmN0aW9uIGlzIHRoZSB3cm9uZyBhcHByb2FjaD88bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UnVzczxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_e1ebcfeb9d09415bad5647a0edad73c9XCHALN010ciscocom_-- From nobody Mon Sep 17 11:21:52 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 577DD130E81 for ; Mon, 17 Sep 2018 11:21:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nf_9_Gm6_I0U for ; Mon, 17 Sep 2018 11:21:48 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E871130E82 for ; Mon, 17 Sep 2018 11:21:48 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id A218A300A02 for ; Mon, 17 Sep 2018 14:21:45 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 5wHsITDKZp3R for ; Mon, 17 Sep 2018 14:21:44 -0400 (EDT) Received: from new-host-5.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 46E4D3005D6 for ; Mon, 17 Sep 2018 14:21:44 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 14:21:44 -0400 References: <153720552308.24615.17813637944141841856@ietfa.amsl.com> To: SPASM In-Reply-To: <153720552308.24615.17813637944141841856@ietfa.amsl.com> Message-Id: <8CC9B482-51C1-44B9-B794-1B8A373B0AF8@vigilsec.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] I-D Action: draft-ietf-lamps-cms-mix-with-psk-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 18:21:50 -0000 This document was posted with only very minor editorial changes. Russ > On Sep 17, 2018, at 1:32 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Limited Additional Mechanisms for = PKIX and SMIME WG of the IETF. >=20 > Title : Using Pre-Shared Key (PSK) in the = Cryptographic Message Syntax (CMS) > Author : Russell Housley > Filename : draft-ietf-lamps-cms-mix-with-psk-00.txt > Pages : 14 > Date : 2018-09-17 >=20 > Abstract: > The invention of a large-scale quantum computer would pose a serious > challenge for the cryptographic algorithms that are widely deployed > today. The Cryptographic Message Syntax (CMS) supports key = transport > and key agreement algorithms that could be broken by the invention = of > such a quantum computer. By storing communications that are > protected with the CMS today, someone could decrypt them in the > future when a large-scale quantum computer becomes available. Once > quantum-secure key management algorithms are available, the CMS will > be extended to support them, if existing syntax the does not > accommodated them. In the near-term, this document describes a > mechanism to protect today's communication from the future invention > of a large-scale quantum computer by mixing the output of key > transport and key agreement algorithms with a pre-shared key. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-mix-with-psk/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-lamps-cms-mix-with-psk-00 > = https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-mix-with-psk-00= >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Sep 17 11:51:54 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53D16130E80 for ; Mon, 17 Sep 2018 11:51:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBIfeukWeEE6 for ; Mon, 17 Sep 2018 11:51:48 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81B73120072 for ; Mon, 17 Sep 2018 11:51:48 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 4E71B300AA4 for ; Mon, 17 Sep 2018 14:51:46 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id vZ7eqlzE8aa7 for ; Mon, 17 Sep 2018 14:51:43 -0400 (EDT) Received: from new-host-5.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id BC942300258; Mon, 17 Sep 2018 14:51:43 -0400 (EDT) From: Russ Housley Message-Id: <1F5FD70A-34B4-41EE-86A7-F1848D2B7DA8@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_718E1E0A-F163-415E-A70A-EAE7A7191337" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 14:51:44 -0400 In-Reply-To: Cc: SPASM To: panos Kampanakis , Jim Schaad , Quynh Dang References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> <019201d44e9c$827ad620$87708260$@augustcellars.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 18:51:53 -0000 --Apple-Mail=_718E1E0A-F163-415E-A70A-EAE7A7191337 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Quynh, Panos, and Jim: While it does look like a simple substitution, I do not think the LAMPS = is the right group to make the assessment. CFRG may have people with = the right skills. Russ > On Sep 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) = wrote: >=20 > I think that falls outside the scope of this spec and the LAMPS = charter to be honest. > I mean, introducing a new MFG should not be taken lightly even if it = is straightforward. > Panos > =20 > From: Jim Schaad [mailto:ietf@augustcellars.com = ]=20 > Sent: Monday, September 17, 2018 11:39 AM > To: 'Russ Housley' >; 'Quynh Dang' >; Panos Kampanakis (pkampana) = > > Cc: 'SPASM' > > Subject: RE: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 > =20 > Russ, > =20 > That is not the question that I was asking. I think that replacing = SHA-1 with SHAKE in the MFG function is correct. I was proposing = replacing the MFG function in its entirety with a new MFG function. > =20 > Jim > =20 > =20 > From: Spasm > = On Behalf Of Russ Housley > Sent: Monday, September 17, 2018 2:53 AM > To: Quynh Dang >; = Panos Kampanakis > > Cc: SPASM > > Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 > =20 > Here is a part of a message to resolve the WG Last Call comments on = draft-ietf-lamps-cms-shakes-01 ... > =20 >=20 > * Message Digests - are the limits on the size only for CMS or do they = apply > everywhere that the algorithm is used. If it is everywhere how do we > reconcile with the usage in RSA-PSS?=20 > =20 > Comment 5: Only in CMS, when a message digest is generated. For = RSA-PSS, a SHAKE has 2 different output sizes for 2 different uses: = hashing a message to be signed and generating a masking value in MGF 1.=20= > [JLS] After looking at this a second time, I propose that this problem = be solved by creation of a new mask generation function MGF-V. We can = eliminate the counter from the operation as being un-needed and just = compute the mask length and generate that many bits of input from a = SHAKE function. > =20 > I thought about that. But that would be another standard function = which have not been defined yet. How could we go from here ? And this = route would take time. Using the existing MGF 1 would waste only 1 = division: to figure out counter number is zero: so there is only one = hash function execution.=20 > [JLS2] No it is more than that. It takes both the one division AND a = concatenation AND the strangeness for trying to decide how long the = SHAKE output is if one is placing it into an existing MGF1 piece of = code. If you define a new MGF-V then there is a new function that is = called =E2=80=93 which code should potentially be setup for =E2=80=93 = and zero extra work beyond that. The size of the mask is the size of = the output, no concatenation. It is much cleaner in my opinion. > =20 > Does anyone think that using SHAKE in the RSA-PSS mask generation = function is the wrong approach? > =20 > Russ > =20 --Apple-Mail=_718E1E0A-F163-415E-A70A-EAE7A7191337 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Quynh, Panos, and Jim:

While it does look like a simple substitution, I do not = think the LAMPS is the right group to make the assessment.  CFRG = may have people with the right skills.

Russ



On Sep = 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) <pkampana=3D40cisco.com@dmarc.ietf.org> wrote:

I think that falls outside = the scope of this spec and the LAMPS charter to be honest.
I mean, introducing a new = MFG should not be taken lightly even if it is straightforward.
Panos
 
From: Jim Schaad [mailto:ietf@augustcellars.com] 
Sent: Monday, September 17, 2018 = 11:39 AM
To: 'Russ Housley' <housley@vigilsec.com>; = 'Quynh Dang' <quynh.dang@nist.gov>; Panos Kampanakis (pkampana) = <pkampana@cisco.com>
Cc: 'SPASM' <spasm@ietf.org>
Subject: RE: [lamps] WGLC comments = draft-ietf-lamps-cms-shakes-01
 
Russ,
 
That is not the question that I was = asking.  I think that replacing SHA-1 with SHAKE in the MFG = function is correct.  I was proposing replacing the MFG function in = its entirety with a new MFG function.
 
Jim
 
 
From: Spasm <spasm-bounces@ietf.org> On Behalf = Of Russ Housley
Sent: Monday, September 17, 2018 = 2:53 AM
To: Quynh Dang <quynh.dang@nist.gov>; = Panos Kampanakis <pkampana@cisco.com>
Cc: SPASM= <spasm@ietf.org>
Subject: Re: [lamps] WGLC comments = draft-ietf-lamps-cms-shakes-01
 
Here is a part of a = message to resolve the WG Last Call comments = on draft-ietf-lamps-cms-shakes-01 ...

 

* Message Digests = - are the limits on the size only for CMS or do they apply
everywhere that the algorithm is used.  If it is = everywhere how do we
reconcile with the usage in = RSA-PSS? 
 
Comment 5: Only in = CMS, when a message digest is generated. For RSA-PSS,  a SHAKE has = 2 different output sizes for 2 different uses: hashing a message to be = signed and generating a masking value in MGF 1. 
[JLS] After looking at this a second time, I propose that = this problem be solved by creation of a new mask generation function = MGF-V.   We can eliminate the counter from the operation as = being un-needed and just compute the mask length and generate that many = bits of input from a SHAKE function.
 
I = thought about that. But that would be another standard function = which have not been defined  yet. How could we go from here ? And = this route would take time. Using the existing MGF 1 would waste = only 1 division: to figure out counter number is zero: so there is only = one hash function execution. 
[JLS2] No = it is more than that.  It takes both the one division AND a = concatenation AND the strangeness for trying to decide how long the = SHAKE output is if one is placing it into an existing MGF1 piece of = code.  If you define a new MGF-V then there is a new function that = is called =E2=80=93 which code should potentially be setup for =E2=80=93 = and zero extra work beyond that.  The size of the mask is the size = of the output, no concatenation.  It is much cleaner in my = opinion.
 
Does anyone think that using SHAKE in = the RSA-PSS mask generation function is the wrong approach?
 
Russ
 
= --Apple-Mail=_718E1E0A-F163-415E-A70A-EAE7A7191337-- From nobody Mon Sep 17 12:49:35 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70FCC130EDA for ; Mon, 17 Sep 2018 12:49:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QPWkMHQ-ypBS for ; Mon, 17 Sep 2018 12:49:30 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BCC4130ED1 for ; Mon, 17 Sep 2018 12:49:29 -0700 (PDT) Received: from Jude (192.168.1.157) by mail2.augustcellars.com (192.168.1.201) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 17 Sep 2018 12:45:20 -0700 From: Jim Schaad To: 'Russ Housley' , 'panos Kampanakis' , 'Quynh Dang' CC: 'SPASM' References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> <019201d44e9c$827ad620$87708260$@augustcellars.com> <1F5FD70A-34B4-41EE-86A7-F1848D2B7DA8@vigilsec.com> In-Reply-To: <1F5FD70A-34B4-41EE-86A7-F1848D2B7DA8@vigilsec.com> Date: Mon, 17 Sep 2018 12:49:16 -0700 Message-ID: <01ca01d44ebf$86141490$923c3db0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_01CB_01D44E84.D9B78680" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJBlyy+liKglkq7u8zG/FAVp0RX2gG+MegMAc2kTZ4B9RaUkwI16IbrAf6+i+YC1J79LQGzGmg8AfF/2fgB7tOBVKOJY2rA Content-Language: en-us X-Originating-IP: [192.168.1.157] Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 19:49:34 -0000 ------=_NextPart_000_01CB_01D44E84.D9B78680 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Ok =E2=80=93 then lets send a request to CFRG to look at this and tell = us if I am crazy to want to do this. =20 =20 Jim =20 =20 From: Spasm On Behalf Of Russ Housley Sent: Monday, September 17, 2018 11:52 AM To: panos Kampanakis ; Jim Schaad = ; Quynh Dang Cc: SPASM Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 =20 Quynh, Panos, and Jim: =20 While it does look like a simple substitution, I do not think the LAMPS = is the right group to make the assessment. CFRG may have people with = the right skills. =20 Russ =20 =20 On Sep 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) = > wrote: =20 I think that falls outside the scope of this spec and the LAMPS charter = to be honest. I mean, introducing a new MFG should not be taken lightly even if it is = straightforward. Panos =20 From: Jim Schaad [ = mailto:ietf@augustcellars.com]=20 Sent: Monday, September 17, 2018 11:39 AM To: 'Russ Housley' < = housley@vigilsec.com>; 'Quynh Dang' < = quynh.dang@nist.gov>; Panos Kampanakis (pkampana) < = pkampana@cisco.com> Cc: 'SPASM' < spasm@ietf.org> Subject: RE: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 =20 Russ, =20 That is not the question that I was asking. I think that replacing = SHA-1 with SHAKE in the MFG function is correct. I was proposing = replacing the MFG function in its entirety with a new MFG function. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Russ Housley Sent: Monday, September 17, 2018 2:53 AM To: Quynh Dang < quynh.dang@nist.gov>; = Panos Kampanakis < pkampana@cisco.com> Cc: SPASM < spasm@ietf.org> Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 =20 Here is a part of a message to resolve the WG Last Call comments on = draft-ietf-lamps-cms-shakes-01 ... =20 * Message Digests - are the limits on the size only for CMS or do they = apply everywhere that the algorithm is used. If it is everywhere how do we reconcile with the usage in RSA-PSS?=20 =20 Comment 5: Only in CMS, when a message digest is generated. For RSA-PSS, = a SHAKE has 2 different output sizes for 2 different uses: hashing a = message to be signed and generating a masking value in MGF 1.=20 [JLS] After looking at this a second time, I propose that this problem = be solved by creation of a new mask generation function MGF-V. We can = eliminate the counter from the operation as being un-needed and just = compute the mask length and generate that many bits of input from a = SHAKE function. =20 I thought about that. But that would be another standard function which = have not been defined yet. How could we go from here ? And this route = would take time. Using the existing MGF 1 would waste only 1 division: = to figure out counter number is zero: so there is only one hash function = execution.=20 [JLS2] No it is more than that. It takes both the one division AND a = concatenation AND the strangeness for trying to decide how long the = SHAKE output is if one is placing it into an existing MGF1 piece of = code. If you define a new MGF-V then there is a new function that is = called =E2=80=93 which code should potentially be setup for =E2=80=93 = and zero extra work beyond that. The size of the mask is the size of = the output, no concatenation. It is much cleaner in my opinion. =20 Does anyone think that using SHAKE in the RSA-PSS mask generation = function is the wrong approach? =20 Russ =20 ------=_NextPart_000_01CB_01D44E84.D9B78680 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Ok = =E2=80=93 then lets send a request to CFRG to look at this and tell us = if I am crazy to want to do this.=C2=A0

 

Jim

 

 

From: Spasm = <spasm-bounces@ietf.org> On Behalf Of Russ = Housley
Sent: Monday, September 17, 2018 11:52 = AM
To: panos Kampanakis <pkampana@cisco.com>; Jim Schaad = <ietf@augustcellars.com>; Quynh Dang = <quynh.dang@nist.gov>
Cc: SPASM = <spasm@ietf.org>
Subject: Re: [lamps] WGLC comments = draft-ietf-lamps-cms-shakes-01

 

Quynh, = Panos, and Jim:

 

While it does look like a simple substitution, I do = not think the LAMPS is the right group to make the assessment. =  CFRG may have people with the right = skills.

 

Russ

 

 



On Sep 17, 2018, at 2:08 PM, Panos Kampanakis = (pkampana) <pkampana=3D40cisco.= com@dmarc.ietf.org> wrote:

 

I think that falls = outside the scope of this spec and the LAMPS charter to be = honest.

I mean, introducing a new MFG should not be = taken lightly even if it is = straightforward.

Panos

 

From: Jim Schaad [mailto:ietf@augustcellars.com] 
Sent: Monday, September 17, 2018 = 11:39 AM
To: 'Russ Housley' <housley@vigilsec.com>; 'Quynh = Dang' <quynh.dang@nist.gov>; Panos = Kampanakis (pkampana) <pkampana@cisco.com>
Cc: 'SPASM' <spasm@ietf.org>
Subject:<= span class=3Dapple-converted-space> RE: [lamps] WGLC = comments = draft-ietf-lamps-cms-shakes-01

 

Russ,

 

That is not the question that I was asking.  I = think that replacing SHA-1 with SHAKE in the MFG function is = correct.  I was proposing replacing the MFG function in its = entirety with a new MFG function.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Russ = Housley
Sent: Monday, September 17, 2018 = 2:53 AM
To: Quynh Dang <quynh.dang@nist.gov>; Panos = Kampanakis <pkampana@cisco.com>
Cc: SPASM <spasm@ietf.org>
Subject:<= span class=3Dapple-converted-space> Re: [lamps] WGLC = comments = draft-ietf-lamps-cms-shakes-01

 

Here is a part of a message to resolve the WG Last = Call comments on draft-ietf-lamps-cms-shakes-01 = ...

 

* Message Digests - = are the limits on the size only for CMS or do they apply
everywhere = that the algorithm is used.  If it is everywhere how do = we
reconcile with the usage in = RSA-PSS? 

 

<= div>

Comment 5: Only in CMS, when a = message digest is generated. For RSA-PSS,  a SHAKE has 2 different = output sizes for 2 different uses: hashing a message to be signed and = generating a masking value in MGF = 1. 

[JLS] = After looking at this a second time, I propose that this problem be = solved by creation of a new mask generation function MGF-V.  =  We can eliminate the counter from the operation as being un-needed = and just compute the mask length and generate that many bits of input = from a SHAKE function.

 

I thought = about that. But that would be another standard function which have = not been defined  yet. How could we go from here ? And this route = would take time. Using the existing MGF 1 would waste only 1 = division: to figure out counter number is zero: so there is only one = hash function = execution. 

[JLS2] No it is more = than that.  It takes both the one division AND a concatenation AND = the strangeness for trying to decide how long the SHAKE output is if one = is placing it into an existing MGF1 piece of code.  If you define a = new MGF-V then there is a new function that is called =E2=80=93 which = code should potentially be setup for =E2=80=93 and zero extra work = beyond that.  The size of the mask is the size of the output, no = concatenation.  It is much cleaner in my = opinion.

<= /div>

 

Does anyone think that using SHAKE in the RSA-PSS mask = generation function is the wrong = approach?

 

Russ

 

------=_NextPart_000_01CB_01D44E84.D9B78680-- From nobody Mon Sep 17 14:00:36 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F15D130DFF for ; Mon, 17 Sep 2018 14:00:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cgO7VYkORUa0 for ; Mon, 17 Sep 2018 14:00:32 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48492124D68 for ; Mon, 17 Sep 2018 14:00:32 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id E7963300AA4 for ; Mon, 17 Sep 2018 17:00:29 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id nE4699vKUdPA for ; Mon, 17 Sep 2018 17:00:28 -0400 (EDT) Received: from new-host-5.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 73FFE300258; Mon, 17 Sep 2018 17:00:28 -0400 (EDT) From: Russ Housley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_B29FB8AC-988C-45D7-9607-9A27CB6D9A2C" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 17 Sep 2018 17:00:28 -0400 In-Reply-To: <01ca01d44ebf$86141490$923c3db0$@augustcellars.com> Cc: Panos Kampanakis , Quynh Dang , SPASM To: Jim Schaad References: <00be01d42b65$b8452ee0$28cf8ca0$@augustcellars.com> <086101d44538$2c0d47e0$8427d7a0$@augustcellars.com> <087301d44543$390807e0$ab1817a0$@augustcellars.com> <09C752C4-CF6C-4455-961F-6121D07B9F1A@vigilsec.com> <019201d44e9c$827ad620$87708260$@augustcellars.com> <1F5FD70A-34B4-41EE-86A7-F1848D2B7DA8@vigilsec.com> <01ca01d44ebf$86141490$923c3db0$@augustcellars.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Sep 2018 21:00:34 -0000 --Apple-Mail=_B29FB8AC-988C-45D7-9607-9A27CB6D9A2C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I sent the query. For those who are not on the CFRG list, the archive = message is here: = https://mailarchive.ietf.org/arch/msg/cfrg/VVm9BQZSOHpaFR4ZQMQPUFtgjOk = Russ > On Sep 17, 2018, at 3:49 PM, Jim Schaad = wrote: >=20 > While it does look like a simple substitution, I do not think the = LAMPS is the right group to make the assessment. CFRG may have people = with the right skills. --Apple-Mail=_B29FB8AC-988C-45D7-9607-9A27CB6D9A2C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = sent the query.  For those who are not on the CFRG list, the = archive message is here:

= https://mailarchive.ietf.org/arch/msg/cfrg/VVm9BQZSOHpaFR4ZQMQP= UFtgjOk

Russ


On Sep = 17, 2018, at 3:49 PM, Jim Schaad <ietf@augustcellars.com> wrote:

While it does = look like a simple substitution, I do not think the LAMPS is the right = group to make the assessment.  CFRG may have people with the right = skills.

= --Apple-Mail=_B29FB8AC-988C-45D7-9607-9A27CB6D9A2C-- From nobody Thu Sep 20 06:26:43 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1213A130F1F for ; Thu, 20 Sep 2018 06:26:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UJWeMZVNH353 for ; Thu, 20 Sep 2018 06:26:28 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91766130EF1 for ; Thu, 20 Sep 2018 06:26:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=84757; q=dns/txt; s=iport; t=1537449988; x=1538659588; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=Ef+YwX4wGBULtweazLtvpsKHVqs4NgzXKEw+yyj50Y8=; b=hCvoYSzFBLorC8GYURiYfiOBgUXwnR4Ut5Cq58eFwTaPjI3RMjq3Q4cb wBBv8Ob59FlMnUpfBl0IuLXY+5GkWULfd1MCFu1DmXHgtPxZl+kNJPT3y kqfKRugdCdNDFDOdQx/reoGWMlu4oc+VV65+Ogm4qkkNtfC1dFqgMavr8 k=; X-Files: image001.png : 1892 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AtAAAhn6Nb/5pdJa1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYFSgQ9IL2V/KAqDaZRFgg2IXo1wgXcDCAECGAEMhEcCF4M?= =?us-ascii?q?qITYWAQMBAQIBAQJtHAyFOAEBAQEDAQEDFQkCCAFACxACAQgOAwQBAQYBAQE?= =?us-ascii?q?YAQYDAgICBRABCQUBCxQJCAIEDgQBBgIGBgdLgjyBaQMVD6NngS4fhAwBgw8?= =?us-ascii?q?NgkAKBYpvF4FBP4ERAYMSglZFAQEDgTsWGwkPEAKCSYJXAogiIDCEcIVwg0y?= =?us-ascii?q?BRYNfLAkChWQBXIZKgw8fjyKHFYRdbYdvAhEUgSUkCCmBVXAVO4JsgiQBF4h?= =?us-ascii?q?ahT5vAYspK4EBgR4BAQ?= X-IronPort-AV: E=Sophos;i="5.53,398,1531785600"; d="png'150?scan'150,208,217,150";a="454981516" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Sep 2018 13:26:27 +0000 Received: from XCH-RCD-006.cisco.com (xch-rcd-006.cisco.com [173.37.102.16]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id w8KDQQSh018477 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 20 Sep 2018 13:26:27 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-RCD-006.cisco.com (173.37.102.16) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 20 Sep 2018 08:26:26 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Thu, 20 Sep 2018 08:26:26 -0500 From: "Panos Kampanakis (pkampana)" To: Massimiliano Pala CC: Erik Andersen , "'SPASM'" , Directory list Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwANHy+AAAKWWwAAAGJ/gAAdEOUAAA5m/4AAAOuWAAAAVAsAAAzUEYAAIGE4gAASdg2AAFmu0YABHhS8AA== Date: Thu, 20 Sep 2018 13:26:26 +0000 Message-ID: <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> In-Reply-To: <002001d44c42$80388fd0$80a9af70$@x500.eu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.82.229.124] Content-Type: multipart/related; boundary="_004_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_"; type="multipart/alternative" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.16, xch-rcd-006.cisco.com X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2018 13:26:42 -0000 --_004_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_ Content-Type: multipart/alternative; boundary="_000_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_" --_000_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWF4LA0KVG8gcmVwaHJhc2UgRXJpY+KAmXMgcXVlc3Rpb24sIHdvdWxkIHRoZSBDb21wb3Np dGVLZXkrQ29tcG9zaXRlU2lnIHByb3Bvc2FsIGJlIGJhY2t3YXJkcyBjb21wYXRpYmxlIHdpdGgg ZXhpc3Rpbmcgc3lzdGVtcz8NCkkgbWVhbiBpdCBnaXZlcyB5b3UgdGhlIGNoYW5nZSB0byB1c2Ug bW9yZSB0aGFuIG9uZSBhbGdvcyBpbiBjYXNlIHlvdSBkb27igJl0IHRydXN0IGFsbCBvZiB0aGVt LiBCdXQgYW4gb2xkIGNsaWVudCB3b3VsZG7igJl0IGJlIGFibGUgdG8ganVzdCB1c2UgdGhlIHRy YWRpdGlvbmFsIGtleStzaWcgdW5sZXNzIGhlIHdhcyB1cGdyYWRlZCB0byB1bmRlcnN0YW5kIENv bXBvc2l0ZUtleStDb21wb3NpdGVTaWcgYW5kIGl0cyBPSURzLCByaWdodD8NClBhbm9zDQoNCkZy b206IFNwYXNtIFttYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEVy aWsgQW5kZXJzZW4NClNlbnQ6IEZyaWRheSwgU2VwdGVtYmVyIDE0LCAyMDE4IDExOjQ5IEFNDQpU bzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc+OyBEaXJlY3RvcnkgbGlzdCA8eDUwMHN0YW5kYXJk QGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0K DQpUaGUgZG91YmxlIHNpZ25hdHVyZSBpcyBpbnRlbmRlZCBhcyBhIG1pZ3JhdGlvbiB0b29sLg0K DQpJbiB0aGUgbm9ybWFsIG9wZXJhdGlvbiwgb25seSBvbmUgc2lnbmF0dXJlIGlzIHVzZWQgKHRo ZSBuYXRpdmUgc2lnbmF0dXJlKS4gV2hlbiBpdCBpcyByZWFsaXplZCB0aGF0IHRoZSBzaWduYXR1 cmUgYWxnb3JpdGhtIHdpbGwgYmUgdG9vIHdlZWsgaSBzb21lIGZ1dHVyZSwgdGhlIG1pZ3JhdGlv biBwZXJpb2Qgc3RhcnRzIGFuZCBhbiBhbHRlcm5hdGl2ZSwgYXNzdW1pbmcgc3Ryb25nZXIgc2ln bmF0dXJlIGlzIHByb3ZpZGVkIGZvciB0aG9zZSBhYmxlIHRvIGhhbmRsZSBpdC4gIExlZ2FjeSBz eXN0ZW1zIHdpbGwgaWdub3JlIHRoaXMgYWx0ZXJuYXRpdmUgc2lnbmF0dXJlLiBBZnRlciB0aGUg bWlncmF0aW9uIHBlcmlvZCwgdGhlcmUgd2lsbCBiZSBubyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUg YW5kIHRoZSBuZXcgc3Ryb25nZXIgc2lnbmF0dXJlIHdpbGwgYmUgdGhlIG5hdGl2ZSBzaWduYXR1 cmUuDQoNCkRvZXMgdGhhdCBtYWtlIHNlbnNlPw0KDQpFcmlrDQoNCkZyYTogTWFzc2ltaWxpYW5v IFBhbGEgW21haWx0bzptLnBhbGFAY2FibGVsYWJzLmNvbV0NClNlbmR0OiAxMiBTZXB0ZW1iZXIg MjAxOCAyMzowMQ0KVGlsOiBSdXNzIEhvdXNsZXkgPGhvdXNsZXlAdmlnaWxzZWMuY29tPG1haWx0 bzpob3VzbGV5QHZpZ2lsc2VjLmNvbT4+DQpDYzogU1BBU00gPHNwYXNtQGlldGYub3JnPG1haWx0 bzpzcGFzbUBpZXRmLm9yZz4+OyBFcmlrIEFuZGVyc2VuIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJh QHg1MDAuZXU+Pg0KRW1uZTogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KDQpIaSBS dXNzLCBhbGwsDQoNCm15IHBlcnNvbmFsIHBvc2l0aW9uIGlzIHRoYXQgdGhlIHNpZ25lciBNVVNU IHVzZSBhbGwgdGhlIGtleXMgdGhhdCBoYXZlIGRpZ2l0YWxTaWduYXR1cmUgc2V0LCB0aGUgdmVy aWZpZXIgc2hhbGwgdmVyaWZ5IGFsbCB0aGUgc2lnbmF0dXJlcyBmb3Igd2hpY2ggaXQgZG9lcyBo YXZlIHN1cHBvcnQgZm9yLg0KDQpUaGUgcmF0aW9uYWxlIGZvciB0aGlzIGlzIHRoYXQgaWYgSSBj ZXJ0aWZ5IGEgcHVibGljIGtleSBpbiB0aGUgY2VydGlmaWNhdGUsIHlvdSBzaG91bGQgYmUgYWJs ZSB0byB1c2UgdGhlIHByaXZhdGUga2V5IHRvIGdlbmVyYXRlIHRoZSBzaWduYXR1cmUsIHRoZXJl Zm9yZSB0aGUgYXBwcm9hY2ggaXMgdGhlIHNhbWUgYXMgdXN1YWw6IHNpZ24gd2l0aCB5b3VyIGtl eS4gSW4gdGhpcyBjYXNlLCBpdCBqdXN0IGhhcHBlbnMgdGhhdCB0byBnZW5lcmF0ZSB0aGUgc2ln bmF0dXJlIHlvdSBoYXZlIHRvIGdlbmVyYXRlIG11bHRpcGxlIG9uZXMgYW5kIHRoZW4gY29tYmlu ZSB0aGVtIHRvZ2V0aGVyLg0KDQpGb3IgdGhlIGFwcGxpY2F0aW9uIHRoYXQgdmVyaWZpZXMgdGhv c2Ugc2lnbmF0dXJlcywgaXQgaXMgYWx3YXlzIGEgcXVlc3Rpb24gb2Ygd2hhdCBpcyB0aGUgdGhy ZXNob2xkIHRoYXQgaXMgYWNjZXB0YWJsZSBmb3IgdGhlIGFwcGxpY2F0aW9uIChpbiB0ZXJtcyBv ZiByaXNrKSBpbiBjYXNlIGl0IGRvZXMgbm90IHN1cHBvcnQgYWxsIG9mIHRoZSBhbGdvcml0aG1z IHRoYXQgYXJlIHVzZWQgdG8gZ2VuZXJhdGUgdGhlIGNvbXBvc2l0ZSBzaWduYXR1cmUuIElkZWFs bHkgaXQgd291bGQgdmVyaWZ5IGFsbCwgYnV0IGl0IG1heSBkZWNpZGUgdG8gdmVyaWZ5IGxlc3Mg KGF0IGxlYXN0IG9uZSkuDQoNCkkgYWxzbyBzYXcgdGhlIG90aGVyIGUtbWFpbCBmcm9tIEppbSBv biB0aGlzIHRvcGljIGFuZCBJIHRoaW5rIGl0IGNvdWxkIGJlIGEgZ29vZCBpZGVhIC0gdGhlIHVz ZSBvZiB0aGUgdHdvIE9JRHMgaXMgYW5vdGhlciB3YXkgdG8gZ28gdG8gY29kaWZ5IHRoZSB2YWxp ZGF0aW9uIHByb2Nlc3MgcmVxdWlyZWQuIFRlY2huaWNhbGx5LCB0aGF0IG1ha2VzIHNlbnNlIHRv IG1lLCBob3dldmVyIEkgYW0gY29uZmxpY3RlZCBhcyB0aGlzIGFwcHJvYWNoIHJlcXVpcmVzIHRo YXQgdGhlIHNpZ25lciBoYXMgYW4gdW5kZXJzdGFuZGluZyBvZiB3aGF0IHRoZSB2ZXJpZmllcidz IGNhcGFiaWxpdGllcyBhcmUuLi4gSSB0aGluayB0aGF0IGRlZmluaW5nIHR3byBPSURzIGZvciB0 aGUgc2lnbmF0dXJlcyBjb3VsZCBzdGlsbCBiZSB1c2VmdWwgYmVjYXVzZSB0aGUgc2lnbmVyIG1p Z2h0IHRoZW4gZGVjaWRlIHRoZSAicmVjb21tZW5kZWQiLyJpbnRlbmRlZCIgdmVyaWZpY2F0aW9u IGJlaGF2aW9yLi4uIEkgY2FuIHNlZSBzb21lIHVzZS1jYXNlcyB0aGF0IG1pZ2h0IGhhdmUgYSBj b21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEVDIH0gYW5kIHRoZSAiTXVzdC1WZXJpZnktQWxsIiBP SUQgZm9yIHRoZSBzaWduYXR1cmUsIGFuZCBhbm90aGVyIHVzZS1jYXNlIHdoZXJlIHdlIGhhdmUg YSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEhBU0gtQkFTRUQgfSBhbmQgZm9yIHRoZSBzaWdu YXR1cmUgIk11c3QtVmVyaWZ5LUF0LUxlYXN0LU9uZSIuDQoNCkRvZXMgdGhpcyBtYWtlIHNlbnNl Pw0KDQpDaGVlcnMsDQpNYXgNCg0KT24gOS8xMi8xOCA2OjEyIEFNLCBSdXNzIEhvdXNsZXkgd3Jv dGU6DQpNYXg6DQoNCkR1cmluZyBhIHRyYW5zaXRpb24gdG8gcXVhbnR1bS1yZXNpc3RhbnQgc2ln bmF0dXJlcywgYSBzaWduZXIgd2FudHMgdG8gcHV0IGEgdHJhZGl0aW9uYWwgc2lnbmF0dXJlIGFu ZCBhIHF1YW50dW0tcmVzaXN0YW50IHNpZ25hdHVyZSBvbiBhbiBvYmplY3QuICBHaXZlbiB5b3Vy IGRlc2NyaXB0aW9uIG9mIGtleVVzYWdlIGFuZCBleHRlbmRlZEtleVVzYWdlLCBib3RoIHdvdWxk IGhhdmUgdGhlIGRpZ2l0YWxTaWduYXR1cmUgYml0IHNldC4gIEhvdyBkb2VzIGEgY2xpZW50IGtu b3cgaWYganVzdCBvbmUgb3IgYm90aCBzaWduYXR1cmVzIG11c3QgYmUgdmFsaWQ/DQoNCkFzIEpp bSBTY2hhYWQgYWxyZWFkeSBzYWlkLCBSRkMgNTc1MiB0YWxrcyBhYm91dCB0aGlzIGlzc3VlIHdo ZW4gYSBDTVMgU2lnbmVkRGF0YSBjb250YWlucyBtb3JlIHRoYW4gb25lIFNpZ25lckluZm8uDQoN ClJ1c3MNCg0KDQpPbiBTZXAgMTEsIDIwMTgsIGF0IDQ6NDUgUE0sIE1heCBQYWxhIDxNLlBhbGFA Y2FibGVsYWJzLmNvbTxtYWlsdG86TS5QYWxhQGNhYmxlbGFicy5jb20+PiB3cm90ZToNCg0KSGkg QWxsLA0KDQpJIGFtIHdvcmtpbmcgb24gYSBzaW1pbGFyIC0gYnV0IGRpZmZlcmVudCAtIHNvbHV0 aW9uLCBpbiBwYXJ0aWN1bGFyIEkgc29sdmUgdGhlIGlzc3VlIG9mIChhKSBiZWluZyBhYmxlIHRv IGNvbWJpbmUgbW9yZSB0aGFuIG9uZSBwdWJsaWMga2V5LCAoYikgb25seSBvbmUgKGFjdHVhbGx5 IHR3bykgT0lEcyByZXF1aXJlZCwgYW5kIChjKSBzaW1wbHkgdGhlIHByb2Nlc3NpbmcgYnkgcmUt dXRpbGl6aW5nIHRoZSBzYW1lIGRhdGEgc3RydWN0dXJlcyB3ZSBoYXZlIHRvZGF5Lg0KDQpJIHBh cnRpY3VsYXIsIEkgZGVmaW5lIGEg4oCcY29tcG9zaXRlIHB1YmxpYyBrZXnigJ0gYW5kIOKAnGNv bXBvc2l0ZSBzaWduYXR1cmXigJ0uDQoNClRoZSBmaXJzdCBvbmUgZW5jb2RlcyBpbiB0aGUga2V5 IHZhbHVl4oCZcyBCSVRTVFJJTkcgdGhlIERFUiB2YWx1ZSBvZiB0aGUgU0VRVUVOQ0Ugb2YgcHVi bGljIGtleXMgKGVhY2ggb2Ygd2hpY2ggaXMgYSB0aGUgc3ViamVjdFB1YmxpY0tleUluZm8gc3Ry dWN0dXJlKSBhbmQgdXNlcyBhIHNwZWNpZmljIE9JRCB0aGF0IGlkZW50aWZpZXMgdGhlIHB1Ymxp YyBrZXkgdHlwZS4gVGhlIHBhcmFtZXRlcnMgb2YgdGhlIGNvbXBvc2l0ZUtleSBhbGdvcml0aG0g Y2FuIGJlIHVzZWQgdG8gZW5jb2RlIHRoZSBrZXlVc2FnZSBhbmQgdGhlIGV4dGVuZGVkS2V5VXNh Z2UgZm9yIGVhY2ggb2YgdGhlIGtleXMgaW4gdGhlIGNvbXBvc2l0ZSBrZXkuDQoNClRoZSBzYW1l IGFwcHJvYWNoIGlzIHVzZWQgZm9yIHRoZSDigJxDb21wb3NpdGUgU2lnbmF0dXJl4oCdIGNhc2Ug d2hlcmUgdGhlIHZhbHVlIG9mIHRoZSBzaWduYXR1cmUgaXMgdGhlIERFUiByZXByZXNlbnRhdGlv biBvZiB0aGUgU0VRVUVOQ0Ugb2Ygc2lnbmF0dXJlcyBtYWRlIHdpdGggZWFjaCBvZiB0aGUga2V5 cy4NCg0KQXMgc29vbiBhcyBJIGhhdmUgc29tZSBzcGFyZSB0aW1lLCBJIHdpbGwgc3VibWl0IHRo ZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUgZGlzY3Vzc2VkIGluIEJhbmdrb2s/DQoNClRo aXMgc2ltcGxlIGlkZWEgYWxsb3dzIHVzIHRvIGhhdmUgYWxsIHRoZSBvdGhlciBwcm9jZWR1cmVz IHJlbGF0ZWQgdG8gUEtJcyB3b3JrIC0gdGhpcyBtZWFucyB3ZSBjYW4gY29tYmluZSBFQ0Mgd2l0 aCBSU0Egb3Igd2l0aCBhIFF1YW50dW0tUmVzaXN0YW50IGFsZ29yaXRobSAod2hlbiBmaW5hbGx5 IGF2YWlsYWJsZSBhbmQgc3RhbmRhcmRpemVkKS4gQSBzdGVwIGZvcndhcmQgZm9yIHRoZSBkZXBs b3ltZW50IG9mIGh5YnJpZC1QS0lzIHdoZXJlIG11bHRpcGxlIExhZ29zIGZvciBrZXlzIGNhbiBi ZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBkYXRhLCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRhLCBldGMu Li4gd2UgcGxhbiB0byB1c2UgdGhpcyBpbiBvdXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHByb3ZpZGUg YSB0cmFuc2l0aW9uYWwgcGF0aCBmb3IgcG9zdC1RdWFudHVtIHRyYW5zaXRpb24gYW5kIHRvIGZ1 cnRoZXIgaW1wcm92ZSB0aGUgYWxnb3JpdGhtLWFnaWxpdHkgY2FwYWJpbGl0eSBvZiBQS0lzLg0K DQpXaGF0IGRvIHlvdSB0aGluaz8NCg0KQ2hlZXJzLA0KTWF4DQoNCg0KLS0tDQoNCkNoZWVycywN Ck1heA0KT24gU2VwIDExLCAyMDE4LCBhdCA4OjM4IEFNLCBUaW0gSG9sbGViZWVrIDx0aW0uaG9s bGViZWVrQGRpZ2ljZXJ0LmNvbTxtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20+PiB3 cm90ZToNClVuZm9ydHVuYXRlbHksIOKAnG5vdCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBi ZSBjb3ZlcmVk4oCdIGludHJvZHVjZXMgYSBsb3Qgb2YgcG9saXRpY3MgYXJvdW5kIGNob29zaW5n IHdoaWNoIGNvbWJpbmF0aW9ucyDigJxuZWVkIHRvIGJlIGNvdmVyZWTigJ0sIGEgc3ViamVjdCBv biB3aGljaCBpbmV2aXRhYmx5IG5vdCBldmVyeW9uZSBhZ3JlZXMuICBJIHdvdWxkIHJhdGhlciBh dm9pZCBhbGwgdGhvc2UgZGlzY3Vzc2lvbnMgYW5kIHRoZSB1bm5lY2Vzc2FyeSB3b3JrIHRoZXkg cmVwcmVzZW50Lg0KDQpJIHBlcnNvbmFsbHkgZG9u4oCZdCB0aGluayBhIHNpbmdsZSBBbGdJRCB3 aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBpcyBhbiBpbXByb3ZlbWVudCBvdmVy IGEgU0VRVUVOQ0Ugb2YgQUxHIElEcywgb3IgaXRzIG1vcmFsIGVxdWl2YWxlbnQuICBGb3Igc2lt cGxlIGh5YnJpZCB1c2UgY2FzZXMsIHRoZXJlIGlzIGFsc28gYSBsb3Qgb2YgdmFsdWUgaW4gaGF2 aW5nIHRoZSBjbGFzc2ljYWwgYWxnb3JpdGhtIElEIGJlaW5nIHRoZSBzYW1lIGFzIGl0IHVzdWFs bHkgaXMsIHRvIGFsbG93IGVhc2llciBpbnRlcm9wZXJhYmlsaXR5IHdpdGggb2xkZXIgc3lzdGVt cyB0aGF0IGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgbmV3ZXIgYWxnb3JpdGhtcyAoYW5kIGNhbiBi bGlzc2Z1bGx5IGlnbm9yZSB0aGVtKS4NCg0KLVRpbQ0KDQpGcm9tOiBTYW50b3NoIENob2toYW5p IDxzYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbTxtYWlsdG86c2FudG9zaC5jaG9raGFuaUBnbWFp bC5jb20+Pg0KU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDEwOjI5IEFNDQpUbzog VGltIEhvbGxlYmVlayA8dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208bWFpbHRvOnRpbS5ob2xs ZWJlZWtAZGlnaWNlcnQuY29tPj47ICdFcmlrIEFuZGVyc2VuJyA8ZXJhQHg1MDAuZXU8bWFpbHRv OmVyYUB4NTAwLmV1Pj47ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRm Lm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZy ZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSRTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpU aGFua3MgVGltLg0KDQpUaGVyZSBhcmUgd2F5cyB0byBhY2NvbW1vZGF0ZSB5b3VyIGNvbmNlcm4u DQoNCk9uZSB3YXkgdG8gaGFuZGxlIHRoaXMgaXMgZGVmaW5pbmcgYSBzaW5nbGUgQWxnIElEIEEg d2hpY2ggaW1wbGllcyBhIFNFUVVFTkNFIG9mIEFMRyBJRHMgYW5kIGRlZmluZSB0aGUgcmVseWlu ZyBwYXJ0eSBydWxlcyBpbiB0ZXJtcyBvZiBpdHMgYWJpbGl0eSB0byBwcm9jZXNzIG9uZSBvciBh bGwgQUxHIElEcy4NCg0KQW5vdGhlciB3YXkgdG8gZG8gdGhpcyBpcyBub3QgZXZlcnkgY29tYmlu YXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZCBhbmQgdGhlIHVzZXIgY29tbXVuaXR5IGRlZmluZXMg aXRzIG93biAgQWxnIElEIFhpIHdoaWNoIG1hcHMgdG8gYSBTRVFVRU5DRSBvZiBBTEcgSURzLg0K DQpGcm9tOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBP ZiBUaW0gSG9sbGViZWVrDQpTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMTA6MDMg QU0NClRvOiBFcmlrIEFuZGVyc2VuIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+Pjsg J1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFu ZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1 YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCkRvZXNu4oCZdCB0aGUgY29t YmluYXRvcmljIGV4cGxvc2lvbiByZW5kZXIgdGhpcyBjb21wbGV0ZWx5IGltcHJhY3RpY2FsPw0K DQpZb3UgbmVlZCBOX2MgeCBOX3BxIGFsZ29yaXRobSBpZGVudGlmaWVycyBqdXN0IHRvIGhhbmRs ZSB0aGUgc2ltcGxlIGh5YnJpZCB1c2UgY2FzZSB3aGVyZSBhIHNpbmdsZSBjbGFzc2ljYWwgYWxn b3JpdGhtIGlzIGJlaW5nIHVzZWQgaW4gY29uanVuY3Rpb24gd2l0aCBhIHNpbmdsZSBwb3N0LXF1 YW50dW0gYWxnb3JpdGhtLg0KDQpBbmQgdGhlcmUgYXJlIHBlb3BsZSB3aG8gd2FudCB0byB1c2Ug bXVsdGlwbGUgcG9zdC1xdWFudHVtIGFsZ29yaXRobXMgdG8gaGVkZ2UgYWdhaW5zdCBwb3RlbnRp YWwgeWV0IHRvIGJlIGRpc2NvdmVyZWQgd2Vha25lc3NlcyBpbiBwb3N0LXF1YW50dW0gYWxnb3Jp dGhtcy4NCg0KSeKAmW0gbm90IHJlYWxseSBsb29raW5nIGZvcndhcmQgdG8gdHJ5aW5nIHRvIGFs bG9jYXRlIG9yIG1hbmFnZSBPKE5fYyB4IE5fcHFeMykgYWxnb3JpdGhtIGlkZW50aWZpZXJz4oCm DQoNCi1UaW0NCg0KRnJvbTogU3Bhc20gPHNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnNw YXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgRXJpayBBbmRlcnNlbg0KU2VudDog VHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDM6MTAgQU0NClRvOiAnU1BBU00nIDxzcGFzbUBp ZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5v cmc8bWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1w c10gRG91YmxlIHNpZ25hdHVyZXMNCg0KSGkgU2FudG9zaCwNCg0KWW91IGhhdmUgcHJvcG9zZWQg c29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUuIEl0IHN0aWxsIHB1enpsaW5nIGluIG15IGJyYWlu LiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVpcmVzIHRoYXQgd2UgZGVmaW5lIGEgcGFydGljdWxh ciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJhbWV0ZXIgdGhhdCBpbmNsdWRlcyB0aGUgdGhpbmdz IHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkgdG8gYmUgYW5hbHlzZWQuDQoNCkVyaWsNCg0KRnJh OiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddIFDDpSB2ZWduZSBhZiBTYW50 b3NoIENob2toYW5pDQpTZW5kdDogMTAgU2VwdGVtYmVyIDIwMTggMTk6MTgNClRpbDogJ0ppbSBT Y2hhYWQnIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPG1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMu Y29tPj47ICdSeWFuIFNsZWV2aScgPHJ5YW4taWV0ZkBzbGVldmkuY29tPG1haWx0bzpyeWFuLWll dGZAc2xlZXZpLmNvbT4+OyBlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+DQpDYzogJ1NQ QVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFy ZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NCkVtbmU6 IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCldoeSBub3QgbGV0IGFsZ29yaXRobSBp ZGVudGlmaWVyIGRpY3RhdGUgdGhlIG51bWJlciBvZiBzaWduYXR1cmVzIGFuZCB0aGVpciBzeW50 YXg/DQoNCkZyb206IFNwYXNtIFttYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZ10gT24gQmVo YWxmIE9mIEppbSBTY2hhYWQNClNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcg UE0NClRvOiAnUnlhbiBTbGVldmknIDxyeWFuLWlldGZAc2xlZXZpLmNvbTxtYWlsdG86cnlhbi1p ZXRmQHNsZWV2aS5jb20+PjsgZXJhQHg1MDAuZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pg0KQ2M6ICdT UEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRh cmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJq ZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpSeWFuLA0KDQpUaGUgZGlzY3Vz c2lvbiBpbiBMb25kb24gZGVhbHQgd2l0aCBhIGNvbXBsZXRlbHkgZGlmZmVyZW50IHByb3Bvc2Fs IHRoYW4gdGhpcyBvbmUuICBXaGlsZSBJIHRoaW5rIHRoZXJlIGFyZSBwcm9ibGVtcyB3aXRoIHRo aXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUgbW9zdGx5IG5vdCB0aGUgc2Ft ZSBzZXQuDQoNCkVyaWssDQoNCldoeSBpcyB0aGlzIGNvbnNpZGVyZWQgdG8gYmUgYSBwcmVmZXJy ZWQgc29sdXRpb24gdG8gZGVmaW5pbmcgYSBuZXcgc2lnbmF0dXJlIGFsZ29yaXRobSB3aGljaCBj b250YWlucyBhcyB0aGUgcGFyYW1ldGVyIHRoZSBzZXF1ZW5jZSBvZiBhbGdvcml0aG0gaWRlbnRp ZmllcnMgYW5kIGFzIHRoZSBzaWduYXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1cmUg dmFsdWVzLiAgVGhlIHByb2JsZW0gd2l0aCBqdXN0IGRlZmluaW5nIHRoZSBleHRlbnNpb24gdG8g U0lHTkVEIGlzIHRoYXQgb25lIG5lZWRzIHRvIG1ha2Ugc3VyZSB0aGF0IHRoZSBzZXQgb2Ygc2ln bmF0dXJlIGFsZ29yaXRobXMgYW5kIHBhcmFtZXRlcnMgYXJlIGFsc28gcGFydCBvZiB0aGUgZGF0 YSB0byBiZSBzaWduZWQgYW5kIEkgYW0gbm90IHNlZWluZyB0aGF0IGhpZ2hsaWdodGVkIGhlcmUu DQoNCkppbQ0KDQoNCkZyb206IFNwYXNtIDxzcGFzbS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpz cGFzbS1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFJ5YW4gU2xlZXZpDQpTZW50OiBN b25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4OjUzIEFNDQpUbzogZXJhQHg1MDAuZXU8bWFpbHRv OmVyYUB4NTAwLmV1Pg0KQ2M6IFNQQVNNIDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0 Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFyZEBm cmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0K DQpPbiBNb24sIFNlcCAxMCwgMjAxOCBhdCAxMDo1NiBBTSBFcmlrIEFuZGVyc2VuIDxlcmFAeDUw MC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PiB3cm90ZToNCkhpIEZvbGssDQoNCkluIElUVS1UIHdl IGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRvdWJsZSBzaWduYXR1cmVzIHVzaW5nIHRoZSBTSUdO RUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBkZWZpbmVkIGluIFguNTA5IHRvIGNvcGUgd2l0aCBz aXR1YXRpb24gYXMgZGVzY3JpYmVkIGluIHRoZSBpbnRlcm5ldCBkcmFmdDog4oCcTXVsdGlwbGUg UHVibGljLUtleSBBbGdvcml0aG0gWC41MDkgQ2VydGlmaWNhdGVzIChkcmFmdC10cnVza292c2t5 LWxhbXBzLXBxLWh5YnJpZC14NTA5LTAxKeKAnQ0KDQpXZSBzdWdnZXN0IHRvIGVuaGFuY2UgdGhl IFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24gYmVsb3c6DQoNClNJR05FRHtUb0JlU2lnbmVkfSA6 Oj0gU0VRVUVOQ0Ugew0KICBDT01QT05FTlRTIE9GIFNJR05BVFVSRSwNCiAgLi4uLi4uLiwNCiAg YWx0QWxnb3JpdGhtSWRlbnRpZmllciAgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxn b3JpdGhtc319IE9QVElPTkFMLA0KICBhbHRTaWduYXR1cmUgICAgICAgICAgICBCSVQgU1RSSU5H IE9QVElPTkFMDQogIH0gKFdJVEggQ09NUE9ORU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlm aWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQUkVTRU5UIH0gfA0KICAgICBXSVRIIENPTVBPTkVO VFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRpZmllciBBQlNFTlQsICBhbHRTaWduYXR1cmUgQUJT RU5UIH0gKQ0KDQpXZSBhcmUgb3BlbiB0byBjb21tZW50cy4gV2Uga25vdyB0aGF0IElFVEYgaXMg bm90IGEgaGVhdnkgdXNlciBvZiB0aGlzIGRhdGEgdHlwZS4NCg0KV2UgaGF2ZSBubyBpbnRlbnRp b24gdG8gdXNlIHRoaXMgZXh0ZW5kZWQgZGF0YSB0eXBlIGZvciBjZXJ0aWZpY2F0ZXMgYW5kIENS THMuDQoNCkZvciB5b3VyIGluZm9ybWF0aW9uLCBTSUdOQVRVUkUgaXMgZGVmaW5lZCBhczoNCg0K U0lHTkFUVVJFIDo6PSBTRVFVRU5DRSB7DQogIGFsZ29yaXRobUlkZW50aWZpZXIgIEFsZ29yaXRo bUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSwNCiAgc2lnbmF0dXJlICAgICAgICAg ICAgQklUIFNUUklORywNCiAgLi4uLi4uLiB9DQoNCkZyb20gdGhlIGRpc2N1c3Npb25zIGluIExv bmRvbiAoMTAxKSwgdGhlcmUgd2VyZSBhIG51bWJlciBvZiBjaGFsbGVuZ2VzIGlkZW50aWZpZWQg ZHVyaW5nIHRoZSBkaXNjdXNzaW9uIC0gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0 aW5nLzEwMS9tYXRlcmlhbHMvbWludXRlcy0xMDEtbGFtcHMtMDEudHh0IC0gdGhhdCBmdW5kYW1l bnRhbGx5IHF1ZXN0aW9uZWQgdGhhdCBhcHByb2FjaC4NCg0KSGFzIHRoZSBJVFUtVCBhZGRyZXNz ZWQgb3IgcmVzb2x2ZWQgdGhvc2UgY29uY2VybnM/IEFyZSB0aGV5IG5vdCBhcHBsaWNhYmxlIGZv ciBzb21lIHJlYXNvbiBzcGVjaWZpYyB0byBJVFUtVD8NCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQpTcGFzbSBtYWlsaW5nIGxpc3QNClNwYXNtQGlldGYu b3JnPG1haWx0bzpTcGFzbUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Bhc20NCg0KDQotLQ0KQmVzdCBSZWdhcmRzLA0KTWFzc2ltaWxpYW5vIFBhbGEs IFBoLkQuDQpbQ2FibGVMYWJzXQ0KUHJpbmNpcGFsIEFyY2hpdGVjdA0KU2VjdXJpdHkgU2Vydmlj ZXMsIFImRA0K --_000_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3IFw7Ijt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyBcOyBjb2xvclw6IHJlZCI7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNv Tm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIixzZXJpZjsNCgljb2xvcjpibGFjazt9DQphOmxpbmssIHNwYW4uTXNvSHlw ZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2Vk DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uYXBwbGUt Y29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9 DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxT dHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEu MGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWF4LDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5UbyByZXBocmFzZSBFcmlj4oCZcyBxdWVzdGlvbiwgd291bGQgdGhlIENvbXBvc2l0 ZUtleSYjNDM7Q29tcG9zaXRlU2lnIHByb3Bvc2FsIGJlIGJhY2t3YXJkcyBjb21wYXRpYmxlIHdp dGggZXhpc3Rpbmcgc3lzdGVtcz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSBtZWFuIGl0IGdpdmVzIHlv dSB0aGUgY2hhbmdlIHRvIHVzZSBtb3JlIHRoYW4gb25lIGFsZ29zIGluIGNhc2UgeW91IGRvbuKA mXQgdHJ1c3QgYWxsIG9mIHRoZW0uIEJ1dCBhbiBvbGQgY2xpZW50IHdvdWxkbuKAmXQgYmUgYWJs ZSB0byBqdXN0IHVzZSB0aGUgdHJhZGl0aW9uYWwNCiBrZXkmIzQzO3NpZyB1bmxlc3MgaGUgd2Fz IHVwZ3JhZGVkIHRvIHVuZGVyc3RhbmQgQ29tcG9zaXRlS2V5JiM0MztDb21wb3NpdGVTaWcgYW5k IGl0cyBPSURzLCByaWdodD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+UGFub3M8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3 aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3Rl eHQiPiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYg T2YgPC9iPkVyaWsgQW5kZXJzZW48YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBTZXB0ZW1iZXIg MTQsIDIwMTggMTE6NDkgQU08YnI+DQo8Yj5Ubzo8L2I+ICdTUEFTTScgJmx0O3NwYXNtQGlldGYu b3JnJmd0OzsgRGlyZWN0b3J5IGxpc3QgJmx0O3g1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnJmd0 Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhlIGRvdWJsZSBzaWduYXR1cmUgaXMgaW50 ZW5kZWQgYXMgYSBtaWdyYXRpb24gdG9vbC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SW4gdGhlIG5vcm1hbCBvcGVy YXRpb24sIG9ubHkgb25lIHNpZ25hdHVyZSBpcyB1c2VkICh0aGUgbmF0aXZlIHNpZ25hdHVyZSku IFdoZW4gaXQgaXMgcmVhbGl6ZWQgdGhhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB3aWxsIGJl IHRvbyB3ZWVrIGkgc29tZQ0KIGZ1dHVyZSwgdGhlIG1pZ3JhdGlvbiBwZXJpb2Qgc3RhcnRzIGFu ZCBhbiBhbHRlcm5hdGl2ZSwgYXNzdW1pbmcgc3Ryb25nZXIgc2lnbmF0dXJlIGlzIHByb3ZpZGVk IGZvciB0aG9zZSBhYmxlIHRvIGhhbmRsZSBpdC4mbmJzcDsgTGVnYWN5IHN5c3RlbXMgd2lsbCBp Z25vcmUgdGhpcyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUuIEFmdGVyIHRoZSBtaWdyYXRpb24gcGVy aW9kLCB0aGVyZSB3aWxsIGJlIG5vIGFsdGVybmF0aXZlIHNpZ25hdHVyZSBhbmQgdGhlDQogbmV3 IHN0cm9uZ2VyIHNpZ25hdHVyZSB3aWxsIGJlIHRoZSBuYXRpdmUgc2lnbmF0dXJlLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5Eb2VzIHRoYXQgbWFrZSBzZW5zZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RXJpazxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxh bmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+RnJhOjwvc3Bhbj48L2I+PHNwYW4g bGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gTWFzc2ltaWxpYW5vIFBhbGEg WzxhIGhyZWY9Im1haWx0bzptLnBhbGFAY2FibGVsYWJzLmNvbSI+bWFpbHRvOm0ucGFsYUBjYWJs ZWxhYnMuY29tPC9hPl0NCjxicj4NCjxiPlNlbmR0OjwvYj4gMTIgU2VwdGVtYmVyIDIwMTggMjM6 MDE8YnI+DQo8Yj5UaWw6PC9iPiBSdXNzIEhvdXNsZXkgJmx0OzxhIGhyZWY9Im1haWx0bzpob3Vz bGV5QHZpZ2lsc2VjLmNvbSI+aG91c2xleUB2aWdpbHNlYy5jb208L2E+Jmd0Ozxicj4NCjxiPkNj OjwvYj4gU1BBU00gJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21AaWV0 Zi5vcmc8L2E+Jmd0OzsgRXJpayBBbmRlcnNlbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAw LmV1Ij5lcmFAeDUwMC5ldTwvYT4mZ3Q7PGJyPg0KPGI+RW1uZTo8L2I+IFJlOiBbbGFtcHNdIERv dWJsZSBzaWduYXR1cmVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+SGkgUnVzcywgYWxsLDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwPjxzcGFuIGxhbmc9IkVOLUdCIj5teSBwZXJzb25hbCBwb3NpdGlvbiBp cyB0aGF0IHRoZSBzaWduZXIgTVVTVCB1c2UgYWxsIHRoZSBrZXlzIHRoYXQgaGF2ZSBkaWdpdGFs U2lnbmF0dXJlIHNldCwgdGhlIHZlcmlmaWVyIHNoYWxsIHZlcmlmeSBhbGwgdGhlIHNpZ25hdHVy ZXMgZm9yIHdoaWNoIGl0IGRvZXMgaGF2ZSBzdXBwb3J0IGZvci48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+VGhlIHJhdGlvbmFsZSBmb3IgdGhpcyBpcyB0aGF0 IGlmIEkgY2VydGlmeSBhIHB1YmxpYyBrZXkgaW4gdGhlIGNlcnRpZmljYXRlLCB5b3Ugc2hvdWxk IGJlIGFibGUgdG8gdXNlIHRoZSBwcml2YXRlIGtleSB0byBnZW5lcmF0ZSB0aGUgc2lnbmF0dXJl LCB0aGVyZWZvcmUgdGhlIGFwcHJvYWNoIGlzIHRoZSBzYW1lIGFzIHVzdWFsOiBzaWduIHdpdGgg eW91ciBrZXkuIEluIHRoaXMgY2FzZSwgaXQganVzdCBoYXBwZW5zDQogdGhhdCB0byBnZW5lcmF0 ZSB0aGUgc2lnbmF0dXJlIHlvdSBoYXZlIHRvIGdlbmVyYXRlIG11bHRpcGxlIG9uZXMgYW5kIHRo ZW4gY29tYmluZSB0aGVtIHRvZ2V0aGVyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFu IGxhbmc9IkVOLUdCIj5Gb3IgdGhlIGFwcGxpY2F0aW9uIHRoYXQgdmVyaWZpZXMgdGhvc2Ugc2ln bmF0dXJlcywgaXQgaXMgYWx3YXlzIGEgcXVlc3Rpb24gb2Ygd2hhdCBpcyB0aGUgdGhyZXNob2xk IHRoYXQgaXMgYWNjZXB0YWJsZSBmb3IgdGhlIGFwcGxpY2F0aW9uIChpbiB0ZXJtcyBvZiByaXNr KSBpbiBjYXNlIGl0IGRvZXMgbm90IHN1cHBvcnQgYWxsIG9mIHRoZSBhbGdvcml0aG1zIHRoYXQg YXJlIHVzZWQgdG8gZ2VuZXJhdGUNCiB0aGUgY29tcG9zaXRlIHNpZ25hdHVyZS4gSWRlYWxseSBp dCB3b3VsZCB2ZXJpZnkgYWxsLCBidXQgaXQgbWF5IGRlY2lkZSB0byB2ZXJpZnkgbGVzcyAoYXQg bGVhc3Qgb25lKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+ SSBhbHNvIHNhdyB0aGUgb3RoZXIgZS1tYWlsIGZyb20gSmltIG9uIHRoaXMgdG9waWMgYW5kIEkg dGhpbmsgaXQgY291bGQgYmUgYSBnb29kIGlkZWEgLSB0aGUgdXNlIG9mIHRoZSB0d28gT0lEcyBp cyBhbm90aGVyIHdheSB0byBnbyB0byBjb2RpZnkgdGhlIHZhbGlkYXRpb24gcHJvY2VzcyByZXF1 aXJlZC4gVGVjaG5pY2FsbHksIHRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUsIGhvd2V2ZXIgSSBhbSBj b25mbGljdGVkDQogYXMgdGhpcyBhcHByb2FjaCByZXF1aXJlcyB0aGF0IHRoZSBzaWduZXIgaGFz IGFuIHVuZGVyc3RhbmRpbmcgb2Ygd2hhdCB0aGUgdmVyaWZpZXIncyBjYXBhYmlsaXRpZXMgYXJl Li4uIEkgdGhpbmsgdGhhdCBkZWZpbmluZyB0d28gT0lEcyBmb3IgdGhlIHNpZ25hdHVyZXMgY291 bGQgc3RpbGwgYmUgdXNlZnVsIGJlY2F1c2UgdGhlIHNpZ25lciBtaWdodCB0aGVuIGRlY2lkZSB0 aGUgJnF1b3Q7cmVjb21tZW5kZWQmcXVvdDsvJnF1b3Q7aW50ZW5kZWQmcXVvdDsgdmVyaWZpY2F0 aW9uDQogYmVoYXZpb3IuLi4gSSBjYW4gc2VlIHNvbWUgdXNlLWNhc2VzIHRoYXQgbWlnaHQgaGF2 ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJTQSwgRUMgfSBhbmQgdGhlICZxdW90O011c3QtVmVy aWZ5LUFsbCZxdW90OyBPSUQgZm9yIHRoZSBzaWduYXR1cmUsIGFuZCBhbm90aGVyIHVzZS1jYXNl IHdoZXJlIHdlIGhhdmUgYSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEhBU0gtQkFTRUQgfSBh bmQgZm9yIHRoZSBzaWduYXR1cmUgJnF1b3Q7TXVzdC1WZXJpZnktQXQtTGVhc3QtT25lJnF1b3Q7 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIGxhbmc9IkVOLUdCIj5Eb2VzIHRoaXMg bWFrZSBzZW5zZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+ Q2hlZXJzLDxicj4NCk1heDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPk9uIDkvMTIvMTggNjox MiBBTSwgUnVzcyBIb3VzbGV5IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+TWF4OiA8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+RHVyaW5nIGEgdHJhbnNpdGlv biB0byBxdWFudHVtLXJlc2lzdGFudCBzaWduYXR1cmVzLCBhIHNpZ25lciB3YW50cyB0byBwdXQg YSB0cmFkaXRpb25hbCBzaWduYXR1cmUgYW5kIGEgcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJl IG9uIGFuIG9iamVjdC4gJm5ic3A7R2l2ZW4geW91ciBkZXNjcmlwdGlvbiBvZiZuYnNwO2tleVVz YWdlIGFuZCBleHRlbmRlZEtleVVzYWdlLCBib3RoIHdvdWxkIGhhdmUNCiB0aGUgZGlnaXRhbFNp Z25hdHVyZSBiaXQgc2V0LiAmbmJzcDtIb3cgZG9lcyBhIGNsaWVudCBrbm93IGlmIGp1c3Qgb25l IG9yIGJvdGggc2lnbmF0dXJlcyBtdXN0IGJlIHZhbGlkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+QXMgSmltIFNjaGFhZCBhbHJlYWR5IHNhaWQsIFJG QyZuYnNwOzU3NTIgdGFsa3MgYWJvdXQgdGhpcyBpc3N1ZSB3aGVuIGEgQ01TIFNpZ25lZERhdGEg Y29udGFpbnMgbW9yZSB0aGFuIG9uZSBTaWduZXJJbmZvLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+UnVzczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiPk9uIFNlcCAxMSwgMjAxOCwgYXQgNDo0NSBQTSwgTWF4IFBhbGEgJmx0OzxhIGhy ZWY9Im1haWx0bzpNLlBhbGFAY2FibGVsYWJzLmNvbSI+TS5QYWxhQGNhYmxlbGFicy5jb208L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5IaSBBbGwsDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIGFtIHdvcmtpbmcgb24gYSBzaW1pbGFyIC0gYnV0 IGRpZmZlcmVudCAtIHNvbHV0aW9uLCBpbiBwYXJ0aWN1bGFyIEkgc29sdmUgdGhlIGlzc3VlIG9m IChhKSBiZWluZyBhYmxlIHRvIGNvbWJpbmUgbW9yZSB0aGFuIG9uZSBwdWJsaWMga2V5LCAoYikg b25seSBvbmUgKGFjdHVhbGx5DQogdHdvKSBPSURzIHJlcXVpcmVkLCBhbmQgKGMpIHNpbXBseSB0 aGUgcHJvY2Vzc2luZyBieSByZS11dGlsaXppbmcgdGhlIHNhbWUgZGF0YSBzdHJ1Y3R1cmVzIHdl IGhhdmUgdG9kYXkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIHBhcnRpY3VsYXIsIEkgZGVmaW5lIGEg4oCc Y29tcG9zaXRlIHB1YmxpYyBrZXnigJ0gYW5kIOKAnGNvbXBvc2l0ZSBzaWduYXR1cmXigJ0uPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5UaGUgZmlyc3Qgb25lIGVuY29kZXMgaW4gdGhlIGtleSB2YWx1ZeKAmXMg QklUU1RSSU5HIHRoZSBERVIgdmFsdWUgb2YgdGhlIFNFUVVFTkNFIG9mIHB1YmxpYyBrZXlzIChl YWNoIG9mIHdoaWNoIGlzIGEgdGhlIHN1YmplY3RQdWJsaWNLZXlJbmZvIHN0cnVjdHVyZSkgYW5k IHVzZXMNCiBhIHNwZWNpZmljIE9JRCB0aGF0IGlkZW50aWZpZXMgdGhlIHB1YmxpYyBrZXkgdHlw ZS4gVGhlIHBhcmFtZXRlcnMgb2YgdGhlIGNvbXBvc2l0ZUtleSBhbGdvcml0aG0gY2FuIGJlIHVz ZWQgdG8gZW5jb2RlIHRoZSBrZXlVc2FnZSBhbmQgdGhlIGV4dGVuZGVkS2V5VXNhZ2UgZm9yIGVh Y2ggb2YgdGhlIGtleXMgaW4gdGhlIGNvbXBvc2l0ZSBrZXkuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGUg c2FtZSBhcHByb2FjaCBpcyB1c2VkIGZvciB0aGUg4oCcQ29tcG9zaXRlIFNpZ25hdHVyZeKAnSBj YXNlIHdoZXJlIHRoZSB2YWx1ZSBvZiB0aGUgc2lnbmF0dXJlIGlzIHRoZSBERVIgcmVwcmVzZW50 YXRpb24gb2YgdGhlIFNFUVVFTkNFIG9mIHNpZ25hdHVyZXMgbWFkZSB3aXRoDQogZWFjaCBvZiB0 aGUga2V5cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFzIHNvb24gYXMgSSBoYXZlIHNvbWUgc3BhcmUgdGlt ZSwgSSB3aWxsIHN1Ym1pdCB0aGUgZHJhZnQgLSBtYXliZSB0aGlzIGNvdWxkIGJlIGRpc2N1c3Nl ZCBpbiBCYW5na29rPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhpcyBzaW1wbGUgaWRlYSBhbGxvd3MgdXMg dG8gaGF2ZSBhbGwgdGhlIG90aGVyIHByb2NlZHVyZXMgcmVsYXRlZCB0byBQS0lzIHdvcmsgLSB0 aGlzIG1lYW5zIHdlIGNhbiBjb21iaW5lIEVDQyB3aXRoIFJTQSBvciB3aXRoIGEgUXVhbnR1bS1S ZXNpc3RhbnQgYWxnb3JpdGhtDQogKHdoZW4gZmluYWxseSBhdmFpbGFibGUgYW5kIHN0YW5kYXJk aXplZCkuIEEgc3RlcCBmb3J3YXJkIGZvciB0aGUgZGVwbG95bWVudCBvZiBoeWJyaWQtUEtJcyB3 aGVyZSBtdWx0aXBsZSBMYWdvcyBmb3Iga2V5cyBjYW4gYmUgdXNlZCB0byBhdXRoZW50aWNhdGUg ZGF0YSwgY2VydHMsIHJldm9jYXRpb24gZGF0YSwgZXRjLi4uIHdlIHBsYW4gdG8gdXNlIHRoaXMg aW4gb3VyIGluZnJhc3RydWN0dXJlcyB0byBwcm92aWRlIGEgdHJhbnNpdGlvbmFsDQogcGF0aCBm b3IgcG9zdC1RdWFudHVtIHRyYW5zaXRpb24gYW5kIHRvIGZ1cnRoZXIgaW1wcm92ZSB0aGUgYWxn b3JpdGhtLWFnaWxpdHkgY2FwYWJpbGl0eSBvZiBQS0lzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+V2hhdCBk byB5b3UgdGhpbms/PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycywNCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+TWF4PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPi0tLQ0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+Q2hlZXJzLA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5NYXg8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5P biBTZXAgMTEsIDIwMTgsIGF0IDg6MzggQU0sIFRpbSBIb2xsZWJlZWsgJmx0OzxhIGhyZWY9Im1h aWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb208L3NwYW4+PC9hPiZndDsNCiB3cm90ZTo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5VbmZvcnR1bmF0ZWx5LCDigJxu b3QgZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZOKAnSBpbnRyb2R1Y2VzIGEg bG90IG9mIHBvbGl0aWNzIGFyb3VuZCBjaG9vc2luZyB3aGljaCBjb21iaW5hdGlvbnMg4oCcbmVl ZCB0byBiZSBjb3ZlcmVk4oCdLCBhIHN1YmplY3Qgb24gd2hpY2gNCiBpbmV2aXRhYmx5IG5vdCBl dmVyeW9uZSBhZ3JlZXMuJm5ic3A7IEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNj dXNzaW9ucyBhbmQgdGhlIHVubmVjZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+SSBwZXJzb25hbGx5IGRvbuKAmXQgdGhpbmsgYSBzaW5nbGUgQWxnSUQgd2hpY2ggaW1w bGllcyBhIFNFUVVFTkNFIG9mIEFMRyBJRHMgaXMgYW4gaW1wcm92ZW1lbnQgb3ZlciBhIFNFUVVF TkNFIG9mIEFMRyBJRHMsIG9yIGl0cyBtb3JhbCBlcXVpdmFsZW50LiZuYnNwOyBGb3Igc2ltcGxl DQogaHlicmlkIHVzZSBjYXNlcywgdGhlcmUgaXMgYWxzbyBhIGxvdCBvZiB2YWx1ZSBpbiBoYXZp bmcgdGhlIGNsYXNzaWNhbCBhbGdvcml0aG0gSUQgYmVpbmcgdGhlIHNhbWUgYXMgaXQgdXN1YWxs eSBpcywgdG8gYWxsb3cgZWFzaWVyIGludGVyb3BlcmFiaWxpdHkgd2l0aCBvbGRlciBzeXN0ZW1z IHRoYXQgZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBuZXdlciBhbGdvcml0aG1zIChhbmQgY2FuIGJs aXNzZnVsbHkgaWdub3JlIHRoZW0pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi1UaW08bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxh bmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNhbnRvc2gNCiBDaG9raGFuaSAmbHQ7PGEgaHJlZj0ibWFp bHRvOnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5zYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8Yj5TZW50OjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VHVlc2RheSwgU2Vw dGVtYmVyIDExLCAyMDE4IDEwOjI5IEFNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UaW0gSG9sbGViZWVrICZsdDs8YSBocmVm PSJtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPC9zcGFuPjwvYT4mZ3Q7OyAnRXJpayBB bmRlcnNlbicgJmx0OzxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPiZndDs7DQogJ1NQQVNNJyAmbHQ7PGEg aHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5z cGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlz dHMub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3Rz Lm9yZzwvc3Bhbj48L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJFOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmtzIFRpbS48 L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5UaGVyZSBhcmUgd2F5cyB0byBhY2NvbW1vZGF0ZSB5b3VyIGNvbmNlcm4uPC9zcGFuPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T25lIHdheSB0 byBoYW5kbGUgdGhpcyBpcyBkZWZpbmluZyBhIHNpbmdsZSBBbGcgSUQgQSB3aGljaCBpbXBsaWVz IGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBhbmQgZGVmaW5lIHRoZSByZWx5aW5nIHBhcnR5IHJ1bGVz IGluIHRlcm1zIG9mIGl0cyBhYmlsaXR5DQogdG8gcHJvY2VzcyBvbmUgb3IgYWxsIEFMRyBJRHMu PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+QW5vdGhlciB3YXkgdG8gZG8gdGhpcyBpcyBub3QgZXZlcnkgY29tYmluYXRpb24gbmVlZHMg dG8gYmUgY292ZXJlZCBhbmQgdGhlIHVzZXIgY29tbXVuaXR5IGRlZmluZXMgaXRzIG93biAmbmJz cDtBbGcgSUQgWGkgd2hpY2ggbWFwcyB0byBhIFNFUVVFTkNFIG9mDQogQUxHIElEcy48L3NwYW4+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNwYXNtDQogWzxhIGhyZWY9Im1h aWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5t YWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlRpbSBIb2xsZWJlZWs8 YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+VHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDEwOjAzIEFNPGJyPg0KPGI+VG86 PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Fcmlr IEFuZGVyc2VuICZsdDs8YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9zcGFuPjwvYT4mZ3Q7OyAnU1BBU00nICZsdDs8YSBo cmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnNw YXNtQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0 cy5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMu b3JnPC9zcGFuPjwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RG9lc27igJl0IHRoZSBjb21iaW5hdG9yaWMg ZXhwbG9zaW9uIHJlbmRlciB0aGlzIGNvbXBsZXRlbHkgaW1wcmFjdGljYWw/PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+WW91IG5lZWQgTl9jIHggTl9wcSBhbGdvcml0aG0gaWRlbnRpZmllcnMganVzdCB0byBoYW5k bGUgdGhlIHNpbXBsZSBoeWJyaWQgdXNlIGNhc2Ugd2hlcmUgYSBzaW5nbGUgY2xhc3NpY2FsIGFs Z29yaXRobSBpcyBiZWluZyB1c2VkIGluIGNvbmp1bmN0aW9uIHdpdGggYSBzaW5nbGUNCiBwb3N0 LXF1YW50dW0gYWxnb3JpdGhtLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZCB0aGVyZSBhcmUgcGVvcGxlIHdo byB3YW50IHRvIHVzZSBtdWx0aXBsZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcyB0byBoZWRnZSBh Z2FpbnN0IHBvdGVudGlhbCB5ZXQgdG8gYmUgZGlzY292ZXJlZCB3ZWFrbmVzc2VzIGluIHBvc3Qt cXVhbnR1bSBhbGdvcml0aG1zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPknigJltIG5vdCByZWFsbHkgbG9va2lu ZyBmb3J3YXJkIHRvIHRyeWluZyB0byBhbGxvY2F0ZSBvciBtYW5hZ2UgTyhOX2MgeCBOX3BxXjMp IGFsZ29yaXRobSBpZGVudGlmaWVyc+KApjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi1UaW08bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFk ZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNwYXNtDQogJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFz bS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5zcGFzbS1ib3Vu Y2VzQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+RXJpayBBbmRlcnNlbjxicj4NCjxiPlNlbnQ6 PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UdWVz ZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMzoxMCBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+J1NQQVNNJyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5zcGFz bUBpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMu b3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9y Zzwvc3Bhbj48L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgU2FudG9zaCw8L3Nw YW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Z b3UgaGF2ZSBwcm9wb3NlZCBzb21ldGhpbmcgbGlrZSB0aGlzIGJlZm9yZS4gSXQgc3RpbGwgcHV6 emxpbmcgaW4gbXkgYnJhaW4uIEFzIEkgdW5kZXJzdGFuZCwgaXQgcmVxdWlyZXMgdGhhdCB3ZSBk ZWZpbmUgYSBwYXJ0aWN1bGFyIGFsZ29yaXRobSB0aGF0DQogaGFzIGEgcGFyYW1ldGVyIHRoYXQg aW5jbHVkZXMgdGhlIHRoaW5ncyB5b3Ugc3VnZ2VzdC4gSXQgaXMgd29ydGh5IHRvIGJlIGFuYWx5 c2VkLjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkVyaWs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyYTo8L3NwYW4+PC9iPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20NCiBbPGEg aHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPm1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT5dPHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPlDDpSB2ZWduZSBhZjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+U2FudG9z aCBDaG9raGFuaTxicj4NCjxiPlNlbmR0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+MTAgU2VwdGVtYmVyIDIwMTggMTk6MTg8YnI+DQo8Yj5UaWw6 PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nSmlt IFNjaGFhZCcgJmx0OzxhIGhyZWY9Im1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5pZXRmQGF1Z3VzdGNlbGxhcnMuY29tPC9zcGFuPjwvYT4m Z3Q7OyAnUnlhbiBTbGVldmknICZsdDs8YSBocmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5j b20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJ5YW4taWV0ZkBzbGVldmkuY29tPC9zcGFu PjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPidTUEFTTScgJmx0OzxhIGhyZWY9Im1haWx0 bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5v cmc8L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+ PC9hPjxicj4NCjxiPkVtbmU6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwvc3Bhbj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5XaHkgbm90IGxldCBhbGdvcml0aG0gaWRlbnRpZmllciBkaWN0YXRlIHRoZSBu dW1iZXIgb2Ygc2lnbmF0dXJlcyBhbmQgdGhlaXIgc3ludGF4Pzwvc3Bhbj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20NCiBbPGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJv dW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1haWx0bzpzcGFzbS1i b3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT5dPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+SmltIFNjaGFhZDxicj4NCjxiPlNlbnQ6PC9i PjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Nb25kYXks IFNlcHRlbWJlciAxMCwgMjAxOCAxOjA3IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nUnlhbiBTbGVldmknICZsdDs8YSBo cmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPnJ5YW4taWV0ZkBzbGVldmkuY29tPC9zcGFuPjwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAu ZXUiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48YnI+ DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPidTUEFTTScgJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs7PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4 NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eDUw MHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBz XSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SeWFuLDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPlRoZSBkaXNjdXNzaW9uIGluIExvbmRvbiBkZWFsdCB3aXRoIGEgY29tcGxl dGVseSBkaWZmZXJlbnQgcHJvcG9zYWwgdGhhbiB0aGlzIG9uZS4mbmJzcDsgV2hpbGUgSSB0aGlu ayB0aGVyZSBhcmUgcHJvYmxlbXMgd2l0aCB0aGlzIHRoYXQgbmVlZCB0byBiZSBkZWFsdCB3aXRo IHRoZXkNCiBhcmUgbW9zdGx5IG5vdCB0aGUgc2FtZSBzZXQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RXJpayw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5XaHkgaXMgdGhpcyBjb25zaWRlcmVkIHRvIGJlIGEgcHJlZmVycmVkIHNv bHV0aW9uIHRvIGRlZmluaW5nIGEgbmV3IHNpZ25hdHVyZSBhbGdvcml0aG0gd2hpY2ggY29udGFp bnMgYXMgdGhlIHBhcmFtZXRlciB0aGUgc2VxdWVuY2Ugb2YgYWxnb3JpdGhtIGlkZW50aWZpZXJz IGFuZA0KIGFzIHRoZSBzaWduYXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1cmUgdmFs dWVzLiZuYnNwOyBUaGUgcHJvYmxlbSB3aXRoIGp1c3QgZGVmaW5pbmcgdGhlIGV4dGVuc2lvbiB0 byBTSUdORUQgaXMgdGhhdCBvbmUgbmVlZHMgdG8gbWFrZSBzdXJlIHRoYXQgdGhlIHNldCBvZiBz aWduYXR1cmUgYWxnb3JpdGhtcyBhbmQgcGFyYW1ldGVycyBhcmUgYWxzbyBwYXJ0IG9mIHRoZSBk YXRhIHRvIGJlIHNpZ25lZCBhbmQgSSBhbSBub3Qgc2VlaW5nIHRoYXQNCiBoaWdobGlnaHRlZCBo ZXJlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkppbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbjtib3JkZXItdG9wLWNvbG9yOnJnYigyMjUsIDIyNSwNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDIyNSkiPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwv Yj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPlNwYXNtDQogJmx0OzxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5zcGFzbS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwv YT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxi Pk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48L2I+UnlhbiBTbGVldmk8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TW9uZGF5LCBTZXB0ZW1iZXIgMTAsIDIwMTgg ODo1MyBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PGJyPg0KPGI+Q2M6PC9iPjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5TUEFTTSAmbHQ7PGEg aHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5z cGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlz dHMub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3Rz Lm9yZzwvc3Bhbj48L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk9u IE1vbiwgU2VwIDEwLCAyMDE4IGF0IDEwOjU2IEFNIEVyaWsgQW5kZXJzZW4gJmx0OzxhIGhyZWY9 Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZXJhQHg1MDAu ZXU8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCB3 aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44 cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1Li4wcHQ7Ym9yZGVyLWxlZnQtY29sb3I6cmdiKDIwNCwgMjA0LA0KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDIwNCkiPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SGkgRm9sayw8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkluIElUVS1UIHdlIGhhdmUgcGxh bnMgdG8gYWxsb3cgZm9yIGRvdWJsZSBzaWduYXR1cmVzIHVzaW5nIHRoZSBTSUdORUQgcGFyYW1l dHJpemVkIGRhdGEgdHlwZSBkZWZpbmVkIGluIFguNTA5IHRvIGNvcGUgd2l0aCBzaXR1YXRpb24g YXMgZGVzY3JpYmVkIGluIHRoZSBpbnRlcm5ldA0KIGRyYWZ0OiDigJxNdWx0aXBsZSBQdWJsaWMt S2V5IEFsZ29yaXRobSBYLjUwOSBDZXJ0aWZpY2F0ZXMgKGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMt cHEtaHlicmlkLXg1MDktMDEp4oCdPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2Ugc3VnZ2VzdCB0byBlbmhhbmNl IHRoZSBTSUdORUQgZGF0YSB0eXBlIGFzIHNob3duIGJlbG93OjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij5TSUdORUR7 VG9CZVNpZ25lZH0gOjo9IFNFUVVFTkNFIHs8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij4mbmJzcDsgQ09NUE9ORU5U UyBPRiBTSUdOQVRVUkUsPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90OyI+Jm5ic3A7IC4uLi4uLi48L3NwYW4+PC9iPjxi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7O2NvbG9yOiNDMDAwMDAiPiw8L3NwYW4+PC9iPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7IGNvbG9yXDog cmVkJnF1b3Q7Ij4mbmJzcDsgYWx0QWxnb3JpdGhtSWRlbnRpZmllciZuYnNwOyBBbGdvcml0aG1J ZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0gT1BUSU9OQUwsPC9zcGFuPjwvYj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyBjb2xvclw6 IHJlZCZxdW90OyI+Jm5ic3A7IGFsdFNpZ25hdHVyZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBCSVQgU1RSSU5HIE9QVElP TkFMJm5ic3A7PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyBcOyBjb2xvclw6IHJlZCZxdW90OyI+Jm5ic3A7Jm5ic3A7PC9zcGFuPjwv Yj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90OyI+fTwvc3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDs7Y29sb3I6cmVk Ij4mbmJzcDs8L3NwYW4+PC9iPjwvc3Bhbj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90Oztjb2xv cjpyZWQiPihXSVRIDQogQ09NUE9ORU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBS RVNFTlQsIGFsdFNpZ25hdHVyZSBQUkVTRU5UIH0gfDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsgY29sb3JcOiByZWQmcXVvdDsi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBXSVRIIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3Jp dGhtSWRlbnRpZmllciBBQlNFTlQsJm5ic3A7IGFsdFNpZ25hdHVyZSBBQlNFTlQgfSApPC9zcGFu PjwvYj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBc OyZxdW90OyI+Jm5ic3A7PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5XZSBhcmUgb3BlbiB0byBjb21tZW50cy4g V2Uga25vdyB0aGF0IElFVEYgaXMgbm90IGEgaGVhdnkgdXNlciBvZiB0aGlzIGRhdGEgdHlwZS48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5XZSBoYXZlIG5vIGludGVudGlvbiB0byB1c2UgdGhpcyBleHRlbmRlZCBk YXRhIHR5cGUgZm9yIGNlcnRpZmljYXRlcyBhbmQgQ1JMcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gb3IgeW91 ciBpbmZvcm1hdGlvbiwgU0lHTkFUVVJFIGlzIGRlZmluZWQgYXM6PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPlNJR05B VFVSRSA6Oj0gU0VRVUVOQ0Ugezwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyBhbGdvcml0aG1JZGVudGlm aWVyJm5ic3A7IEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSw8L3Nw YW4+PC9iPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 IFw7JnF1b3Q7Ij4mbmJzcDsgc2lnbmF0dXJlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJJVCBTVFJJTkcsPC9zcGFuPjwv Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyZx dW90OyI+Jm5ic3A7IC4uLi4uLi4gfTwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSksIHRo ZXJlIHdlcmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUgZGlz Y3Vzc2lvbiAtJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0 aW5nLzEwMS9tYXRlcmlhbHMvbWludXRlcy0xMDEtbGFtcHMtMDEudHh0Ij48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTAxL21h dGVyaWFscy9taW51dGVzLTEwMS1sYW1wcy0wMS50eHQ8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tDQogdGhhdCBmdW5kYW1lbnRhbGx5 IHF1ZXN0aW9uZWQgdGhhdCBhcHByb2FjaC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5IYXMgdGhlIElUVS1UIGFkZHJlc3NlZCBvciByZXNvbHZlZCB0aG9zZSBj b25jZXJucz8gQXJlIHRoZXkgbm90IGFwcGxpY2FibGUgZm9yIHNvbWUgcmVhc29uIHNwZWNpZmlj IHRvIElUVS1UPyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnI+DQpTcGFzbSBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PHNwYW4g bGFuZz0iRU4tR0IiPjxhIGhyZWY9Im1haWx0bzpTcGFzbUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpwdXJwbGUiPlNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT48L3NwYW4+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+ PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zcGFzbSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Bhc208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiPi0tIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9Im1hcmdp bi10b3A6Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkJl c3QgUmVnYXJkcywgPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWJv dHRvbTo3LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+TWFz c2ltaWxpYW5vIFBhbGEsIFBoLkQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PGltZyBib3JkZXI9IjAiIHdpZHRo PSIxMjAiIGhlaWdodD0iMTgiIGlkPSJfeDAwMDBfaTEwMjUiIHNyYz0iY2lkOmltYWdlMDAxLnBu Z0AwMUQ0NTBDMy5BNzA2QzJGMCIgYWx0PSJDYWJsZUxhYnMiPjxicj4NClByaW5jaXBhbCBBcmNo aXRlY3Q8YnI+DQpTZWN1cml0eSBTZXJ2aWNlcywgUiZhbXA7RDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_-- --_004_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=1892; creation-date="Thu, 20 Sep 2018 13:26:25 GMT"; modification-date="Thu, 20 Sep 2018 13:26:25 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= --_004_9c5c57bdbd9b4fe4aee5040f319f46a2XCHALN010ciscocom_-- From nobody Thu Sep 20 10:35:57 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 348A6130DE6 for ; Thu, 20 Sep 2018 10:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GCzqt9GPwm8K for ; Thu, 20 Sep 2018 10:35:49 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91442130E3D for ; Thu, 20 Sep 2018 10:35:47 -0700 (PDT) Received: from Jude (192.168.1.157) by mail2.augustcellars.com (192.168.1.201) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 20 Sep 2018 10:31:40 -0700 From: Jim Schaad To: "'Panos Kampanakis (pkampana)'" , 'Massimiliano Pala' CC: 'SPASM' , 'Directory list' , 'Erik Andersen' References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> In-Reply-To: <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> Date: Thu, 20 Sep 2018 10:35:37 -0700 Message-ID: <00d601d45108$59dfbb90$0d9f32b0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_00D7_01D450CD.AD848D10" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheAIUS8OeAbwv1UoDDno9LKWE1xWg X-Originating-IP: [192.168.1.157] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2018 17:35:55 -0000 ------=_NextPart_000_00D7_01D450CD.AD848D10 Content-Type: multipart/alternative; boundary="----=_NextPart_001_00D8_01D450CD.AD848D10" ------=_NextPart_001_00D8_01D450CD.AD848D10 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Panos, =20 The same would be true if you extended the structure to have two = signatures in it as is proposed in the SIGNED macro below. Systems = which can only parse a single signature there would be unable to use = objects which had both signatures in that location. This is one of the = reasons that it is stated that there is no plan to use this for = Certificates and CRLs at this time. =20 jim =20 From: Spasm On Behalf Of Panos Kampanakis = (pkampana) Sent: Thursday, September 20, 2018 6:26 AM To: Massimiliano Pala Cc: 'SPASM' ; Directory list = ; Erik Andersen Subject: Re: [lamps] Double signatures =20 Hi Max, To rephrase Eric=E2=80=99s question, would the CompositeKey+CompositeSig = proposal be backwards compatible with existing systems? I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, right? Panos =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Erik Andersen Sent: Friday, September 14, 2018 11:49 AM To: 'SPASM' >; Directory list = > Subject: Re: [lamps] Double signatures =20 The double signature is intended as a migration tool. =20 In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle it. = Legacy systems will ignore this alternative signature. After the = migration period, there will be no alternative signature and the new = stronger signature will be the native signature. =20 Does that make sense? =20 Erik =20 Fra: Massimiliano Pala [mailto:m.pala@cablelabs.com]=20 Sendt: 12 September 2018 23:01 Til: Russ Housley > Cc: SPASM >; Erik Andersen = > Emne: Re: [lamps] Double signatures =20 Hi Russ, all, my personal position is that the signer MUST use all the keys that have = digitalSignature set, the verifier shall verify all the signatures for = which it does have support for. The rationale for this is that if I certify a public key in the = certificate, you should be able to use the private key to generate the = signature, therefore the approach is the same as usual: sign with your = key. In this case, it just happens that to generate the signature you = have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a = question of what is the threshold that is acceptable for the application = (in terms of risk) in case it does not support all of the algorithms = that are used to generate the composite signature. Ideally it would = verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could = be a good idea - the use of the two OIDs is another way to go to codify = the validation process required. Technically, that makes sense to me, = however I am conflicted as this approach requires that the signer has an = understanding of what the verifier's capabilities are... I think that = defining two OIDs for the signatures could still be useful because the = signer might then decide the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the signature, and = another use-case where we have a composite key with { RSA, HASH-BASED } = and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max =20 On 9/12/18 6:12 AM, Russ Housley wrote: Max:=20 =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 =20 On Sep 11, 2018, at 4:45 PM, Max Pala > wrote: =20 Hi All,=20 =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers,=20 Max =20 =20 ---=20 =20 Cheers,=20 Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ......., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ....... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 =20 --=20 Best Regards,=20 Massimiliano Pala, Ph.D. Principal Architect Security Services, R&D ------=_NextPart_001_00D8_01D450CD.AD848D10 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Panos,

 

The same would be true if you extended the structure to have two = signatures in it as is proposed in the SIGNED macro below.=C2=A0 Systems = which can only parse a single signature there would be unable to use = objects which had both signatures in that location.=C2=A0 This is one of = the reasons that it is stated that there is no plan to use this for = Certificates and CRLs at this time.

 

jim

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Panos = Kampanakis (pkampana)
Sent: Thursday, September 20, 2018 6:26 = AM
To: Massimiliano Pala = <m.pala@cablelabs.com>
Cc: 'SPASM' = <spasm@ietf.org>; Directory list = <x500standard@freelists.org>; Erik Andersen = <era@x500.eu>
Subject: Re: [lamps] Double = signatures

 

Hi Max,

To rephrase Eric=E2=80=99s question, would the = CompositeKey+CompositeSig proposal be backwards compatible with existing = systems?

I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, = right?

Panos

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Erik Andersen
Sent: Friday, September 14, = 2018 11:49 AM
To: 'SPASM' <spasm@ietf.org>; Directory list = <x500standard@freelists.org= >
Subject: Re: [lamps] Double = signatures

 

The double signature is intended as a migration = tool.

 

In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle = it.  Legacy systems will ignore this alternative signature. After = the migration period, there will be no alternative signature and the new = stronger signature will be the native signature.

 

Does that make sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala@cablelabs.com] =
Sendt: 12 September 2018 23:01
Til: Russ Housley = <housley@vigilsec.com>
C= c: SPASM <spasm@ietf.org>; Erik Andersen = <era@x500.eu>
Emne: = Re: [lamps] Double signatures

 

Hi Russ, = all,

my personal position is = that the signer MUST use all the keys that have digitalSignature set, = the verifier shall verify all the signatures for which it does have = support for.

The rationale = for this is that if I certify a public key in the certificate, you = should be able to use the private key to generate the signature, = therefore the approach is the same as usual: sign with your key. In this = case, it just happens that to generate the signature you have to = generate multiple ones and then combine them = together.

For the application = that verifies those signatures, it is always a question of what is the = threshold that is acceptable for the application (in terms of risk) in = case it does not support all of the algorithms that are used to generate = the composite signature. Ideally it would verify all, but it may decide = to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I = think it could be a good idea - the use of the two OIDs is another way = to go to codify the validation process required. Technically, that makes = sense to me, however I am conflicted as this approach requires that the = signer has an understanding of what the verifier's capabilities are... I = think that defining two OIDs for the signatures could still be useful = because the signer might then decide the = "recommended"/"intended" verification behavior... I = can see some use-cases that might have a composite key with { RSA, EC } = and the "Must-Verify-All" OID for the signature, and another = use-case where we have a composite key with { RSA, HASH-BASED } and for = the signature = "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max

 

On 9/12/18 6:12 AM, Russ Housley = wrote:

Max: =

 

During a transition to = quantum-resistant signatures, a signer wants to put a traditional = signature and a quantum-resistant signature on an object.  Given = your description of keyUsage and extendedKeyUsage, both would have = the digitalSignature bit set.  How does a client know if just one = or both signatures must be valid?

 

As Jim Schaad already said, = RFC 5752 talks about this issue when a CMS SignedData contains more = than one SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max = Pala <M.Pala@cablelabs.com> = wrote:

 

Hi All, =

 <= /o:p>

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 <= /o:p>

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 <= /o:p>

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 <= /o:p>

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 <= /o:p>

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 <= /o:p>

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 <= /o:p>

What do you = think?

 <= /o:p>

Cheers, =

Max

 <= /o:p>

 <= /o:p>

--- =

 <= /o:p>

Cheers, =

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately= , =E2=80=9Cnot every combination needs to be covered=E2=80=9D introduces = a lot of politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.

 

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 

-Tim

 

From:<= /b> = Santosh = Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik = Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 

Thanks Tim.

 

There are ways to accommodate your concern.

 

One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs.

 

Another way to do this is not every combination needs to be covered and = the user community defines its own  Alg ID Xi which maps to a = SEQUENCE of ALG IDs.

 

From:<= /b> = Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Doesn=E2=80=99= t the combinatoric explosion render this completely = impractical?

 

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 

I=E2=80=99m = not really looking forward to trying to allocate or manage O(N_c x = N_pq^3) algorithm = identifiers=E2=80=A6

 

-Tim

 

From:<= /b> = Spasm <spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed.

 

Erik

 

Fra: = Spasm [mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; 'Ryan = Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 

Why not let algorithm identifier dictate the number of signatures and = their syntax?

 

From:<= /b> = Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

Ryan,

 

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same = set.

 

Erik,

 

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 

Jim

 

 

From:<= /b> = Spasm <spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 

 

On Mon, Sep = 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> = wrote:

Hi = Folk,

 =

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 

We suggest = to enhance the SIGNED data type as shown = below:

 

SIGNED{ToBeSigned} ::=3D SEQUENCE {

  COMPONENTS = OF SIGNATURE,

  = .......,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH = COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 

We have no = intention to use this extended data type for certificates and = CRLs.

 

For your = information, SIGNATURE is defined as:

 

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ....... = }

 

From the = discussions in London (101), there were a number of challenges = identified during the discussion - https://datatracker.ietf.org/meeting/101/materials= /minutes-101-lamps-01.txt - that fundamentally = questioned that approach.

 

Has the = ITU-T addressed or resolved those concerns? Are they not applicable for = some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing = list
Spasm@ietf.org
<= span lang=3DEN-GB>https://www.ietf.org/mailman/listinfo/spasm=

 

 

--

Best = Regards,

Massimiliano Pala, = Ph.D.

3DCableLabs
Principal = Architect
Security Services, = R&D

------=_NextPart_001_00D8_01D450CD.AD848D10-- ------=_NextPart_000_00D7_01D450CD.AD848D10 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= ------=_NextPart_000_00D7_01D450CD.AD848D10-- From nobody Thu Sep 20 10:44:47 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27DE7130DE9 for ; Thu, 20 Sep 2018 10:44:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.88 X-Spam-Level: X-Spam-Status: No, score=-1.88 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_HK_NAME_DR=0.01, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wgym7VD6mToU for ; Thu, 20 Sep 2018 10:44:40 -0700 (PDT) Received: from mail.katezarealty.com (mail.katezarealty.com [104.168.158.213]) by ietfa.amsl.com (Postfix) with ESMTP id DA18B12426A for ; Thu, 20 Sep 2018 10:44:39 -0700 (PDT) Received: from localhost (unknown [127.0.0.1]) by mail.katezarealty.com (Postfix) with ESMTP id A58593741042 for ; Thu, 20 Sep 2018 17:44:39 +0000 (UTC) X-Virus-Scanned: amavisd-new at katezarealty.com Received: from mail.katezarealty.com ([127.0.0.1]) by localhost (mail.katezarealty.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id HMPS79t13-y8 for ; Thu, 20 Sep 2018 13:44:25 -0400 (EDT) Received: from Maxs-MBP.cablelabs.com (unknown [192.160.73.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.katezarealty.com (Postfix) with ESMTPSA id 0B55937404AB for ; Thu, 20 Sep 2018 13:44:25 -0400 (EDT) To: spasm@ietf.org References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> From: "Dr. Pala" Message-ID: <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> Date: Thu, 20 Sep 2018 11:44:22 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> Content-Type: multipart/alternative; boundary="------------999C640EE5E7C12534D43CC4" Content-Language: en-US Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2018 17:44:45 -0000 This is a multi-part message in MIME format. --------------999C640EE5E7C12534D43CC4 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Panos, all, that is correct - since the new OIDs for the Key and the Signatures would be new, clients would fail since they do not know the "composite" algorithm :D Although developing support for it should not be too difficult, the solution it is not meant to be backward compatible as we want applications to be able to fail if they do not even know they were supposed to generate or verify multiple signatures instead of just one. From a usage perspective, I am leaning towards the need for the owner of the certificates to generate signatures with all the keys, and for the entity that validates the signatures it should validate all the signatures it supports and may accept signatures even if it does not understand all the algorithms (this is more an application decision based on the risk and threat model). As I said, this solution fits not only certificates, but also OCSP responses, CRLs, CMS, PKCS#7, etc. and that is part of what is interesting for us :D I still need to check what are the needed changes for other formats like PKCS#1/#8/#12 for storing the composite public and private keys (this part still missing), but I hope that solving that part will not be too difficult... Cheers, Max On 9/20/18 7:26 AM, Panos Kampanakis (pkampana) wrote: > > Hi Max, > > To rephrase Eric’s question, would the CompositeKey+CompositeSig > proposal be backwards compatible with existing systems? > > I mean it gives you the change to use more than one algos in case you > don’t trust all of them. But an old client wouldn’t be able to just > use the traditional key+sig unless he was upgraded to understand > CompositeKey+CompositeSig and its OIDs, right? > > Panos > > *From:*Spasm [mailto:spasm-bounces@ietf.org] *On Behalf Of *Erik Andersen > *Sent:* Friday, September 14, 2018 11:49 AM > *To:* 'SPASM' ; Directory list > > *Subject:* Re: [lamps] Double signatures > > The double signature is intended as a migration tool. > > In the normal operation, only one signature is used (the native > signature). When it is realized that the signature algorithm will be > too week i some future, the migration period starts and an > alternative, assuming stronger signature is provided for those able to > handle it. Legacy systems will ignore this alternative signature. > After the migration period, there will be no alternative signature and > the new stronger signature will be the native signature. > > Does that make sense? > > Erik > > *Fra:*Massimiliano Pala [mailto:m.pala@cablelabs.com] > *Sendt:* 12 September 2018 23:01 > *Til:* Russ Housley > > *Cc:* SPASM >; Erik Andersen > > > *Emne:* Re: [lamps] Double signatures > > Hi Russ, all, > > my personal position is that the signer MUST use all the keys that > have digitalSignature set, the verifier shall verify all the > signatures for which it does have support for. > > The rationale for this is that if I certify a public key in the > certificate, you should be able to use the private key to generate the > signature, therefore the approach is the same as usual: sign with your > key. In this case, it just happens that to generate the signature you > have to generate multiple ones and then combine them together. > > For the application that verifies those signatures, it is always a > question of what is the threshold that is acceptable for the > application (in terms of risk) in case it does not support all of the > algorithms that are used to generate the composite signature. Ideally > it would verify all, but it may decide to verify less (at least one). > > I also saw the other e-mail from Jim on this topic and I think it > could be a good idea - the use of the two OIDs is another way to go to > codify the validation process required. Technically, that makes sense > to me, however I am conflicted as this approach requires that the > signer has an understanding of what the verifier's capabilities are... > I think that defining two OIDs for the signatures could still be > useful because the signer might then decide the > "recommended"/"intended" verification behavior... I can see some > use-cases that might have a composite key with { RSA, EC } and the > "Must-Verify-All" OID for the signature, and another use-case where we > have a composite key with { RSA, HASH-BASED } and for the signature > "Must-Verify-At-Least-One". > > Does this make sense? > > Cheers, > Max > > On 9/12/18 6:12 AM, Russ Housley wrote: > > Max: > > During a transition to quantum-resistant signatures, a signer > wants to put a traditional signature and a quantum-resistant > signature on an object.  Given your description of keyUsage and > extendedKeyUsage, both would have the digitalSignature bit set. >  How does a client know if just one or both signatures must be valid? > > As Jim Schaad already said, RFC 5752 talks about this issue when a > CMS SignedData contains more than one SignerInfo. > > Russ > > On Sep 11, 2018, at 4:45 PM, Max Pala > wrote: > > Hi All, > > I am working on a similar - but different - solution, in > particular I solve the issue of (a) being able to combine more > than one public key, (b) only one (actually two) OIDs > required, and (c) simply the processing by re-utilizing the > same data structures we have today. > > I particular, I define a “composite public key” and “composite > signature”. > > The first one encodes in the key value’s BITSTRING the DER > value of the SEQUENCE of public keys (each of which is a the > subjectPublicKeyInfo structure) and uses a specific OID that > identifies the public key type. The parameters of the > compositeKey algorithm can be used to encode the keyUsage and > the extendedKeyUsage for each of the keys in the composite key. > > The same approach is used for the “Composite Signature” case > where the value of the signature is the DER representation of > the SEQUENCE of signatures made with each of the keys. > > As soon as I have some spare time, I will submit the draft - > maybe this could be discussed in Bangkok? > > This simple idea allows us to have all the other procedures > related to PKIs work - this means we can combine ECC with RSA > or with a Quantum-Resistant algorithm (when finally available > and standardized). A step forward for the deployment of > hybrid-PKIs where multiple Lagos for keys can be used to > authenticate data, certs, revocation data, etc... we plan to > use this in our infrastructures to provide a transitional path > for post-Quantum transition and to further improve the > algorithm-agility capability of PKIs. > > What do you think? > > Cheers, > > Max > > --- > > Cheers, > > Max > > On Sep 11, 2018, at 8:38 AM, Tim Hollebeek > > wrote: > > Unfortunately, “not every combination needs to be covered” > introduces a lot of politics around choosing which > combinations “need to be covered”, a subject on which > inevitably not everyone agrees.  I would rather avoid all > those discussions and the unnecessary work they represent. > > I personally don’t think a single AlgID which implies a > SEQUENCE of ALG IDs is an improvement over a SEQUENCE of > ALG IDs, or its moral equivalent.  For simple hybrid use > cases, there is also a lot of value in having the > classical algorithm ID being the same as it usually is, to > allow easier interoperability with older systems that > don’t understand the newer algorithms (and can blissfully > ignore them). > > -Tim > > *From:*Santosh Chokhani > > *Sent:*Tuesday, September 11, 2018 10:29 AM > *To:*Tim Hollebeek >; 'Erik Andersen' > >; 'SPASM' > >;x500standard@freelists.org > > *Subject:*RE: [lamps] Double signatures > > Thanks Tim. > > There are ways to accommodate your concern. > > One way to handle this is defining a single Alg ID A which > implies a SEQUENCE of ALG IDs and define the relying party > rules in terms of its ability to process one or all ALG IDs. > > Another way to do this is not every combination needs to > be covered and the user community defines its own  Alg ID > Xi which maps to a SEQUENCE of ALG IDs. > > *From:*Spasm [mailto:spasm-bounces@ietf.org]*On Behalf > Of*Tim Hollebeek > *Sent:*Tuesday, September 11, 2018 10:03 AM > *To:*Erik Andersen >; > 'SPASM' >;x500standard@freelists.org > > *Subject:*Re: [lamps] Double signatures > > Doesn’t the combinatoric explosion render this completely > impractical? > > You need N_c x N_pq algorithm identifiers just to handle > the simple hybrid use case where a single classical > algorithm is being used in conjunction with a single > post-quantum algorithm. > > And there are people who want to use multiple post-quantum > algorithms to hedge against potential yet to be discovered > weaknesses in post-quantum algorithms. > > I’m not really looking forward to trying to allocate or > manage O(N_c x N_pq^3) algorithm identifiers… > > -Tim > > *From:*Spasm >*On Behalf Of*Erik Andersen > *Sent:*Tuesday, September 11, 2018 3:10 AM > *To:*'SPASM' >;x500standard@freelists.org > > *Subject:*Re: [lamps] Double signatures > > Hi Santosh, > > You have proposed something like this before. It still > puzzling in my brain. As I understand, it requires that we > define a particular algorithm that has a parameter that > includes the things you suggest. It is worthy to be analysed. > > Erik > > *Fra:*Spasm [mailto:spasm-bounces@ietf.org]*På vegne > af*Santosh Chokhani > *Sendt:*10 September 2018 19:18 > *Til:*'Jim Schaad' >; 'Ryan Sleevi' > >;era@x500.eu > > *Cc:*'SPASM' >;x500standard@freelists.org > > *Emne:*Re: [lamps] Double signatures > > Why not let algorithm identifier dictate the number of > signatures and their syntax? > > *From:*Spasm [mailto:spasm-bounces@ietf.org]*On Behalf > Of*Jim Schaad > *Sent:*Monday, September 10, 2018 1:07 PM > *To:*'Ryan Sleevi' >;era@x500.eu > > *Cc:*'SPASM' >;x500standard@freelists.org > > *Subject:*Re: [lamps] Double signatures > > Ryan, > > The discussion in London dealt with a completely different > proposal than this one. While I think there are problems > with this that need to be dealt with they are mostly not > the same set. > > Erik, > > Why is this considered to be a preferred solution to > defining a new signature algorithm which contains as the > parameter the sequence of algorithm identifiers and as the > signature value a sequence of signature values.  The > problem with just defining the extension to SIGNED is that > one needs to make sure that the set of signature > algorithms and parameters are also part of the data to be > signed and I am not seeing that highlighted here. > > Jim > > *From:*Spasm >*On Behalf Of*Ryan Sleevi > *Sent:*Monday, September 10, 2018 8:53 AM > *To:*era@x500.eu > *Cc:*SPASM >;x500standard@freelists.org > > *Subject:*Re: [lamps] Double signatures > > On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen > > wrote: > > Hi Folk, > > In ITU-T we have plans to allow for double signatures > using the SIGNED parametrized data type defined in > X.509 to cope with situation as described in the > internet draft: “Multiple Public-Key Algorithm X.509 > Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)” > > We suggest to enhance the SIGNED data type as shown below: > > *SIGNED{ToBeSigned} ::= SEQUENCE {* > > *COMPONENTS OF SIGNATURE,* > > *.......**,* > > *altAlgorithmIdentifier > AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,* > > *altSignature BIT STRING OPTIONAL * > > ***}****(WITH COMPONENTS {..., altAlgorithmIdentifier > PRESENT, altSignature PRESENT } |* > > *WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, > altSignature ABSENT } )* > > ** > > We are open to comments. We know that IETF is not a > heavy user of this data type. > > We have no intention to use this extended data type > for certificates and CRLs. > > For your information, SIGNATURE is defined as: > > *SIGNATURE ::= SEQUENCE {* > > *algorithmIdentifier > AlgorithmIdentifier{{SupportedAlgorithms}},* > > *signature BIT STRING,* > > *....... }* > > From the discussions in London (101), there were a number > of challenges identified during the discussion - > https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt- > that fundamentally questioned that approach. > > Has the ITU-T addressed or resolved those concerns? Are > they not applicable for some reason specific to ITU-T? > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > > -- > > Best Regards, > > Massimiliano Pala, Ph.D. > > CableLabs > Principal Architect > Security Services, R&D > > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --------------999C640EE5E7C12534D43CC4 Content-Type: multipart/related; boundary="------------67F29EE622517A344CC04A93" --------------67F29EE622517A344CC04A93 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Panos, all,

that is correct - since the new OIDs for the Key and the Signatures would be new, clients would fail since they do not know the "composite" algorithm :D

Although developing support for it should not be too difficult, the solution it is not meant to be backward compatible as we want applications to be able to fail if they do not even know they were supposed to generate or verify multiple signatures instead of just one.

From a usage perspective, I am leaning towards the need for the owner of the certificates to generate signatures with all the keys, and for the entity that validates the signatures it should validate all the signatures it supports and may accept signatures even if it does not understand all the algorithms (this is more an application decision based on the risk and threat model).

As I said, this solution fits not only certificates, but also OCSP responses, CRLs, CMS, PKCS#7, etc. and that is part of what is interesting for us :D I still need to check what are the needed changes for other formats like PKCS#1/#8/#12 for storing the composite public and private keys (this part still missing), but I hope that solving that part will not be too difficult...

Cheers,
Max


On 9/20/18 7:26 AM, Panos Kampanakis (pkampana) wrote:

Hi Max,

To rephrase Eric’s question, would the CompositeKey+CompositeSig proposal be backwards compatible with existing systems?

I mean it gives you the change to use more than one algos in case you don’t trust all of them. But an old client wouldn’t be able to just use the traditional key+sig unless he was upgraded to understand CompositeKey+CompositeSig and its OIDs, right?

Panos

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Erik Andersen
Sent: Friday, September 14, 2018 11:49 AM
To: 'SPASM' <spasm@ietf.org>; Directory list <x500standard@freelists.org>
Subject: Re: [lamps] Double signatures

 

The double signature is intended as a migration tool.

 

In the normal operation, only one signature is used (the native signature). When it is realized that the signature algorithm will be too week i some future, the migration period starts and an alternative, assuming stronger signature is provided for those able to handle it.  Legacy systems will ignore this alternative signature. After the migration period, there will be no alternative signature and the new stronger signature will be the native signature.

 

Does that make sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala@cablelabs.com]
Sendt: 12 September 2018 23:01
Til: Russ Housley <housley@vigilsec.com>
Cc: SPASM <spasm@ietf.org>; Erik Andersen <era@x500.eu>
Emne: Re: [lamps] Double signatures

 

Hi Russ, all,

my personal position is that the signer MUST use all the keys that have digitalSignature set, the verifier shall verify all the signatures for which it does have support for.

The rationale for this is that if I certify a public key in the certificate, you should be able to use the private key to generate the signature, therefore the approach is the same as usual: sign with your key. In this case, it just happens that to generate the signature you have to generate multiple ones and then combine them together.

For the application that verifies those signatures, it is always a question of what is the threshold that is acceptable for the application (in terms of risk) in case it does not support all of the algorithms that are used to generate the composite signature. Ideally it would verify all, but it may decide to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I think it could be a good idea - the use of the two OIDs is another way to go to codify the validation process required. Technically, that makes sense to me, however I am conflicted as this approach requires that the signer has an understanding of what the verifier's capabilities are... I think that defining two OIDs for the signatures could still be useful because the signer might then decide the "recommended"/"intended" verification behavior... I can see some use-cases that might have a composite key with { RSA, EC } and the "Must-Verify-All" OID for the signature, and another use-case where we have a composite key with { RSA, HASH-BASED } and for the signature "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max

 

On 9/12/18 6:12 AM, Russ Housley wrote:

Max:

 

During a transition to quantum-resistant signatures, a signer wants to put a traditional signature and a quantum-resistant signature on an object.  Given your description of keyUsage and extendedKeyUsage, both would have the digitalSignature bit set.  How does a client know if just one or both signatures must be valid?

 

As Jim Schaad already said, RFC 5752 talks about this issue when a CMS SignedData contains more than one SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max Pala <M.Pala@cablelabs.com> wrote:

 

Hi All,

 

I am working on a similar - but different - solution, in particular I solve the issue of (a) being able to combine more than one public key, (b) only one (actually two) OIDs required, and (c) simply the processing by re-utilizing the same data structures we have today.

 

I particular, I define a “composite public key” and “composite signature”.

 

The first one encodes in the key value’s BITSTRING the DER value of the SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo structure) and uses a specific OID that identifies the public key type. The parameters of the compositeKey algorithm can be used to encode the keyUsage and the extendedKeyUsage for each of the keys in the composite key.

 

The same approach is used for the “Composite Signature” case where the value of the signature is the DER representation of the SEQUENCE of signatures made with each of the keys.

 

As soon as I have some spare time, I will submit the draft - maybe this could be discussed in Bangkok?

 

This simple idea allows us to have all the other procedures related to PKIs work - this means we can combine ECC with RSA or with a Quantum-Resistant algorithm (when finally available and standardized). A step forward for the deployment of hybrid-PKIs where multiple Lagos for keys can be used to authenticate data, certs, revocation data, etc... we plan to use this in our infrastructures to provide a transitional path for post-Quantum transition and to further improve the algorithm-agility capability of PKIs.

 

What do you think?

 

Cheers,

Max

 

 

---

 

Cheers,

Max

On Sep 11, 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> wrote:

Unfortunately, “not every combination needs to be covered” introduces a lot of politics around choosing which combinations “need to be covered”, a subject on which inevitably not everyone agrees.  I would rather avoid all those discussions and the unnecessary work they represent.

 

I personally don’t think a single AlgID which implies a SEQUENCE of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral equivalent.  For simple hybrid use cases, there is also a lot of value in having the classical algorithm ID being the same as it usually is, to allow easier interoperability with older systems that don’t understand the newer algorithms (and can blissfully ignore them).

 

-Tim

 

From: Santosh Chokhani <santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 10:29 AM
To: Tim Hollebeek <tim.hollebeek@digicert.com>; 'Erik Andersen' <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: RE: [lamps] Double signatures

 

Thanks Tim.

 

There are ways to accommodate your concern.

 

One way to handle this is defining a single Alg ID A which implies a SEQUENCE of ALG IDs and define the relying party rules in terms of its ability to process one or all ALG IDs.

 

Another way to do this is not every combination needs to be covered and the user community defines its own  Alg ID Xi which maps to a SEQUENCE of ALG IDs.

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek
Sent: Tuesday, September 11, 2018 10:03 AM
To: Erik Andersen <era@x500.eu>; 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double signatures

 

Doesn’t the combinatoric explosion render this completely impractical?

 

You need N_c x N_pq algorithm identifiers just to handle the simple hybrid use case where a single classical algorithm is being used in conjunction with a single post-quantum algorithm.

 

And there are people who want to use multiple post-quantum algorithms to hedge against potential yet to be discovered weaknesses in post-quantum algorithms.

 

I’m not really looking forward to trying to allocate or manage O(N_c x N_pq^3) algorithm identifiers…

 

-Tim

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Erik Andersen
Sent: Tuesday, September 11, 2018 3:10 AM
To: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double signatures

 

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my brain. As I understand, it requires that we define a particular algorithm that has a parameter that includes the things you suggest. It is worthy to be analysed.

 

Erik

 

Fra: Spasm [mailto:spasm-bounces@ietf.org] På vegne af Santosh Chokhani
Sendt: 10 September 2018 19:18
Til: 'Jim Schaad' <ietf@augustcellars.com>; 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Emne: Re: [lamps] Double signatures

 

Why not let algorithm identifier dictate the number of signatures and their syntax?

 

From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad
Sent: Monday, September 10, 2018 1:07 PM
To: 'Ryan Sleevi' <ryan-ietf@sleevi.com>; era@x500.eu
Cc: 'SPASM' <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double signatures

 

Ryan,

 

The discussion in London dealt with a completely different proposal than this one.  While I think there are problems with this that need to be dealt with they are mostly not the same set.

 

Erik,

 

Why is this considered to be a preferred solution to defining a new signature algorithm which contains as the parameter the sequence of algorithm identifiers and as the signature value a sequence of signature values.  The problem with just defining the extension to SIGNED is that one needs to make sure that the set of signature algorithms and parameters are also part of the data to be signed and I am not seeing that highlighted here.

 

Jim

 

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Ryan Sleevi
Sent: Monday, September 10, 2018 8:53 AM
To: era@x500.eu
Cc: SPASM <spasm@ietf.org>; x500standard@freelists.org
Subject: Re: [lamps] Double signatures

 

 

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <era@x500.eu> wrote:

Hi Folk,

 

In ITU-T we have plans to allow for double signatures using the SIGNED parametrized data type defined in X.509 to cope with situation as described in the internet draft: “Multiple Public-Key Algorithm X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)”

 

We suggest to enhance the SIGNED data type as shown below:

 

SIGNED{ToBeSigned} ::= SEQUENCE {

  COMPONENTS OF SIGNATURE,

  .......,

  altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}} OPTIONAL,

  altSignature            BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT,  altSignature ABSENT } )

 

We are open to comments. We know that IETF is not a heavy user of this data type.

 

We have no intention to use this extended data type for certificates and CRLs.

 

For your information, SIGNATURE is defined as:

 

SIGNATURE ::= SEQUENCE {

  algorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}},

  signature            BIT STRING,

  ....... }

 

From the discussions in London (101), there were a number of challenges identified during the discussion - https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt - that fundamentally questioned that approach.

 

Has the ITU-T addressed or resolved those concerns? Are they not applicable for some reason specific to ITU-T? 

_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

 

 

--

Best Regards,

Massimiliano Pala, Ph.D.

CableLabs
Principal Architect
Security Services, R&D



_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

--------------67F29EE622517A344CC04A93 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="image001.png" iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURB VFjDldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZY kUSr2FxBIC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9 GQJJtNLTINfoodpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6M tN1XWkVq4Z5rgvNyskJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoX fEXABSGJIX6Xh3tgXWR+DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTO McuxqLHE1Y7X2Q1WglYWR6eEaAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/ O9Ivc7rTY7oRpmkua7lvkBC9jdZfoe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejt x3pqZru5FtuckzcJNYkiXWKgk/zHCmtVRTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4 us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KCCUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4 OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd18qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1h EpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVOAzvzklKjFTTQ6B6Xp/X1ISdY4OwG yAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX30M3N7jA4hqSNGGCSF03R1gRz Yln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNOyOjn1ri5kaX7nI2sSo9Y 5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZTxhtVgxOe5SpNC6t J6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75eNl6lvq4HXvc l05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfgKPBHXXPJ TT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21+gev b+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6y tRFDUGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/ g/XqABXZVr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0Yz O+xCc30ty+1kUtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTI aJcvwxO0tKURt5dob4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXu jaG1TJeycYH+jcI7xi2xPO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2 QiPygEuc54kDhxQSlyu0VGmcKaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD 0+dWqcG5lsa3o2W0irHmN5GEQy2NPnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKz xgMoqdJKReZEQYOkfi43AdSux2Ng/pAk0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7 RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZVRfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M 9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOqjEt/JzYpi2GWKHCp7mbWlUZREtKiGKbc kEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719RrdFmMtAS1BC0LaHIM95vQGfu7xaKrJ varOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlYVkc9bTQ2vRASF3nD8yoUOUuF W+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHLB+n5aOcyrWw21/fcYqAC 75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinSxTmG6Wy7xRZ4R1dX mWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkAAAAASUVORK5C YII= --------------67F29EE622517A344CC04A93-- --------------999C640EE5E7C12534D43CC4-- From nobody Fri Sep 21 20:08:36 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A0C5130EB7 for ; Fri, 21 Sep 2018 20:08:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tV9x9fzsUtZ3 for ; Fri, 21 Sep 2018 20:08:29 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07640130EB4 for ; Fri, 21 Sep 2018 20:08:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=100373; q=dns/txt; s=iport; t=1537585709; x=1538795309; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=lzQUjB2N0xSY0I/UGaOxzzV4387e3BTwYQWC6XFxjwo=; b=WZDbDQ8MVCh3iFv1mIJ3ESwLO62esE3FZc6J78EiQOLBVl74QFsA91HR w46LJJrEJgLPadA9JrwRkTLJjG0ICTFa0iof8Sh1C2TiAWfPidkRwT3wd GMnNlSEkY45BwuYjduXp0TkuSGvkJcBKE0vksbxTL5g589gTVn6JRVUFv k=; X-Files: image001.png : 1892 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ATAACUsaVb/4gNJK1aGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUYEXSC9lfygKg2mIFYwpgg2IXo1xgXcDCAECGAEMhEc?= =?us-ascii?q?CF4MvITQYAQMBAQIBAQJtHAyFOAEBAQEDAQEDFQkCCAFACxACAQgRBAEBBgE?= =?us-ascii?q?BARgBBgMCAgIFEAEJBQELFAkIAgQBDQQBBgIGBgdLgjyBaQMVD6J8gS4fhAw?= =?us-ascii?q?BgwoNgkAKBYpwF4FBP4ERAYMSglZFAQEDgTsWGwkPEAKCSYJXAogkIDCEdYV?= =?us-ascii?q?0g0yBR4NgLAkChWQBXIZNgxEfjyqHG4RfbYd3AhEUgSUdOIFVcBU7gmyCJAE?= =?us-ascii?q?XiFqFPm8BixorgQGBHgEB?= X-IronPort-AV: E=Sophos;i="5.54,287,1534809600"; d="png'150?scan'150,208,217,150";a="174476556" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Sep 2018 03:08:27 +0000 Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id w8M38QUf012868 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 22 Sep 2018 03:08:27 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 21 Sep 2018 22:08:26 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Fri, 21 Sep 2018 22:08:26 -0500 From: "Panos Kampanakis (pkampana)" To: "Dr. Pala" , Jim Schaad CC: "spasm@ietf.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwANHy+AAAKWWwAAAGJ/gAAdEOUAAA5m/4AAAOuWAAAAVAsAAAzUEYAAIGE4gAASdg2AAFmu0YABHhS8AAATr4MAAAUjhrA= Date: Sat, 22 Sep 2018 03:08:26 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> In-Reply-To: <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.116.108.5] Content-Type: multipart/related; boundary="_004_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_"; type="multipart/alternative" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Sep 2018 03:08:34 -0000 --_004_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_ Content-Type: multipart/alternative; boundary="_000_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_" --_000_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWF4LCBKaW0sDQoNCkFncmVlZC4gSW4gc3VtbWFyeSwgdGhlcmUgYXJlIHRvbyBnb29kIHBy b3Bvc2FscyAoRXJpaywgTWF44oCZcykgdGhhdCBjYW4gY29tYmluZSBtdWx0aXBsZSBQS3MgYW5k IFNpZ3MuIFRoYXQgd291bGQgYWxsb3cgdXMgdG8gdXMgbW9yZSB0aGFuIG9uZSBQUSBhbGdvcyBp ZiB0aGV5IGFyZSBub3QgdHJ1c3RlZC4NCg0KZHJhZnQtdHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJy aWQgYWxsb3dzIGZvciBiYWNrd2FyZHMgY29tcGF0aWJpbGl0eSBieSBkZWZpbmluZyBvbmUgb25s eSBQUSBrZXkgYW5kIHNpZyBhcyBub24tY3JpdGljYWwgZXh0ZW5zaW9ucy4NCg0KSSB3b25kZXIg aWYgdGhlIHR3byBjb25jZXB0cyBjb3VsZCBiZSBtZXJnZWQuIE1lYW5pbmcgdXNlIHRoZSBjb21w b3NpdGUga2V5ICsgc2lncyBjYW4gbm9uLWNyaXRpY2FsIGV4dGVuc2lvbnMuIE9sZCBjbGllbnRz IGRpc3JlZ2FyZCB0aGUgUFEgZXh0ZW5zaW9ucy4gTmV3IGNsaWVudHMgdmVyaWZ5IHRoZSBjbGFz c2ljYWwgIGFuZCB0aGUgUFEgYWxnb3MgZGVmaW5lZCBpbiB0aGUgY29tcG9zaXRlIE9JRCBjb250 YWluZWQgaW4gdGhlIG5vbi1jcml0aWNhbCBleHRlbnNpb24uDQoNClBhbm9zDQoNCg0KRnJvbTog U3Bhc20gW21haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgRHIuIFBh bGENClNlbnQ6IFRodXJzZGF5LCBTZXB0ZW1iZXIgMjAsIDIwMTggMTo0NCBQTQ0KVG86IHNwYXNt QGlldGYub3JnDQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQoNCkhp IFBhbm9zLCBhbGwsDQoNCnRoYXQgaXMgY29ycmVjdCAtIHNpbmNlIHRoZSBuZXcgT0lEcyBmb3Ig dGhlIEtleSBhbmQgdGhlIFNpZ25hdHVyZXMgd291bGQgYmUgbmV3LCBjbGllbnRzIHdvdWxkIGZh aWwgc2luY2UgdGhleSBkbyBub3Qga25vdyB0aGUgImNvbXBvc2l0ZSIgYWxnb3JpdGhtIDpEDQoN CkFsdGhvdWdoIGRldmVsb3Bpbmcgc3VwcG9ydCBmb3IgaXQgc2hvdWxkIG5vdCBiZSB0b28gZGlm ZmljdWx0LCB0aGUgc29sdXRpb24gaXQgaXMgbm90IG1lYW50IHRvIGJlIGJhY2t3YXJkIGNvbXBh dGlibGUgYXMgd2Ugd2FudCBhcHBsaWNhdGlvbnMgdG8gYmUgYWJsZSB0byBmYWlsIGlmIHRoZXkg ZG8gbm90IGV2ZW4ga25vdyB0aGV5IHdlcmUgc3VwcG9zZWQgdG8gZ2VuZXJhdGUgb3IgdmVyaWZ5 IG11bHRpcGxlIHNpZ25hdHVyZXMgaW5zdGVhZCBvZiBqdXN0IG9uZS4NCg0KRnJvbSBhIHVzYWdl IHBlcnNwZWN0aXZlLCBJIGFtIGxlYW5pbmcgdG93YXJkcyB0aGUgbmVlZCBmb3IgdGhlIG93bmVy IG9mIHRoZSBjZXJ0aWZpY2F0ZXMgdG8gZ2VuZXJhdGUgc2lnbmF0dXJlcyB3aXRoIGFsbCB0aGUg a2V5cywgYW5kIGZvciB0aGUgZW50aXR5IHRoYXQgdmFsaWRhdGVzIHRoZSBzaWduYXR1cmVzIGl0 IHNob3VsZCB2YWxpZGF0ZSBhbGwgdGhlIHNpZ25hdHVyZXMgaXQgc3VwcG9ydHMgYW5kIG1heSBh Y2NlcHQgc2lnbmF0dXJlcyBldmVuIGlmIGl0IGRvZXMgbm90IHVuZGVyc3RhbmQgYWxsIHRoZSBh bGdvcml0aG1zICh0aGlzIGlzIG1vcmUgYW4gYXBwbGljYXRpb24gZGVjaXNpb24gYmFzZWQgb24g dGhlIHJpc2sgYW5kIHRocmVhdCBtb2RlbCkuDQoNCkFzIEkgc2FpZCwgdGhpcyBzb2x1dGlvbiBm aXRzIG5vdCBvbmx5IGNlcnRpZmljYXRlcywgYnV0IGFsc28gT0NTUCByZXNwb25zZXMsIENSTHMs IENNUywgUEtDUyM3LCBldGMuIGFuZCB0aGF0IGlzIHBhcnQgb2Ygd2hhdCBpcyBpbnRlcmVzdGlu ZyBmb3IgdXMgOkQgSSBzdGlsbCBuZWVkIHRvIGNoZWNrIHdoYXQgYXJlIHRoZSBuZWVkZWQgY2hh bmdlcyBmb3Igb3RoZXIgZm9ybWF0cyBsaWtlIFBLQ1MjMS8jOC8jMTIgZm9yIHN0b3JpbmcgdGhl IGNvbXBvc2l0ZSBwdWJsaWMgYW5kIHByaXZhdGUga2V5cyAodGhpcyBwYXJ0IHN0aWxsIG1pc3Np bmcpLCBidXQgSSBob3BlIHRoYXQgc29sdmluZyB0aGF0IHBhcnQgd2lsbCBub3QgYmUgdG9vIGRp ZmZpY3VsdC4uLg0KDQpDaGVlcnMsDQpNYXgNCg0KT24gOS8yMC8xOCA3OjI2IEFNLCBQYW5vcyBL YW1wYW5ha2lzIChwa2FtcGFuYSkgd3JvdGU6DQpIaSBNYXgsDQpUbyByZXBocmFzZSBFcmlj4oCZ cyBxdWVzdGlvbiwgd291bGQgdGhlIENvbXBvc2l0ZUtleStDb21wb3NpdGVTaWcgcHJvcG9zYWwg YmUgYmFja3dhcmRzIGNvbXBhdGlibGUgd2l0aCBleGlzdGluZyBzeXN0ZW1zPw0KSSBtZWFuIGl0 IGdpdmVzIHlvdSB0aGUgY2hhbmdlIHRvIHVzZSBtb3JlIHRoYW4gb25lIGFsZ29zIGluIGNhc2Ug eW91IGRvbuKAmXQgdHJ1c3QgYWxsIG9mIHRoZW0uIEJ1dCBhbiBvbGQgY2xpZW50IHdvdWxkbuKA mXQgYmUgYWJsZSB0byBqdXN0IHVzZSB0aGUgdHJhZGl0aW9uYWwga2V5K3NpZyB1bmxlc3MgaGUg d2FzIHVwZ3JhZGVkIHRvIHVuZGVyc3RhbmQgQ29tcG9zaXRlS2V5K0NvbXBvc2l0ZVNpZyBhbmQg aXRzIE9JRHMsIHJpZ2h0Pw0KUGFub3MNCg0KRnJvbTogU3Bhc20gW21haWx0bzpzcGFzbS1ib3Vu Y2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgRXJpayBBbmRlcnNlbg0KU2VudDogRnJpZGF5LCBT ZXB0ZW1iZXIgMTQsIDIwMTggMTE6NDkgQU0NClRvOiAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZz48 bWFpbHRvOnNwYXNtQGlldGYub3JnPjsgRGlyZWN0b3J5IGxpc3QgPHg1MDBzdGFuZGFyZEBmcmVl bGlzdHMub3JnPjxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBS ZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpUaGUgZG91YmxlIHNpZ25hdHVyZSBpcyBp bnRlbmRlZCBhcyBhIG1pZ3JhdGlvbiB0b29sLg0KDQpJbiB0aGUgbm9ybWFsIG9wZXJhdGlvbiwg b25seSBvbmUgc2lnbmF0dXJlIGlzIHVzZWQgKHRoZSBuYXRpdmUgc2lnbmF0dXJlKS4gV2hlbiBp dCBpcyByZWFsaXplZCB0aGF0IHRoZSBzaWduYXR1cmUgYWxnb3JpdGhtIHdpbGwgYmUgdG9vIHdl ZWsgaSBzb21lIGZ1dHVyZSwgdGhlIG1pZ3JhdGlvbiBwZXJpb2Qgc3RhcnRzIGFuZCBhbiBhbHRl cm5hdGl2ZSwgYXNzdW1pbmcgc3Ryb25nZXIgc2lnbmF0dXJlIGlzIHByb3ZpZGVkIGZvciB0aG9z ZSBhYmxlIHRvIGhhbmRsZSBpdC4gIExlZ2FjeSBzeXN0ZW1zIHdpbGwgaWdub3JlIHRoaXMgYWx0 ZXJuYXRpdmUgc2lnbmF0dXJlLiBBZnRlciB0aGUgbWlncmF0aW9uIHBlcmlvZCwgdGhlcmUgd2ls bCBiZSBubyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUgYW5kIHRoZSBuZXcgc3Ryb25nZXIgc2lnbmF0 dXJlIHdpbGwgYmUgdGhlIG5hdGl2ZSBzaWduYXR1cmUuDQoNCkRvZXMgdGhhdCBtYWtlIHNlbnNl Pw0KDQpFcmlrDQoNCkZyYTogTWFzc2ltaWxpYW5vIFBhbGEgW21haWx0bzptLnBhbGFAY2FibGVs YWJzLmNvbV0NClNlbmR0OiAxMiBTZXB0ZW1iZXIgMjAxOCAyMzowMQ0KVGlsOiBSdXNzIEhvdXNs ZXkgPGhvdXNsZXlAdmlnaWxzZWMuY29tPG1haWx0bzpob3VzbGV5QHZpZ2lsc2VjLmNvbT4+DQpD YzogU1BBU00gPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyBFcmlrIEFu ZGVyc2VuIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+Pg0KRW1uZTogUmU6IFtsYW1w c10gRG91YmxlIHNpZ25hdHVyZXMNCg0KDQpIaSBSdXNzLCBhbGwsDQoNCm15IHBlcnNvbmFsIHBv c2l0aW9uIGlzIHRoYXQgdGhlIHNpZ25lciBNVVNUIHVzZSBhbGwgdGhlIGtleXMgdGhhdCBoYXZl IGRpZ2l0YWxTaWduYXR1cmUgc2V0LCB0aGUgdmVyaWZpZXIgc2hhbGwgdmVyaWZ5IGFsbCB0aGUg c2lnbmF0dXJlcyBmb3Igd2hpY2ggaXQgZG9lcyBoYXZlIHN1cHBvcnQgZm9yLg0KDQpUaGUgcmF0 aW9uYWxlIGZvciB0aGlzIGlzIHRoYXQgaWYgSSBjZXJ0aWZ5IGEgcHVibGljIGtleSBpbiB0aGUg Y2VydGlmaWNhdGUsIHlvdSBzaG91bGQgYmUgYWJsZSB0byB1c2UgdGhlIHByaXZhdGUga2V5IHRv IGdlbmVyYXRlIHRoZSBzaWduYXR1cmUsIHRoZXJlZm9yZSB0aGUgYXBwcm9hY2ggaXMgdGhlIHNh bWUgYXMgdXN1YWw6IHNpZ24gd2l0aCB5b3VyIGtleS4gSW4gdGhpcyBjYXNlLCBpdCBqdXN0IGhh cHBlbnMgdGhhdCB0byBnZW5lcmF0ZSB0aGUgc2lnbmF0dXJlIHlvdSBoYXZlIHRvIGdlbmVyYXRl IG11bHRpcGxlIG9uZXMgYW5kIHRoZW4gY29tYmluZSB0aGVtIHRvZ2V0aGVyLg0KDQpGb3IgdGhl IGFwcGxpY2F0aW9uIHRoYXQgdmVyaWZpZXMgdGhvc2Ugc2lnbmF0dXJlcywgaXQgaXMgYWx3YXlz IGEgcXVlc3Rpb24gb2Ygd2hhdCBpcyB0aGUgdGhyZXNob2xkIHRoYXQgaXMgYWNjZXB0YWJsZSBm b3IgdGhlIGFwcGxpY2F0aW9uIChpbiB0ZXJtcyBvZiByaXNrKSBpbiBjYXNlIGl0IGRvZXMgbm90 IHN1cHBvcnQgYWxsIG9mIHRoZSBhbGdvcml0aG1zIHRoYXQgYXJlIHVzZWQgdG8gZ2VuZXJhdGUg dGhlIGNvbXBvc2l0ZSBzaWduYXR1cmUuIElkZWFsbHkgaXQgd291bGQgdmVyaWZ5IGFsbCwgYnV0 IGl0IG1heSBkZWNpZGUgdG8gdmVyaWZ5IGxlc3MgKGF0IGxlYXN0IG9uZSkuDQoNCkkgYWxzbyBz YXcgdGhlIG90aGVyIGUtbWFpbCBmcm9tIEppbSBvbiB0aGlzIHRvcGljIGFuZCBJIHRoaW5rIGl0 IGNvdWxkIGJlIGEgZ29vZCBpZGVhIC0gdGhlIHVzZSBvZiB0aGUgdHdvIE9JRHMgaXMgYW5vdGhl ciB3YXkgdG8gZ28gdG8gY29kaWZ5IHRoZSB2YWxpZGF0aW9uIHByb2Nlc3MgcmVxdWlyZWQuIFRl Y2huaWNhbGx5LCB0aGF0IG1ha2VzIHNlbnNlIHRvIG1lLCBob3dldmVyIEkgYW0gY29uZmxpY3Rl ZCBhcyB0aGlzIGFwcHJvYWNoIHJlcXVpcmVzIHRoYXQgdGhlIHNpZ25lciBoYXMgYW4gdW5kZXJz dGFuZGluZyBvZiB3aGF0IHRoZSB2ZXJpZmllcidzIGNhcGFiaWxpdGllcyBhcmUuLi4gSSB0aGlu ayB0aGF0IGRlZmluaW5nIHR3byBPSURzIGZvciB0aGUgc2lnbmF0dXJlcyBjb3VsZCBzdGlsbCBi ZSB1c2VmdWwgYmVjYXVzZSB0aGUgc2lnbmVyIG1pZ2h0IHRoZW4gZGVjaWRlIHRoZSAicmVjb21t ZW5kZWQiLyJpbnRlbmRlZCIgdmVyaWZpY2F0aW9uIGJlaGF2aW9yLi4uIEkgY2FuIHNlZSBzb21l IHVzZS1jYXNlcyB0aGF0IG1pZ2h0IGhhdmUgYSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEVD IH0gYW5kIHRoZSAiTXVzdC1WZXJpZnktQWxsIiBPSUQgZm9yIHRoZSBzaWduYXR1cmUsIGFuZCBh bm90aGVyIHVzZS1jYXNlIHdoZXJlIHdlIGhhdmUgYSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0Es IEhBU0gtQkFTRUQgfSBhbmQgZm9yIHRoZSBzaWduYXR1cmUgIk11c3QtVmVyaWZ5LUF0LUxlYXN0 LU9uZSIuDQoNCkRvZXMgdGhpcyBtYWtlIHNlbnNlPw0KDQpDaGVlcnMsDQpNYXgNCg0KT24gOS8x Mi8xOCA2OjEyIEFNLCBSdXNzIEhvdXNsZXkgd3JvdGU6DQpNYXg6DQoNCkR1cmluZyBhIHRyYW5z aXRpb24gdG8gcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJlcywgYSBzaWduZXIgd2FudHMgdG8g cHV0IGEgdHJhZGl0aW9uYWwgc2lnbmF0dXJlIGFuZCBhIHF1YW50dW0tcmVzaXN0YW50IHNpZ25h dHVyZSBvbiBhbiBvYmplY3QuICBHaXZlbiB5b3VyIGRlc2NyaXB0aW9uIG9mIGtleVVzYWdlIGFu ZCBleHRlbmRlZEtleVVzYWdlLCBib3RoIHdvdWxkIGhhdmUgdGhlIGRpZ2l0YWxTaWduYXR1cmUg Yml0IHNldC4gIEhvdyBkb2VzIGEgY2xpZW50IGtub3cgaWYganVzdCBvbmUgb3IgYm90aCBzaWdu YXR1cmVzIG11c3QgYmUgdmFsaWQ/DQoNCkFzIEppbSBTY2hhYWQgYWxyZWFkeSBzYWlkLCBSRkMg NTc1MiB0YWxrcyBhYm91dCB0aGlzIGlzc3VlIHdoZW4gYSBDTVMgU2lnbmVkRGF0YSBjb250YWlu cyBtb3JlIHRoYW4gb25lIFNpZ25lckluZm8uDQoNClJ1c3MNCg0KDQpPbiBTZXAgMTEsIDIwMTgs IGF0IDQ6NDUgUE0sIE1heCBQYWxhIDxNLlBhbGFAY2FibGVsYWJzLmNvbTxtYWlsdG86TS5QYWxh QGNhYmxlbGFicy5jb20+PiB3cm90ZToNCg0KSGkgQWxsLA0KDQpJIGFtIHdvcmtpbmcgb24gYSBz aW1pbGFyIC0gYnV0IGRpZmZlcmVudCAtIHNvbHV0aW9uLCBpbiBwYXJ0aWN1bGFyIEkgc29sdmUg dGhlIGlzc3VlIG9mIChhKSBiZWluZyBhYmxlIHRvIGNvbWJpbmUgbW9yZSB0aGFuIG9uZSBwdWJs aWMga2V5LCAoYikgb25seSBvbmUgKGFjdHVhbGx5IHR3bykgT0lEcyByZXF1aXJlZCwgYW5kIChj KSBzaW1wbHkgdGhlIHByb2Nlc3NpbmcgYnkgcmUtdXRpbGl6aW5nIHRoZSBzYW1lIGRhdGEgc3Ry dWN0dXJlcyB3ZSBoYXZlIHRvZGF5Lg0KDQpJIHBhcnRpY3VsYXIsIEkgZGVmaW5lIGEg4oCcY29t cG9zaXRlIHB1YmxpYyBrZXnigJ0gYW5kIOKAnGNvbXBvc2l0ZSBzaWduYXR1cmXigJ0uDQoNClRo ZSBmaXJzdCBvbmUgZW5jb2RlcyBpbiB0aGUga2V5IHZhbHVl4oCZcyBCSVRTVFJJTkcgdGhlIERF UiB2YWx1ZSBvZiB0aGUgU0VRVUVOQ0Ugb2YgcHVibGljIGtleXMgKGVhY2ggb2Ygd2hpY2ggaXMg YSB0aGUgc3ViamVjdFB1YmxpY0tleUluZm8gc3RydWN0dXJlKSBhbmQgdXNlcyBhIHNwZWNpZmlj IE9JRCB0aGF0IGlkZW50aWZpZXMgdGhlIHB1YmxpYyBrZXkgdHlwZS4gVGhlIHBhcmFtZXRlcnMg b2YgdGhlIGNvbXBvc2l0ZUtleSBhbGdvcml0aG0gY2FuIGJlIHVzZWQgdG8gZW5jb2RlIHRoZSBr ZXlVc2FnZSBhbmQgdGhlIGV4dGVuZGVkS2V5VXNhZ2UgZm9yIGVhY2ggb2YgdGhlIGtleXMgaW4g dGhlIGNvbXBvc2l0ZSBrZXkuDQoNClRoZSBzYW1lIGFwcHJvYWNoIGlzIHVzZWQgZm9yIHRoZSDi gJxDb21wb3NpdGUgU2lnbmF0dXJl4oCdIGNhc2Ugd2hlcmUgdGhlIHZhbHVlIG9mIHRoZSBzaWdu YXR1cmUgaXMgdGhlIERFUiByZXByZXNlbnRhdGlvbiBvZiB0aGUgU0VRVUVOQ0Ugb2Ygc2lnbmF0 dXJlcyBtYWRlIHdpdGggZWFjaCBvZiB0aGUga2V5cy4NCg0KQXMgc29vbiBhcyBJIGhhdmUgc29t ZSBzcGFyZSB0aW1lLCBJIHdpbGwgc3VibWl0IHRoZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQg YmUgZGlzY3Vzc2VkIGluIEJhbmdrb2s/DQoNClRoaXMgc2ltcGxlIGlkZWEgYWxsb3dzIHVzIHRv IGhhdmUgYWxsIHRoZSBvdGhlciBwcm9jZWR1cmVzIHJlbGF0ZWQgdG8gUEtJcyB3b3JrIC0gdGhp cyBtZWFucyB3ZSBjYW4gY29tYmluZSBFQ0Mgd2l0aCBSU0Egb3Igd2l0aCBhIFF1YW50dW0tUmVz aXN0YW50IGFsZ29yaXRobSAod2hlbiBmaW5hbGx5IGF2YWlsYWJsZSBhbmQgc3RhbmRhcmRpemVk KS4gQSBzdGVwIGZvcndhcmQgZm9yIHRoZSBkZXBsb3ltZW50IG9mIGh5YnJpZC1QS0lzIHdoZXJl IG11bHRpcGxlIExhZ29zIGZvciBrZXlzIGNhbiBiZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBkYXRh LCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRhLCBldGMuLi4gd2UgcGxhbiB0byB1c2UgdGhpcyBpbiBv dXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHByb3ZpZGUgYSB0cmFuc2l0aW9uYWwgcGF0aCBmb3IgcG9z dC1RdWFudHVtIHRyYW5zaXRpb24gYW5kIHRvIGZ1cnRoZXIgaW1wcm92ZSB0aGUgYWxnb3JpdGht LWFnaWxpdHkgY2FwYWJpbGl0eSBvZiBQS0lzLg0KDQpXaGF0IGRvIHlvdSB0aGluaz8NCg0KQ2hl ZXJzLA0KTWF4DQoNCg0KLS0tDQoNCkNoZWVycywNCk1heA0KT24gU2VwIDExLCAyMDE4LCBhdCA4 OjM4IEFNLCBUaW0gSG9sbGViZWVrIDx0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTxtYWlsdG86 dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20+PiB3cm90ZToNClVuZm9ydHVuYXRlbHksIOKAnG5v dCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBiZSBjb3ZlcmVk4oCdIGludHJvZHVjZXMgYSBs b3Qgb2YgcG9saXRpY3MgYXJvdW5kIGNob29zaW5nIHdoaWNoIGNvbWJpbmF0aW9ucyDigJxuZWVk IHRvIGJlIGNvdmVyZWTigJ0sIGEgc3ViamVjdCBvbiB3aGljaCBpbmV2aXRhYmx5IG5vdCBldmVy eW9uZSBhZ3JlZXMuICBJIHdvdWxkIHJhdGhlciBhdm9pZCBhbGwgdGhvc2UgZGlzY3Vzc2lvbnMg YW5kIHRoZSB1bm5lY2Vzc2FyeSB3b3JrIHRoZXkgcmVwcmVzZW50Lg0KDQpJIHBlcnNvbmFsbHkg ZG9u4oCZdCB0aGluayBhIHNpbmdsZSBBbGdJRCB3aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ugb2Yg QUxHIElEcyBpcyBhbiBpbXByb3ZlbWVudCBvdmVyIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcywgb3Ig aXRzIG1vcmFsIGVxdWl2YWxlbnQuICBGb3Igc2ltcGxlIGh5YnJpZCB1c2UgY2FzZXMsIHRoZXJl IGlzIGFsc28gYSBsb3Qgb2YgdmFsdWUgaW4gaGF2aW5nIHRoZSBjbGFzc2ljYWwgYWxnb3JpdGht IElEIGJlaW5nIHRoZSBzYW1lIGFzIGl0IHVzdWFsbHkgaXMsIHRvIGFsbG93IGVhc2llciBpbnRl cm9wZXJhYmlsaXR5IHdpdGggb2xkZXIgc3lzdGVtcyB0aGF0IGRvbuKAmXQgdW5kZXJzdGFuZCB0 aGUgbmV3ZXIgYWxnb3JpdGhtcyAoYW5kIGNhbiBibGlzc2Z1bGx5IGlnbm9yZSB0aGVtKS4NCg0K LVRpbQ0KDQpGcm9tOiBTYW50b3NoIENob2toYW5pIDxzYW50b3NoLmNob2toYW5pQGdtYWlsLmNv bTxtYWlsdG86c2FudG9zaC5jaG9raGFuaUBnbWFpbC5jb20+Pg0KU2VudDogVHVlc2RheSwgU2Vw dGVtYmVyIDExLCAyMDE4IDEwOjI5IEFNDQpUbzogVGltIEhvbGxlYmVlayA8dGltLmhvbGxlYmVl a0BkaWdpY2VydC5jb208bWFpbHRvOnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPj47ICdFcmlr IEFuZGVyc2VuJyA8ZXJhQHg1MDAuZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pj47ICdTUEFTTScgPHNw YXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxp c3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSRTog W2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpUaGFua3MgVGltLg0KDQpUaGVyZSBhcmUgd2F5 cyB0byBhY2NvbW1vZGF0ZSB5b3VyIGNvbmNlcm4uDQoNCk9uZSB3YXkgdG8gaGFuZGxlIHRoaXMg aXMgZGVmaW5pbmcgYSBzaW5nbGUgQWxnIElEIEEgd2hpY2ggaW1wbGllcyBhIFNFUVVFTkNFIG9m IEFMRyBJRHMgYW5kIGRlZmluZSB0aGUgcmVseWluZyBwYXJ0eSBydWxlcyBpbiB0ZXJtcyBvZiBp dHMgYWJpbGl0eSB0byBwcm9jZXNzIG9uZSBvciBhbGwgQUxHIElEcy4NCg0KQW5vdGhlciB3YXkg dG8gZG8gdGhpcyBpcyBub3QgZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZCBh bmQgdGhlIHVzZXIgY29tbXVuaXR5IGRlZmluZXMgaXRzIG93biAgQWxnIElEIFhpIHdoaWNoIG1h cHMgdG8gYSBTRVFVRU5DRSBvZiBBTEcgSURzLg0KDQpGcm9tOiBTcGFzbSBbbWFpbHRvOnNwYXNt LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBUaW0gSG9sbGViZWVrDQpTZW50OiBUdWVz ZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMTA6MDMgQU0NClRvOiBFcmlrIEFuZGVyc2VuIDxlcmFA eDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PjsgJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFp bHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4 NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBz aWduYXR1cmVzDQoNCkRvZXNu4oCZdCB0aGUgY29tYmluYXRvcmljIGV4cGxvc2lvbiByZW5kZXIg dGhpcyBjb21wbGV0ZWx5IGltcHJhY3RpY2FsPw0KDQpZb3UgbmVlZCBOX2MgeCBOX3BxIGFsZ29y aXRobSBpZGVudGlmaWVycyBqdXN0IHRvIGhhbmRsZSB0aGUgc2ltcGxlIGh5YnJpZCB1c2UgY2Fz ZSB3aGVyZSBhIHNpbmdsZSBjbGFzc2ljYWwgYWxnb3JpdGhtIGlzIGJlaW5nIHVzZWQgaW4gY29u anVuY3Rpb24gd2l0aCBhIHNpbmdsZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtLg0KDQpBbmQgdGhl cmUgYXJlIHBlb3BsZSB3aG8gd2FudCB0byB1c2UgbXVsdGlwbGUgcG9zdC1xdWFudHVtIGFsZ29y aXRobXMgdG8gaGVkZ2UgYWdhaW5zdCBwb3RlbnRpYWwgeWV0IHRvIGJlIGRpc2NvdmVyZWQgd2Vh a25lc3NlcyBpbiBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcy4NCg0KSeKAmW0gbm90IHJlYWxseSBs b29raW5nIGZvcndhcmQgdG8gdHJ5aW5nIHRvIGFsbG9jYXRlIG9yIG1hbmFnZSBPKE5fYyB4IE5f cHFeMykgYWxnb3JpdGhtIGlkZW50aWZpZXJz4oCmDQoNCi1UaW0NCg0KRnJvbTogU3Bhc20gPHNw YXNtLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBC ZWhhbGYgT2YgRXJpayBBbmRlcnNlbg0KU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4 IDM6MTAgQU0NClRvOiAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0Zi5v cmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFyZEBmcmVl bGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KSGkg U2FudG9zaCwNCg0KWW91IGhhdmUgcHJvcG9zZWQgc29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUu IEl0IHN0aWxsIHB1enpsaW5nIGluIG15IGJyYWluLiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVp cmVzIHRoYXQgd2UgZGVmaW5lIGEgcGFydGljdWxhciBhbGdvcml0aG0gdGhhdCBoYXMgYSBwYXJh bWV0ZXIgdGhhdCBpbmNsdWRlcyB0aGUgdGhpbmdzIHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkg dG8gYmUgYW5hbHlzZWQuDQoNCkVyaWsNCg0KRnJhOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5j ZXNAaWV0Zi5vcmddIFDDpSB2ZWduZSBhZiBTYW50b3NoIENob2toYW5pDQpTZW5kdDogMTAgU2Vw dGVtYmVyIDIwMTggMTk6MTgNClRpbDogJ0ppbSBTY2hhYWQnIDxpZXRmQGF1Z3VzdGNlbGxhcnMu Y29tPG1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tPj47ICdSeWFuIFNsZWV2aScgPHJ5YW4t aWV0ZkBzbGVldmkuY29tPG1haWx0bzpyeWFuLWlldGZAc2xlZXZpLmNvbT4+OyBlcmFAeDUwMC5l dTxtYWlsdG86ZXJhQHg1MDAuZXU+DQpDYzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRv OnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAw c3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NCkVtbmU6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1 cmVzDQoNCldoeSBub3QgbGV0IGFsZ29yaXRobSBpZGVudGlmaWVyIGRpY3RhdGUgdGhlIG51bWJl ciBvZiBzaWduYXR1cmVzIGFuZCB0aGVpciBzeW50YXg/DQoNCkZyb206IFNwYXNtIFttYWlsdG86 c3Bhc20tYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEppbSBTY2hhYWQNClNlbnQ6IE1v bmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcgUE0NClRvOiAnUnlhbiBTbGVldmknIDxyeWFu LWlldGZAc2xlZXZpLmNvbTxtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5jb20+PjsgZXJhQHg1MDAu ZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pg0KQ2M6ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0 bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUw MHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2ln bmF0dXJlcw0KDQpSeWFuLA0KDQpUaGUgZGlzY3Vzc2lvbiBpbiBMb25kb24gZGVhbHQgd2l0aCBh IGNvbXBsZXRlbHkgZGlmZmVyZW50IHByb3Bvc2FsIHRoYW4gdGhpcyBvbmUuICBXaGlsZSBJIHRo aW5rIHRoZXJlIGFyZSBwcm9ibGVtcyB3aXRoIHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdp dGggdGhleSBhcmUgbW9zdGx5IG5vdCB0aGUgc2FtZSBzZXQuDQoNCkVyaWssDQoNCldoeSBpcyB0 aGlzIGNvbnNpZGVyZWQgdG8gYmUgYSBwcmVmZXJyZWQgc29sdXRpb24gdG8gZGVmaW5pbmcgYSBu ZXcgc2lnbmF0dXJlIGFsZ29yaXRobSB3aGljaCBjb250YWlucyBhcyB0aGUgcGFyYW1ldGVyIHRo ZSBzZXF1ZW5jZSBvZiBhbGdvcml0aG0gaWRlbnRpZmllcnMgYW5kIGFzIHRoZSBzaWduYXR1cmUg dmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1cmUgdmFsdWVzLiAgVGhlIHByb2JsZW0gd2l0aCBq dXN0IGRlZmluaW5nIHRoZSBleHRlbnNpb24gdG8gU0lHTkVEIGlzIHRoYXQgb25lIG5lZWRzIHRv IG1ha2Ugc3VyZSB0aGF0IHRoZSBzZXQgb2Ygc2lnbmF0dXJlIGFsZ29yaXRobXMgYW5kIHBhcmFt ZXRlcnMgYXJlIGFsc28gcGFydCBvZiB0aGUgZGF0YSB0byBiZSBzaWduZWQgYW5kIEkgYW0gbm90 IHNlZWluZyB0aGF0IGhpZ2hsaWdodGVkIGhlcmUuDQoNCkppbQ0KDQoNCkZyb206IFNwYXNtIDxz cGFzbS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnPj4gT24g QmVoYWxmIE9mIFJ5YW4gU2xlZXZpDQpTZW50OiBNb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4 OjUzIEFNDQpUbzogZXJhQHg1MDAuZXU8bWFpbHRvOmVyYUB4NTAwLmV1Pg0KQ2M6IFNQQVNNIDxz cGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVs aXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6 IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KDQpPbiBNb24sIFNlcCAxMCwgMjAxOCBhdCAx MDo1NiBBTSBFcmlrIEFuZGVyc2VuIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PiB3 cm90ZToNCkhpIEZvbGssDQoNCkluIElUVS1UIHdlIGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRv dWJsZSBzaWduYXR1cmVzIHVzaW5nIHRoZSBTSUdORUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBk ZWZpbmVkIGluIFguNTA5IHRvIGNvcGUgd2l0aCBzaXR1YXRpb24gYXMgZGVzY3JpYmVkIGluIHRo ZSBpbnRlcm5ldCBkcmFmdDog4oCcTXVsdGlwbGUgUHVibGljLUtleSBBbGdvcml0aG0gWC41MDkg Q2VydGlmaWNhdGVzIChkcmFmdC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZC14NTA5LTAxKeKA nQ0KDQpXZSBzdWdnZXN0IHRvIGVuaGFuY2UgdGhlIFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24g YmVsb3c6DQoNClNJR05FRHtUb0JlU2lnbmVkfSA6Oj0gU0VRVUVOQ0Ugew0KICBDT01QT05FTlRT IE9GIFNJR05BVFVSRSwNCiAgLi4uLi4uLiwNCiAgYWx0QWxnb3JpdGhtSWRlbnRpZmllciAgQWxn b3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxnb3JpdGhtc319IE9QVElPTkFMLA0KICBhbHRT aWduYXR1cmUgICAgICAgICAgICBCSVQgU1RSSU5HIE9QVElPTkFMDQogIH0gKFdJVEggQ09NUE9O RU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQ UkVTRU5UIH0gfA0KICAgICBXSVRIIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRp ZmllciBBQlNFTlQsICBhbHRTaWduYXR1cmUgQUJTRU5UIH0gKQ0KDQpXZSBhcmUgb3BlbiB0byBj b21tZW50cy4gV2Uga25vdyB0aGF0IElFVEYgaXMgbm90IGEgaGVhdnkgdXNlciBvZiB0aGlzIGRh dGEgdHlwZS4NCg0KV2UgaGF2ZSBubyBpbnRlbnRpb24gdG8gdXNlIHRoaXMgZXh0ZW5kZWQgZGF0 YSB0eXBlIGZvciBjZXJ0aWZpY2F0ZXMgYW5kIENSTHMuDQoNCkZvciB5b3VyIGluZm9ybWF0aW9u LCBTSUdOQVRVUkUgaXMgZGVmaW5lZCBhczoNCg0KU0lHTkFUVVJFIDo6PSBTRVFVRU5DRSB7DQog IGFsZ29yaXRobUlkZW50aWZpZXIgIEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29y aXRobXN9fSwNCiAgc2lnbmF0dXJlICAgICAgICAgICAgQklUIFNUUklORywNCiAgLi4uLi4uLiB9 DQoNCkZyb20gdGhlIGRpc2N1c3Npb25zIGluIExvbmRvbiAoMTAxKSwgdGhlcmUgd2VyZSBhIG51 bWJlciBvZiBjaGFsbGVuZ2VzIGlkZW50aWZpZWQgZHVyaW5nIHRoZSBkaXNjdXNzaW9uIC0gaHR0 cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5nLzEwMS9tYXRlcmlhbHMvbWludXRlcy0x MDEtbGFtcHMtMDEudHh0IC0gdGhhdCBmdW5kYW1lbnRhbGx5IHF1ZXN0aW9uZWQgdGhhdCBhcHBy b2FjaC4NCg0KSGFzIHRoZSBJVFUtVCBhZGRyZXNzZWQgb3IgcmVzb2x2ZWQgdGhvc2UgY29uY2Vy bnM/IEFyZSB0aGV5IG5vdCBhcHBsaWNhYmxlIGZvciBzb21lIHJlYXNvbiBzcGVjaWZpYyB0byBJ VFUtVD8NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpT cGFzbSBtYWlsaW5nIGxpc3QNClNwYXNtQGlldGYub3JnPG1haWx0bzpTcGFzbUBpZXRmLm9yZz4N Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Bhc20NCg0KDQotLQ0KQmVz dCBSZWdhcmRzLA0KTWFzc2ltaWxpYW5vIFBhbGEsIFBoLkQuDQpbQ2FibGVMYWJzXQ0KUHJpbmNp cGFsIEFyY2hpdGVjdA0KU2VjdXJpdHkgU2VydmljZXMsIFImRA0KDQoNCg0KDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpTcGFzbSBtYWlsaW5nIGxp c3QNCg0KU3Bhc21AaWV0Zi5vcmc8bWFpbHRvOlNwYXNtQGlldGYub3JnPg0KDQpodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtDQoNCg== --_000_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXcgXDsiO30NCkBmb250LWZhY2UNCgl7Zm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3IFw7IGNvbG9yXDogcmVkIjt9DQpAZm9udC1mYWNlDQoJe2Zv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyBcO2NvbG9yXDpcI0MwMDAwMCI7DQoJcGFub3NlLTE6 MCAwIDAgMCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyBcOyBcO2NvbG9yXDpyZWQiOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7fQ0K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5N c29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjsNCgljb2xv cjpibGFjazt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0 eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNp dGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm Ow0KCWNvbG9yOmJsYWNrO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0 eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2lu LWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3IjsNCgljb2xvcjpibGFjazt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21z by1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWls eTpDb25zb2xhczsNCgljb2xvcjpibGFjazt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0K CXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxl MjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMx RjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4w aW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjEN Cgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3ht bD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6 ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBl bGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUi IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+SGkgTWF4LCBKaW0sPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5BZ3JlZWQuIEluIHN1bW1hcnksIHRoZXJlIGFyZSB0b28gZ29vZCBwcm9wb3NhbHMg KEVyaWssIE1heOKAmXMpIHRoYXQgY2FuIGNvbWJpbmUgbXVsdGlwbGUgUEtzIGFuZCBTaWdzLiBU aGF0IHdvdWxkIGFsbG93IHVzIHRvIHVzIG1vcmUgdGhhbiBvbmUgUFEgYWxnb3MgaWYgdGhleQ0K IGFyZSBub3QgdHJ1c3RlZC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5kcmFmdC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZCBhbGxvd3MgZm9yIGJhY2t3YXJk cyBjb21wYXRpYmlsaXR5IGJ5IGRlZmluaW5nIG9uZSBvbmx5IFBRIGtleSBhbmQgc2lnIGFzIG5v bi1jcml0aWNhbCBleHRlbnNpb25zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+SSB3b25kZXIgaWYgdGhlIHR3byBjb25jZXB0cyBjb3VsZCBiZSBtZXJnZWQuIE1l YW5pbmcgdXNlIHRoZSBjb21wb3NpdGUga2V5ICYjNDM7IHNpZ3MgY2FuIG5vbi1jcml0aWNhbCBl eHRlbnNpb25zLiBPbGQgY2xpZW50cyBkaXNyZWdhcmQgdGhlIFBRIGV4dGVuc2lvbnMuIE5ldyBj bGllbnRzDQogdmVyaWZ5IHRoZSBjbGFzc2ljYWwgJm5ic3A7YW5kIHRoZSBQUSBhbGdvcyBkZWZp bmVkIGluIHRoZSBjb21wb3NpdGUgT0lEIGNvbnRhaW5lZCBpbiB0aGUgbm9uLWNyaXRpY2FsIGV4 dGVuc2lvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlBhbm9z PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+IFNwYXNtIFttYWls dG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+RHIuIFBhbGE8 YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXksIFNlcHRlbWJlciAyMCwgMjAxOCAxOjQ0IFBNPGJy Pg0KPGI+VG86PC9iPiBzcGFzbUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW2xh bXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPkhpIFBh bm9zLCBhbGwsPG86cD48L286cD48L3A+DQo8cD50aGF0IGlzIGNvcnJlY3QgLSBzaW5jZSB0aGUg bmV3IE9JRHMgZm9yIHRoZSBLZXkgYW5kIHRoZSBTaWduYXR1cmVzIHdvdWxkIGJlIG5ldywgY2xp ZW50cyB3b3VsZCBmYWlsIHNpbmNlIHRoZXkgZG8gbm90IGtub3cgdGhlICZxdW90O2NvbXBvc2l0 ZSZxdW90OyBhbGdvcml0aG0gOkQ8bzpwPjwvbzpwPjwvcD4NCjxwPkFsdGhvdWdoIGRldmVsb3Bp bmcgc3VwcG9ydCBmb3IgaXQgc2hvdWxkIG5vdCBiZSB0b28gZGlmZmljdWx0LCB0aGUgc29sdXRp b24gaXQgaXMgbm90IG1lYW50IHRvIGJlIGJhY2t3YXJkIGNvbXBhdGlibGUgYXMgd2Ugd2FudCBh cHBsaWNhdGlvbnMgdG8gYmUgYWJsZSB0byBmYWlsIGlmIHRoZXkgZG8gbm90IGV2ZW4ga25vdyB0 aGV5IHdlcmUgc3VwcG9zZWQgdG8gZ2VuZXJhdGUgb3IgdmVyaWZ5IG11bHRpcGxlIHNpZ25hdHVy ZXMgaW5zdGVhZA0KIG9mIGp1c3Qgb25lLjxvOnA+PC9vOnA+PC9wPg0KPHA+RnJvbSBhIHVzYWdl IHBlcnNwZWN0aXZlLCBJIGFtIGxlYW5pbmcgdG93YXJkcyB0aGUgbmVlZCBmb3IgdGhlIG93bmVy IG9mIHRoZSBjZXJ0aWZpY2F0ZXMgdG8gZ2VuZXJhdGUgc2lnbmF0dXJlcyB3aXRoIGFsbCB0aGUg a2V5cywgYW5kIGZvciB0aGUgZW50aXR5IHRoYXQgdmFsaWRhdGVzIHRoZSBzaWduYXR1cmVzIGl0 IHNob3VsZCB2YWxpZGF0ZSBhbGwgdGhlIHNpZ25hdHVyZXMgaXQgc3VwcG9ydHMgYW5kIG1heSBh Y2NlcHQgc2lnbmF0dXJlcw0KIGV2ZW4gaWYgaXQgZG9lcyBub3QgdW5kZXJzdGFuZCBhbGwgdGhl IGFsZ29yaXRobXMgKHRoaXMgaXMgbW9yZSBhbiBhcHBsaWNhdGlvbiBkZWNpc2lvbiBiYXNlZCBv biB0aGUgcmlzayBhbmQgdGhyZWF0IG1vZGVsKS48bzpwPjwvbzpwPjwvcD4NCjxwPkFzIEkgc2Fp ZCwgdGhpcyBzb2x1dGlvbiBmaXRzIG5vdCBvbmx5IGNlcnRpZmljYXRlcywgYnV0IGFsc28gT0NT UCByZXNwb25zZXMsIENSTHMsIENNUywgUEtDUyM3LCBldGMuIGFuZCB0aGF0IGlzIHBhcnQgb2Yg d2hhdCBpcyBpbnRlcmVzdGluZyBmb3IgdXMgOkQgSSBzdGlsbCBuZWVkIHRvIGNoZWNrIHdoYXQg YXJlIHRoZSBuZWVkZWQgY2hhbmdlcyBmb3Igb3RoZXIgZm9ybWF0cyBsaWtlIFBLQ1MjMS8jOC8j MTIgZm9yIHN0b3JpbmcgdGhlDQogY29tcG9zaXRlIHB1YmxpYyBhbmQgcHJpdmF0ZSBrZXlzICh0 aGlzIHBhcnQgc3RpbGwgbWlzc2luZyksIGJ1dCBJIGhvcGUgdGhhdCBzb2x2aW5nIHRoYXQgcGFy dCB3aWxsIG5vdCBiZSB0b28gZGlmZmljdWx0Li4uPG86cD48L286cD48L3A+DQo8cD5DaGVlcnMs PGJyPg0KTWF4PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiA5LzIwLzE4IDc6MjYg QU0sIFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+SGkgTWF4LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UbyByZXBocmFzZSBFcmlj4oCZcyBxdWVzdGlv biwgd291bGQgdGhlIENvbXBvc2l0ZUtleSYjNDM7Q29tcG9zaXRlU2lnIHByb3Bvc2FsIGJlIGJh Y2t3YXJkcyBjb21wYXRpYmxlIHdpdGggZXhpc3Rpbmcgc3lzdGVtcz88L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+SSBtZWFuIGl0IGdpdmVzIHlvdSB0aGUgY2hhbmdlIHRvIHVzZSBtb3JlIHRoYW4gb25lIGFs Z29zIGluIGNhc2UgeW91IGRvbuKAmXQgdHJ1c3QgYWxsIG9mIHRoZW0uIEJ1dCBhbiBvbGQgY2xp ZW50IHdvdWxkbuKAmXQgYmUgYWJsZSB0byBqdXN0IHVzZSB0aGUgdHJhZGl0aW9uYWwNCiBrZXkm IzQzO3NpZyB1bmxlc3MgaGUgd2FzIHVwZ3JhZGVkIHRvIHVuZGVyc3RhbmQgQ29tcG9zaXRlS2V5 JiM0MztDb21wb3NpdGVTaWcgYW5kIGl0cyBPSURzLCByaWdodD88L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ UGFub3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPiBTcGFzbSBbPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpz cGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPm1haWx0bzpzcGFzbS1ib3Vu Y2VzQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+ XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5FcmlrIEFuZGVyc2VuPGJyPg0KPGI+U2VudDo8L2I+IEZy aWRheSwgU2VwdGVtYmVyIDE0LCAyMDE4IDExOjQ5IEFNPGJyPg0KPGI+VG86PC9iPiAnU1BBU00n IDwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jmx0O3NwYXNtQGlldGYub3JnJmd0Ozwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndp bmRvd3RleHQiPjsgRGlyZWN0b3J5IGxpc3QNCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0 YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmx0O3g1MDBzdGFuZGFyZEBm cmVlbGlzdHMub3JnJmd0Ozwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3Rl eHQiPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhlIGRvdWJsZSBzaWduYXR1cmUgaXMg aW50ZW5kZWQgYXMgYSBtaWdyYXRpb24gdG9vbC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SW4gdGhlIG5vcm1hbCBv cGVyYXRpb24sIG9ubHkgb25lIHNpZ25hdHVyZSBpcyB1c2VkICh0aGUgbmF0aXZlIHNpZ25hdHVy ZSkuIFdoZW4gaXQgaXMgcmVhbGl6ZWQgdGhhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobSB3aWxs IGJlIHRvbyB3ZWVrIGkgc29tZQ0KIGZ1dHVyZSwgdGhlIG1pZ3JhdGlvbiBwZXJpb2Qgc3RhcnRz IGFuZCBhbiBhbHRlcm5hdGl2ZSwgYXNzdW1pbmcgc3Ryb25nZXIgc2lnbmF0dXJlIGlzIHByb3Zp ZGVkIGZvciB0aG9zZSBhYmxlIHRvIGhhbmRsZSBpdC4mbmJzcDsgTGVnYWN5IHN5c3RlbXMgd2ls bCBpZ25vcmUgdGhpcyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUuIEFmdGVyIHRoZSBtaWdyYXRpb24g cGVyaW9kLCB0aGVyZSB3aWxsIGJlIG5vIGFsdGVybmF0aXZlIHNpZ25hdHVyZSBhbmQgdGhlDQog bmV3IHN0cm9uZ2VyIHNpZ25hdHVyZSB3aWxsIGJlIHRoZSBuYXRpdmUgc2lnbmF0dXJlLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5Eb2VzIHRoYXQgbWFrZSBzZW5zZT88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RXJpazwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+RnJhOjwvc3Bhbj48L2I+PHNw YW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gTWFzc2ltaWxpYW5vIFBh bGEgWzwvc3Bhbj48YSBocmVmPSJtYWlsdG86bS5wYWxhQGNhYmxlbGFicy5jb20iPjxzcGFuIGxh bmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPm1haWx0bzptLnBhbGFAY2FibGVsYWJzLmNvbTwvc3Bhbj48L2E+ PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5dDQo8YnI+DQo8Yj5T ZW5kdDo8L2I+IDEyIFNlcHRlbWJlciAyMDE4IDIzOjAxPGJyPg0KPGI+VGlsOjwvYj4gUnVzcyBI b3VzbGV5ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tIj48 c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5ob3VzbGV5QHZpZ2lsc2VjLmNvbTwvc3Bhbj48L2E+ PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiBTUEFTTSAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+ PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+Jmd0OzsgRXJpayBBbmRlcnNl bg0KICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBsYW5nPSJE QSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4mZ3Q7PGJyPg0KPGI+RW1uZTo8L2I+IFJlOiBbbGFtcHNd IERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+SGkgUnVzcywgYWxsLDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwPjxzcGFuIGxhbmc9IkVOLUdCIj5teSBwZXJzb25hbCBwb3NpdGlv biBpcyB0aGF0IHRoZSBzaWduZXIgTVVTVCB1c2UgYWxsIHRoZSBrZXlzIHRoYXQgaGF2ZSBkaWdp dGFsU2lnbmF0dXJlIHNldCwgdGhlIHZlcmlmaWVyIHNoYWxsIHZlcmlmeSBhbGwgdGhlIHNpZ25h dHVyZXMgZm9yIHdoaWNoIGl0IGRvZXMgaGF2ZSBzdXBwb3J0IGZvci48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+VGhlIHJhdGlvbmFsZSBmb3IgdGhpcyBpcyB0 aGF0IGlmIEkgY2VydGlmeSBhIHB1YmxpYyBrZXkgaW4gdGhlIGNlcnRpZmljYXRlLCB5b3Ugc2hv dWxkIGJlIGFibGUgdG8gdXNlIHRoZSBwcml2YXRlIGtleSB0byBnZW5lcmF0ZSB0aGUgc2lnbmF0 dXJlLCB0aGVyZWZvcmUgdGhlIGFwcHJvYWNoIGlzIHRoZSBzYW1lIGFzIHVzdWFsOiBzaWduIHdp dGggeW91ciBrZXkuIEluIHRoaXMgY2FzZSwgaXQganVzdCBoYXBwZW5zDQogdGhhdCB0byBnZW5l cmF0ZSB0aGUgc2lnbmF0dXJlIHlvdSBoYXZlIHRvIGdlbmVyYXRlIG11bHRpcGxlIG9uZXMgYW5k IHRoZW4gY29tYmluZSB0aGVtIHRvZ2V0aGVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwPjxz cGFuIGxhbmc9IkVOLUdCIj5Gb3IgdGhlIGFwcGxpY2F0aW9uIHRoYXQgdmVyaWZpZXMgdGhvc2Ug c2lnbmF0dXJlcywgaXQgaXMgYWx3YXlzIGEgcXVlc3Rpb24gb2Ygd2hhdCBpcyB0aGUgdGhyZXNo b2xkIHRoYXQgaXMgYWNjZXB0YWJsZSBmb3IgdGhlIGFwcGxpY2F0aW9uIChpbiB0ZXJtcyBvZiBy aXNrKSBpbiBjYXNlIGl0IGRvZXMgbm90IHN1cHBvcnQgYWxsIG9mIHRoZSBhbGdvcml0aG1zIHRo YXQgYXJlIHVzZWQgdG8gZ2VuZXJhdGUNCiB0aGUgY29tcG9zaXRlIHNpZ25hdHVyZS4gSWRlYWxs eSBpdCB3b3VsZCB2ZXJpZnkgYWxsLCBidXQgaXQgbWF5IGRlY2lkZSB0byB2ZXJpZnkgbGVzcyAo YXQgbGVhc3Qgb25lKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1H QiI+SSBhbHNvIHNhdyB0aGUgb3RoZXIgZS1tYWlsIGZyb20gSmltIG9uIHRoaXMgdG9waWMgYW5k IEkgdGhpbmsgaXQgY291bGQgYmUgYSBnb29kIGlkZWEgLSB0aGUgdXNlIG9mIHRoZSB0d28gT0lE cyBpcyBhbm90aGVyIHdheSB0byBnbyB0byBjb2RpZnkgdGhlIHZhbGlkYXRpb24gcHJvY2VzcyBy ZXF1aXJlZC4gVGVjaG5pY2FsbHksIHRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUsIGhvd2V2ZXIgSSBh bSBjb25mbGljdGVkDQogYXMgdGhpcyBhcHByb2FjaCByZXF1aXJlcyB0aGF0IHRoZSBzaWduZXIg aGFzIGFuIHVuZGVyc3RhbmRpbmcgb2Ygd2hhdCB0aGUgdmVyaWZpZXIncyBjYXBhYmlsaXRpZXMg YXJlLi4uIEkgdGhpbmsgdGhhdCBkZWZpbmluZyB0d28gT0lEcyBmb3IgdGhlIHNpZ25hdHVyZXMg Y291bGQgc3RpbGwgYmUgdXNlZnVsIGJlY2F1c2UgdGhlIHNpZ25lciBtaWdodCB0aGVuIGRlY2lk ZSB0aGUgJnF1b3Q7cmVjb21tZW5kZWQmcXVvdDsvJnF1b3Q7aW50ZW5kZWQmcXVvdDsgdmVyaWZp Y2F0aW9uDQogYmVoYXZpb3IuLi4gSSBjYW4gc2VlIHNvbWUgdXNlLWNhc2VzIHRoYXQgbWlnaHQg aGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJTQSwgRUMgfSBhbmQgdGhlICZxdW90O011c3Qt VmVyaWZ5LUFsbCZxdW90OyBPSUQgZm9yIHRoZSBzaWduYXR1cmUsIGFuZCBhbm90aGVyIHVzZS1j YXNlIHdoZXJlIHdlIGhhdmUgYSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEhBU0gtQkFTRUQg fSBhbmQgZm9yIHRoZSBzaWduYXR1cmUgJnF1b3Q7TXVzdC1WZXJpZnktQXQtTGVhc3QtT25lJnF1 b3Q7Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwPjxzcGFuIGxhbmc9IkVOLUdCIj5Eb2VzIHRo aXMgbWFrZSBzZW5zZT88L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1H QiI+Q2hlZXJzLDxicj4NCk1heDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPk9uIDkvMTIvMTgg NjoxMiBBTSwgUnVzcyBIb3VzbGV5IHdyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+TWF4OiA8L3NwYW4+ PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+RHVyaW5nIGEgdHJhbnNp dGlvbiB0byBxdWFudHVtLXJlc2lzdGFudCBzaWduYXR1cmVzLCBhIHNpZ25lciB3YW50cyB0byBw dXQgYSB0cmFkaXRpb25hbCBzaWduYXR1cmUgYW5kIGEgcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0 dXJlIG9uIGFuIG9iamVjdC4gJm5ic3A7R2l2ZW4geW91ciBkZXNjcmlwdGlvbiBvZiZuYnNwO2tl eVVzYWdlIGFuZCBleHRlbmRlZEtleVVzYWdlLCBib3RoIHdvdWxkIGhhdmUNCiB0aGUgZGlnaXRh bFNpZ25hdHVyZSBiaXQgc2V0LiAmbmJzcDtIb3cgZG9lcyBhIGNsaWVudCBrbm93IGlmIGp1c3Qg b25lIG9yIGJvdGggc2lnbmF0dXJlcyBtdXN0IGJlIHZhbGlkPzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+QXMgSmltIFNjaGFhZCBhbHJlYWR5IHNhaWQs IFJGQyZuYnNwOzU3NTIgdGFsa3MgYWJvdXQgdGhpcyBpc3N1ZSB3aGVuIGEgQ01TIFNpZ25lZERh dGEgY29udGFpbnMgbW9yZSB0aGFuIG9uZSBTaWduZXJJbmZvLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+UnVzczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiPk9uIFNlcCAxMSwgMjAxOCwgYXQgNDo0NSBQTSwgTWF4IFBhbGEgJmx0Ozwv c3Bhbj48YSBocmVmPSJtYWlsdG86TS5QYWxhQGNhYmxlbGFicy5jb20iPjxzcGFuIGxhbmc9IkVO LUdCIj5NLlBhbGFAY2FibGVsYWJzLmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiPiZn dDsgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+SGkgQWxsLA0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSBhbSB3b3JraW5nIG9uIGEgc2ltaWxhciAtIGJ1dCBk aWZmZXJlbnQgLSBzb2x1dGlvbiwgaW4gcGFydGljdWxhciBJIHNvbHZlIHRoZSBpc3N1ZSBvZiAo YSkgYmVpbmcgYWJsZSB0byBjb21iaW5lIG1vcmUgdGhhbiBvbmUgcHVibGljIGtleSwgKGIpIG9u bHkgb25lIChhY3R1YWxseQ0KIHR3bykgT0lEcyByZXF1aXJlZCwgYW5kIChjKSBzaW1wbHkgdGhl IHByb2Nlc3NpbmcgYnkgcmUtdXRpbGl6aW5nIHRoZSBzYW1lIGRhdGEgc3RydWN0dXJlcyB3ZSBo YXZlIHRvZGF5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSBwYXJ0aWN1bGFyLCBJIGRlZmluZSBhIOKAnGNv bXBvc2l0ZSBwdWJsaWMga2V54oCdIGFuZCDigJxjb21wb3NpdGUgc2lnbmF0dXJl4oCdLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+VGhlIGZpcnN0IG9uZSBlbmNvZGVzIGluIHRoZSBrZXkgdmFsdWXigJlzIEJJ VFNUUklORyB0aGUgREVSIHZhbHVlIG9mIHRoZSBTRVFVRU5DRSBvZiBwdWJsaWMga2V5cyAoZWFj aCBvZiB3aGljaCBpcyBhIHRoZSBzdWJqZWN0UHVibGljS2V5SW5mbyBzdHJ1Y3R1cmUpIGFuZCB1 c2VzDQogYSBzcGVjaWZpYyBPSUQgdGhhdCBpZGVudGlmaWVzIHRoZSBwdWJsaWMga2V5IHR5cGUu IFRoZSBwYXJhbWV0ZXJzIG9mIHRoZSBjb21wb3NpdGVLZXkgYWxnb3JpdGhtIGNhbiBiZSB1c2Vk IHRvIGVuY29kZSB0aGUga2V5VXNhZ2UgYW5kIHRoZSBleHRlbmRlZEtleVVzYWdlIGZvciBlYWNo IG9mIHRoZSBrZXlzIGluIHRoZSBjb21wb3NpdGUga2V5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhlIHNh bWUgYXBwcm9hY2ggaXMgdXNlZCBmb3IgdGhlIOKAnENvbXBvc2l0ZSBTaWduYXR1cmXigJ0gY2Fz ZSB3aGVyZSB0aGUgdmFsdWUgb2YgdGhlIHNpZ25hdHVyZSBpcyB0aGUgREVSIHJlcHJlc2VudGF0 aW9uIG9mIHRoZSBTRVFVRU5DRSBvZiBzaWduYXR1cmVzIG1hZGUgd2l0aA0KIGVhY2ggb2YgdGhl IGtleXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5BcyBzb29uIGFzIEkgaGF2ZSBzb21lIHNwYXJlIHRpbWUs IEkgd2lsbCBzdWJtaXQgdGhlIGRyYWZ0IC0gbWF5YmUgdGhpcyBjb3VsZCBiZSBkaXNjdXNzZWQg aW4gQmFuZ2tvaz88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgc2ltcGxlIGlkZWEgYWxsb3dzIHVzIHRv IGhhdmUgYWxsIHRoZSBvdGhlciBwcm9jZWR1cmVzIHJlbGF0ZWQgdG8gUEtJcyB3b3JrIC0gdGhp cyBtZWFucyB3ZSBjYW4gY29tYmluZSBFQ0Mgd2l0aCBSU0Egb3Igd2l0aCBhIFF1YW50dW0tUmVz aXN0YW50IGFsZ29yaXRobQ0KICh3aGVuIGZpbmFsbHkgYXZhaWxhYmxlIGFuZCBzdGFuZGFyZGl6 ZWQpLiBBIHN0ZXAgZm9yd2FyZCBmb3IgdGhlIGRlcGxveW1lbnQgb2YgaHlicmlkLVBLSXMgd2hl cmUgbXVsdGlwbGUgTGFnb3MgZm9yIGtleXMgY2FuIGJlIHVzZWQgdG8gYXV0aGVudGljYXRlIGRh dGEsIGNlcnRzLCByZXZvY2F0aW9uIGRhdGEsIGV0Yy4uLiB3ZSBwbGFuIHRvIHVzZSB0aGlzIGlu IG91ciBpbmZyYXN0cnVjdHVyZXMgdG8gcHJvdmlkZSBhIHRyYW5zaXRpb25hbA0KIHBhdGggZm9y IHBvc3QtUXVhbnR1bSB0cmFuc2l0aW9uIGFuZCB0byBmdXJ0aGVyIGltcHJvdmUgdGhlIGFsZ29y aXRobS1hZ2lsaXR5IGNhcGFiaWxpdHkgb2YgUEtJcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgZG8g eW91IHRoaW5rPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5DaGVlcnMsDQo8L3NwYW4+PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPk1heDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4tLS0NCjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PkNoZWVycywNCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+TWF4PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24g U2VwIDExLCAyMDE4LCBhdCA4OjM4IEFNLCBUaW0gSG9sbGViZWVrICZsdDs8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPC9zcGFu PjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ow0KIHdyb3RlOjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVuZm9ydHVuYXRlbHksIOKAnG5vdCBl dmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBiZSBjb3ZlcmVk4oCdIGludHJvZHVjZXMgYSBsb3Qg b2YgcG9saXRpY3MgYXJvdW5kIGNob29zaW5nIHdoaWNoIGNvbWJpbmF0aW9ucyDigJxuZWVkIHRv IGJlIGNvdmVyZWTigJ0sIGEgc3ViamVjdCBvbiB3aGljaA0KIGluZXZpdGFibHkgbm90IGV2ZXJ5 b25lIGFncmVlcy4mbmJzcDsgSSB3b3VsZCByYXRoZXIgYXZvaWQgYWxsIHRob3NlIGRpc2N1c3Np b25zIGFuZCB0aGUgdW5uZWNlc3Nhcnkgd29yayB0aGV5IHJlcHJlc2VudC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5JIHBlcnNvbmFsbHkgZG9u4oCZdCB0aGluayBhIHNpbmdsZSBBbGdJRCB3aGljaCBpbXBsaWVz IGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBpcyBhbiBpbXByb3ZlbWVudCBvdmVyIGEgU0VRVUVOQ0Ug b2YgQUxHIElEcywgb3IgaXRzIG1vcmFsIGVxdWl2YWxlbnQuJm5ic3A7IEZvciBzaW1wbGUNCiBo eWJyaWQgdXNlIGNhc2VzLCB0aGVyZSBpcyBhbHNvIGEgbG90IG9mIHZhbHVlIGluIGhhdmluZyB0 aGUgY2xhc3NpY2FsIGFsZ29yaXRobSBJRCBiZWluZyB0aGUgc2FtZSBhcyBpdCB1c3VhbGx5IGlz LCB0byBhbGxvdyBlYXNpZXIgaW50ZXJvcGVyYWJpbGl0eSB3aXRoIG9sZGVyIHN5c3RlbXMgdGhh dCBkb27igJl0IHVuZGVyc3RhbmQgdGhlIG5ld2VyIGFsZ29yaXRobXMgKGFuZCBjYW4gYmxpc3Nm dWxseSBpZ25vcmUgdGhlbSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+LVRpbTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBp biAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+U2FudG9zaA0KIENob2toYW5pICZsdDs8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOnB1cnBsZSI+c2FudG9zaC5jaG9raGFuaUBnbWFpbC5jb208L3NwYW4+PC9h PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlR1ZXNkYXksIFNlcHRlbWJlciAx MSwgMjAxOCAxMDoyOSBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VGltIEhvbGxlYmVlayAmbHQ7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpwdXJwbGUiPnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7Ow0KICdFcmlrIEFuZGVyc2VuJyAm bHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OyAnU1BBU00nICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFp bHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1 cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxp c3RzLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+ U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPlJFOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmtzIFRpbS48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+VGhlcmUgYXJlIHdheXMgdG8gYWNjb21tb2RhdGUgeW91ciBjb25j ZXJuLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5PbmUgd2F5IHRv IGhhbmRsZSB0aGlzIGlzIGRlZmluaW5nIGEgc2luZ2xlIEFsZyBJRCBBIHdoaWNoIGltcGxpZXMg YSBTRVFVRU5DRSBvZiBBTEcgSURzIGFuZCBkZWZpbmUgdGhlIHJlbHlpbmcgcGFydHkgcnVsZXMg aW4gdGVybXMgb2YgaXRzIGFiaWxpdHkNCiB0byBwcm9jZXNzIG9uZSBvciBhbGwgQUxHIElEcy48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QW5vdGhlciB3YXkgdG8g ZG8gdGhpcyBpcyBub3QgZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZCBhbmQg dGhlIHVzZXIgY29tbXVuaXR5IGRlZmluZXMgaXRzIG93biAmbmJzcDtBbGcgSUQgWGkgd2hpY2gg bWFwcyB0byBhIFNFUVVFTkNFIG9mDQogQUxHIElEcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+ PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5TcGFzbQ0KIFs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmci PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5tYWlsdG86c3Bhc20t Ym91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0K IEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48L2I+VGltIEhvbGxlYmVlazxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTgg MTA6MDMgQU08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPkVyaWsgQW5kZXJzZW4gJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86 ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5l cmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzsN CiAnU1BBU00nICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3Nw YW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86 eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwvc3Bhbj48L2E+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBz aWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkRvZXNu4oCZdCB0aGUgY29t YmluYXRvcmljIGV4cGxvc2lvbiByZW5kZXIgdGhpcyBjb21wbGV0ZWx5IGltcHJhY3RpY2FsPzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPllvdSBuZWVkIE5fYyB4IE5fcHEgYWxnb3JpdGhtIGlkZW50aWZpZXJzIGp1 c3QgdG8gaGFuZGxlIHRoZSBzaW1wbGUgaHlicmlkIHVzZSBjYXNlIHdoZXJlIGEgc2luZ2xlIGNs YXNzaWNhbCBhbGdvcml0aG0gaXMgYmVpbmcgdXNlZCBpbiBjb25qdW5jdGlvbiB3aXRoIGEgc2lu Z2xlDQogcG9zdC1xdWFudHVtIGFsZ29yaXRobS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmQgdGhlcmUgYXJl IHBlb3BsZSB3aG8gd2FudCB0byB1c2UgbXVsdGlwbGUgcG9zdC1xdWFudHVtIGFsZ29yaXRobXMg dG8gaGVkZ2UgYWdhaW5zdCBwb3RlbnRpYWwgeWV0IHRvIGJlIGRpc2NvdmVyZWQgd2Vha25lc3Nl cyBpbiBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5J4oCZbSBub3QgcmVh bGx5IGxvb2tpbmcgZm9yd2FyZCB0byB0cnlpbmcgdG8gYWxsb2NhdGUgb3IgbWFuYWdlIE8oTl9j IHggTl9wcV4zKSBhbGdvcml0aG0gaWRlbnRpZmllcnPigKY8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4tVGltPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVl IDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBp biAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwv c3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TcGFzbQ0KICZsdDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uDQogQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5FcmlrIEFuZGVyc2VuPGJyPg0K PGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPlR1ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAxOCAzOjEwIEFNPGJyPg0KPGI+VG86PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nU1BBU00nICZs dDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJk QGZyZWVsaXN0cy5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxl Ij54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgU2FudG9zaCw8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+WW91IGhhdmUgcHJvcG9zZWQg c29tZXRoaW5nIGxpa2UgdGhpcyBiZWZvcmUuIEl0IHN0aWxsIHB1enpsaW5nIGluIG15IGJyYWlu LiBBcyBJIHVuZGVyc3RhbmQsIGl0IHJlcXVpcmVzIHRoYXQgd2UgZGVmaW5lIGEgcGFydGljdWxh ciBhbGdvcml0aG0gdGhhdA0KIGhhcyBhIHBhcmFtZXRlciB0aGF0IGluY2x1ZGVzIHRoZSB0aGlu Z3MgeW91IHN1Z2dlc3QuIEl0IGlzIHdvcnRoeSB0byBiZSBhbmFseXNlZC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RXJpazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyYTo8L3NwYW4+PC9iPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20N CiBbPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBs YW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0 Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPl08c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+UMOlDQogdmVnbmUgYWY8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlNhbnRvc2gg Q2hva2hhbmk8YnI+DQo8Yj5TZW5kdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjEwIFNlcHRlbWJlciAyMDE4IDE5OjE4PGJyPg0KPGI+VGlsOjwv Yj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+J0ppbSBT Y2hhYWQnICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20i PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5pZXRmQGF1Z3VzdGNlbGxh cnMuY29tPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7Ow0KICdSeWFu IFNsZWV2aScgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5jb20i PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5yeWFuLWlldGZAc2xlZXZp LmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUi PmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8 Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PidTUEFTTScgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFu IGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbUBpZXRmLm9yZzwvc3Bhbj48 L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3Rh bmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJw bGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj48YnI+DQo8Yj5FbW5lOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5XaHkgbm90IGxldCBhbGdvcml0 aG0gaWRlbnRpZmllciBkaWN0YXRlIHRoZSBudW1iZXIgb2Ygc2lnbmF0dXJlcyBhbmQgdGhlaXIg c3ludGF4Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGlu IDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9z cGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNwYXNtDQogWzwvc3Bhbj48YSBocmVm PSJtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpwdXJwbGUiPm1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5dPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uDQogQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5KaW0gU2NoYWFkPGJyPg0KPGI+ U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pk1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDE6MDcgUE08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPidSeWFuIFNsZWV2aScg Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86cnlhbi1pZXRmQHNsZWV2aS5jb20iPjxzcGFuIGxh bmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5yeWFuLWlldGZAc2xlZXZpLmNvbTwv c3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0 bzplcmFAeDUwMC5ldSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUi PmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+ DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPidTUEFTTScgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbUBpZXRmLm9yZzwv c3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0 bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwvYT48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91Ymxl IHNpZ25hdHVyZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Unlhbiw8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5UaGUgZGlzY3Vzc2lvbiBpbiBMb25kb24gZGVhbHQgd2l0aCBhIGNvbXBsZXRlbHkgZGlm ZmVyZW50IHByb3Bvc2FsIHRoYW4gdGhpcyBvbmUuJm5ic3A7IFdoaWxlIEkgdGhpbmsgdGhlcmUg YXJlIHByb2JsZW1zIHdpdGggdGhpcyB0aGF0IG5lZWQgdG8gYmUgZGVhbHQgd2l0aCB0aGV5DQog YXJlIG1vc3RseSBub3QgdGhlIHNhbWUgc2V0Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkVyaWssPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+V2h5IGlzIHRoaXMgY29uc2lkZXJlZCB0byBiZSBhIHByZWZlcnJlZCBzb2x1dGlvbiB0 byBkZWZpbmluZyBhIG5ldyBzaWduYXR1cmUgYWxnb3JpdGhtIHdoaWNoIGNvbnRhaW5zIGFzIHRo ZSBwYXJhbWV0ZXIgdGhlIHNlcXVlbmNlIG9mIGFsZ29yaXRobSBpZGVudGlmaWVycyBhbmQNCiBh cyB0aGUgc2lnbmF0dXJlIHZhbHVlIGEgc2VxdWVuY2Ugb2Ygc2lnbmF0dXJlIHZhbHVlcy4mbmJz cDsgVGhlIHByb2JsZW0gd2l0aCBqdXN0IGRlZmluaW5nIHRoZSBleHRlbnNpb24gdG8gU0lHTkVE IGlzIHRoYXQgb25lIG5lZWRzIHRvIG1ha2Ugc3VyZSB0aGF0IHRoZSBzZXQgb2Ygc2lnbmF0dXJl IGFsZ29yaXRobXMgYW5kIHBhcmFtZXRlcnMgYXJlIGFsc28gcGFydCBvZiB0aGUgZGF0YSB0byBi ZSBzaWduZWQgYW5kIEkgYW0gbm90IHNlZWluZyB0aGF0DQogaGlnaGxpZ2h0ZWQgaGVyZS48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5KaW08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUg MS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW47Ym9yZGVyLXRvcC1jb2xvcjpyZ2IoMjI1LA0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAyMjUsIDIyNSkiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNw YXNtDQogJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZyI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtLWJvdW5jZXNA aWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24NCiBCZWhh bGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9i PlJ5YW4gU2xlZXZpPGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPk1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDg6NTMgQU08 YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5TUEFTTSAmbHQ7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpwdXJwbGUiPnNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZy ZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4N CjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5SZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIFNlcCAxMCwgMjAxOCBh dCAxMDo1NiBBTSBFcmlrIEFuZGVyc2VuICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4 NTAwLmV1Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+ZXJhQHg1 MDAuZXU8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsNCiB3cm90 ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDttYXJnaW4tYm90dG9tOjUuLjBwdDti b3JkZXItbGVmdC1jb2xvcjpyZ2IoMjA0LA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgMjA0LCAyMDQpIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkhpIEZvbGssPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SW4gSVRVLVQgd2UgaGF2ZSBwbGFucyB0byBhbGxvdyBmb3IgZG91YmxlIHNpZ25hdHVyZXMgdXNp bmcgdGhlIFNJR05FRCBwYXJhbWV0cml6ZWQgZGF0YSB0eXBlIGRlZmluZWQgaW4gWC41MDkgdG8g Y29wZSB3aXRoIHNpdHVhdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhlIGludGVybmV0DQogZHJhZnQ6 IOKAnE11bHRpcGxlIFB1YmxpYy1LZXkgQWxnb3JpdGhtIFguNTA5IENlcnRpZmljYXRlcyAoZHJh ZnQtdHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJyaWQteDUwOS0wMSnigJ08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5X ZSBzdWdnZXN0IHRvIGVuaGFuY2UgdGhlIFNJR05FRCBkYXRhIHR5cGUgYXMgc2hvd24gYmVsb3c6 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcgXDsmcXVvdDsiPlNJR05FRHtUb0JlU2lnbmVkfSA6Oj0gU0VRVUVOQ0Ugezwvc3Bhbj48L2I+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyBcOyZxdW90OyI+Jm5ic3A7IENPTVBPTkVOVFMgT0YgU0lHTkFUVVJFLDwv c3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90OyI+Jm5ic3A7IC4uLi4uLi48L3NwYW4+PC9i PjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3IDsgO2NvbG9yOiNDMDAwMDAmcXVvdDssc2VyaWYiPiw8L3NwYW4+ PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcgOyBjb2xvcjogcmVkJnF1b3Q7LHNlcmlmIj4mbmJzcDsgYWx0QWxn b3JpdGhtSWRlbnRpZmllciZuYnNwOyBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdv cml0aG1zfX0gT1BUSU9OQUwsPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsgY29sb3I6IHJlZCZx dW90OyxzZXJpZiI+Jm5ic3A7IGFsdFNpZ25hdHVyZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBCSVQgU1RSSU5HIE9QVElP TkFMJm5ic3A7PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IDsgY29sb3I6IHJlZCZxdW90OyxzZXJp ZiI+Jm5ic3A7Jm5ic3A7PC9zcGFuPjwvYj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90OyI+fTwv c3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PGI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcgOyA7Y29sb3I6cmVkJnF1b3Q7LHNlcmlmIj4mbmJzcDs8L3NwYW4+PC9iPjwvc3Bhbj48 Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyBcOyZxdW90Oztjb2xvcjpyZWQiPihXSVRIDQogQ09NUE9ORU5UUyB7 Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIFBSRVNFTlQsIGFsdFNpZ25hdHVyZSBQUkVTRU5U IH0gfDwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyA7IGNvbG9yOiByZWQmcXVvdDssc2VyaWYiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBXSVRIIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGht SWRlbnRpZmllciBBQlNFTlQsJm5ic3A7IGFsdFNpZ25hdHVyZSBBQlNFTlQgfSApPC9zcGFuPjwv Yj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+V2UgYXJlIG9wZW4gdG8gY29tbWVudHMuIFdlIGtub3cgdGhhdCBJRVRGIGlz IG5vdCBhIGhlYXZ5IHVzZXIgb2YgdGhpcyBkYXRhIHR5cGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2UgaGF2 ZSBubyBpbnRlbnRpb24gdG8gdXNlIHRoaXMgZXh0ZW5kZWQgZGF0YSB0eXBlIGZvciBjZXJ0aWZp Y2F0ZXMgYW5kIENSTHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Rm9yIHlvdXIgaW5mb3JtYXRpb24sIFNJR05B VFVSRSBpcyBkZWZpbmVkIGFzOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij5TSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHs8 L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyBhbGdvcml0aG1JZGVudGlm aWVyJm5ic3A7IEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSw8L3Nw YW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyBzaWduYXR1cmUmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg QklUIFNUUklORyw8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyAuLi4u Li4uIH08L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSks IHRoZXJlIHdlcmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUg ZGlzY3Vzc2lvbiAtJm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4dCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4 dDwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4tDQogdGhhdCBmdW5kYW1lbnRhbGx5IHF1ZXN0aW9uZWQgdGhhdCBhcHBy b2FjaC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5IYXMgdGhl IElUVS1UIGFkZHJlc3NlZCBvciByZXNvbHZlZCB0aG9zZSBjb25jZXJucz8gQXJlIHRoZXkgbm90 IGFwcGxpY2FibGUgZm9yIHNvbWUgcmVhc29uIHNwZWNpZmljIHRvIElUVS1UPyZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpT cGFzbSBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOlNwYXNtQGlldGYu b3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPlNwYXNtQGll dGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPC9z cGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Bhc20i PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zcGFzbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4tLSA8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tdG9wOjcuNXB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIj5CZXN0IFJlZ2FyZHMsIDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1ib3R0b206Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiPk1hc3NpbWlsaWFubyBQYWxhLCBQaC5ELjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGltZyBib3JkZXI9IjAiIHdpZHRoPSIxMjAiIGhl aWdodD0iMTgiIGlkPSJQaWN0dXJlX3gwMDIwXzEiIHNyYz0iY2lkOmltYWdlMDAxLnBuZ0AwMUQ0 NTBGRC43RTAxRUI3MCIgYWx0PSJDYWJsZUxhYnMiPjxzcGFuIGxhbmc9IkVOLUdCIj48YnI+DQpQ cmluY2lwYWwgQXJjaGl0ZWN0PGJyPg0KU2VjdXJpdHkgU2VydmljZXMsIFImYW1wO0Q8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJy Pg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cHJlPl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3ByZT4NCjxwcmU+U3Bhc20g bWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFpbHRvOlNwYXNt QGlldGYub3JnIj5TcGFzbUBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48YSBo cmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtPC9hPjxvOnA+PC9vOnA+PC9wcmU+ DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_-- --_004_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=1892; creation-date="Sat, 22 Sep 2018 03:08:25 GMT"; modification-date="Sat, 22 Sep 2018 03:08:25 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= --_004_a529b8de7dbf4402865d1253e9553969XCHALN010ciscocom_-- From nobody Fri Sep 21 21:18:28 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99073130E5C for ; Fri, 21 Sep 2018 21:18:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 51BUkSB18tJq for ; Fri, 21 Sep 2018 21:18:20 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EB76130DD8 for ; Fri, 21 Sep 2018 21:18:19 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Fri, 21 Sep 2018 21:14:08 -0700 From: Jim Schaad To: "'Panos Kampanakis (pkampana)'" CC: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> In-Reply-To: Date: Fri, 21 Sep 2018 21:18:05 -0700 Message-ID: <000001d4522b$44713c10$cd53b430$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_0001_01D451F0.98180960" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheAIUS8OeAbwv1UoDDno9LAJjga1+AgVhZhylY8d8sA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Sep 2018 04:18:26 -0000 ------=_NextPart_000_0001_01D451F0.98180960 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0002_01D451F0.98180960" ------=_NextPart_001_0002_01D451F0.98180960 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Panos, =20 Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it. A quick = list of problems that I would list (without thought) are: =20 1. Historically, lots of people cannot get DER encoding correct. Peter = Gutmann has a huge collection of certificates that were issued by CAs = that were not correctly DER encoded. =20 2. Everybody who wants to support PQ algorithms is now required to add a = DER encoder to their systems. For things which only consume = certificates, crls, cms objects this means that they now have enlarged = code size. 3. I have no idea what the rules are for matching CRLs and certificates = in terms of signature algorithms, I would assume that you need the same = protections for CRLs. 4. You are not signing the alt signature algorithm as part of the TBS = (easy to fix) 5. How are the certificates for the issuer setup? Are there separate = certificates or the same certificate? 6. Just how badly does this affect the path building code as it now = needs to be modified to have additional inputs. 7. Do you want to change the AKI field to make chain building better or = are you going to cause non-supporting systems to potentially start = downloading lots of other certificates as well. =20 8. Same issues applying to CRL distribution points =E2=80=93 it would = potentially be more efficient to have separate CRLs rather than combined = ones as you could not use the extension in that case. 9. How is AIA going to work. 10. If you require that the same algorithms be used, what happens with = OCSP responses and delegated CRL issuers?=E2=80=99 =20 =20 Jim =20 =20 From: Panos Kampanakis (pkampana) =20 Sent: Friday, September 21, 2018 8:08 PM To: Dr. Pala ; Jim Schaad Cc: spasm@ietf.org Subject: RE: [lamps] Double signatures =20 Hi Max, Jim, =20 Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.=20 =20 draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical extensions. =20 I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical and the PQ algos defined = in the composite OID contained in the non-critical extension. =20 Panos =20 =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Dr. Pala Sent: Thursday, September 20, 2018 1:44 PM To: spasm@ietf.org =20 Subject: Re: [lamps] Double signatures =20 Hi Panos, all, that is correct - since the new OIDs for the Key and the Signatures = would be new, clients would fail since they do not know the "composite" = algorithm :D Although developing support for it should not be too difficult, the = solution it is not meant to be backward compatible as we want = applications to be able to fail if they do not even know they were = supposed to generate or verify multiple signatures instead of just one. >From a usage perspective, I am leaning towards the need for the owner of = the certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model). As I said, this solution fits not only certificates, but also OCSP = responses, CRLs, CMS, PKCS#7, etc. and that is part of what is = interesting for us :D I still need to check what are the needed changes = for other formats like PKCS#1/#8/#12 for storing the composite public = and private keys (this part still missing), but I hope that solving that = part will not be too difficult... Cheers, Max =20 On 9/20/18 7:26 AM, Panos Kampanakis (pkampana) wrote: Hi Max, To rephrase Eric=E2=80=99s question, would the CompositeKey+CompositeSig = proposal be backwards compatible with existing systems? I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, right? Panos =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Erik Andersen Sent: Friday, September 14, 2018 11:49 AM To: 'SPASM' ; Directory list = Subject: Re: [lamps] Double signatures =20 The double signature is intended as a migration tool. =20 In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle it. = Legacy systems will ignore this alternative signature. After the = migration period, there will be no alternative signature and the new = stronger signature will be the native signature. =20 Does that make sense? =20 Erik =20 Fra: Massimiliano Pala [ = mailto:m.pala@cablelabs.com]=20 Sendt: 12 September 2018 23:01 Til: Russ Housley < housley@vigilsec.com> Cc: SPASM < spasm@ietf.org>; Erik Andersen < = era@x500.eu> Emne: Re: [lamps] Double signatures =20 Hi Russ, all, my personal position is that the signer MUST use all the keys that have = digitalSignature set, the verifier shall verify all the signatures for = which it does have support for. The rationale for this is that if I certify a public key in the = certificate, you should be able to use the private key to generate the = signature, therefore the approach is the same as usual: sign with your = key. In this case, it just happens that to generate the signature you = have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a = question of what is the threshold that is acceptable for the application = (in terms of risk) in case it does not support all of the algorithms = that are used to generate the composite signature. Ideally it would = verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could = be a good idea - the use of the two OIDs is another way to go to codify = the validation process required. Technically, that makes sense to me, = however I am conflicted as this approach requires that the signer has an = understanding of what the verifier's capabilities are... I think that = defining two OIDs for the signatures could still be useful because the = signer might then decide the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the signature, and = another use-case where we have a composite key with { RSA, HASH-BASED } = and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max =20 On 9/12/18 6:12 AM, Russ Housley wrote: Max:=20 =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 =20 On Sep 11, 2018, at 4:45 PM, Max Pala < = M.Pala@cablelabs.com> wrote: =20 Hi All,=20 =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers,=20 Max =20 =20 ---=20 =20 Cheers,=20 Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ......., altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ....... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 =20 --=20 Best Regards,=20 Massimiliano Pala, Ph.D. Principal Architect Security Services, R&D _______________________________________________ Spasm mailing list Spasm@ietf.org =20 https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_001_0002_01D451F0.98180960 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Panos,

 

Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it.=C2=A0=C2=A0 = A quick list of problems that I would list (without thought) = are:

 

  1. Historically,= lots of people cannot get DER encoding correct.=C2=A0 Peter Gutmann has = a huge collection of certificates that were issued by CAs that were not = correctly DER encoded.=C2=A0
  2. Everybody = who wants to support PQ algorithms is now required to add a DER encoder = to their systems.=C2=A0 For things which only consume certificates, = crls, cms objects this means that they now have enlarged code = size.
  3. I have no = idea what the rules are for matching CRLs and certificates in terms of = signature algorithms, I would assume that you need the same protections = for CRLs.
  4. You are not = signing the alt signature algorithm as part of the TBS (easy to = fix)
  5. How are the = certificates for the issuer setup?=C2=A0 Are there separate certificates = or the same certificate?
  6. Just how = badly does this affect the path building code as it now needs to be = modified to have additional inputs.
  7. Do you want = to change the AKI field to make chain building better or are you going = to cause non-supporting systems to potentially start downloading lots of = other certificates as well.=C2=A0
  8. Same issues = applying to CRL distribution points =E2=80=93 it would potentially be = more efficient to have separate CRLs rather than combined ones as you = could not use the extension in that case.
  9. How is AIA = going to work.
  10. If you = require that the same algorithms be used, what happens with OCSP = responses and delegated CRL = issuers?=E2=80=99

 

 

Jim

 

 

From: Panos Kampanakis (pkampana) <pkampana@cisco.com> =
Sent: Friday, September 21, 2018 8:08 PM
To: Dr. = Pala <madwolf@openca.org>; Jim Schaad = <ietf@augustcellars.com>
Cc: = spasm@ietf.org
Subject: RE: [lamps] Double = signatures

 

Hi Max, Jim,

 

Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.

 

draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical = extensions.

 

I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical  and the PQ algos = defined in the composite OID contained in the non-critical = extension.

 

Panos

 

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Dr. Pala
Sent: Thursday, September 20, = 2018 1:44 PM
To: spasm@ietf.org
Subject: Re: = [lamps] Double signatures

 

Hi Panos, = all,

that is correct - since the new OIDs for the Key = and the Signatures would be new, clients would fail since they do not = know the "composite" algorithm :D

Although = developing support for it should not be too difficult, the solution it = is not meant to be backward compatible as we want applications to be = able to fail if they do not even know they were supposed to generate or = verify multiple signatures instead of just one.

From a = usage perspective, I am leaning towards the need for the owner of the = certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model).

As I said, this = solution fits not only certificates, but also OCSP responses, CRLs, CMS, = PKCS#7, etc. and that is part of what is interesting for us :D I still = need to check what are the needed changes for other formats like = PKCS#1/#8/#12 for storing the composite public and private keys (this = part still missing), but I hope that solving that part will not be too = difficult...

Cheers,
Max

 

On = 9/20/18 7:26 AM, Panos Kampanakis (pkampana) = wrote:

Hi Max,

To rephrase Eric=E2=80=99s question, would the = CompositeKey+CompositeSig proposal be backwards compatible with existing = systems?

I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, = right?

Panos

 

From: Spasm [mailto:spasm-= bounces@ietf.org] On Behalf Of Erik Andersen
Sent: Friday, = September 14, 2018 11:49 AM
To: 'SPASM' <spasm@iet= f.org>; Directory list <x500stand= ard@freelists.org>
Subject: Re: [lamps] Double = signatures

 

The double signature is intended as a migration = tool.

 

In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle = it.  Legacy systems will ignore this alternative signature. After = the migration period, there will be no alternative signature and the new = stronger signature will be the native signature.

 

Does that make sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala= @cablelabs.com]
Sendt: 12 September 2018 23:01
Til: Russ = Housley <housley@vigil= sec.com>
Cc: SPASM <spasm@ietf.or= g>; Erik Andersen <era@x500.eu>
Emne: Re: [lamps] Double = signatures

 

Hi Russ, = all,

my personal position is = that the signer MUST use all the keys that have digitalSignature set, = the verifier shall verify all the signatures for which it does have = support for.

The rationale = for this is that if I certify a public key in the certificate, you = should be able to use the private key to generate the signature, = therefore the approach is the same as usual: sign with your key. In this = case, it just happens that to generate the signature you have to = generate multiple ones and then combine them = together.

For the application = that verifies those signatures, it is always a question of what is the = threshold that is acceptable for the application (in terms of risk) in = case it does not support all of the algorithms that are used to generate = the composite signature. Ideally it would verify all, but it may decide = to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I = think it could be a good idea - the use of the two OIDs is another way = to go to codify the validation process required. Technically, that makes = sense to me, however I am conflicted as this approach requires that the = signer has an understanding of what the verifier's capabilities are... I = think that defining two OIDs for the signatures could still be useful = because the signer might then decide the = "recommended"/"intended" verification behavior... I = can see some use-cases that might have a composite key with { RSA, EC } = and the "Must-Verify-All" OID for the signature, and another = use-case where we have a composite key with { RSA, HASH-BASED } and for = the signature = "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max

 

On 9/12/18 6:12 AM, Russ Housley = wrote:

Max: =

 

During a transition to = quantum-resistant signatures, a signer wants to put a traditional = signature and a quantum-resistant signature on an object.  Given = your description of keyUsage and extendedKeyUsage, both would have = the digitalSignature bit set.  How does a client know if just one = or both signatures must be valid?

 

As Jim Schaad already said, = RFC 5752 talks about this issue when a CMS SignedData contains more = than one SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max = Pala <M.Pala@cablelabs.com> = wrote:

 

Hi All, =

 

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 

What do you = think?

 

Cheers, =

Max

 

 

--- =

 

Cheers, =

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately= , =E2=80=9Cnot every combination needs to be covered=E2=80=9D introduces = a lot of politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.

 =

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 =

-Tim

 =

From:<= /b> = Santosh = Chokhani <= santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <= tim.hollebeek@digicert.com>; 'Erik = Andersen' <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 =

Thanks Tim.

 

There are ways to accommodate your = concern.

 

One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG = IDs.

 

Another way to do this is not every combination needs to be covered and = the user community defines its own  Alg ID Xi which maps to a = SEQUENCE of ALG IDs.

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Doesn=E2=80=99= t the combinatoric explosion render this completely = impractical?

 =

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 =

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 =

I=E2=80=99m = not really looking forward to trying to allocate or manage O(N_c x = N_pq^3) algorithm = identifiers=E2=80=A6

 =

-Tim

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed.

 

Erik

 

Fra: = Spasm = [= mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <= ietf@augustcellars.com>; 'Ryan = Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 =

Why not let algorithm identifier dictate the number of signatures and = their syntax?

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Ryan,<= o:p>

 =

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same = set.

 =

Erik,<= o:p>

 =

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 =

Jim

 =

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: = era@x500.eu
Cc: SPASM <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

 =

On Mon, Sep = 10, 2018 at 10:56 AM Erik Andersen <= era@x500.eu> = wrote:

Hi = Folk,

 =

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 =

We suggest = to enhance the SIGNED data type as shown = below:

 =

SIGNED{ToBeSigned} ::=3D SEQUENCE = {

  COMPONENTS OF = SIGNATURE,

  = .......,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH = COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 =

We have no = intention to use this extended data type for certificates and = CRLs.

 =

For your = information, SIGNATURE is defined as:

 =

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ....... = }

 =

From the = discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt = - that = fundamentally questioned that = approach.

 =

Has the = ITU-T addressed or resolved those concerns? Are they not applicable for = some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

 

--

Best = Regards,

Massimiliano Pala, = Ph.D.

3DCableLabs
Principal Architect
Security = Services, R&D



______________=
_________________________________
Spasm mailing =
list
Spasm@ietf.org
https://www.ietf.org=
/mailman/listinfo/spasm

 

------=_NextPart_001_0002_01D451F0.98180960-- ------=_NextPart_000_0001_01D451F0.98180960 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= ------=_NextPart_000_0001_01D451F0.98180960-- From nobody Sat Sep 22 04:33:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C65A3128D0C for ; Sat, 22 Sep 2018 04:33:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=digicert.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ie6UCZmDQua for ; Sat, 22 Sep 2018 04:33:15 -0700 (PDT) Received: from mail1.bemta23.messagelabs.com (mail1.bemta23.messagelabs.com [67.219.246.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63A78130DE6 for ; Sat, 22 Sep 2018 04:33:15 -0700 (PDT) Received: from [67.219.246.100] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-2.bemta.az-b.us-east-1.aws.symcld.net id 3F/DE-23144-A7826AB5; Sat, 22 Sep 2018 11:33:14 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA2WTfUwTdxjH+d1d7w5C9SwozxhO6UQmeE2rRjF ZFv5xITPLDIn7Q3w76EEbSml6JQM1WbcEO1smLKGDVRAwpWytGjGgxvASa+J8iQbxjUjUUNQw 2BDwBRc32F1/1Wn855fPPd/v83yfu9yPJTUXmVRWrHSIdqtg0dIJ1NDyrtN81SeBAv1Y+5KcU MMsnfNsIIhyDt8uyiXzOpsa6Lz6V52qPL//b2ILuU1lthaWV+5Wmbw1IcbmfKyqrK7pYJzoZk DlRvEsxdWQ8HRccqMEVsPVEdA/5mTwwz0EFy4NMoqL5vRwu/d3QuFkbifMRyKkwiSXAc0Hmyi Fk7iV0HPoPIM9mdDc1korg5K5BgQvJs8SOC4DnK6+qEnN7YCGY3UqnPYdAx1zx6NT47lcmJ0f ijLilsDs5aMETkuBuw9bogxcMoxcv0JjXgx/jM6psH87ND8Nx+rL4IinP8ZLYbDFg5Qw4PoZO P3oCcICD1NeL4n5S/jtSg+DTYMIAidDFBayoKe3X4XZAvcnDsdMAwi6O2/EVvoIgj+OUFjoJu F6tysmpEFtxzCBBQ8DtXf+jWZrOCPUB8N0Hcr2vfV+PtlHcq0IZlq8jC/6pRbBpV8eUtj0NUS 6XhKYt8FU3yMScxb4v59nMGdDoG0iVl8Fz+qGqffrPJwdaItxOtR7RmK9q+HM3KRcZ2T+FLqM 7zvWw/5r03QrWhhE6wvt5hKTo0wwW3iDXs8bDGv4tTKt0Ql7+EJdhcSLguTgDTrhG0knVZUVW Yw6q+g4ieQ/2Wgji8+gW66SMPqAJbSL1d82tRdoFhSWG6tMgmTaZa+wiFIYpbGsFtSfZwYKNI vsYolYWWy2yNfhtQxsojZZvUCR1ZJNKJPMJVi6jDayB4erG0k20viDfE4qp4ayllvF1BR1vtL AKQ2mCuubca8v2CBampqkRnFxcZpEm2gvMzve1cdRCou0SepNypREs9XxJnVcXoiQF7rp8ysL OYT/pVQnOrTxQPHV0MX8ihmy1NC7+id9fu7MVlsjce/Df+L3nRr5dXrzugRj/WypdyrTmxnyh ztqR6tXjUayD2RMb9WURz7ea3enneirFd23/qSvtnD3iyZ8Gzx/bWoPfpa+Nj3u2PLNww/OLf OcMLhd1L4bX+wIu56XDo0t/Nng+upO19EVK0e1lGQSDFmkXRL+AzPeBGNbBAAA X-Env-Sender: tim.hollebeek@digicert.com X-Msg-Ref: server-25.tower-384.messagelabs.com!1537615993!4767011!1 X-Originating-IP: [216.32.180.183] X-SYMC-ESS-Client-Auth: mailfrom-relay-check=pass X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: (qmail 15682 invoked from network); 22 Sep 2018 11:33:13 -0000 Received: from mail-bn3nam01lp0183.outbound.protection.outlook.com (HELO NAM01-BN3-obe.outbound.protection.outlook.com) (216.32.180.183) by server-25.tower-384.messagelabs.com with AES256-SHA256 encrypted SMTP; 22 Sep 2018 11:33:13 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cPkkQek4jxXr/blSjZFmzj+8bzDP/u+DOUJBB9MCS5k=; b=VbS3tx63Wm10QXNZEmxJ5xVJ8iX6j4U8eHWtEvZTVC2RyF/g/wMLrrmwAIUYmn/0gMEMFUyV9U3Wul4n8Qlbgkq8stDv+Md+nzYmsYIFEw0d66Z7CrHP7bcutoGWc+ST89x1zkkgRWpJIN4Qu7SrDogBdOc1Q9a9pmu/X1hi2y0= Received: from BN6PR14MB1106.namprd14.prod.outlook.com (10.173.161.15) by BN6PR14MB1092.namprd14.prod.outlook.com (10.173.161.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.18; Sat, 22 Sep 2018 11:33:10 +0000 Received: from BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::29f5:b1e:c591:e5fc]) by BN6PR14MB1106.namprd14.prod.outlook.com ([fe80::29f5:b1e:c591:e5fc%7]) with mapi id 15.20.1143.019; Sat, 22 Sep 2018 11:33:09 +0000 From: Tim Hollebeek To: Jim Schaad , "'Panos Kampanakis (pkampana)'" CC: "spasm@ietf.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwACpPmAAAKWXAAAAGJ/gAAdEOUAAA5DsMAAAQ7lAAAACX/AAA0enYAAIGE3gAASdg6AAFmu0YABKMIkAAAJAhsAAEX9wAAAAm64gAAOu/qQ Date: Sat, 22 Sep 2018 11:33:09 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> <000001d4522b$44713c10$cd53b430$@augustcellars.com> In-Reply-To: <000001d4522b$44713c10$cd53b430$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [12.0.200.35] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN6PR14MB1092; 6:TThsnHfQhhK12OxKR6dHPITCGoqFtkP+24ABw2Y0gEGu/X7iR8O6Vu3QvzgXxC/HbXMxOiK+lvNoyMu7bw/DxsRJ8ThsAS7oahxPmlmUvN52B2ShjYDKiqCoFAmgvAOsc+Yc4ef8zwi0OhgSIIdjjySJoeMzqMJcAoPtdx/7WIslcDWleP0uTIPtwLMLHbHy4iBNVTpt5DyrEWh+ZZludJFw7dBTXD6LEYmtxR7dZAec8VjX2n3sQpfEHEr7wGMhhLb7DvkFiecag4Kjw669qDgIlkIem/bko55MX0VD9mxP5mrM1KRK0KDkl4cEubiyMdWQYQgx/IgWFNlTDNLH3Ml/sksD/AXCkj7dhM145SKqTDFOJ0NmEVnP4Ywvea4zunlk/eFBaSSsvYwQjj9TluxOcyYl8hQ/tTFqn/KGeE8GDQDnZnbEit+j+jcgXPdiJA5yTdXx4tw1axXd/4euTw==; 5:/jsSBDOfSPcAbpJSg9/U8mh784Ufd53G8nuadre5GPgYNe7l+jkgnMY4MW6heviJFDUAQERaMgg4pD6NHMaSyOfOT6h2yhQd/z5xfbeEPq949o0puHM4BUlJTELU7N1/n8Qrz+J2G6QVAyjDUTo9PSmOHh2lv5NBp7F1Co5HKLE=; 7:dtUbmQ1i4ds9lRAQQ4t/LKHbbx7uHjNV5JuY8bV8MNVpwqdr4MLQ38PtwxXv8zgiHn09lIQN+H/sxJk21XDR2MzuWYUb+d30F+Zju4T7/9MtY55c8SVzENOlziPeGbKlHhScVoSghzaRT0kuuADBvTt0siK/FtFwrMDShgNsry9aU7oGCmVKCojYAQIsq9h30xJdn5PMW9Peylc1g+m/wT6PRyRhSw2HLTnYDPvPWowhCzywk9jP9azpBJrRJvnT x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 9bdf606a-b891-4bb8-0558-08d6207f2c7f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989299)(4534165)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020); SRVR:BN6PR14MB1092; x-ms-traffictypediagnostic: BN6PR14MB1092: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(95692535739014)(35073007944872)(278428928389397)(85827821059158)(120809045254105)(192374486261705)(21748063052155)(28532068793085)(190501279198761)(227612066756510); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231355)(944501410)(52105095)(149027)(150027)(6041310)(20161123558120)(20161123562045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(201708071742011)(7699051); SRVR:BN6PR14MB1092; BCL:0; PCL:0; RULEID:; SRVR:BN6PR14MB1092; x-forefront-prvs: 0803A0241F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(376002)(136003)(39860400002)(346002)(366004)(189003)(199004)(53754006)(51444003)(54094003)(4326008)(53546011)(6506007)(93886005)(102836004)(25786009)(476003)(229853002)(11346002)(6246003)(2900100001)(76176011)(446003)(14444005)(256004)(486006)(16200700003)(44832011)(6436002)(33656002)(53946003)(9686003)(6306002)(54896002)(54556002)(71200400001)(236005)(97736004)(561944003)(53936002)(7696005)(186003)(8676002)(66066001)(71190400001)(733005)(5250100002)(106356001)(14454004)(86362001)(105586002)(55016002)(110136005)(68736007)(7736002)(2906002)(99936001)(99286004)(606006)(5660300001)(316002)(966005)(8936002)(6116002)(3846002)(478600001)(790700001)(81156014)(81166006)(74316002)(26005)(559001)(579004)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR14MB1092; H:BN6PR14MB1106.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: digicert.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: zKWyzR9WqiirvPZskOi/OgtmBwzlmlBHkccUjxQo33Sf+YlC2TCBYwFarI+PuiAeyMVVlI3TO/72kInfWPuDWn0ZmL17ih2hO0G5505+h0oR0KcjIXSs5eoeCsfqTW0eoJHoMHdNUj9FyFdofm6Qtk1KkiSPrTg6oCJ3ODCfSEHoHmepX7gnPHleIW8CnlWOcEz5wsm0Rh4jFZjq3vghWkUfR+ntvuqjE2/qnZ3gzXh25elbjfPff+DPr/itIAUTa3jWFEOSdHSEnI0waeJO/wO4i5/GBw8Z3uoijGoUNvYH7i+2MXJykGspxwjBwr7hC9edJrzP6rfaMU2+uol+3umVSmu5mXrEEp/x4zFixiU= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=2.16.840.1.101.3.4.2.1; boundary="----=_NextPart_000_0900_01D45246.78B12290" MIME-Version: 1.0 X-OriginatorOrg: digicert.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9bdf606a-b891-4bb8-0558-08d6207f2c7f X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Sep 2018 11:33:09.7711 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR14MB1092 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Sep 2018 11:33:22 -0000 ------=_NextPart_000_0900_01D45246.78B12290 Content-Type: multipart/related; boundary="----=_NextPart_001_0901_01D45246.78B149A0" ------=_NextPart_001_0901_01D45246.78B149A0 Content-Type: multipart/alternative; boundary="----=_NextPart_002_0902_01D45246.78B149A0" ------=_NextPart_002_0902_01D45246.78B149A0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable How are chain/path building, AIA, and so on affected? Alternative = signatures just give alternative information that can be either be used = separately or additionally to verify a particular certificate signature. = How you find valid certificates and put them together into a chain = seems to me to be completely independent of how you validate a = particular signature. =20 Problem 5 seems like a particularly odd objection. I haven=E2=80=99t = seen a proposal for separate certificates. Indeed, that is one of the = things that I think is very wise to avoid, as it has caused significant = problems in the past, most recently for example with SHA1 / SHA-256 = transition. The entire point of including multiple signatures with = different algorithms is to avoid the need to have separate hierarchies = for the old and new ways of doing things. =20 =20 There seem to be some assumptions built into your list of problems that = I think are important to unpack, discuss, and resolve first. =20 -Tim =20 From: Spasm On Behalf Of Jim Schaad Sent: Saturday, September 22, 2018 12:18 AM To: 'Panos Kampanakis (pkampana)' Cc: spasm@ietf.org Subject: Re: [lamps] Double signatures =20 Panos, =20 Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it. A quick = list of problems that I would list (without thought) are: =20 1. Historically, lots of people cannot get DER encoding correct. Peter = Gutmann has a huge collection of certificates that were issued by CAs = that were not correctly DER encoded. =20 2. Everybody who wants to support PQ algorithms is now required to add a = DER encoder to their systems. For things which only consume = certificates, crls, cms objects this means that they now have enlarged = code size. 3. I have no idea what the rules are for matching CRLs and certificates = in terms of signature algorithms, I would assume that you need the same = protections for CRLs. 4. You are not signing the alt signature algorithm as part of the TBS = (easy to fix) 5. How are the certificates for the issuer setup? Are there separate = certificates or the same certificate? 6. Just how badly does this affect the path building code as it now = needs to be modified to have additional inputs. 7. Do you want to change the AKI field to make chain building better or = are you going to cause non-supporting systems to potentially start = downloading lots of other certificates as well. =20 8. Same issues applying to CRL distribution points =E2=80=93 it would = potentially be more efficient to have separate CRLs rather than combined = ones as you could not use the extension in that case. 9. How is AIA going to work. 10. If you require that the same algorithms be used, what happens with = OCSP responses and delegated CRL issuers?=E2=80=99 =20 =20 Jim =20 =20 From: Panos Kampanakis (pkampana) >=20 Sent: Friday, September 21, 2018 8:08 PM To: Dr. Pala >; Jim = Schaad > Cc: spasm@ietf.org =20 Subject: RE: [lamps] Double signatures =20 Hi Max, Jim, =20 Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.=20 =20 draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical extensions. =20 I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical and the PQ algos defined = in the composite OID contained in the non-critical extension. =20 Panos =20 =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Dr. Pala Sent: Thursday, September 20, 2018 1:44 PM To: spasm@ietf.org =20 Subject: Re: [lamps] Double signatures =20 Hi Panos, all, that is correct - since the new OIDs for the Key and the Signatures = would be new, clients would fail since they do not know the "composite" = algorithm :D Although developing support for it should not be too difficult, the = solution it is not meant to be backward compatible as we want = applications to be able to fail if they do not even know they were = supposed to generate or verify multiple signatures instead of just one. >From a usage perspective, I am leaning towards the need for the owner of = the certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model). As I said, this solution fits not only certificates, but also OCSP = responses, CRLs, CMS, PKCS#7, etc. and that is part of what is = interesting for us :D I still need to check what are the needed changes = for other formats like PKCS#1/#8/#12 for storing the composite public = and private keys (this part still missing), but I hope that solving that = part will not be too difficult... Cheers, Max =20 On 9/20/18 7:26 AM, Panos Kampanakis (pkampana) wrote: Hi Max, To rephrase Eric=E2=80=99s question, would the CompositeKey+CompositeSig = proposal be backwards compatible with existing systems? I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, right? Panos =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Erik Andersen Sent: Friday, September 14, 2018 11:49 AM To: 'SPASM' ; Directory list = Subject: Re: [lamps] Double signatures =20 The double signature is intended as a migration tool. =20 In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle it. = Legacy systems will ignore this alternative signature. After the = migration period, there will be no alternative signature and the new = stronger signature will be the native signature. =20 Does that make sense? =20 Erik =20 Fra: Massimiliano Pala [ = mailto:m.pala@cablelabs.com]=20 Sendt: 12 September 2018 23:01 Til: Russ Housley < housley@vigilsec.com> Cc: SPASM < spasm@ietf.org>; Erik Andersen < = era@x500.eu> Emne: Re: [lamps] Double signatures =20 Hi Russ, all, my personal position is that the signer MUST use all the keys that have = digitalSignature set, the verifier shall verify all the signatures for = which it does have support for. The rationale for this is that if I certify a public key in the = certificate, you should be able to use the private key to generate the = signature, therefore the approach is the same as usual: sign with your = key. In this case, it just happens that to generate the signature you = have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a = question of what is the threshold that is acceptable for the application = (in terms of risk) in case it does not support all of the algorithms = that are used to generate the composite signature. Ideally it would = verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could = be a good idea - the use of the two OIDs is another way to go to codify = the validation process required. Technically, that makes sense to me, = however I am conflicted as this approach requires that the signer has an = understanding of what the verifier's capabilities are... I think that = defining two OIDs for the signatures could still be useful because the = signer might then decide the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the signature, and = another use-case where we have a composite key with { RSA, HASH-BASED } = and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max =20 On 9/12/18 6:12 AM, Russ Housley wrote: Max:=20 =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 =20 On Sep 11, 2018, at 4:45 PM, Max Pala < = M.Pala@cablelabs.com> wrote: =20 Hi All,=20 =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers,=20 Max =20 =20 ---=20 =20 Cheers,=20 Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ........, altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ....... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 =20 --=20 Best Regards,=20 Massimiliano Pala, Ph.D. Principal Architect Security Services, R&D =20 _______________________________________________ Spasm mailing list Spasm@ietf.org =20 https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_002_0902_01D45246.78B149A0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

How are chain/path building, AIA, and so on affected?=C2=A0 = Alternative signatures just give alternative information that can be = either be used separately or additionally to verify a particular = certificate signature.=C2=A0 How you find valid certificates and put = them together into a chain seems to me to be completely independent of = how you validate a particular signature.

 

Problem 5 seems like a particularly odd objection.=C2=A0 I = haven=E2=80=99t seen a proposal for separate certificates.=C2=A0 Indeed, = that is one of the things that I think is very wise to avoid, as it has = caused significant problems in the past, most recently for example with = SHA1 / SHA-256 transition.=C2=A0 The entire point of including multiple = signatures with different algorithms is to avoid the need to have = separate hierarchies for the old and new ways of doing things.=C2=A0 =

 

There seem to be some assumptions built into your list of problems = that I think are important to unpack, discuss, and resolve = first.

 

-Tim

 

From: Spasm <spasm-bounces@ietf.org> On Behalf Of Jim = Schaad
Sent: Saturday, September 22, 2018 12:18 = AM
To: 'Panos Kampanakis (pkampana)' = <pkampana@cisco.com>
Cc: = spasm@ietf.org
Subject: Re: [lamps] Double = signatures

 

Panos,

 

Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it.   = A quick list of problems that I would list (without thought) = are:

 

  1. Historically,= lots of people cannot get DER encoding correct.  Peter Gutmann has = a huge collection of certificates that were issued by CAs that were not = correctly DER encoded. 
  2. Everybody = who wants to support PQ algorithms is now required to add a DER encoder = to their systems.  For things which only consume certificates, = crls, cms objects this means that they now have enlarged code = size.
  3. I have no = idea what the rules are for matching CRLs and certificates in terms of = signature algorithms, I would assume that you need the same protections = for CRLs.
  4. You are not = signing the alt signature algorithm as part of the TBS (easy to = fix)
  5. How are the = certificates for the issuer setup?  Are there separate certificates = or the same certificate?
  6. Just how = badly does this affect the path building code as it now needs to be = modified to have additional inputs.
  7. Do you want = to change the AKI field to make chain building better or are you going = to cause non-supporting systems to potentially start downloading lots of = other certificates as well. 
  8. Same issues = applying to CRL distribution points =E2=80=93 it would potentially be = more efficient to have separate CRLs rather than combined ones as you = could not use the extension in that case.
  9. How is AIA = going to work.
  10. If you = require that the same algorithms be used, what happens with OCSP = responses and delegated CRL = issuers?=E2=80=99

 

 

Jim

 

 

From: Panos Kampanakis (pkampana) <pkampana@cisco.com> =
Sent: Friday, September 21, 2018 8:08 PM
To: Dr. = Pala <madwolf@openca.org>; Jim = Schaad <ietf@augustcellars.com>
= Cc: spasm@ietf.org
Subject: RE: = [lamps] Double signatures

 

Hi Max, Jim,

 

Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.

 

draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical = extensions.

 

I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical  and the PQ algos = defined in the composite OID contained in the non-critical = extension.

 

Panos

 

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Dr. Pala
Sent: Thursday, September 20, = 2018 1:44 PM
To: spasm@ietf.org
Subject: Re: = [lamps] Double signatures

 

Hi Panos, = all,

that is correct - since the new OIDs for the Key = and the Signatures would be new, clients would fail since they do not = know the "composite" algorithm :D

Although = developing support for it should not be too difficult, the solution it = is not meant to be backward compatible as we want applications to be = able to fail if they do not even know they were supposed to generate or = verify multiple signatures instead of just one.

From a = usage perspective, I am leaning towards the need for the owner of the = certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model).

As I said, this = solution fits not only certificates, but also OCSP responses, CRLs, CMS, = PKCS#7, etc. and that is part of what is interesting for us :D I still = need to check what are the needed changes for other formats like = PKCS#1/#8/#12 for storing the composite public and private keys (this = part still missing), but I hope that solving that part will not be too = difficult...

Cheers,
Max

 

On = 9/20/18 7:26 AM, Panos Kampanakis (pkampana) = wrote:

Hi Max,

To rephrase Eric=E2=80=99s question, would the = CompositeKey+CompositeSig proposal be backwards compatible with existing = systems?

I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, = right?

Panos

 

From: Spasm [mailto:spasm-= bounces@ietf.org] On Behalf Of Erik Andersen
Sent: Friday, = September 14, 2018 11:49 AM
To: 'SPASM' <spasm@iet= f.org>; Directory list <x500stand= ard@freelists.org>
Subject: Re: [lamps] Double = signatures

 

The double signature is intended as a migration = tool.

 

In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle = it.  Legacy systems will ignore this alternative signature. After = the migration period, there will be no alternative signature and the new = stronger signature will be the native signature.

 

Does that make sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala= @cablelabs.com]
Sendt: 12 September 2018 23:01
Til: Russ = Housley <housley@vigil= sec.com>
Cc: SPASM <spasm@ietf.or= g>; Erik Andersen <era@x500.eu>
Emne: Re: [lamps] Double = signatures

 

Hi Russ, = all,

my personal position is = that the signer MUST use all the keys that have digitalSignature set, = the verifier shall verify all the signatures for which it does have = support for.

The rationale = for this is that if I certify a public key in the certificate, you = should be able to use the private key to generate the signature, = therefore the approach is the same as usual: sign with your key. In this = case, it just happens that to generate the signature you have to = generate multiple ones and then combine them = together.

For the application = that verifies those signatures, it is always a question of what is the = threshold that is acceptable for the application (in terms of risk) in = case it does not support all of the algorithms that are used to generate = the composite signature. Ideally it would verify all, but it may decide = to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I = think it could be a good idea - the use of the two OIDs is another way = to go to codify the validation process required. Technically, that makes = sense to me, however I am conflicted as this approach requires that the = signer has an understanding of what the verifier's capabilities are... I = think that defining two OIDs for the signatures could still be useful = because the signer might then decide the = "recommended"/"intended" verification behavior... I = can see some use-cases that might have a composite key with { RSA, EC } = and the "Must-Verify-All" OID for the signature, and another = use-case where we have a composite key with { RSA, HASH-BASED } and for = the signature = "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max

 

On 9/12/18 6:12 AM, Russ Housley = wrote:

Max: =

 

During a transition to = quantum-resistant signatures, a signer wants to put a traditional = signature and a quantum-resistant signature on an object.  Given = your description of keyUsage and extendedKeyUsage, both would have = the digitalSignature bit set.  How does a client know if just one = or both signatures must be valid?

 

As Jim Schaad already said, = RFC 5752 talks about this issue when a CMS SignedData contains more = than one SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max = Pala <M.Pala@cablelabs.com> = wrote:

 

Hi All, =

 

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 

What do you = think?

 

Cheers, =

Max

 

 

--- =

 

Cheers, =

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately= , =E2=80=9Cnot every combination needs to be covered=E2=80=9D introduces = a lot of politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.

 =

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 =

-Tim

 =

From:<= /b> = Santosh = Chokhani <= santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <= tim.hollebeek@digicert.com>; 'Erik = Andersen' <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 =

Thanks Tim.

 

There are ways to accommodate your = concern.

 

One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG = IDs.

 

Another way to do this is not every combination needs to be covered and = the user community defines its own  Alg ID Xi which maps to a = SEQUENCE of ALG IDs.

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Doesn=E2=80=99= t the combinatoric explosion render this completely = impractical?

 =

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 =

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 =

I=E2=80=99m = not really looking forward to trying to allocate or manage O(N_c x = N_pq^3) algorithm = identifiers=E2=80=A6

 =

-Tim

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed.

 

Erik

 

Fra: = Spasm = [= mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <= ietf@augustcellars.com>; 'Ryan = Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 =

Why not let algorithm identifier dictate the number of signatures and = their syntax?

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Ryan,<= o:p>

 =

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same = set.

 =

Erik,<= o:p>

 =

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 =

Jim

 =

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: = era@x500.eu
Cc: SPASM <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

 =

On Mon, Sep = 10, 2018 at 10:56 AM Erik Andersen <= era@x500.eu> = wrote:

Hi = Folk,

 =

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 =

We suggest = to enhance the SIGNED data type as shown = below:

 =

SIGNED{ToBeSigned} ::=3D SEQUENCE = {

  COMPONENTS OF = SIGNATURE,

  = ........,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH COMPONENTS {..., altAlgorithmIdentifier = PRESENT, altSignature PRESENT } |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 =

We have no = intention to use this extended data type for certificates and = CRLs.

 =

For your = information, SIGNATURE is defined as:

 =

SIGNATURE = ::=3D SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  = ....... = }

 =

From the = discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt = - that = fundamentally questioned that = approach.

 =

Has the = ITU-T addressed or resolved those concerns? Are they not applicable for = some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

 

--

Best = Regards,

Massimiliano Pala, = Ph.D.

3DCableLabs
Principal Architect
Security = Services, R&D

 

________________=
_______________________________
Spasm mailing =
list
Spasm@ietf.org
https://www.ietf.org=
/mailman/listinfo/spasm

 

------=_NextPart_002_0902_01D45246.78B149A0-- ------=_NextPart_001_0901_01D45246.78B149A0 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= ------=_NextPart_001_0901_01D45246.78B149A0-- ------=_NextPart_000_0900_01D45246.78B12290 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD0sw ggO3MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTEx MTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfzt2D5cRKlrtwmlIiq9M71 IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq9g+YMjZ2zN7dPKii72r7IfJS Yd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OMM9nYLxj+KA+zp4PWw25EwGE1lhb+ WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJfDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh 5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwOsLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Y d08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXr oq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqG SIb3DQEBBQUAA4IBAQCiDrzf4u3w43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwS TFjk0z2DSUVYlzVpGqhH6lbGeasS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJ s13rsgkq6ybteL59PyvztyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLx vlBnt2y98/Efaww2BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76 jRslbWyPpbdhAbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIFOjCCBCKgAwIBAgIQ Di7WjgxCjxTrYbReNHesEzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMM RGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2Vy dCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcxMTI4MDAwMDAwWhcNMjIwMjI1MTIwMDAwWjBWMQsw CQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDENMAsGA1UEBxMETGVoaTERMA8GA1UEChMIRGlnaUNl cnQxFjAUBgNVBAMTDVRpbSBIb2xsZWJlZWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDKUTIS9F3d7CfkCjsf4my28pYoZJDkEAiXVqGP4jzbFkszUQNfW3PYpFUo1GnKQykl/tM0qnzw 05bfVLo1+ce0e9fyAwYfulr+HaAVCPqx+PZw9CDY6c0NYd7Fc7S0scONxKekNF4q1mUucfGuGapW sEsyix0CuR0NMuJ4I+w8qMn9MzjzI7bvduG+uVLmZIi0p6D8+2R5BOQFy0tVeQ/aLfS91fG1DTYF YkPF+a/6JlFxzywPzCth8KW2Po4w8JqQWtam/ADKrgMaOnEJs9csefTW/FWRDeGQk5t3rnyS19FP QfpyPPau4ChB5xokfRcg3VEwqfOoIIexjUhZY5X9AgMBAAGjggHzMIIB7zAfBgNVHSMEGDAWgBTn AiOAAE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUjqBhf3GcBV6YGYSmp2iS4Wi/3N4wDAYDVR0T AQH/BAIwADAlBgNVHREEHjAcgRp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAmOLw9+cVMHn8tJ0k 76baCfFZwkvfvxSAlCXo+Fcsv55/og0V065Rpb4HvVTi0e0qKCMbBxc71NWxhMvKJHt+sfSmVatX mAOPNDRvtVvJBkcd0bvzMut/r3npQqs1wezHLtAq+MlQZDjgiJB+DkNblnnphzEQSp7q/4K9oMoP KViRxBv+/kseA8GOfhHU6EVmeu9xQrBqexH1DPUrUSGpNGDyvtUaU+bBy8Kz2hQfOu6f/73wLqUx e583C9y2Gqn1xCB77yPxXqRSLLRC6FbrToJbKiFYQJ4znZZyhPYJHL0SOpWyXfVKp4PEO54A/xr5 oVyPhEQhOtasoIRCLtHZrzCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggO/MIIDuwIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQDi7WjgxCjxTrYbReNHes EzANBglghkgBZQMEAgEFAKCCAhcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTgwOTIyMTEzMjUyWjAvBgkqhkiG9w0BCQQxIgQg9wBgQ7lHvBT+o4TjGn8kZP7i0ZnT qA3L2VoZHTjgW5EwgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOthtF40d6wTMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAOLtaODEKPFOth tF40d6wTMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggq hkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCG SAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUA BIIBAJcHXXAd1ltvoleTb92/bVUCpBjCiOQT55nsN07JGWbjBcuZO2XtoGjfBQKTn0GZBi4qD9Bv 2iz/+l2/irQDBtSiYsVHNKY1vAsAFaBXPhiKdbeyRFck7mxMJijKfsk7TIAqglIbNMpiAm9CoQeu ITAu+9UGnZQgSokzbI2hXZq6YJrZCqCgmkJHRIJosFHlx4LhKihxPOx6oOGF8LBYCDgZ9pAnKVvR mFwy9SNHUqz/vAnQdQExr9XDxgherZ4o/9AzfwlbUfNGKx/yUSa8pypITy8cwzFLcNFh1IDe5ZlB KkRBMT4iCqiLBHXoQPiMS3NN7gOKrEtAvL+wH9ixhQgAAAAAAAA= ------=_NextPart_000_0900_01D45246.78B12290-- From nobody Sat Sep 22 14:49:23 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1648112785F for ; Sat, 22 Sep 2018 14:49:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id puSje-JqkieR for ; Sat, 22 Sep 2018 14:49:16 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE5A912426A for ; Sat, 22 Sep 2018 14:49:14 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Sat, 22 Sep 2018 14:44:40 -0700 From: Jim Schaad To: 'Tim Hollebeek' , "'Panos Kampanakis (pkampana)'" CC: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> <000001d4522b$44713c10$cd53b430$@augustcellars.com> In-Reply-To: Date: Sat, 22 Sep 2018 14:48:37 -0700 Message-ID: <005401d452be$068c2a20$13a47e60$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_0055_01D45283.5A33E1D0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEeKhTkIyWJvDJmtkckrYoYnqsyLAKU/EXwAvtpPxkCYiDthAIpj1iIAzshKQwBinJdFQHyxjh8AhUcZ2UCVBhheAIUS8OeAbwv1UoDDno9LAJjga1+AgVhZhwB6/X4ygKdoltGpUCh7VA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Sep 2018 21:49:21 -0000 ------=_NextPart_000_0055_01D45283.5A33E1D0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0056_01D45283.5A3408E0" ------=_NextPart_001_0056_01D45283.5A3408E0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Tim, =20 Except for the case of self-issued certificates, I almost never care = about processing a single certificate. Rather I am going to process a = chain of certificates that goes back to a trust root. Comparing this to = the SHA1/SHA-256 transition I don=E2=80=99t think is very relevant. In = that case one could be using the same public key value with different = signature algorithms. Here we are looking at using two completely = different public key structures, i.e. an EdDSA and a Hash-based = signature. This means that both public keys need to be findable from = some issuer certificate. This proposal does not have any way of = encoding the multiple public keys. From this I make the assumption = that there is a single certificate for each of the public keys, which = can have multiple signatures on it. If the public keys are in their = own certificates, then you get lots of fun in terms of trying to build = the chains and all of the things that I pointed to are relevant. If the = public keys are in a single certificate then this is not documented. =20 jim =20 =20 =20 From: Tim Hollebeek =20 Sent: Saturday, September 22, 2018 4:33 AM To: Jim Schaad ; 'Panos Kampanakis (pkampana)' = Cc: spasm@ietf.org Subject: RE: [lamps] Double signatures =20 How are chain/path building, AIA, and so on affected? Alternative = signatures just give alternative information that can be either be used = separately or additionally to verify a particular certificate signature. = How you find valid certificates and put them together into a chain = seems to me to be completely independent of how you validate a = particular signature. =20 Problem 5 seems like a particularly odd objection. I haven=E2=80=99t = seen a proposal for separate certificates. Indeed, that is one of the = things that I think is very wise to avoid, as it has caused significant = problems in the past, most recently for example with SHA1 / SHA-256 = transition. The entire point of including multiple signatures with = different algorithms is to avoid the need to have separate hierarchies = for the old and new ways of doing things. =20 =20 There seem to be some assumptions built into your list of problems that = I think are important to unpack, discuss, and resolve first. =20 -Tim =20 From: Spasm > On = Behalf Of Jim Schaad Sent: Saturday, September 22, 2018 12:18 AM To: 'Panos Kampanakis (pkampana)' > Cc: spasm@ietf.org =20 Subject: Re: [lamps] Double signatures =20 Panos, =20 Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it. A quick = list of problems that I would list (without thought) are: =20 1. Historically, lots of people cannot get DER encoding correct. Peter = Gutmann has a huge collection of certificates that were issued by CAs = that were not correctly DER encoded. =20 2. Everybody who wants to support PQ algorithms is now required to add a = DER encoder to their systems. For things which only consume = certificates, crls, cms objects this means that they now have enlarged = code size. 3. I have no idea what the rules are for matching CRLs and certificates = in terms of signature algorithms, I would assume that you need the same = protections for CRLs. 4. You are not signing the alt signature algorithm as part of the TBS = (easy to fix) 5. How are the certificates for the issuer setup? Are there separate = certificates or the same certificate? 6. Just how badly does this affect the path building code as it now = needs to be modified to have additional inputs. 7. Do you want to change the AKI field to make chain building better or = are you going to cause non-supporting systems to potentially start = downloading lots of other certificates as well. =20 8. Same issues applying to CRL distribution points =E2=80=93 it would = potentially be more efficient to have separate CRLs rather than combined = ones as you could not use the extension in that case. 9. How is AIA going to work. 10. If you require that the same algorithms be used, what happens with = OCSP responses and delegated CRL issuers?=E2=80=99 =20 =20 Jim =20 =20 From: Panos Kampanakis (pkampana) >=20 Sent: Friday, September 21, 2018 8:08 PM To: Dr. Pala >; Jim = Schaad > Cc: spasm@ietf.org =20 Subject: RE: [lamps] Double signatures =20 Hi Max, Jim, =20 Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.=20 =20 draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical extensions. =20 I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical and the PQ algos defined = in the composite OID contained in the non-critical extension. =20 Panos =20 =20 From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Dr. Pala Sent: Thursday, September 20, 2018 1:44 PM To: spasm@ietf.org =20 Subject: Re: [lamps] Double signatures =20 Hi Panos, all, that is correct - since the new OIDs for the Key and the Signatures = would be new, clients would fail since they do not know the "composite" = algorithm :D Although developing support for it should not be too difficult, the = solution it is not meant to be backward compatible as we want = applications to be able to fail if they do not even know they were = supposed to generate or verify multiple signatures instead of just one. >From a usage perspective, I am leaning towards the need for the owner of = the certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model). As I said, this solution fits not only certificates, but also OCSP = responses, CRLs, CMS, PKCS#7, etc. and that is part of what is = interesting for us :D I still need to check what are the needed changes = for other formats like PKCS#1/#8/#12 for storing the composite public = and private keys (this part still missing), but I hope that solving that = part will not be too difficult... Cheers, Max =20 On 9/20/18 7:26 AM, Panos Kampanakis (pkampana) wrote: Hi Max, To rephrase Eric=E2=80=99s question, would the CompositeKey+CompositeSig = proposal be backwards compatible with existing systems? I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, right? Panos =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Erik Andersen Sent: Friday, September 14, 2018 11:49 AM To: 'SPASM' ; Directory list = Subject: Re: [lamps] Double signatures =20 The double signature is intended as a migration tool. =20 In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle it. = Legacy systems will ignore this alternative signature. After the = migration period, there will be no alternative signature and the new = stronger signature will be the native signature. =20 Does that make sense? =20 Erik =20 Fra: Massimiliano Pala [ = mailto:m.pala@cablelabs.com]=20 Sendt: 12 September 2018 23:01 Til: Russ Housley < housley@vigilsec.com> Cc: SPASM < spasm@ietf.org>; Erik Andersen < = era@x500.eu> Emne: Re: [lamps] Double signatures =20 Hi Russ, all, my personal position is that the signer MUST use all the keys that have = digitalSignature set, the verifier shall verify all the signatures for = which it does have support for. The rationale for this is that if I certify a public key in the = certificate, you should be able to use the private key to generate the = signature, therefore the approach is the same as usual: sign with your = key. In this case, it just happens that to generate the signature you = have to generate multiple ones and then combine them together. For the application that verifies those signatures, it is always a = question of what is the threshold that is acceptable for the application = (in terms of risk) in case it does not support all of the algorithms = that are used to generate the composite signature. Ideally it would = verify all, but it may decide to verify less (at least one). I also saw the other e-mail from Jim on this topic and I think it could = be a good idea - the use of the two OIDs is another way to go to codify = the validation process required. Technically, that makes sense to me, = however I am conflicted as this approach requires that the signer has an = understanding of what the verifier's capabilities are... I think that = defining two OIDs for the signatures could still be useful because the = signer might then decide the "recommended"/"intended" verification = behavior... I can see some use-cases that might have a composite key = with { RSA, EC } and the "Must-Verify-All" OID for the signature, and = another use-case where we have a composite key with { RSA, HASH-BASED } = and for the signature "Must-Verify-At-Least-One". Does this make sense? Cheers, Max =20 On 9/12/18 6:12 AM, Russ Housley wrote: Max:=20 =20 During a transition to quantum-resistant signatures, a signer wants to = put a traditional signature and a quantum-resistant signature on an = object. Given your description of keyUsage and extendedKeyUsage, both = would have the digitalSignature bit set. How does a client know if just = one or both signatures must be valid? =20 As Jim Schaad already said, RFC 5752 talks about this issue when a CMS = SignedData contains more than one SignerInfo. =20 Russ =20 =20 On Sep 11, 2018, at 4:45 PM, Max Pala < = M.Pala@cablelabs.com> wrote: =20 Hi All,=20 =20 I am working on a similar - but different - solution, in particular I = solve the issue of (a) being able to combine more than one public key, = (b) only one (actually two) OIDs required, and (c) simply the processing = by re-utilizing the same data structures we have today. =20 I particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite signature=E2=80=9D. =20 The first one encodes in the key value=E2=80=99s BITSTRING the DER value = of the SEQUENCE of public keys (each of which is a the = subjectPublicKeyInfo structure) and uses a specific OID that identifies = the public key type. The parameters of the compositeKey algorithm can be = used to encode the keyUsage and the extendedKeyUsage for each of the = keys in the composite key. =20 The same approach is used for the =E2=80=9CComposite Signature=E2=80=9D = case where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the keys. =20 As soon as I have some spare time, I will submit the draft - maybe this = could be discussed in Bangkok? =20 This simple idea allows us to have all the other procedures related to = PKIs work - this means we can combine ECC with RSA or with a = Quantum-Resistant algorithm (when finally available and standardized). A = step forward for the deployment of hybrid-PKIs where multiple Lagos for = keys can be used to authenticate data, certs, revocation data, etc... we = plan to use this in our infrastructures to provide a transitional path = for post-Quantum transition and to further improve the algorithm-agility = capability of PKIs. =20 What do you think? =20 Cheers,=20 Max =20 =20 ---=20 =20 Cheers,=20 Max On Sep 11, 2018, at 8:38 AM, Tim Hollebeek < = tim.hollebeek@digicert.com> wrote: Unfortunately, =E2=80=9Cnot every combination needs to be = covered=E2=80=9D introduces a lot of politics around choosing which = combinations =E2=80=9Cneed to be covered=E2=80=9D, a subject on which = inevitably not everyone agrees. I would rather avoid all those = discussions and the unnecessary work they represent. =20 I personally don=E2=80=99t think a single AlgID which implies a SEQUENCE = of ALG IDs is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent. For simple hybrid use cases, there is also a lot of value = in having the classical algorithm ID being the same as it usually is, to = allow easier interoperability with older systems that don=E2=80=99t = understand the newer algorithms (and can blissfully ignore them). =20 -Tim =20 From: Santosh Chokhani < = santosh.chokhani@gmail.com>=20 Sent: Tuesday, September 11, 2018 10:29 AM To: Tim Hollebeek < = tim.hollebeek@digicert.com>; 'Erik Andersen' < = era@x500.eu>; 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: RE: [lamps] Double signatures =20 Thanks Tim. =20 There are ways to accommodate your concern. =20 One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG IDs. =20 Another way to do this is not every combination needs to be covered and = the user community defines its own Alg ID Xi which maps to a SEQUENCE = of ALG IDs. =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Tim Hollebeek Sent: Tuesday, September 11, 2018 10:03 AM To: Erik Andersen < era@x500.eu>; 'SPASM' < = spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Doesn=E2=80=99t the combinatoric explosion render this completely = impractical? =20 You need N_c x N_pq algorithm identifiers just to handle the simple = hybrid use case where a single classical algorithm is being used in = conjunction with a single post-quantum algorithm. =20 And there are people who want to use multiple post-quantum algorithms to = hedge against potential yet to be discovered weaknesses in post-quantum = algorithms. =20 I=E2=80=99m not really looking forward to trying to allocate or manage = O(N_c x N_pq^3) algorithm identifiers=E2=80=A6 =20 -Tim =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Erik Andersen Sent: Tuesday, September 11, 2018 3:10 AM To: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Hi Santosh, =20 You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed. =20 Erik =20 Fra: Spasm [ = mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh Chokhani Sendt: 10 September 2018 19:18 Til: 'Jim Schaad' < = ietf@augustcellars.com>; 'Ryan Sleevi' < = ryan-ietf@sleevi.com>; era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Emne: Re: [lamps] Double signatures =20 Why not let algorithm identifier dictate the number of signatures and = their syntax? =20 From: Spasm [ = mailto:spasm-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Monday, September 10, 2018 1:07 PM To: 'Ryan Sleevi' < ryan-ietf@sleevi.com>; = era@x500.eu Cc: 'SPASM' < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 Ryan, =20 The discussion in London dealt with a completely different proposal than = this one. While I think there are problems with this that need to be = dealt with they are mostly not the same set. =20 Erik, =20 Why is this considered to be a preferred solution to defining a new = signature algorithm which contains as the parameter the sequence of = algorithm identifiers and as the signature value a sequence of signature = values. The problem with just defining the extension to SIGNED is that = one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here. =20 Jim =20 =20 From: Spasm < spasm-bounces@ietf.org> On = Behalf Of Ryan Sleevi Sent: Monday, September 10, 2018 8:53 AM To: era@x500.eu Cc: SPASM < spasm@ietf.org>; = x500standard@freelists.org Subject: Re: [lamps] Double signatures =20 =20 On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen < = era@x500.eu> wrote: Hi Folk, =20 In ITU-T we have plans to allow for double signatures using the SIGNED = parametrized data type defined in X.509 to cope with situation as = described in the internet draft: =E2=80=9CMultiple Public-Key Algorithm = X.509 Certificates (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D =20 We suggest to enhance the SIGNED data type as shown below: =20 SIGNED{ToBeSigned} ::=3D SEQUENCE { COMPONENTS OF SIGNATURE, ........, altAlgorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL, altSignature BIT STRING OPTIONAL=20 } (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature = PRESENT } | WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT, altSignature = ABSENT } ) =20 We are open to comments. We know that IETF is not a heavy user of this = data type. =20 We have no intention to use this extended data type for certificates and = CRLs. =20 For your information, SIGNATURE is defined as: =20 SIGNATURE ::=3D SEQUENCE { algorithmIdentifier AlgorithmIdentifier{{SupportedAlgorithms}}, signature BIT STRING, ....... } =20 >From the discussions in London (101), there were a number of challenges = identified during the discussion - = = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt - that fundamentally questioned that approach. =20 Has the ITU-T addressed or resolved those concerns? Are they not = applicable for some reason specific to ITU-T?=20 _______________________________________________ Spasm mailing list Spasm@ietf.org = https://www.ietf.org/mailman/listinfo/spasm =20 =20 --=20 Best Regards,=20 Massimiliano Pala, Ph.D. Principal Architect Security Services, R&D =20 _______________________________________________ Spasm mailing list Spasm@ietf.org =20 https://www.ietf.org/mailman/listinfo/spasm =20 ------=_NextPart_001_0056_01D45283.5A3408E0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Tim,

 

Except for the case of self-issued certificates, I almost never care = about processing a single certificate.=C2=A0 Rather I am going to = process a chain of certificates that goes back to a trust root. = Comparing this to the SHA1/SHA-256 transition I don=E2=80=99t think is = very relevant.=C2=A0 In that case one could be using the same public key = value with different signature algorithms.=C2=A0 Here we are looking at = using two completely different public key structures, i.e. an EdDSA and = a Hash-based signature.=C2=A0 This means that both public keys need to = be findable from some issuer certificate.=C2=A0 This proposal does not = have any way of encoding the multiple public keys.=C2=A0=C2=A0 From this = I make the assumption that there is a single certificate for each of the = public keys, which can have multiple signatures on it.=C2=A0 =C2=A0If = the public keys are in their own certificates, then you get lots of fun = in terms of trying to build the chains and all of the things that I = pointed to are relevant.=C2=A0 If the public keys are in a single = certificate then this is not documented.

 

jim

 

 

 

From: Tim Hollebeek <tim.hollebeek@digicert.com>
Sent: = Saturday, September 22, 2018 4:33 AM
To: Jim Schaad = <ietf@augustcellars.com>; 'Panos Kampanakis (pkampana)' = <pkampana@cisco.com>
Cc: = spasm@ietf.org
Subject: RE: [lamps] Double = signatures

 

How are chain/path building, AIA, and so on affected?  = Alternative signatures just give alternative information that can be = either be used separately or additionally to verify a particular = certificate signature.  How you find valid certificates and put = them together into a chain seems to me to be completely independent of = how you validate a particular signature.

 

Problem 5 seems like a particularly odd objection.  I = haven=E2=80=99t seen a proposal for separate certificates.  Indeed, = that is one of the things that I think is very wise to avoid, as it has = caused significant problems in the past, most recently for example with = SHA1 / SHA-256 transition.  The entire point of including multiple = signatures with different algorithms is to avoid the need to have = separate hierarchies for the old and new ways of doing things.  =

 

There seem to be some assumptions built into your list of problems = that I think are important to unpack, discuss, and resolve = first.

 

-Tim

 

From: Spasm <spasm-bounces@ietf.org> = On Behalf Of Jim Schaad
Sent: Saturday, September 22, = 2018 12:18 AM
To: 'Panos Kampanakis (pkampana)' <pkampana@cisco.com>
Cc: spasm@ietf.org
Subject: Re: = [lamps] Double signatures

 

Panos,

 

Without a really detailed analysis of your proposal and how it will = interact with existing code I could not possibly support it.   = A quick list of problems that I would list (without thought) = are:

 

  1. Historically,= lots of people cannot get DER encoding correct.  Peter Gutmann has = a huge collection of certificates that were issued by CAs that were not = correctly DER encoded. 
  2. Everybody = who wants to support PQ algorithms is now required to add a DER encoder = to their systems.  For things which only consume certificates, = crls, cms objects this means that they now have enlarged code = size.
  3. I have no = idea what the rules are for matching CRLs and certificates in terms of = signature algorithms, I would assume that you need the same protections = for CRLs.
  4. You are not = signing the alt signature algorithm as part of the TBS (easy to = fix)
  5. How are the = certificates for the issuer setup?  Are there separate certificates = or the same certificate?
  6. Just how = badly does this affect the path building code as it now needs to be = modified to have additional inputs.
  7. Do you want = to change the AKI field to make chain building better or are you going = to cause non-supporting systems to potentially start downloading lots of = other certificates as well. 
  8. Same issues = applying to CRL distribution points =E2=80=93 it would potentially be = more efficient to have separate CRLs rather than combined ones as you = could not use the extension in that case.
  9. How is AIA = going to work.
  10. If you = require that the same algorithms be used, what happens with OCSP = responses and delegated CRL = issuers?=E2=80=99

 

 

Jim

 

 

From: Panos Kampanakis (pkampana) <pkampana@cisco.com> =
Sent: Friday, September 21, 2018 8:08 PM
To: Dr. = Pala <madwolf@openca.org>; Jim = Schaad <ietf@augustcellars.com>
= Cc: spasm@ietf.org
Subject: RE: = [lamps] Double signatures

 

Hi Max, Jim,

 

Agreed. In summary, there are too good proposals (Erik, Max=E2=80=99s) = that can combine multiple PKs and Sigs. That would allow us to us more = than one PQ algos if they are not trusted.

 

draft-truskovsky-lamps-pq-hybrid allows for backwards compatibility by = defining one only PQ key and sig as non-critical = extensions.

 

I wonder if the two concepts could be merged. Meaning use the composite = key + sigs can non-critical extensions. Old clients disregard the PQ = extensions. New clients verify the classical  and the PQ algos = defined in the composite OID contained in the non-critical = extension.

 

Panos

 

 

From: Spasm [mailto:spasm-bounces@ietf.org]= On Behalf Of Dr. Pala
Sent: Thursday, September 20, = 2018 1:44 PM
To: spasm@ietf.org
Subject: Re: = [lamps] Double signatures

 

Hi Panos, = all,

that is correct - since the new OIDs for the Key = and the Signatures would be new, clients would fail since they do not = know the "composite" algorithm :D

Although = developing support for it should not be too difficult, the solution it = is not meant to be backward compatible as we want applications to be = able to fail if they do not even know they were supposed to generate or = verify multiple signatures instead of just one.

From a = usage perspective, I am leaning towards the need for the owner of the = certificates to generate signatures with all the keys, and for the = entity that validates the signatures it should validate all the = signatures it supports and may accept signatures even if it does not = understand all the algorithms (this is more an application decision = based on the risk and threat model).

As I said, this = solution fits not only certificates, but also OCSP responses, CRLs, CMS, = PKCS#7, etc. and that is part of what is interesting for us :D I still = need to check what are the needed changes for other formats like = PKCS#1/#8/#12 for storing the composite public and private keys (this = part still missing), but I hope that solving that part will not be too = difficult...

Cheers,
Max

 

On = 9/20/18 7:26 AM, Panos Kampanakis (pkampana) = wrote:

Hi Max,

To rephrase Eric=E2=80=99s question, would the = CompositeKey+CompositeSig proposal be backwards compatible with existing = systems?

I mean it gives you the change to use more than one algos in case you = don=E2=80=99t trust all of them. But an old client wouldn=E2=80=99t be = able to just use the traditional key+sig unless he was upgraded to = understand CompositeKey+CompositeSig and its OIDs, = right?

Panos

 

From: Spasm [mailto:spasm-= bounces@ietf.org] On Behalf Of Erik Andersen
Sent: Friday, = September 14, 2018 11:49 AM
To: 'SPASM' <spasm@iet= f.org>; Directory list <x500stand= ard@freelists.org>
Subject: Re: [lamps] Double = signatures

 

The double signature is intended as a migration = tool.

 

In the normal operation, only one signature is used (the native = signature). When it is realized that the signature algorithm will be too = week i some future, the migration period starts and an alternative, = assuming stronger signature is provided for those able to handle = it.  Legacy systems will ignore this alternative signature. After = the migration period, there will be no alternative signature and the new = stronger signature will be the native signature.

 

Does that make sense?

 

Erik

 

Fra: Massimiliano Pala [mailto:m.pala= @cablelabs.com]
Sendt: 12 September 2018 23:01
Til: Russ = Housley <housley@vigil= sec.com>
Cc: SPASM <spasm@ietf.or= g>; Erik Andersen <era@x500.eu>
Emne: Re: [lamps] Double = signatures

 

Hi Russ, = all,

my personal position is = that the signer MUST use all the keys that have digitalSignature set, = the verifier shall verify all the signatures for which it does have = support for.

The rationale = for this is that if I certify a public key in the certificate, you = should be able to use the private key to generate the signature, = therefore the approach is the same as usual: sign with your key. In this = case, it just happens that to generate the signature you have to = generate multiple ones and then combine them = together.

For the application = that verifies those signatures, it is always a question of what is the = threshold that is acceptable for the application (in terms of risk) in = case it does not support all of the algorithms that are used to generate = the composite signature. Ideally it would verify all, but it may decide = to verify less (at least one).

I also saw the other e-mail from Jim on this topic and I = think it could be a good idea - the use of the two OIDs is another way = to go to codify the validation process required. Technically, that makes = sense to me, however I am conflicted as this approach requires that the = signer has an understanding of what the verifier's capabilities are... I = think that defining two OIDs for the signatures could still be useful = because the signer might then decide the = "recommended"/"intended" verification behavior... I = can see some use-cases that might have a composite key with { RSA, EC } = and the "Must-Verify-All" OID for the signature, and another = use-case where we have a composite key with { RSA, HASH-BASED } and for = the signature = "Must-Verify-At-Least-One".

Does this make sense?

Cheers,
Max

 

On 9/12/18 6:12 AM, Russ Housley = wrote:

Max: =

 

During a transition to = quantum-resistant signatures, a signer wants to put a traditional = signature and a quantum-resistant signature on an object.  Given = your description of keyUsage and extendedKeyUsage, both would have = the digitalSignature bit set.  How does a client know if just one = or both signatures must be valid?

 

As Jim Schaad already said, = RFC 5752 talks about this issue when a CMS SignedData contains more = than one SignerInfo.

 

Russ

 

 

On Sep 11, 2018, at 4:45 PM, Max = Pala <M.Pala@cablelabs.com> = wrote:

 

Hi All, =

 

I am = working on a similar - but different - solution, in particular I solve = the issue of (a) being able to combine more than one public key, (b) = only one (actually two) OIDs required, and (c) simply the processing by = re-utilizing the same data structures we have = today.

 

I = particular, I define a =E2=80=9Ccomposite public key=E2=80=9D and = =E2=80=9Ccomposite = signature=E2=80=9D.

 

The first = one encodes in the key value=E2=80=99s BITSTRING the DER value of the = SEQUENCE of public keys (each of which is a the subjectPublicKeyInfo = structure) and uses a specific OID that identifies the public key type. = The parameters of the compositeKey algorithm can be used to encode the = keyUsage and the extendedKeyUsage for each of the keys in the composite = key.

 

The same = approach is used for the =E2=80=9CComposite Signature=E2=80=9D case = where the value of the signature is the DER representation of the = SEQUENCE of signatures made with each of the = keys.

 

As soon as = I have some spare time, I will submit the draft - maybe this could be = discussed in Bangkok?

 

This simple = idea allows us to have all the other procedures related to PKIs work - = this means we can combine ECC with RSA or with a Quantum-Resistant = algorithm (when finally available and standardized). A step forward for = the deployment of hybrid-PKIs where multiple Lagos for keys can be used = to authenticate data, certs, revocation data, etc... we plan to use this = in our infrastructures to provide a transitional path for post-Quantum = transition and to further improve the algorithm-agility capability of = PKIs.

 

What do you = think?

 

Cheers, =

Max

 

 

--- =

 

Cheers, =

Max

On Sep 11, = 2018, at 8:38 AM, Tim Hollebeek <tim.hollebeek@digicert.com> = wrote:

Unfortunately= , =E2=80=9Cnot every combination needs to be covered=E2=80=9D introduces = a lot of politics around choosing which combinations =E2=80=9Cneed to be = covered=E2=80=9D, a subject on which inevitably not everyone = agrees.  I would rather avoid all those discussions and the = unnecessary work they represent.

 =

I personally = don=E2=80=99t think a single AlgID which implies a SEQUENCE of ALG IDs = is an improvement over a SEQUENCE of ALG IDs, or its moral = equivalent.  For simple hybrid use cases, there is also a lot of = value in having the classical algorithm ID being the same as it usually = is, to allow easier interoperability with older systems that = don=E2=80=99t understand the newer algorithms (and can blissfully ignore = them).

 =

-Tim

 =

From:<= /b> = Santosh = Chokhani <= santosh.chokhani@gmail.com> 
Sent: Tuesday, September 11, 2018 = 10:29 AM
To: Tim Hollebeek <= tim.hollebeek@digicert.com>; 'Erik = Andersen' <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: RE: [lamps] = Double signatures

 =

Thanks Tim.

 

There are ways to accommodate your = concern.

 

One way to handle this is defining a single Alg ID A which implies a = SEQUENCE of ALG IDs and define the relying party rules in terms of its = ability to process one or all ALG = IDs.

 

Another way to do this is not every combination needs to be covered and = the user community defines its own  Alg ID Xi which maps to a = SEQUENCE of ALG IDs.

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Tim = Hollebeek
Sent: Tuesday, September 11, 2018 = 10:03 AM
To: Erik Andersen <= era@x500.eu>; = 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Doesn=E2=80=99= t the combinatoric explosion render this completely = impractical?

 =

You need N_c = x N_pq algorithm identifiers just to handle the simple hybrid use case = where a single classical algorithm is being used in conjunction with a = single post-quantum algorithm.

 =

And there = are people who want to use multiple post-quantum algorithms to hedge = against potential yet to be discovered weaknesses in post-quantum = algorithms.

 =

I=E2=80=99m = not really looking forward to trying to allocate or manage O(N_c x = N_pq^3) algorithm = identifiers=E2=80=A6

 =

-Tim

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Erik = Andersen
Sent: Tuesday, September 11, 2018 = 3:10 AM
To: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Hi Santosh,

 

You have proposed something like this before. It still puzzling in my = brain. As I understand, it requires that we define a particular = algorithm that has a parameter that includes the things you suggest. It = is worthy to be analysed.

 

Erik

 

Fra: = Spasm = [= mailto:spasm-bounces@ietf.org] P=C3=A5 vegne af Santosh = Chokhani
Sendt: 10 September 2018 = 19:18
Til: 'Jim Schaad' <= ietf@augustcellars.com>; 'Ryan = Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Emne:<= /b> Re: [lamps] Double = signatures

 =

Why not let algorithm identifier dictate the number of signatures and = their syntax?

 

From:<= /b> = Spasm = [= mailto:spasm-bounces@ietf.org] On Behalf Of Jim = Schaad
Sent: Monday, September 10, 2018 = 1:07 PM
To: 'Ryan Sleevi' <= ryan-ietf@sleevi.com>; = era@x500.eu
Cc: 'SPASM' <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

Ryan,<= o:p>

 =

The = discussion in London dealt with a completely different proposal than = this one.  While I think there are problems with this that need to = be dealt with they are mostly not the same = set.

 =

Erik,<= o:p>

 =

Why is this = considered to be a preferred solution to defining a new signature = algorithm which contains as the parameter the sequence of algorithm = identifiers and as the signature value a sequence of signature = values.  The problem with just defining the extension to SIGNED is = that one needs to make sure that the set of signature algorithms and = parameters are also part of the data to be signed and I am not seeing = that highlighted here.

 =

Jim

 =

 =

From:<= /b> = Spasm = <= spasm-bounces@ietf.org> On Behalf Of Ryan = Sleevi
Sent: Monday, September 10, 2018 = 8:53 AM
To: = era@x500.eu
Cc: SPASM <= spasm@ietf.org>; = x500standard@freelists.org
Subjec= t: Re: [lamps] = Double signatures

 =

 =

On Mon, Sep = 10, 2018 at 10:56 AM Erik Andersen <= era@x500.eu> = wrote:

Hi = Folk,

 =

In ITU-T we = have plans to allow for double signatures using the SIGNED parametrized = data type defined in X.509 to cope with situation as described in the = internet draft: =E2=80=9CMultiple Public-Key Algorithm X.509 = Certificates = (draft-truskovsky-lamps-pq-hybrid-x509-01)=E2=80=9D

=

 =

We suggest = to enhance the SIGNED data type as shown = below:

 =

SIGNED{ToBeSigned} ::=3D SEQUENCE = {

  COMPONENTS OF = SIGNATURE,

  = ........,

  altAlgorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}} = OPTIONAL,

  = altSignature          &= nbsp; BIT STRING OPTIONAL 

  } (WITH = COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature PRESENT } = |

     WITH COMPONENTS {..., = altAlgorithmIdentifier ABSENT,  altSignature ABSENT } = )

 

We are open = to comments. We know that IETF is not a heavy user of this data = type.

 =

We have no = intention to use this extended data type for certificates and = CRLs.

 =

For your = information, SIGNATURE is defined as:

 =

SIGNATURE ::=3D = SEQUENCE {

  = algorithmIdentifier  = AlgorithmIdentifier{{SupportedAlgorithms}},

  = signature          &nbs= p; BIT STRING,

  ....... = }

 =

From the = discussions in London (101), there were a number of challenges = identified during the discussion - = https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.t= xt = - that = fundamentally questioned that = approach.

 =

Has the = ITU-T addressed or resolved those concerns? Are they not applicable for = some reason specific to = ITU-T? 

____________= ___________________________________
Spasm mailing list
Spasm@ietf.org
<= a href=3D"https://www.ietf.org/mailman/listinfo/spasm">https://www.ietf.org/mailman/listinfo/spasm

 

 

--

Best = Regards,

Massimiliano Pala, = Ph.D.

3DCableLabs
Principal Architect
Security = Services, R&D

 

________________=
_______________________________
Spasm mailing =
list
Spasm@ietf.org
https://www.ietf.org=
/mailman/listinfo/spasm

 

------=_NextPart_001_0056_01D45283.5A3408E0-- ------=_NextPart_000_0055_01D45283.5A33E1D0 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= ------=_NextPart_000_0055_01D45283.5A33E1D0-- From nobody Sat Sep 22 16:12:27 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 918B0128CB7 for ; Sat, 22 Sep 2018 16:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vISDTqocjduD for ; Sat, 22 Sep 2018 16:12:19 -0700 (PDT) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23AAD120072 for ; Sat, 22 Sep 2018 16:12:18 -0700 (PDT) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip1.isaracorp.com with ESMTP; 22 Sep 2018 23:12:17 +0000 Received: from V0501WEXGPR01.isaracorp.com (10.5.8.20) by V0501WEXGPR02.isaracorp.com (10.5.9.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1466.3; Sat, 22 Sep 2018 19:12:16 -0400 Received: from V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba]) by V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba%7]) with mapi id 15.01.1466.003; Sat, 22 Sep 2018 19:12:16 -0400 From: Daniel Van Geest To: Jim Schaad , 'Tim Hollebeek' , "'Panos Kampanakis (pkampana)'" CC: "spasm@ietf.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwALBr6AAAKWWwAAAGJ/gAAdEOUAAA5m/4AAAOuWAAAAVAsAAAzUEYAAIGE4gAASdg2AAFmu0YABKMIlAAAJAhoAAEX9wQAAAm64gAAPMcyAABV+tIAABxx5AA== Date: Sat, 22 Sep 2018 23:12:16 +0000 Message-ID: <0BB17F84-31A6-40CF-8451-E785F78DFDA2@isara.com> References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> <000001d4522b$44713c10$cd53b430$@augustcellars.com> <005401d452be$068c2a20$13a47e60$@augustcellars.com> In-Reply-To: <005401d452be$068c2a20$13a47e60$@augustcellars.com> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.5.17.157] Content-Type: multipart/related; boundary="_004_0BB17F8431A640CF8451E785F78DFDA2isaracom_"; type="multipart/alternative" MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Sep 2018 23:12:26 -0000 --_004_0BB17F8431A640CF8451E785F78DFDA2isaracom_ Content-Type: multipart/alternative; boundary="_000_0BB17F8431A640CF8451E785F78DFDA2isaracom_" --_000_0BB17F8431A640CF8451E785F78DFDA2isaracom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSmltLA0KDQpUaGUgaW50ZW50aW9uIG9mIGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHli cmlkLXg1MDkgd2FzIHRoYXQgdGhlIHB1YmxpYyBrZXkgaW4gU3ViamVjdEFsdFB1YmxpY0tleUlu Zm9FeHQgZXh0ZW5zaW9uIGlzIGFuIGFsdGVybmF0aXZlIHRvIHRoZSBwdWJsaWMga2V5IGluIFN1 YmplY3RQdWJsaWNLZXlJbmZvICh0aG91Z2ggZGVwZW5kaW5nIG9uIHBvbGljeSwgYm90aCB2ZXJp Znlpbmcgc2lnbmF0dXJlcyBjb3VsZCBiZSByZXF1aXJlZCkuICBUaGUgYWx0ZXJuYXRpdmUga2V5 IHBhaXIgaXMgYm91bmQgdG8gdGhlIHByaW1hcnkga2V5IHBhaXIsIGFuZCBib3RoIHdpbGwgYmUg YXNzb2NpYXRlZCB3aXRoIHRoZSBzYW1lIGlzc3VpbmcgY2VydGlmaWNhdGUuICBUaGlzIGlzIHdo eSB3ZSBkaWRu4oCZdCBhZGQgYWx0ZXJuYXRpdmUgQUtJIG9yIFNLSSBleHRlbnNpb25zLiAgT3Ro ZXJ3aXNlLCB0aGUgY2VydGlmaWNhdGUgY2hhaW4gd291bGQgdHVybiBpbnRvIGEgY2VydGlmaWNh dGUgdHJlZSBhcyB5b3UgcG9pbnQgb3V0LCBncmVhdGx5IGluY3JlYXNpbmcgdGhlIGRpZmZpY3Vs dHkgb2YgcHJvY2Vzc2luZyB0aGVtLg0KDQpUaGUgbmV4dCB2ZXJzaW9uIG9mIHRoZSBkcmFmdCB3 aWxsIG1ha2UgdGhpcyByZXF1aXJlbWVudCBleHBsaWNpdC4NCg0KSSBkb27igJl0IHVuZGVyc3Rh bmQgeW91ciBzdGF0ZW1lbnQg4oCcVGhpcyBwcm9wb3NhbCBkb2VzIG5vdCBoYXZlIGFueSB3YXkg b2YgZW5jb2RpbmcgdGhlIG11bHRpcGxlIHB1YmxpYyBrZXlzLuKAnSAgVGhlIGFsdGVybmF0aXZl IHB1YmxpYyBrZXkgaXMgZW5jb2RlZCBpbiB0aGUgU3ViamVjdEFsdFB1YmxpY0tleUluZm9FeHQg ZXh0ZW5zaW9uLiAgSWYgeW91IG1lYW4gdGhlcmXigJlzIG5vIHdheSBvZiBlbmNvZGluZyA+IDEg YWx0ZXJuYXRpdmUga2V5cyAoaS5lLiA+IDIgdG90YWwga2V5cyBpbiB0aGUgY2VydGlmaWNhdGUp IHRoZW4geW91IGFyZSBjb3JyZWN0LiAgVG8ga2VlcCB0aGluZ3Mgc2ltcGxlIChJIGtub3csIEkg a25vdywgaXTigJlzIFguNTA5LCB0aGF0IHNoaXAgaGFzIHNhaWxlZCkgd2UgcmVzdHJpY3RlZCBp dCB0byBhIHNpbmdsZSBhbHRlcm5hdGl2ZSBrZXkvc2lnbmF0dXJlLiAgVG8gZ2V0IG11bHRpcGxl IGFsdGVybmF0aXZlIGtleXMvc2lnbmF0dXJlcywgb25lIGNvdWxkIGRlZmluZSBhIG5ldyBBbGdv cml0aG1JZGVudGlmaWVyIHNwZWNpZnlpbmcgbXVsdGlwbGUga2V5cyBhbmQgc2lnbmF0dXJlcywg YXMgbWVudGlvbmVkIGVhcmxpZXIgaW4gdGhlIHRocmVhZC4gIFRoaXMgY2FuIGJlIHNwZWNpZmll ZCBpbiBhIHNlcGFyYXRlIGRyYWZ0IGlmIGRlc2lyZWQsIGFuZCB0aGUgQWxnb3JpdGhtSWRlbnRp ZmllciBjb3VsZCBiZSB1c2VkIGluIHRoZSBTdWJqZWN0QWx0UHVibGljS2V5SW5mb0V4dCBhbmQg QWx0U2lnbmF0dXJlQWxnb3JpdGhtRXh0IGV4dGVuc2lvbnMgKHdpdGggdGhlIG11bHRpcGxlIHNp Z25hdHVyZXMgZW5jb2RlZCBpbiB0aGUgQWx0U2lnbmF0dXJlVmFsdWVFeHQgZXh0ZW5zaW9uKSBp biBvcmRlciB0byBnZXQgbXVsdGlwbGUgYWx0ZXJuYXRpdmUga2V5cy9zaWduYXR1cmVzICh3aXRo IGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5KSwgb3IgdGhlIEFsZ29yaXRobUlkZW50aWZpZXIgY291 bGQgYmUgdXNlZCBpbiB0aGUgUkZDNTI4MCBmaWVsZHMgaW4gb3JkZXIgdG8gZ2V0IG11bHRpcGxl IGtleXMvc2lnbmF0dXJlcyAod2l0aG91dCBiYWNrd2FyZHMgY29tcGF0aWJpbGl0eSkuDQoNClRo YW5rcywNCkRhbmllbA0KDQoNCk9uIDIwMTgtMDktMjIsIDExOjQ5IFBNLCAiU3Bhc20gb24gYmVo YWxmIG9mIEppbSBTY2hhYWQiIDxzcGFzbS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpzcGFzbS1i b3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgaWV0ZkBhdWd1c3RjZWxsYXJzLmNvbTxtYWls dG86aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT4+IHdyb3RlOg0KDQpUaW0sDQoNCkV4Y2VwdCBmb3Ig dGhlIGNhc2Ugb2Ygc2VsZi1pc3N1ZWQgY2VydGlmaWNhdGVzLCBJIGFsbW9zdCBuZXZlciBjYXJl IGFib3V0IHByb2Nlc3NpbmcgYSBzaW5nbGUgY2VydGlmaWNhdGUuICBSYXRoZXIgSSBhbSBnb2lu ZyB0byBwcm9jZXNzIGEgY2hhaW4gb2YgY2VydGlmaWNhdGVzIHRoYXQgZ29lcyBiYWNrIHRvIGEg dHJ1c3Qgcm9vdC4gQ29tcGFyaW5nIHRoaXMgdG8gdGhlIFNIQTEvU0hBLTI1NiB0cmFuc2l0aW9u IEkgZG9u4oCZdCB0aGluayBpcyB2ZXJ5IHJlbGV2YW50LiAgSW4gdGhhdCBjYXNlIG9uZSBjb3Vs ZCBiZSB1c2luZyB0aGUgc2FtZSBwdWJsaWMga2V5IHZhbHVlIHdpdGggZGlmZmVyZW50IHNpZ25h dHVyZSBhbGdvcml0aG1zLiAgSGVyZSB3ZSBhcmUgbG9va2luZyBhdCB1c2luZyB0d28gY29tcGxl dGVseSBkaWZmZXJlbnQgcHVibGljIGtleSBzdHJ1Y3R1cmVzLCBpLmUuIGFuIEVkRFNBIGFuZCBh IEhhc2gtYmFzZWQgc2lnbmF0dXJlLiAgVGhpcyBtZWFucyB0aGF0IGJvdGggcHVibGljIGtleXMg bmVlZCB0byBiZSBmaW5kYWJsZSBmcm9tIHNvbWUgaXNzdWVyIGNlcnRpZmljYXRlLiAgVGhpcyBw cm9wb3NhbCBkb2VzIG5vdCBoYXZlIGFueSB3YXkgb2YgZW5jb2RpbmcgdGhlIG11bHRpcGxlIHB1 YmxpYyBrZXlzLiAgIEZyb20gdGhpcyBJIG1ha2UgdGhlIGFzc3VtcHRpb24gdGhhdCB0aGVyZSBp cyBhIHNpbmdsZSBjZXJ0aWZpY2F0ZSBmb3IgZWFjaCBvZiB0aGUgcHVibGljIGtleXMsIHdoaWNo IGNhbiBoYXZlIG11bHRpcGxlIHNpZ25hdHVyZXMgb24gaXQuICAgSWYgdGhlIHB1YmxpYyBrZXlz IGFyZSBpbiB0aGVpciBvd24gY2VydGlmaWNhdGVzLCB0aGVuIHlvdSBnZXQgbG90cyBvZiBmdW4g aW4gdGVybXMgb2YgdHJ5aW5nIHRvIGJ1aWxkIHRoZSBjaGFpbnMgYW5kIGFsbCBvZiB0aGUgdGhp bmdzIHRoYXQgSSBwb2ludGVkIHRvIGFyZSByZWxldmFudC4gIElmIHRoZSBwdWJsaWMga2V5cyBh cmUgaW4gYSBzaW5nbGUgY2VydGlmaWNhdGUgdGhlbiB0aGlzIGlzIG5vdCBkb2N1bWVudGVkLg0K DQpqaW0NCg0KDQoNCkZyb206IFRpbSBIb2xsZWJlZWsgPHRpbS5ob2xsZWJlZWtAZGlnaWNlcnQu Y29tPg0KU2VudDogU2F0dXJkYXksIFNlcHRlbWJlciAyMiwgMjAxOCA0OjMzIEFNDQpUbzogSmlt IFNjaGFhZCA8aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT47ICdQYW5vcyBLYW1wYW5ha2lzIChwa2Ft cGFuYSknIDxwa2FtcGFuYUBjaXNjby5jb20+DQpDYzogc3Bhc21AaWV0Zi5vcmcNClN1YmplY3Q6 IFJFOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCkhvdyBhcmUgY2hhaW4vcGF0aCBidWls ZGluZywgQUlBLCBhbmQgc28gb24gYWZmZWN0ZWQ/ICBBbHRlcm5hdGl2ZSBzaWduYXR1cmVzIGp1 c3QgZ2l2ZSBhbHRlcm5hdGl2ZSBpbmZvcm1hdGlvbiB0aGF0IGNhbiBiZSBlaXRoZXIgYmUgdXNl ZCBzZXBhcmF0ZWx5IG9yIGFkZGl0aW9uYWxseSB0byB2ZXJpZnkgYSBwYXJ0aWN1bGFyIGNlcnRp ZmljYXRlIHNpZ25hdHVyZS4gIEhvdyB5b3UgZmluZCB2YWxpZCBjZXJ0aWZpY2F0ZXMgYW5kIHB1 dCB0aGVtIHRvZ2V0aGVyIGludG8gYSBjaGFpbiBzZWVtcyB0byBtZSB0byBiZSBjb21wbGV0ZWx5 IGluZGVwZW5kZW50IG9mIGhvdyB5b3UgdmFsaWRhdGUgYSBwYXJ0aWN1bGFyIHNpZ25hdHVyZS4N Cg0KUHJvYmxlbSA1IHNlZW1zIGxpa2UgYSBwYXJ0aWN1bGFybHkgb2RkIG9iamVjdGlvbi4gIEkg aGF2ZW7igJl0IHNlZW4gYSBwcm9wb3NhbCBmb3Igc2VwYXJhdGUgY2VydGlmaWNhdGVzLiAgSW5k ZWVkLCB0aGF0IGlzIG9uZSBvZiB0aGUgdGhpbmdzIHRoYXQgSSB0aGluayBpcyB2ZXJ5IHdpc2Ug dG8gYXZvaWQsIGFzIGl0IGhhcyBjYXVzZWQgc2lnbmlmaWNhbnQgcHJvYmxlbXMgaW4gdGhlIHBh c3QsIG1vc3QgcmVjZW50bHkgZm9yIGV4YW1wbGUgd2l0aCBTSEExIC8gU0hBLTI1NiB0cmFuc2l0 aW9uLiAgVGhlIGVudGlyZSBwb2ludCBvZiBpbmNsdWRpbmcgbXVsdGlwbGUgc2lnbmF0dXJlcyB3 aXRoIGRpZmZlcmVudCBhbGdvcml0aG1zIGlzIHRvIGF2b2lkIHRoZSBuZWVkIHRvIGhhdmUgc2Vw YXJhdGUgaGllcmFyY2hpZXMgZm9yIHRoZSBvbGQgYW5kIG5ldyB3YXlzIG9mIGRvaW5nIHRoaW5n cy4NCg0KVGhlcmUgc2VlbSB0byBiZSBzb21lIGFzc3VtcHRpb25zIGJ1aWx0IGludG8geW91ciBs aXN0IG9mIHByb2JsZW1zIHRoYXQgSSB0aGluayBhcmUgaW1wb3J0YW50IHRvIHVucGFjaywgZGlz Y3VzcywgYW5kIHJlc29sdmUgZmlyc3QuDQoNCi1UaW0NCg0KRnJvbTogU3Bhc20gPHNwYXNtLWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYg T2YgSmltIFNjaGFhZA0KU2VudDogU2F0dXJkYXksIFNlcHRlbWJlciAyMiwgMjAxOCAxMjoxOCBB TQ0KVG86ICdQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSknIDxwa2FtcGFuYUBjaXNjby5jb208 bWFpbHRvOnBrYW1wYW5hQGNpc2NvLmNvbT4+DQpDYzogc3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNw YXNtQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0K UGFub3MsDQoNCldpdGhvdXQgYSByZWFsbHkgZGV0YWlsZWQgYW5hbHlzaXMgb2YgeW91ciBwcm9w b3NhbCBhbmQgaG93IGl0IHdpbGwgaW50ZXJhY3Qgd2l0aCBleGlzdGluZyBjb2RlIEkgY291bGQg bm90IHBvc3NpYmx5IHN1cHBvcnQgaXQuICAgQSBxdWljayBsaXN0IG9mIHByb2JsZW1zIHRoYXQg SSB3b3VsZCBsaXN0ICh3aXRob3V0IHRob3VnaHQpIGFyZToNCg0KDQoxLiAgICAgIEhpc3Rvcmlj YWxseSwgbG90cyBvZiBwZW9wbGUgY2Fubm90IGdldCBERVIgZW5jb2RpbmcgY29ycmVjdC4gIFBl dGVyIEd1dG1hbm4gaGFzIGEgaHVnZSBjb2xsZWN0aW9uIG9mIGNlcnRpZmljYXRlcyB0aGF0IHdl cmUgaXNzdWVkIGJ5IENBcyB0aGF0IHdlcmUgbm90IGNvcnJlY3RseSBERVIgZW5jb2RlZC4NCg0K Mi4gICAgICBFdmVyeWJvZHkgd2hvIHdhbnRzIHRvIHN1cHBvcnQgUFEgYWxnb3JpdGhtcyBpcyBu b3cgcmVxdWlyZWQgdG8gYWRkIGEgREVSIGVuY29kZXIgdG8gdGhlaXIgc3lzdGVtcy4gIEZvciB0 aGluZ3Mgd2hpY2ggb25seSBjb25zdW1lIGNlcnRpZmljYXRlcywgY3JscywgY21zIG9iamVjdHMg dGhpcyBtZWFucyB0aGF0IHRoZXkgbm93IGhhdmUgZW5sYXJnZWQgY29kZSBzaXplLg0KDQozLiAg ICAgIEkgaGF2ZSBubyBpZGVhIHdoYXQgdGhlIHJ1bGVzIGFyZSBmb3IgbWF0Y2hpbmcgQ1JMcyBh bmQgY2VydGlmaWNhdGVzIGluIHRlcm1zIG9mIHNpZ25hdHVyZSBhbGdvcml0aG1zLCBJIHdvdWxk IGFzc3VtZSB0aGF0IHlvdSBuZWVkIHRoZSBzYW1lIHByb3RlY3Rpb25zIGZvciBDUkxzLg0KDQo0 LiAgICAgIFlvdSBhcmUgbm90IHNpZ25pbmcgdGhlIGFsdCBzaWduYXR1cmUgYWxnb3JpdGhtIGFz IHBhcnQgb2YgdGhlIFRCUyAoZWFzeSB0byBmaXgpDQoNCjUuICAgICAgSG93IGFyZSB0aGUgY2Vy dGlmaWNhdGVzIGZvciB0aGUgaXNzdWVyIHNldHVwPyAgQXJlIHRoZXJlIHNlcGFyYXRlIGNlcnRp ZmljYXRlcyBvciB0aGUgc2FtZSBjZXJ0aWZpY2F0ZT8NCg0KNi4gICAgICBKdXN0IGhvdyBiYWRs eSBkb2VzIHRoaXMgYWZmZWN0IHRoZSBwYXRoIGJ1aWxkaW5nIGNvZGUgYXMgaXQgbm93IG5lZWRz IHRvIGJlIG1vZGlmaWVkIHRvIGhhdmUgYWRkaXRpb25hbCBpbnB1dHMuDQoNCjcuICAgICAgRG8g eW91IHdhbnQgdG8gY2hhbmdlIHRoZSBBS0kgZmllbGQgdG8gbWFrZSBjaGFpbiBidWlsZGluZyBi ZXR0ZXIgb3IgYXJlIHlvdSBnb2luZyB0byBjYXVzZSBub24tc3VwcG9ydGluZyBzeXN0ZW1zIHRv IHBvdGVudGlhbGx5IHN0YXJ0IGRvd25sb2FkaW5nIGxvdHMgb2Ygb3RoZXIgY2VydGlmaWNhdGVz IGFzIHdlbGwuDQoNCjguICAgICAgU2FtZSBpc3N1ZXMgYXBwbHlpbmcgdG8gQ1JMIGRpc3RyaWJ1 dGlvbiBwb2ludHMg4oCTIGl0IHdvdWxkIHBvdGVudGlhbGx5IGJlIG1vcmUgZWZmaWNpZW50IHRv IGhhdmUgc2VwYXJhdGUgQ1JMcyByYXRoZXIgdGhhbiBjb21iaW5lZCBvbmVzIGFzIHlvdSBjb3Vs ZCBub3QgdXNlIHRoZSBleHRlbnNpb24gaW4gdGhhdCBjYXNlLg0KDQo5LiAgICAgIEhvdyBpcyBB SUEgZ29pbmcgdG8gd29yay4NCg0KMTAuICBJZiB5b3UgcmVxdWlyZSB0aGF0IHRoZSBzYW1lIGFs Z29yaXRobXMgYmUgdXNlZCwgd2hhdCBoYXBwZW5zIHdpdGggT0NTUCByZXNwb25zZXMgYW5kIGRl bGVnYXRlZCBDUkwgaXNzdWVycz/igJkNCg0KDQpKaW0NCg0KDQpGcm9tOiBQYW5vcyBLYW1wYW5h a2lzIChwa2FtcGFuYSkgPHBrYW1wYW5hQGNpc2NvLmNvbTxtYWlsdG86cGthbXBhbmFAY2lzY28u Y29tPj4NClNlbnQ6IEZyaWRheSwgU2VwdGVtYmVyIDIxLCAyMDE4IDg6MDggUE0NClRvOiBEci4g UGFsYSA8bWFkd29sZkBvcGVuY2Eub3JnPG1haWx0bzptYWR3b2xmQG9wZW5jYS5vcmc+PjsgSmlt IFNjaGFhZCA8aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbTxtYWlsdG86aWV0ZkBhdWd1c3RjZWxsYXJz LmNvbT4+DQpDYzogc3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPg0KU3ViamVj dDogUkU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KSGkgTWF4LCBKaW0sDQoNCkFncmVl ZC4gSW4gc3VtbWFyeSwgdGhlcmUgYXJlIHRvbyBnb29kIHByb3Bvc2FscyAoRXJpaywgTWF44oCZ cykgdGhhdCBjYW4gY29tYmluZSBtdWx0aXBsZSBQS3MgYW5kIFNpZ3MuIFRoYXQgd291bGQgYWxs b3cgdXMgdG8gdXMgbW9yZSB0aGFuIG9uZSBQUSBhbGdvcyBpZiB0aGV5IGFyZSBub3QgdHJ1c3Rl ZC4NCg0KZHJhZnQtdHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJyaWQgYWxsb3dzIGZvciBiYWNrd2Fy ZHMgY29tcGF0aWJpbGl0eSBieSBkZWZpbmluZyBvbmUgb25seSBQUSBrZXkgYW5kIHNpZyBhcyBu b24tY3JpdGljYWwgZXh0ZW5zaW9ucy4NCg0KSSB3b25kZXIgaWYgdGhlIHR3byBjb25jZXB0cyBj b3VsZCBiZSBtZXJnZWQuIE1lYW5pbmcgdXNlIHRoZSBjb21wb3NpdGUga2V5ICsgc2lncyBjYW4g bm9uLWNyaXRpY2FsIGV4dGVuc2lvbnMuIE9sZCBjbGllbnRzIGRpc3JlZ2FyZCB0aGUgUFEgZXh0 ZW5zaW9ucy4gTmV3IGNsaWVudHMgdmVyaWZ5IHRoZSBjbGFzc2ljYWwgIGFuZCB0aGUgUFEgYWxn b3MgZGVmaW5lZCBpbiB0aGUgY29tcG9zaXRlIE9JRCBjb250YWluZWQgaW4gdGhlIG5vbi1jcml0 aWNhbCBleHRlbnNpb24uDQoNClBhbm9zDQoNCg0KRnJvbTogU3Bhc20gW21haWx0bzpzcGFzbS1i b3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgRHIuIFBhbGENClNlbnQ6IFRodXJzZGF5LCBT ZXB0ZW1iZXIgMjAsIDIwMTggMTo0NCBQTQ0KVG86IHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFz bUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCg0K SGkgUGFub3MsIGFsbCwNCg0KdGhhdCBpcyBjb3JyZWN0IC0gc2luY2UgdGhlIG5ldyBPSURzIGZv ciB0aGUgS2V5IGFuZCB0aGUgU2lnbmF0dXJlcyB3b3VsZCBiZSBuZXcsIGNsaWVudHMgd291bGQg ZmFpbCBzaW5jZSB0aGV5IGRvIG5vdCBrbm93IHRoZSAiY29tcG9zaXRlIiBhbGdvcml0aG0gOkQN Cg0KQWx0aG91Z2ggZGV2ZWxvcGluZyBzdXBwb3J0IGZvciBpdCBzaG91bGQgbm90IGJlIHRvbyBk aWZmaWN1bHQsIHRoZSBzb2x1dGlvbiBpdCBpcyBub3QgbWVhbnQgdG8gYmUgYmFja3dhcmQgY29t cGF0aWJsZSBhcyB3ZSB3YW50IGFwcGxpY2F0aW9ucyB0byBiZSBhYmxlIHRvIGZhaWwgaWYgdGhl eSBkbyBub3QgZXZlbiBrbm93IHRoZXkgd2VyZSBzdXBwb3NlZCB0byBnZW5lcmF0ZSBvciB2ZXJp ZnkgbXVsdGlwbGUgc2lnbmF0dXJlcyBpbnN0ZWFkIG9mIGp1c3Qgb25lLg0KDQpGcm9tIGEgdXNh Z2UgcGVyc3BlY3RpdmUsIEkgYW0gbGVhbmluZyB0b3dhcmRzIHRoZSBuZWVkIGZvciB0aGUgb3du ZXIgb2YgdGhlIGNlcnRpZmljYXRlcyB0byBnZW5lcmF0ZSBzaWduYXR1cmVzIHdpdGggYWxsIHRo ZSBrZXlzLCBhbmQgZm9yIHRoZSBlbnRpdHkgdGhhdCB2YWxpZGF0ZXMgdGhlIHNpZ25hdHVyZXMg aXQgc2hvdWxkIHZhbGlkYXRlIGFsbCB0aGUgc2lnbmF0dXJlcyBpdCBzdXBwb3J0cyBhbmQgbWF5 IGFjY2VwdCBzaWduYXR1cmVzIGV2ZW4gaWYgaXQgZG9lcyBub3QgdW5kZXJzdGFuZCBhbGwgdGhl IGFsZ29yaXRobXMgKHRoaXMgaXMgbW9yZSBhbiBhcHBsaWNhdGlvbiBkZWNpc2lvbiBiYXNlZCBv biB0aGUgcmlzayBhbmQgdGhyZWF0IG1vZGVsKS4NCg0KQXMgSSBzYWlkLCB0aGlzIHNvbHV0aW9u IGZpdHMgbm90IG9ubHkgY2VydGlmaWNhdGVzLCBidXQgYWxzbyBPQ1NQIHJlc3BvbnNlcywgQ1JM cywgQ01TLCBQS0NTIzcsIGV0Yy4gYW5kIHRoYXQgaXMgcGFydCBvZiB3aGF0IGlzIGludGVyZXN0 aW5nIGZvciB1cyA6RCBJIHN0aWxsIG5lZWQgdG8gY2hlY2sgd2hhdCBhcmUgdGhlIG5lZWRlZCBj aGFuZ2VzIGZvciBvdGhlciBmb3JtYXRzIGxpa2UgUEtDUyMxLyM4LyMxMiBmb3Igc3RvcmluZyB0 aGUgY29tcG9zaXRlIHB1YmxpYyBhbmQgcHJpdmF0ZSBrZXlzICh0aGlzIHBhcnQgc3RpbGwgbWlz c2luZyksIGJ1dCBJIGhvcGUgdGhhdCBzb2x2aW5nIHRoYXQgcGFydCB3aWxsIG5vdCBiZSB0b28g ZGlmZmljdWx0Li4uDQoNCkNoZWVycywNCk1heA0KDQpPbiA5LzIwLzE4IDc6MjYgQU0sIFBhbm9z IEthbXBhbmFraXMgKHBrYW1wYW5hKSB3cm90ZToNCkhpIE1heCwNClRvIHJlcGhyYXNlIEVyaWPi gJlzIHF1ZXN0aW9uLCB3b3VsZCB0aGUgQ29tcG9zaXRlS2V5K0NvbXBvc2l0ZVNpZyBwcm9wb3Nh bCBiZSBiYWNrd2FyZHMgY29tcGF0aWJsZSB3aXRoIGV4aXN0aW5nIHN5c3RlbXM/DQpJIG1lYW4g aXQgZ2l2ZXMgeW91IHRoZSBjaGFuZ2UgdG8gdXNlIG1vcmUgdGhhbiBvbmUgYWxnb3MgaW4gY2Fz ZSB5b3UgZG9u4oCZdCB0cnVzdCBhbGwgb2YgdGhlbS4gQnV0IGFuIG9sZCBjbGllbnQgd291bGRu 4oCZdCBiZSBhYmxlIHRvIGp1c3QgdXNlIHRoZSB0cmFkaXRpb25hbCBrZXkrc2lnIHVubGVzcyBo ZSB3YXMgdXBncmFkZWQgdG8gdW5kZXJzdGFuZCBDb21wb3NpdGVLZXkrQ29tcG9zaXRlU2lnIGFu ZCBpdHMgT0lEcywgcmlnaHQ/DQpQYW5vcw0KDQpGcm9tOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJv dW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBFcmlrIEFuZGVyc2VuDQpTZW50OiBGcmlkYXks IFNlcHRlbWJlciAxNCwgMjAxOCAxMTo0OSBBTQ0KVG86ICdTUEFTTScgPHNwYXNtQGlldGYub3Jn PjxtYWlsdG86c3Bhc21AaWV0Zi5vcmc+OyBEaXJlY3RvcnkgbGlzdCA8eDUwMHN0YW5kYXJkQGZy ZWVsaXN0cy5vcmc+PG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6 IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNClRoZSBkb3VibGUgc2lnbmF0dXJlIGlz IGludGVuZGVkIGFzIGEgbWlncmF0aW9uIHRvb2wuDQoNCkluIHRoZSBub3JtYWwgb3BlcmF0aW9u LCBvbmx5IG9uZSBzaWduYXR1cmUgaXMgdXNlZCAodGhlIG5hdGl2ZSBzaWduYXR1cmUpLiBXaGVu IGl0IGlzIHJlYWxpemVkIHRoYXQgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gd2lsbCBiZSB0b28g d2VlayBpIHNvbWUgZnV0dXJlLCB0aGUgbWlncmF0aW9uIHBlcmlvZCBzdGFydHMgYW5kIGFuIGFs dGVybmF0aXZlLCBhc3N1bWluZyBzdHJvbmdlciBzaWduYXR1cmUgaXMgcHJvdmlkZWQgZm9yIHRo b3NlIGFibGUgdG8gaGFuZGxlIGl0LiAgTGVnYWN5IHN5c3RlbXMgd2lsbCBpZ25vcmUgdGhpcyBh bHRlcm5hdGl2ZSBzaWduYXR1cmUuIEFmdGVyIHRoZSBtaWdyYXRpb24gcGVyaW9kLCB0aGVyZSB3 aWxsIGJlIG5vIGFsdGVybmF0aXZlIHNpZ25hdHVyZSBhbmQgdGhlIG5ldyBzdHJvbmdlciBzaWdu YXR1cmUgd2lsbCBiZSB0aGUgbmF0aXZlIHNpZ25hdHVyZS4NCg0KRG9lcyB0aGF0IG1ha2Ugc2Vu c2U/DQoNCkVyaWsNCg0KRnJhOiBNYXNzaW1pbGlhbm8gUGFsYSBbbWFpbHRvOm0ucGFsYUBjYWJs ZWxhYnMuY29tXQ0KU2VuZHQ6IDEyIFNlcHRlbWJlciAyMDE4IDIzOjAxDQpUaWw6IFJ1c3MgSG91 c2xleSA8aG91c2xleUB2aWdpbHNlYy5jb208bWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tPj4N CkNjOiBTUEFTTSA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IEVyaWsg QW5kZXJzZW4gPGVyYUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4+DQpFbW5lOiBSZTogW2xh bXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQoNCkhpIFJ1c3MsIGFsbCwNCg0KbXkgcGVyc29uYWwg cG9zaXRpb24gaXMgdGhhdCB0aGUgc2lnbmVyIE1VU1QgdXNlIGFsbCB0aGUga2V5cyB0aGF0IGhh dmUgZGlnaXRhbFNpZ25hdHVyZSBzZXQsIHRoZSB2ZXJpZmllciBzaGFsbCB2ZXJpZnkgYWxsIHRo ZSBzaWduYXR1cmVzIGZvciB3aGljaCBpdCBkb2VzIGhhdmUgc3VwcG9ydCBmb3IuDQoNClRoZSBy YXRpb25hbGUgZm9yIHRoaXMgaXMgdGhhdCBpZiBJIGNlcnRpZnkgYSBwdWJsaWMga2V5IGluIHRo ZSBjZXJ0aWZpY2F0ZSwgeW91IHNob3VsZCBiZSBhYmxlIHRvIHVzZSB0aGUgcHJpdmF0ZSBrZXkg dG8gZ2VuZXJhdGUgdGhlIHNpZ25hdHVyZSwgdGhlcmVmb3JlIHRoZSBhcHByb2FjaCBpcyB0aGUg c2FtZSBhcyB1c3VhbDogc2lnbiB3aXRoIHlvdXIga2V5LiBJbiB0aGlzIGNhc2UsIGl0IGp1c3Qg aGFwcGVucyB0aGF0IHRvIGdlbmVyYXRlIHRoZSBzaWduYXR1cmUgeW91IGhhdmUgdG8gZ2VuZXJh dGUgbXVsdGlwbGUgb25lcyBhbmQgdGhlbiBjb21iaW5lIHRoZW0gdG9nZXRoZXIuDQoNCkZvciB0 aGUgYXBwbGljYXRpb24gdGhhdCB2ZXJpZmllcyB0aG9zZSBzaWduYXR1cmVzLCBpdCBpcyBhbHdh eXMgYSBxdWVzdGlvbiBvZiB3aGF0IGlzIHRoZSB0aHJlc2hvbGQgdGhhdCBpcyBhY2NlcHRhYmxl IGZvciB0aGUgYXBwbGljYXRpb24gKGluIHRlcm1zIG9mIHJpc2spIGluIGNhc2UgaXQgZG9lcyBu b3Qgc3VwcG9ydCBhbGwgb2YgdGhlIGFsZ29yaXRobXMgdGhhdCBhcmUgdXNlZCB0byBnZW5lcmF0 ZSB0aGUgY29tcG9zaXRlIHNpZ25hdHVyZS4gSWRlYWxseSBpdCB3b3VsZCB2ZXJpZnkgYWxsLCBi dXQgaXQgbWF5IGRlY2lkZSB0byB2ZXJpZnkgbGVzcyAoYXQgbGVhc3Qgb25lKS4NCg0KSSBhbHNv IHNhdyB0aGUgb3RoZXIgZS1tYWlsIGZyb20gSmltIG9uIHRoaXMgdG9waWMgYW5kIEkgdGhpbmsg aXQgY291bGQgYmUgYSBnb29kIGlkZWEgLSB0aGUgdXNlIG9mIHRoZSB0d28gT0lEcyBpcyBhbm90 aGVyIHdheSB0byBnbyB0byBjb2RpZnkgdGhlIHZhbGlkYXRpb24gcHJvY2VzcyByZXF1aXJlZC4g VGVjaG5pY2FsbHksIHRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUsIGhvd2V2ZXIgSSBhbSBjb25mbGlj dGVkIGFzIHRoaXMgYXBwcm9hY2ggcmVxdWlyZXMgdGhhdCB0aGUgc2lnbmVyIGhhcyBhbiB1bmRl cnN0YW5kaW5nIG9mIHdoYXQgdGhlIHZlcmlmaWVyJ3MgY2FwYWJpbGl0aWVzIGFyZS4uLiBJIHRo aW5rIHRoYXQgZGVmaW5pbmcgdHdvIE9JRHMgZm9yIHRoZSBzaWduYXR1cmVzIGNvdWxkIHN0aWxs IGJlIHVzZWZ1bCBiZWNhdXNlIHRoZSBzaWduZXIgbWlnaHQgdGhlbiBkZWNpZGUgdGhlICJyZWNv bW1lbmRlZCIvImludGVuZGVkIiB2ZXJpZmljYXRpb24gYmVoYXZpb3IuLi4gSSBjYW4gc2VlIHNv bWUgdXNlLWNhc2VzIHRoYXQgbWlnaHQgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJTQSwg RUMgfSBhbmQgdGhlICJNdXN0LVZlcmlmeS1BbGwiIE9JRCBmb3IgdGhlIHNpZ25hdHVyZSwgYW5k IGFub3RoZXIgdXNlLWNhc2Ugd2hlcmUgd2UgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJT QSwgSEFTSC1CQVNFRCB9IGFuZCBmb3IgdGhlIHNpZ25hdHVyZSAiTXVzdC1WZXJpZnktQXQtTGVh c3QtT25lIi4NCg0KRG9lcyB0aGlzIG1ha2Ugc2Vuc2U/DQoNCkNoZWVycywNCk1heA0KDQpPbiA5 LzEyLzE4IDY6MTIgQU0sIFJ1c3MgSG91c2xleSB3cm90ZToNCk1heDoNCg0KRHVyaW5nIGEgdHJh bnNpdGlvbiB0byBxdWFudHVtLXJlc2lzdGFudCBzaWduYXR1cmVzLCBhIHNpZ25lciB3YW50cyB0 byBwdXQgYSB0cmFkaXRpb25hbCBzaWduYXR1cmUgYW5kIGEgcXVhbnR1bS1yZXNpc3RhbnQgc2ln bmF0dXJlIG9uIGFuIG9iamVjdC4gIEdpdmVuIHlvdXIgZGVzY3JpcHRpb24gb2Yga2V5VXNhZ2Ug YW5kIGV4dGVuZGVkS2V5VXNhZ2UsIGJvdGggd291bGQgaGF2ZSB0aGUgZGlnaXRhbFNpZ25hdHVy ZSBiaXQgc2V0LiAgSG93IGRvZXMgYSBjbGllbnQga25vdyBpZiBqdXN0IG9uZSBvciBib3RoIHNp Z25hdHVyZXMgbXVzdCBiZSB2YWxpZD8NCg0KQXMgSmltIFNjaGFhZCBhbHJlYWR5IHNhaWQsIFJG QyA1NzUyIHRhbGtzIGFib3V0IHRoaXMgaXNzdWUgd2hlbiBhIENNUyBTaWduZWREYXRhIGNvbnRh aW5zIG1vcmUgdGhhbiBvbmUgU2lnbmVySW5mby4NCg0KUnVzcw0KDQoNCk9uIFNlcCAxMSwgMjAx OCwgYXQgNDo0NSBQTSwgTWF4IFBhbGEgPE0uUGFsYUBjYWJsZWxhYnMuY29tPG1haWx0bzpNLlBh bGFAY2FibGVsYWJzLmNvbT4+IHdyb3RlOg0KDQpIaSBBbGwsDQoNCkkgYW0gd29ya2luZyBvbiBh IHNpbWlsYXIgLSBidXQgZGlmZmVyZW50IC0gc29sdXRpb24sIGluIHBhcnRpY3VsYXIgSSBzb2x2 ZSB0aGUgaXNzdWUgb2YgKGEpIGJlaW5nIGFibGUgdG8gY29tYmluZSBtb3JlIHRoYW4gb25lIHB1 YmxpYyBrZXksIChiKSBvbmx5IG9uZSAoYWN0dWFsbHkgdHdvKSBPSURzIHJlcXVpcmVkLCBhbmQg KGMpIHNpbXBseSB0aGUgcHJvY2Vzc2luZyBieSByZS11dGlsaXppbmcgdGhlIHNhbWUgZGF0YSBz dHJ1Y3R1cmVzIHdlIGhhdmUgdG9kYXkuDQoNCkkgcGFydGljdWxhciwgSSBkZWZpbmUgYSDigJxj b21wb3NpdGUgcHVibGljIGtleeKAnSBhbmQg4oCcY29tcG9zaXRlIHNpZ25hdHVyZeKAnS4NCg0K VGhlIGZpcnN0IG9uZSBlbmNvZGVzIGluIHRoZSBrZXkgdmFsdWXigJlzIEJJVFNUUklORyB0aGUg REVSIHZhbHVlIG9mIHRoZSBTRVFVRU5DRSBvZiBwdWJsaWMga2V5cyAoZWFjaCBvZiB3aGljaCBp cyBhIHRoZSBzdWJqZWN0UHVibGljS2V5SW5mbyBzdHJ1Y3R1cmUpIGFuZCB1c2VzIGEgc3BlY2lm aWMgT0lEIHRoYXQgaWRlbnRpZmllcyB0aGUgcHVibGljIGtleSB0eXBlLiBUaGUgcGFyYW1ldGVy cyBvZiB0aGUgY29tcG9zaXRlS2V5IGFsZ29yaXRobSBjYW4gYmUgdXNlZCB0byBlbmNvZGUgdGhl IGtleVVzYWdlIGFuZCB0aGUgZXh0ZW5kZWRLZXlVc2FnZSBmb3IgZWFjaCBvZiB0aGUga2V5cyBp biB0aGUgY29tcG9zaXRlIGtleS4NCg0KVGhlIHNhbWUgYXBwcm9hY2ggaXMgdXNlZCBmb3IgdGhl IOKAnENvbXBvc2l0ZSBTaWduYXR1cmXigJ0gY2FzZSB3aGVyZSB0aGUgdmFsdWUgb2YgdGhlIHNp Z25hdHVyZSBpcyB0aGUgREVSIHJlcHJlc2VudGF0aW9uIG9mIHRoZSBTRVFVRU5DRSBvZiBzaWdu YXR1cmVzIG1hZGUgd2l0aCBlYWNoIG9mIHRoZSBrZXlzLg0KDQpBcyBzb29uIGFzIEkgaGF2ZSBz b21lIHNwYXJlIHRpbWUsIEkgd2lsbCBzdWJtaXQgdGhlIGRyYWZ0IC0gbWF5YmUgdGhpcyBjb3Vs ZCBiZSBkaXNjdXNzZWQgaW4gQmFuZ2tvaz8NCg0KVGhpcyBzaW1wbGUgaWRlYSBhbGxvd3MgdXMg dG8gaGF2ZSBhbGwgdGhlIG90aGVyIHByb2NlZHVyZXMgcmVsYXRlZCB0byBQS0lzIHdvcmsgLSB0 aGlzIG1lYW5zIHdlIGNhbiBjb21iaW5lIEVDQyB3aXRoIFJTQSBvciB3aXRoIGEgUXVhbnR1bS1S ZXNpc3RhbnQgYWxnb3JpdGhtICh3aGVuIGZpbmFsbHkgYXZhaWxhYmxlIGFuZCBzdGFuZGFyZGl6 ZWQpLiBBIHN0ZXAgZm9yd2FyZCBmb3IgdGhlIGRlcGxveW1lbnQgb2YgaHlicmlkLVBLSXMgd2hl cmUgbXVsdGlwbGUgTGFnb3MgZm9yIGtleXMgY2FuIGJlIHVzZWQgdG8gYXV0aGVudGljYXRlIGRh dGEsIGNlcnRzLCByZXZvY2F0aW9uIGRhdGEsIGV0Yy4uLiB3ZSBwbGFuIHRvIHVzZSB0aGlzIGlu IG91ciBpbmZyYXN0cnVjdHVyZXMgdG8gcHJvdmlkZSBhIHRyYW5zaXRpb25hbCBwYXRoIGZvciBw b3N0LVF1YW50dW0gdHJhbnNpdGlvbiBhbmQgdG8gZnVydGhlciBpbXByb3ZlIHRoZSBhbGdvcml0 aG0tYWdpbGl0eSBjYXBhYmlsaXR5IG9mIFBLSXMuDQoNCldoYXQgZG8geW91IHRoaW5rPw0KDQpD aGVlcnMsDQpNYXgNCg0KDQotLS0NCg0KQ2hlZXJzLA0KTWF4DQpPbiBTZXAgMTEsIDIwMTgsIGF0 IDg6MzggQU0sIFRpbSBIb2xsZWJlZWsgPHRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPG1haWx0 bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbT4+IHdyb3RlOg0KVW5mb3J0dW5hdGVseSwg4oCc bm90IGV2ZXJ5IGNvbWJpbmF0aW9uIG5lZWRzIHRvIGJlIGNvdmVyZWTigJ0gaW50cm9kdWNlcyBh IGxvdCBvZiBwb2xpdGljcyBhcm91bmQgY2hvb3Npbmcgd2hpY2ggY29tYmluYXRpb25zIOKAnG5l ZWQgdG8gYmUgY292ZXJlZOKAnSwgYSBzdWJqZWN0IG9uIHdoaWNoIGluZXZpdGFibHkgbm90IGV2 ZXJ5b25lIGFncmVlcy4gIEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNzaW9u cyBhbmQgdGhlIHVubmVjZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuDQoNCkkgcGVyc29uYWxs eSBkb27igJl0IHRoaW5rIGEgc2luZ2xlIEFsZ0lEIHdoaWNoIGltcGxpZXMgYSBTRVFVRU5DRSBv ZiBBTEcgSURzIGlzIGFuIGltcHJvdmVtZW50IG92ZXIgYSBTRVFVRU5DRSBvZiBBTEcgSURzLCBv ciBpdHMgbW9yYWwgZXF1aXZhbGVudC4gIEZvciBzaW1wbGUgaHlicmlkIHVzZSBjYXNlcywgdGhl cmUgaXMgYWxzbyBhIGxvdCBvZiB2YWx1ZSBpbiBoYXZpbmcgdGhlIGNsYXNzaWNhbCBhbGdvcml0 aG0gSUQgYmVpbmcgdGhlIHNhbWUgYXMgaXQgdXN1YWxseSBpcywgdG8gYWxsb3cgZWFzaWVyIGlu dGVyb3BlcmFiaWxpdHkgd2l0aCBvbGRlciBzeXN0ZW1zIHRoYXQgZG9u4oCZdCB1bmRlcnN0YW5k IHRoZSBuZXdlciBhbGdvcml0aG1zIChhbmQgY2FuIGJsaXNzZnVsbHkgaWdub3JlIHRoZW0pLg0K DQotVGltDQoNCkZyb206IFNhbnRvc2ggQ2hva2hhbmkgPHNhbnRvc2guY2hva2hhbmlAZ21haWwu Y29tPG1haWx0bzpzYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbT4+DQpTZW50OiBUdWVzZGF5LCBT ZXB0ZW1iZXIgMTEsIDIwMTggMTA6MjkgQU0NClRvOiBUaW0gSG9sbGViZWVrIDx0aW0uaG9sbGVi ZWVrQGRpZ2ljZXJ0LmNvbTxtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20+PjsgJ0Vy aWsgQW5kZXJzZW4nIDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PjsgJ1NQQVNNJyA8 c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVl bGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJF OiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNClRoYW5rcyBUaW0uDQoNClRoZXJlIGFyZSB3 YXlzIHRvIGFjY29tbW9kYXRlIHlvdXIgY29uY2Vybi4NCg0KT25lIHdheSB0byBoYW5kbGUgdGhp cyBpcyBkZWZpbmluZyBhIHNpbmdsZSBBbGcgSUQgQSB3aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ug b2YgQUxHIElEcyBhbmQgZGVmaW5lIHRoZSByZWx5aW5nIHBhcnR5IHJ1bGVzIGluIHRlcm1zIG9m IGl0cyBhYmlsaXR5IHRvIHByb2Nlc3Mgb25lIG9yIGFsbCBBTEcgSURzLg0KDQpBbm90aGVyIHdh eSB0byBkbyB0aGlzIGlzIG5vdCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBiZSBjb3ZlcmVk IGFuZCB0aGUgdXNlciBjb21tdW5pdHkgZGVmaW5lcyBpdHMgb3duICBBbGcgSUQgWGkgd2hpY2gg bWFwcyB0byBhIFNFUVVFTkNFIG9mIEFMRyBJRHMuDQoNCkZyb206IFNwYXNtIFttYWlsdG86c3Bh c20tYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFRpbSBIb2xsZWJlZWsNClNlbnQ6IFR1 ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAxOCAxMDowMyBBTQ0KVG86IEVyaWsgQW5kZXJzZW4gPGVy YUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4+OyAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZzxt YWlsdG86c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRv Ong1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91Ymxl IHNpZ25hdHVyZXMNCg0KRG9lc27igJl0IHRoZSBjb21iaW5hdG9yaWMgZXhwbG9zaW9uIHJlbmRl ciB0aGlzIGNvbXBsZXRlbHkgaW1wcmFjdGljYWw/DQoNCllvdSBuZWVkIE5fYyB4IE5fcHEgYWxn b3JpdGhtIGlkZW50aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRoZSBzaW1wbGUgaHlicmlkIHVzZSBj YXNlIHdoZXJlIGEgc2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0aG0gaXMgYmVpbmcgdXNlZCBpbiBj b25qdW5jdGlvbiB3aXRoIGEgc2luZ2xlIHBvc3QtcXVhbnR1bSBhbGdvcml0aG0uDQoNCkFuZCB0 aGVyZSBhcmUgcGVvcGxlIHdobyB3YW50IHRvIHVzZSBtdWx0aXBsZSBwb3N0LXF1YW50dW0gYWxn b3JpdGhtcyB0byBoZWRnZSBhZ2FpbnN0IHBvdGVudGlhbCB5ZXQgdG8gYmUgZGlzY292ZXJlZCB3 ZWFrbmVzc2VzIGluIHBvc3QtcXVhbnR1bSBhbGdvcml0aG1zLg0KDQpJ4oCZbSBub3QgcmVhbGx5 IGxvb2tpbmcgZm9yd2FyZCB0byB0cnlpbmcgdG8gYWxsb2NhdGUgb3IgbWFuYWdlIE8oTl9jIHgg Tl9wcV4zKSBhbGdvcml0aG0gaWRlbnRpZmllcnPigKYNCg0KLVRpbQ0KDQpGcm9tOiBTcGFzbSA8 c3Bhc20tYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZz4+IE9u IEJlaGFsZiBPZiBFcmlrIEFuZGVyc2VuDQpTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIw MTggMzoxMCBBTQ0KVG86ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRm Lm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZy ZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpI aSBTYW50b3NoLA0KDQpZb3UgaGF2ZSBwcm9wb3NlZCBzb21ldGhpbmcgbGlrZSB0aGlzIGJlZm9y ZS4gSXQgc3RpbGwgcHV6emxpbmcgaW4gbXkgYnJhaW4uIEFzIEkgdW5kZXJzdGFuZCwgaXQgcmVx dWlyZXMgdGhhdCB3ZSBkZWZpbmUgYSBwYXJ0aWN1bGFyIGFsZ29yaXRobSB0aGF0IGhhcyBhIHBh cmFtZXRlciB0aGF0IGluY2x1ZGVzIHRoZSB0aGluZ3MgeW91IHN1Z2dlc3QuIEl0IGlzIHdvcnRo eSB0byBiZSBhbmFseXNlZC4NCg0KRXJpaw0KDQpGcmE6IFNwYXNtIFttYWlsdG86c3Bhc20tYm91 bmNlc0BpZXRmLm9yZ10gUMOlIHZlZ25lIGFmIFNhbnRvc2ggQ2hva2hhbmkNClNlbmR0OiAxMCBT ZXB0ZW1iZXIgMjAxOCAxOToxOA0KVGlsOiAnSmltIFNjaGFhZCcgPGlldGZAYXVndXN0Y2VsbGFy cy5jb208bWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20+PjsgJ1J5YW4gU2xlZXZpJyA8cnlh bi1pZXRmQHNsZWV2aS5jb208bWFpbHRvOnJ5YW4taWV0ZkBzbGVldmkuY29tPj47IGVyYUB4NTAw LmV1PG1haWx0bzplcmFAeDUwMC5ldT4NCkNjOiAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZzxtYWls dG86c3Bhc21AaWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1 MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPg0KRW1uZTogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25h dHVyZXMNCg0KV2h5IG5vdCBsZXQgYWxnb3JpdGhtIGlkZW50aWZpZXIgZGljdGF0ZSB0aGUgbnVt YmVyIG9mIHNpZ25hdHVyZXMgYW5kIHRoZWlyIHN5bnRheD8NCg0KRnJvbTogU3Bhc20gW21haWx0 bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgSmltIFNjaGFhZA0KU2VudDog TW9uZGF5LCBTZXB0ZW1iZXIgMTAsIDIwMTggMTowNyBQTQ0KVG86ICdSeWFuIFNsZWV2aScgPHJ5 YW4taWV0ZkBzbGVldmkuY29tPG1haWx0bzpyeWFuLWlldGZAc2xlZXZpLmNvbT4+OyBlcmFAeDUw MC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+DQpDYzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFp bHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4 NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBz aWduYXR1cmVzDQoNClJ5YW4sDQoNClRoZSBkaXNjdXNzaW9uIGluIExvbmRvbiBkZWFsdCB3aXRo IGEgY29tcGxldGVseSBkaWZmZXJlbnQgcHJvcG9zYWwgdGhhbiB0aGlzIG9uZS4gIFdoaWxlIEkg dGhpbmsgdGhlcmUgYXJlIHByb2JsZW1zIHdpdGggdGhpcyB0aGF0IG5lZWQgdG8gYmUgZGVhbHQg d2l0aCB0aGV5IGFyZSBtb3N0bHkgbm90IHRoZSBzYW1lIHNldC4NCg0KRXJpaywNCg0KV2h5IGlz IHRoaXMgY29uc2lkZXJlZCB0byBiZSBhIHByZWZlcnJlZCBzb2x1dGlvbiB0byBkZWZpbmluZyBh IG5ldyBzaWduYXR1cmUgYWxnb3JpdGhtIHdoaWNoIGNvbnRhaW5zIGFzIHRoZSBwYXJhbWV0ZXIg dGhlIHNlcXVlbmNlIG9mIGFsZ29yaXRobSBpZGVudGlmaWVycyBhbmQgYXMgdGhlIHNpZ25hdHVy ZSB2YWx1ZSBhIHNlcXVlbmNlIG9mIHNpZ25hdHVyZSB2YWx1ZXMuICBUaGUgcHJvYmxlbSB3aXRo IGp1c3QgZGVmaW5pbmcgdGhlIGV4dGVuc2lvbiB0byBTSUdORUQgaXMgdGhhdCBvbmUgbmVlZHMg dG8gbWFrZSBzdXJlIHRoYXQgdGhlIHNldCBvZiBzaWduYXR1cmUgYWxnb3JpdGhtcyBhbmQgcGFy YW1ldGVycyBhcmUgYWxzbyBwYXJ0IG9mIHRoZSBkYXRhIHRvIGJlIHNpZ25lZCBhbmQgSSBhbSBu b3Qgc2VlaW5nIHRoYXQgaGlnaGxpZ2h0ZWQgaGVyZS4NCg0KSmltDQoNCg0KRnJvbTogU3Bhc20g PHNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBP biBCZWhhbGYgT2YgUnlhbiBTbGVldmkNClNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4 IDg6NTMgQU0NClRvOiBlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+DQpDYzogU1BBU00g PHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJl ZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBS ZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQoNCk9uIE1vbiwgU2VwIDEwLCAyMDE4IGF0 IDEwOjU2IEFNIEVyaWsgQW5kZXJzZW4gPGVyYUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4+ IHdyb3RlOg0KSGkgRm9saywNCg0KSW4gSVRVLVQgd2UgaGF2ZSBwbGFucyB0byBhbGxvdyBmb3Ig ZG91YmxlIHNpZ25hdHVyZXMgdXNpbmcgdGhlIFNJR05FRCBwYXJhbWV0cml6ZWQgZGF0YSB0eXBl IGRlZmluZWQgaW4gWC41MDkgdG8gY29wZSB3aXRoIHNpdHVhdGlvbiBhcyBkZXNjcmliZWQgaW4g dGhlIGludGVybmV0IGRyYWZ0OiDigJxNdWx0aXBsZSBQdWJsaWMtS2V5IEFsZ29yaXRobSBYLjUw OSBDZXJ0aWZpY2F0ZXMgKGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDktMDEp 4oCdDQoNCldlIHN1Z2dlc3QgdG8gZW5oYW5jZSB0aGUgU0lHTkVEIGRhdGEgdHlwZSBhcyBzaG93 biBiZWxvdzoNCg0KU0lHTkVEe1RvQmVTaWduZWR9IDo6PSBTRVFVRU5DRSB7DQogIENPTVBPTkVO VFMgT0YgU0lHTkFUVVJFLA0KICAuLi4uLi4uLi4sDQogIGFsdEFsZ29yaXRobUlkZW50aWZpZXIg IEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSBPUFRJT05BTCwNCiAg YWx0U2lnbmF0dXJlICAgICAgICAgICAgQklUIFNUUklORyBPUFRJT05BTA0KICB9IChXSVRIIENP TVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRpZmllciBQUkVTRU5ULCBhbHRTaWduYXR1 cmUgUFJFU0VOVCB9IHwNCiAgICAgV0lUSCBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRobUlk ZW50aWZpZXIgQUJTRU5ULCAgYWx0U2lnbmF0dXJlIEFCU0VOVCB9ICkNCg0KV2UgYXJlIG9wZW4g dG8gY29tbWVudHMuIFdlIGtub3cgdGhhdCBJRVRGIGlzIG5vdCBhIGhlYXZ5IHVzZXIgb2YgdGhp cyBkYXRhIHR5cGUuDQoNCldlIGhhdmUgbm8gaW50ZW50aW9uIHRvIHVzZSB0aGlzIGV4dGVuZGVk IGRhdGEgdHlwZSBmb3IgY2VydGlmaWNhdGVzIGFuZCBDUkxzLg0KDQpGb3IgeW91ciBpbmZvcm1h dGlvbiwgU0lHTkFUVVJFIGlzIGRlZmluZWQgYXM6DQoNClNJR05BVFVSRSA6Oj0gU0VRVUVOQ0Ug ew0KICBhbGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRB bGdvcml0aG1zfX0sDQogIHNpZ25hdHVyZSAgICAgICAgICAgIEJJVCBTVFJJTkcsDQogIC4uLi4u Li4gfQ0KDQpGcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSksIHRoZXJlIHdlcmUg YSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUgZGlzY3Vzc2lvbiAt IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0 ZXMtMTAxLWxhbXBzLTAxLnR4dCAtIHRoYXQgZnVuZGFtZW50YWxseSBxdWVzdGlvbmVkIHRoYXQg YXBwcm9hY2guDQoNCkhhcyB0aGUgSVRVLVQgYWRkcmVzc2VkIG9yIHJlc29sdmVkIHRob3NlIGNv bmNlcm5zPyBBcmUgdGhleSBub3QgYXBwbGljYWJsZSBmb3Igc29tZSByZWFzb24gc3BlY2lmaWMg dG8gSVRVLVQ/DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KU3Bhc20gbWFpbGluZyBsaXN0DQpTcGFzbUBpZXRmLm9yZzxtYWlsdG86U3Bhc21AaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtDQoNCg0KLS0N CkJlc3QgUmVnYXJkcywNCk1hc3NpbWlsaWFubyBQYWxhLCBQaC5ELg0KW0NhYmxlTGFic10NClBy aW5jaXBhbCBBcmNoaXRlY3QNClNlY3VyaXR5IFNlcnZpY2VzLCBSJkQNCg0KDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpTcGFzbSBtYWlsaW5nIGxp c3QNCg0KU3Bhc21AaWV0Zi5vcmc8bWFpbHRvOlNwYXNtQGlldGYub3JnPg0KDQpodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtDQoNCg== --_000_0BB17F8431A640CF8451E785F78DFDA2isaracom_ Content-Type: text/html; charset="utf-8" Content-ID: <1DB7AA63763DEF47B52C6A1C5C255429@isara.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMTowIDAgMCAwIDAgMCAwIDAgMCAw O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6 MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZh bWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyI7DQoJcGFub3NlLTE6MiA3IDMgOSAy IDIgNSAyIDQgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyBj b2xvclw6IHJlZCI7DQoJcGFub3NlLTE6MiA3IDMgOSAyIDIgNSAyIDQgNDt9DQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyBcO2NvbG9yXDpcI0MwMDAwMCI7DQoJcGFu b3NlLTE6MiA3IDMgOSAyIDIgNSAyIDQgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyBcOyBcO2NvbG9yXDpyZWQiOw0KCXBhbm9zZS0xOjIgNyAzIDkgMiAyIDUgMiA0 IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjsN Cgljb2xvcjpibGFjazt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0K YTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0 eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwcmUN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1h dHRlZCBDaGFyIjsNCgltYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6YmxhY2s7 fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBh cmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207DQoJbWFy Z2luLXJpZ2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDozNi4wcHQ7 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1p bHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcC5tc29ub3JtYWww LCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3Jt YWw7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0K CW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2lu LWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBS b21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0K CXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1m YW1pbHk6Q29uc29sYXM7DQoJY29sb3I6YmxhY2s7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxT dHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyNA0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0 OTdEO30NCnNwYW4uRW1haWxTdHlsZTI1DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTI2DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm O30NCnNwYW4uRW1haWxTdHlsZTI3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTI5DQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZv bnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIu MHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlz dCBsMA0KCXttc28tbGlzdC1pZDo2NzAyNTgxMTE7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjkx ODI5ODUyNjt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOjM2LjBwdDsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9 DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLXRhYi1zdG9wOjcyLjBwdDsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBs MDpsZXZlbDMNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0 DQoJe21zby1sZXZlbC10YWItc3RvcDoxNDQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28t bGV2ZWwtdGFiLXN0b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLXRh Yi1zdG9wOjIxNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDoy NTIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot MTguMHB0O30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mjg4LjBwdDsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9 DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMyNC4wcHQ7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3Qg bDENCgl7bXNvLWxpc3QtaWQ6MTM0OTc5MTc5NjsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCglt c28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE0NzExMTY4NTAgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3 MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7 fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwx OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6 bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsNQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7 bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tQ0EiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SGkgSmltLDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5U aGUgaW50ZW50aW9uIG9mIGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDkgd2Fz IHRoYXQgdGhlIHB1YmxpYyBrZXkgaW4gU3ViamVjdEFsdFB1YmxpY0tleUluZm9FeHQgZXh0ZW5z aW9uIGlzIGFuIGFsdGVybmF0aXZlIHRvIHRoZSBwdWJsaWMga2V5IGluIFN1YmplY3RQdWJsaWNL ZXlJbmZvDQogKHRob3VnaCBkZXBlbmRpbmcgb24gcG9saWN5LCBib3RoIHZlcmlmeWluZyBzaWdu YXR1cmVzIGNvdWxkIGJlIHJlcXVpcmVkKS4mbmJzcDsgVGhlIGFsdGVybmF0aXZlIGtleSBwYWly IGlzIGJvdW5kIHRvIHRoZSBwcmltYXJ5IGtleSBwYWlyLCBhbmQgYm90aCB3aWxsIGJlIGFzc29j aWF0ZWQgd2l0aCB0aGUgc2FtZSBpc3N1aW5nIGNlcnRpZmljYXRlLiZuYnNwOyBUaGlzIGlzIHdo eSB3ZSBkaWRu4oCZdCBhZGQgYWx0ZXJuYXRpdmUgQUtJIG9yIFNLSSBleHRlbnNpb25zLiZuYnNw Ow0KIE90aGVyd2lzZSwgdGhlIGNlcnRpZmljYXRlIGNoYWluIHdvdWxkIHR1cm4gaW50byBhIGNl cnRpZmljYXRlIHRyZWUgYXMgeW91IHBvaW50IG91dCwgZ3JlYXRseSBpbmNyZWFzaW5nIHRoZSBk aWZmaWN1bHR5IG9mIHByb2Nlc3NpbmcgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VGhlIG5leHQgdmVy c2lvbiBvZiB0aGUgZHJhZnQgd2lsbCBtYWtlIHRoaXMgcmVxdWlyZW1lbnQgZXhwbGljaXQuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkkgZG9u4oCZdCB1bmRlcnN0YW5kIHlvdXIgc3RhdGVtZW50IOKAnDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgcHJvcG9zYWwgZG9lcyBub3QgaGF2ZSBhbnkgd2F5IG9m IGVuY29kaW5nIHRoZSBtdWx0aXBsZSBwdWJsaWMNCiBrZXlzLjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPuKAnSZuYnNwOyBUaGUgYWx0ZXJuYXRpdmUgcHVibGljIGtleSBpcyBlbmNvZGVkIGluIHRo ZSBTdWJqZWN0QWx0UHVibGljS2V5SW5mb0V4dCBleHRlbnNpb24uJm5ic3A7IElmIHlvdSBtZWFu IHRoZXJl4oCZcyBubyB3YXkgb2YgZW5jb2RpbmcgJmd0OyAxIGFsdGVybmF0aXZlIGtleXMgKGku ZS4gJmd0OyAyIHRvdGFsIGtleXMgaW4gdGhlIGNlcnRpZmljYXRlKQ0KIHRoZW4geW91IGFyZSBj b3JyZWN0LiZuYnNwOyBUbyBrZWVwIHRoaW5ncyBzaW1wbGUgKEkga25vdywgSSBrbm93LCBpdOKA mXMgWC41MDksIHRoYXQgc2hpcCBoYXMgc2FpbGVkKSB3ZSByZXN0cmljdGVkIGl0IHRvIGEgc2lu Z2xlIGFsdGVybmF0aXZlIGtleS9zaWduYXR1cmUuJm5ic3A7IFRvIGdldCBtdWx0aXBsZSBhbHRl cm5hdGl2ZSBrZXlzL3NpZ25hdHVyZXMsIG9uZSBjb3VsZCBkZWZpbmUgYSBuZXcgQWxnb3JpdGht SWRlbnRpZmllciBzcGVjaWZ5aW5nIG11bHRpcGxlDQoga2V5cyBhbmQgc2lnbmF0dXJlcywgYXMg bWVudGlvbmVkIGVhcmxpZXIgaW4gdGhlIHRocmVhZC4mbmJzcDsgVGhpcyBjYW4gYmUgc3BlY2lm aWVkIGluIGEgc2VwYXJhdGUgZHJhZnQgaWYgZGVzaXJlZCwgYW5kIHRoZSBBbGdvcml0aG1JZGVu dGlmaWVyIGNvdWxkIGJlIHVzZWQgaW4gdGhlIFN1YmplY3RBbHRQdWJsaWNLZXlJbmZvRXh0IGFu ZCBBbHRTaWduYXR1cmVBbGdvcml0aG1FeHQgZXh0ZW5zaW9ucyAod2l0aCB0aGUgbXVsdGlwbGUg c2lnbmF0dXJlcw0KIGVuY29kZWQgaW4gdGhlIEFsdFNpZ25hdHVyZVZhbHVlRXh0IGV4dGVuc2lv bikgaW4gb3JkZXIgdG8gZ2V0IG11bHRpcGxlIGFsdGVybmF0aXZlIGtleXMvc2lnbmF0dXJlcyAo d2l0aCBiYWNrd2FyZHMgY29tcGF0aWJpbGl0eSksIG9yIHRoZSBBbGdvcml0aG1JZGVudGlmaWVy IGNvdWxkIGJlIHVzZWQgaW4gdGhlIFJGQzUyODAgZmllbGRzIGluIG9yZGVyIHRvIGdldCBtdWx0 aXBsZSBrZXlzL3NpZ25hdHVyZXMgKHdpdGhvdXQgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkpLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5UaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5EYW5pZWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5PbiAyMDE4LTA5LTIyLCAxMTo0OSBQTSwgJnF1b3Q7 U3Bhc20gb24gYmVoYWxmIG9mIEppbSBTY2hhYWQmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpz cGFzbS1ib3VuY2VzQGlldGYub3JnIj5zcGFzbS1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhh bGYgb2YNCjxhIGhyZWY9Im1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tIj5pZXRmQGF1Z3Vz dGNlbGxhcnMuY29tPC9hPiZndDsgd3JvdGU6PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+VGltLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5FeGNlcHQgZm9yIHRoZSBjYXNl IG9mIHNlbGYtaXNzdWVkIGNlcnRpZmljYXRlcywgSSBhbG1vc3QgbmV2ZXIgY2FyZSBhYm91dCBw cm9jZXNzaW5nIGEgc2luZ2xlIGNlcnRpZmljYXRlLiZuYnNwOyBSYXRoZXIgSSBhbSBnb2luZyB0 byBwcm9jZXNzIGEgY2hhaW4NCiBvZiBjZXJ0aWZpY2F0ZXMgdGhhdCBnb2VzIGJhY2sgdG8gYSB0 cnVzdCByb290LiBDb21wYXJpbmcgdGhpcyB0byB0aGUgU0hBMS9TSEEtMjU2IHRyYW5zaXRpb24g SSBkb27igJl0IHRoaW5rIGlzIHZlcnkgcmVsZXZhbnQuJm5ic3A7IEluIHRoYXQgY2FzZSBvbmUg Y291bGQgYmUgdXNpbmcgdGhlIHNhbWUgcHVibGljIGtleSB2YWx1ZSB3aXRoIGRpZmZlcmVudCBz aWduYXR1cmUgYWxnb3JpdGhtcy4mbmJzcDsgSGVyZSB3ZSBhcmUgbG9va2luZyBhdCB1c2luZyB0 d28NCiBjb21wbGV0ZWx5IGRpZmZlcmVudCBwdWJsaWMga2V5IHN0cnVjdHVyZXMsIGkuZS4gYW4g RWREU0EgYW5kIGEgSGFzaC1iYXNlZCBzaWduYXR1cmUuJm5ic3A7IFRoaXMgbWVhbnMgdGhhdCBi b3RoIHB1YmxpYyBrZXlzIG5lZWQgdG8gYmUgZmluZGFibGUgZnJvbSBzb21lIGlzc3VlciBjZXJ0 aWZpY2F0ZS4mbmJzcDsgVGhpcyBwcm9wb3NhbCBkb2VzIG5vdCBoYXZlIGFueSB3YXkgb2YgZW5j b2RpbmcgdGhlIG11bHRpcGxlIHB1YmxpYyBrZXlzLiZuYnNwOyZuYnNwOyBGcm9tIHRoaXMNCiBJ IG1ha2UgdGhlIGFzc3VtcHRpb24gdGhhdCB0aGVyZSBpcyBhIHNpbmdsZSBjZXJ0aWZpY2F0ZSBm b3IgZWFjaCBvZiB0aGUgcHVibGljIGtleXMsIHdoaWNoIGNhbiBoYXZlIG11bHRpcGxlIHNpZ25h dHVyZXMgb24gaXQuJm5ic3A7ICZuYnNwO0lmIHRoZSBwdWJsaWMga2V5cyBhcmUgaW4gdGhlaXIg b3duIGNlcnRpZmljYXRlcywgdGhlbiB5b3UgZ2V0IGxvdHMgb2YgZnVuIGluIHRlcm1zIG9mIHRy eWluZyB0byBidWlsZCB0aGUgY2hhaW5zIGFuZCBhbGwgb2YgdGhlDQogdGhpbmdzIHRoYXQgSSBw b2ludGVkIHRvIGFyZSByZWxldmFudC4mbmJzcDsgSWYgdGhlIHB1YmxpYyBrZXlzIGFyZSBpbiBh IHNpbmdsZSBjZXJ0aWZpY2F0ZSB0aGVuIHRoaXMgaXMgbm90IGRvY3VtZW50ZWQuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPmppbTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gVGltIEhvbGxlYmVlayAmbHQ7dGltLmhvbGxlYmVla0BkaWdp Y2VydC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gU2F0dXJkYXksIFNlcHRlbWJlciAyMiwg MjAxOCA0OjMzIEFNPGJyPg0KPGI+VG86PC9iPiBKaW0gU2NoYWFkICZsdDtpZXRmQGF1Z3VzdGNl bGxhcnMuY29tJmd0OzsgJ1Bhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKScgJmx0O3BrYW1wYW5h QGNpc2NvLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IHNwYXNtQGlldGYub3JnPGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJFOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Ib3cgYXJlIGNoYWlu L3BhdGggYnVpbGRpbmcsIEFJQSwgYW5kIHNvIG9uIGFmZmVjdGVkPyZuYnNwOyBBbHRlcm5hdGl2 ZSBzaWduYXR1cmVzIGp1c3QgZ2l2ZSBhbHRlcm5hdGl2ZSBpbmZvcm1hdGlvbiB0aGF0IGNhbiBi ZSBlaXRoZXIgYmUgdXNlZCBzZXBhcmF0ZWx5DQogb3IgYWRkaXRpb25hbGx5IHRvIHZlcmlmeSBh IHBhcnRpY3VsYXIgY2VydGlmaWNhdGUgc2lnbmF0dXJlLiZuYnNwOyBIb3cgeW91IGZpbmQgdmFs aWQgY2VydGlmaWNhdGVzIGFuZCBwdXQgdGhlbSB0b2dldGhlciBpbnRvIGEgY2hhaW4gc2VlbXMg dG8gbWUgdG8gYmUgY29tcGxldGVseSBpbmRlcGVuZGVudCBvZiBob3cgeW91IHZhbGlkYXRlIGEg cGFydGljdWxhciBzaWduYXR1cmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlByb2JsZW0gNSBzZWVtcyBsaWtlIGEg cGFydGljdWxhcmx5IG9kZCBvYmplY3Rpb24uJm5ic3A7IEkgaGF2ZW7igJl0IHNlZW4gYSBwcm9w b3NhbCBmb3Igc2VwYXJhdGUgY2VydGlmaWNhdGVzLiZuYnNwOyBJbmRlZWQsIHRoYXQgaXMgb25l IG9mIHRoZSB0aGluZ3MgdGhhdA0KIEkgdGhpbmsgaXMgdmVyeSB3aXNlIHRvIGF2b2lkLCBhcyBp dCBoYXMgY2F1c2VkIHNpZ25pZmljYW50IHByb2JsZW1zIGluIHRoZSBwYXN0LCBtb3N0IHJlY2Vu dGx5IGZvciBleGFtcGxlIHdpdGggU0hBMSAvIFNIQS0yNTYgdHJhbnNpdGlvbi4mbmJzcDsgVGhl IGVudGlyZSBwb2ludCBvZiBpbmNsdWRpbmcgbXVsdGlwbGUgc2lnbmF0dXJlcyB3aXRoIGRpZmZl cmVudCBhbGdvcml0aG1zIGlzIHRvIGF2b2lkIHRoZSBuZWVkIHRvIGhhdmUgc2VwYXJhdGUgaGll cmFyY2hpZXMNCiBmb3IgdGhlIG9sZCBhbmQgbmV3IHdheXMgb2YgZG9pbmcgdGhpbmdzLiZuYnNw OyA8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+VGhlcmUgc2VlbSB0byBiZSBzb21lIGFzc3VtcHRpb25zIGJ1aWx0IGlu dG8geW91ciBsaXN0IG9mIHByb2JsZW1zIHRoYXQgSSB0aGluayBhcmUgaW1wb3J0YW50IHRvIHVu cGFjaywgZGlzY3VzcywgYW5kIHJlc29sdmUgZmlyc3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi1UaW08L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGlu ZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU3Bhc20gJmx0Ozxh IGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj5zcGFzbS1ib3VuY2VzQGlldGYu b3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+SmltIFNjaGFhZDxicj4NCjxiPlNlbnQ6 PC9iPiBTYXR1cmRheSwgU2VwdGVtYmVyIDIyLCAyMDE4IDEyOjE4IEFNPGJyPg0KPGI+VG86PC9i PiAnUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBrYW1w YW5hQGNpc2NvLmNvbSI+cGthbXBhbmFAY2lzY28uY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+ IDxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+c3Bhc21AaWV0Zi5vcmc8L2E+PGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5QYW5vcyw8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+V2l0aG91dCBhIHJlYWxseSBkZXRhaWxlZCBhbmFseXNpcyBvZiB5b3VyIHBy b3Bvc2FsIGFuZCBob3cgaXQgd2lsbCBpbnRlcmFjdCB3aXRoIGV4aXN0aW5nIGNvZGUgSSBjb3Vs ZCBub3QgcG9zc2libHkgc3VwcG9ydCBpdC4mbmJzcDsmbmJzcDsgQSBxdWljayBsaXN0IG9mDQog cHJvYmxlbXMgdGhhdCBJIHdvdWxkIGxpc3QgKHdpdGhvdXQgdGhvdWdodCkgYXJlOjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQ7dGV4dC1p bmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9ydExp c3RzXT48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4xLjxzcGFuIHN0eWxlPSJmb250Ojcu MHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkhpc3Rvcmlj YWxseSwgbG90cyBvZiBwZW9wbGUgY2Fubm90IGdldCBERVIgZW5jb2RpbmcgY29ycmVjdC4mbmJz cDsgUGV0ZXIgR3V0bWFubiBoYXMgYSBodWdlIGNvbGxlY3Rpb24gb2YgY2VydGlmaWNhdGVzIHRo YXQgd2VyZSBpc3N1ZWQgYnkgQ0FzIHRoYXQgd2VyZSBub3QgY29ycmVjdGx5IERFUiBlbmNvZGVk LiZuYnNwOw0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3Jh cGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlz dDpsMSBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0ibXNv LWxpc3Q6SWdub3JlIj4yLjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBS b21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFu PjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkV2ZXJ5Ym9keSB3aG8gd2FudHMgdG8gc3VwcG9y dCBQUSBhbGdvcml0aG1zIGlzIG5vdyByZXF1aXJlZCB0byBhZGQgYSBERVIgZW5jb2RlciB0byB0 aGVpciBzeXN0ZW1zLiZuYnNwOyBGb3IgdGhpbmdzIHdoaWNoIG9ubHkgY29uc3VtZSBjZXJ0aWZp Y2F0ZXMsIGNybHMsIGNtcyBvYmplY3RzIHRoaXMgbWVhbnMNCiB0aGF0IHRoZXkgbm93IGhhdmUg ZW5sYXJnZWQgY29kZSBzaXplLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0O3RleHQtaW5kZW50Oi0xOC4w cHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4g c3R5bGU9Im1zby1saXN0Oklnbm9yZSI+My48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JIGhhdmUgbm8gaWRlYSB3aGF0 IHRoZSBydWxlcyBhcmUgZm9yIG1hdGNoaW5nIENSTHMgYW5kIGNlcnRpZmljYXRlcyBpbiB0ZXJt cyBvZiBzaWduYXR1cmUgYWxnb3JpdGhtcywgSSB3b3VsZCBhc3N1bWUgdGhhdCB5b3UgbmVlZCB0 aGUgc2FtZSBwcm90ZWN0aW9ucyBmb3IgQ1JMcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcyLjBwdDt0ZXh0LWlu ZGVudDotMTguMHB0O21zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlz dHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjQuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4w cHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+WW91IGFyZSBu b3Qgc2lnbmluZyB0aGUgYWx0IHNpZ25hdHVyZSBhbGdvcml0aG0gYXMgcGFydCBvZiB0aGUgVEJT IChlYXN5IHRvIGZpeCk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcyLjBwdDt0ZXh0LWluZGVudDotMTguMHB0O21z by1saXN0OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxl PSJtc28tbGlzdDpJZ25vcmUiPjUuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMg TmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SG93IGFyZSB0aGUgY2VydGlmaWNhdGVz IGZvciB0aGUgaXNzdWVyIHNldHVwPyZuYnNwOyBBcmUgdGhlcmUgc2VwYXJhdGUgY2VydGlmaWNh dGVzIG9yIHRoZSBzYW1lIGNlcnRpZmljYXRlPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0O3RleHQtaW5k ZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0 c10+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Ni48c3BhbiBzdHlsZT0iZm9udDo3LjBw dCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOw0KPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5KdXN0IGhvdyBi YWRseSBkb2VzIHRoaXMgYWZmZWN0IHRoZSBwYXRoIGJ1aWxkaW5nIGNvZGUgYXMgaXQgbm93IG5l ZWRzIHRvIGJlIG1vZGlmaWVkIHRvIGhhdmUgYWRkaXRpb25hbCBpbnB1dHMuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVm dDo3Mi4wcHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQo8 IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj43LjxzcGFu IHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkRvIHlvdSB3YW50IHRvIGNoYW5nZSB0aGUgQUtJIGZpZWxkIHRvIG1ha2UgY2hhaW4g YnVpbGRpbmcgYmV0dGVyIG9yIGFyZSB5b3UgZ29pbmcgdG8gY2F1c2Ugbm9uLXN1cHBvcnRpbmcg c3lzdGVtcyB0byBwb3RlbnRpYWxseSBzdGFydCBkb3dubG9hZGluZyBsb3RzIG9mIG90aGVyIGNl cnRpZmljYXRlcw0KIGFzIHdlbGwuJm5ic3A7IDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0O3RleHQtaW5k ZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0 c10+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+OC48c3BhbiBzdHlsZT0iZm9udDo3LjBw dCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOw0KPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TYW1lIGlzc3Vl cyBhcHBseWluZyB0byBDUkwgZGlzdHJpYnV0aW9uIHBvaW50cyDigJMgaXQgd291bGQgcG90ZW50 aWFsbHkgYmUgbW9yZSBlZmZpY2llbnQgdG8gaGF2ZSBzZXBhcmF0ZSBDUkxzIHJhdGhlciB0aGFu IGNvbWJpbmVkIG9uZXMgYXMgeW91IGNvdWxkIG5vdCB1c2UgdGhlIGV4dGVuc2lvbg0KIGluIHRo YXQgY2FzZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcyLjBwdDt0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0 OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28t bGlzdDpJZ25vcmUiPjkuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+ PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SG93IGlzIEFJQSBnb2luZyB0byB3b3JrLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6NzIuMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxm bzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+ MTAuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4m bmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SWYgeW91IHJl cXVpcmUgdGhhdCB0aGUgc2FtZSBhbGdvcml0aG1zIGJlIHVzZWQsIHdoYXQgaGFwcGVucyB3aXRo IE9DU1AgcmVzcG9uc2VzIGFuZCBkZWxlZ2F0ZWQgQ1JMIGlzc3VlcnM/4oCZPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SmltPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4gUGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpICZsdDs8YSBocmVm PSJtYWlsdG86cGthbXBhbmFAY2lzY28uY29tIj5wa2FtcGFuYUBjaXNjby5jb208L2E+Jmd0Ow0K PGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgU2VwdGVtYmVyIDIxLCAyMDE4IDg6MDggUE08YnI+ DQo8Yj5Ubzo8L2I+IERyLiBQYWxhICZsdDs8YSBocmVmPSJtYWlsdG86bWFkd29sZkBvcGVuY2Eu b3JnIj5tYWR3b2xmQG9wZW5jYS5vcmc8L2E+Jmd0OzsgSmltIFNjaGFhZCAmbHQ7PGEgaHJlZj0i bWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20iPmlldGZAYXVndXN0Y2VsbGFycy5jb208L2E+ Jmd0Ozxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj5zcGFz bUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtsYW1wc10gRG91YmxlIHNp Z25hdHVyZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWF4LCBKaW0sPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5BZ3JlZWQuIEluIHN1bW1hcnksIHRoZXJlIGFyZSB0b28g Z29vZCBwcm9wb3NhbHMgKEVyaWssIE1heOKAmXMpIHRoYXQgY2FuIGNvbWJpbmUgbXVsdGlwbGUg UEtzIGFuZCBTaWdzLiBUaGF0IHdvdWxkIGFsbG93IHVzIHRvIHVzIG1vcmUNCiB0aGFuIG9uZSBQ USBhbGdvcyBpZiB0aGV5IGFyZSBub3QgdHJ1c3RlZC4gPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5kcmFmdC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZCBhbGxvd3Mg Zm9yIGJhY2t3YXJkcyBjb21wYXRpYmlsaXR5IGJ5IGRlZmluaW5nIG9uZSBvbmx5IFBRIGtleSBh bmQgc2lnIGFzIG5vbi1jcml0aWNhbCBleHRlbnNpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+SSB3b25kZXIgaWYgdGhlIHR3byBjb25jZXB0cyBjb3VsZCBiZSBt ZXJnZWQuIE1lYW5pbmcgdXNlIHRoZSBjb21wb3NpdGUga2V5ICYjNDM7IHNpZ3MgY2FuIG5vbi1j cml0aWNhbCBleHRlbnNpb25zLiBPbGQgY2xpZW50cyBkaXNyZWdhcmQNCiB0aGUgUFEgZXh0ZW5z aW9ucy4gTmV3IGNsaWVudHMgdmVyaWZ5IHRoZSBjbGFzc2ljYWwgJm5ic3A7YW5kIHRoZSBQUSBh bGdvcyBkZWZpbmVkIGluIHRoZSBjb21wb3NpdGUgT0lEIGNvbnRhaW5lZCBpbiB0aGUgbm9uLWNy aXRpY2FsIGV4dGVuc2lvbi48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlBhbm9zPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU3Bhc20gWzxhIGhyZWY9 Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRm Lm9yZzwvYT5dDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkRyLiBQYWxhPGJyPg0KPGI+U2VudDo8L2I+ IFRodXJzZGF5LCBTZXB0ZW1iZXIgMjAsIDIwMTggMTo0NCBQTTxicj4NCjxiPlRvOjwvYj4gPGEg aHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj5zcGFzbUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5T dWJqZWN0OjwvYj4gUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij5IaSBQYW5vcywgYWxsLDxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+dGhhdCBpcyBjb3JyZWN0IC0gc2luY2UgdGhlIG5ldyBPSURzIGZvciB0 aGUgS2V5IGFuZCB0aGUgU2lnbmF0dXJlcyB3b3VsZCBiZSBuZXcsIGNsaWVudHMgd291bGQgZmFp bCBzaW5jZSB0aGV5IGRvIG5vdCBrbm93IHRoZSAmcXVvdDtjb21wb3NpdGUmcXVvdDsgYWxnb3Jp dGhtIDpEPG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5BbHRo b3VnaCBkZXZlbG9waW5nIHN1cHBvcnQgZm9yIGl0IHNob3VsZCBub3QgYmUgdG9vIGRpZmZpY3Vs dCwgdGhlIHNvbHV0aW9uIGl0IGlzIG5vdCBtZWFudCB0byBiZSBiYWNrd2FyZCBjb21wYXRpYmxl IGFzIHdlIHdhbnQgYXBwbGljYXRpb25zIHRvIGJlIGFibGUgdG8gZmFpbCBpZiB0aGV5IGRvIG5v dCBldmVuIGtub3cgdGhleSB3ZXJlIHN1cHBvc2VkIHRvIGdlbmVyYXRlIG9yIHZlcmlmeQ0KIG11 bHRpcGxlIHNpZ25hdHVyZXMgaW5zdGVhZCBvZiBqdXN0IG9uZS48bzpwPjwvbzpwPjwvcD4NCjxw IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPkZyb20gYSB1c2FnZSBwZXJzcGVjdGl2ZSwgSSBh bSBsZWFuaW5nIHRvd2FyZHMgdGhlIG5lZWQgZm9yIHRoZSBvd25lciBvZiB0aGUgY2VydGlmaWNh dGVzIHRvIGdlbmVyYXRlIHNpZ25hdHVyZXMgd2l0aCBhbGwgdGhlIGtleXMsIGFuZCBmb3IgdGhl IGVudGl0eSB0aGF0IHZhbGlkYXRlcyB0aGUgc2lnbmF0dXJlcyBpdCBzaG91bGQgdmFsaWRhdGUg YWxsIHRoZSBzaWduYXR1cmVzIGl0IHN1cHBvcnRzDQogYW5kIG1heSBhY2NlcHQgc2lnbmF0dXJl cyBldmVuIGlmIGl0IGRvZXMgbm90IHVuZGVyc3RhbmQgYWxsIHRoZSBhbGdvcml0aG1zICh0aGlz IGlzIG1vcmUgYW4gYXBwbGljYXRpb24gZGVjaXNpb24gYmFzZWQgb24gdGhlIHJpc2sgYW5kIHRo cmVhdCBtb2RlbCkuPG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij5BcyBJIHNhaWQsIHRoaXMgc29sdXRpb24gZml0cyBub3Qgb25seSBjZXJ0aWZpY2F0ZXMsIGJ1 dCBhbHNvIE9DU1AgcmVzcG9uc2VzLCBDUkxzLCBDTVMsIFBLQ1MjNywgZXRjLiBhbmQgdGhhdCBp cyBwYXJ0IG9mIHdoYXQgaXMgaW50ZXJlc3RpbmcgZm9yIHVzIDpEIEkgc3RpbGwgbmVlZCB0byBj aGVjayB3aGF0IGFyZSB0aGUgbmVlZGVkIGNoYW5nZXMgZm9yIG90aGVyIGZvcm1hdHMgbGlrZSBQ S0NTIzEvIzgvIzEyDQogZm9yIHN0b3JpbmcgdGhlIGNvbXBvc2l0ZSBwdWJsaWMgYW5kIHByaXZh dGUga2V5cyAodGhpcyBwYXJ0IHN0aWxsIG1pc3NpbmcpLCBidXQgSSBob3BlIHRoYXQgc29sdmlu ZyB0aGF0IHBhcnQgd2lsbCBub3QgYmUgdG9vIGRpZmZpY3VsdC4uLjxvOnA+PC9vOnA+PC9wPg0K PHAgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Q2hlZXJzLDxicj4NCk1heDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+T24gOS8yMC8xOCA3OjI2IEFNLCBQYW5vcyBLYW1wYW5ha2lzIChw a2FtcGFuYSkgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkhpIE1heCw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+VG8gcmVwaHJhc2UgRXJpY+KAmXMgcXVlc3Rpb24sIHdvdWxkIHRoZSBDb21wb3NpdGVLZXkm IzQzO0NvbXBvc2l0ZVNpZyBwcm9wb3NhbCBiZSBiYWNrd2FyZHMgY29tcGF0aWJsZSB3aXRoIGV4 aXN0aW5nIHN5c3RlbXM/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkkgbWVhbiBpdCBnaXZlcyB5b3UgdGhlIGNoYW5nZSB0byB1c2UgbW9yZSB0aGFuIG9uZSBh bGdvcyBpbiBjYXNlIHlvdSBkb27igJl0IHRydXN0IGFsbCBvZiB0aGVtLiBCdXQgYW4gb2xkIGNs aWVudCB3b3VsZG7igJl0IGJlIGFibGUgdG8NCiBqdXN0IHVzZSB0aGUgdHJhZGl0aW9uYWwga2V5 JiM0MztzaWcgdW5sZXNzIGhlIHdhcyB1cGdyYWRlZCB0byB1bmRlcnN0YW5kIENvbXBvc2l0ZUtl eSYjNDM7Q29tcG9zaXRlU2lnIGFuZCBpdHMgT0lEcywgcmlnaHQ/PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlBhbm9zPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiBTcGFzbSBbPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3Vu Y2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPm1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYu b3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+RXJp ayBBbmRlcnNlbjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIFNlcHRlbWJlciAxNCwgMjAxOCAx MTo0OSBBTTxicj4NCjxiPlRvOjwvYj4gJ1NQQVNNJyA8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNw YXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZsdDtzcGFzbUBpZXRmLm9yZyZndDs8L3Nw YW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+OyBEaXJlY3RvcnkgbGlzdA0KPC9zcGFuPjxhIGhyZWY9 Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbHQ7 eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmcmZ3Q7PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi Pjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhlIGRvdWJsZSBzaWduYXR1cmUgaXMgaW50ZW5k ZWQgYXMgYSBtaWdyYXRpb24gdG9vbC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SW4gdGhlIG5vcm1hbCBvcGVyYXRpb24s IG9ubHkgb25lIHNpZ25hdHVyZSBpcyB1c2VkICh0aGUgbmF0aXZlIHNpZ25hdHVyZSkuIFdoZW4g aXQgaXMgcmVhbGl6ZWQgdGhhdCB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobQ0KIHdpbGwgYmUgdG9v IHdlZWsgaSBzb21lIGZ1dHVyZSwgdGhlIG1pZ3JhdGlvbiBwZXJpb2Qgc3RhcnRzIGFuZCBhbiBh bHRlcm5hdGl2ZSwgYXNzdW1pbmcgc3Ryb25nZXIgc2lnbmF0dXJlIGlzIHByb3ZpZGVkIGZvciB0 aG9zZSBhYmxlIHRvIGhhbmRsZSBpdC4mbmJzcDsgTGVnYWN5IHN5c3RlbXMgd2lsbCBpZ25vcmUg dGhpcyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUuIEFmdGVyIHRoZSBtaWdyYXRpb24gcGVyaW9kLCB0 aGVyZSB3aWxsIGJlIG5vIGFsdGVybmF0aXZlDQogc2lnbmF0dXJlIGFuZCB0aGUgbmV3IHN0cm9u Z2VyIHNpZ25hdHVyZSB3aWxsIGJlIHRoZSBuYXRpdmUgc2lnbmF0dXJlLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Eb2Vz IHRoYXQgbWFrZSBzZW5zZT88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+RXJpazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0Ux RTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPkZyYTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBNYXNzaW1pbGlh bm8gUGFsYSBbPC9zcGFuPjxhIGhyZWY9Im1haWx0bzptLnBhbGFAY2FibGVsYWJzLmNvbSI+PHNw YW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+bWFpbHRvOm0ucGFsYUBjYWJsZWxhYnMuY29tPC9zcGFu PjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5dDQo8YnI+DQo8Yj5TZW5kdDo8L2I+IDEy IFNlcHRlbWJlciAyMDE4IDIzOjAxPGJyPg0KPGI+VGlsOjwvYj4gUnVzcyBIb3VzbGV5ICZsdDs8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tIj48c3BhbiBsYW5nPSJE QSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5ob3VzbGV5QHZpZ2lsc2VjLmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0i REEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gU1BBU00gJmx0Ozwvc3Bhbj48YSBo cmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPnNw YXNtQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OyBF cmlrIEFuZGVyc2VuICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3Bh biBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0i REEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkVtbmU6PC9iPiBSZTogW2xhbXBzXSBEb3VibGUg c2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPkhpIFJ1c3MsIGFsbCw8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+bXkg cGVyc29uYWwgcG9zaXRpb24gaXMgdGhhdCB0aGUgc2lnbmVyIE1VU1QgdXNlIGFsbCB0aGUga2V5 cyB0aGF0IGhhdmUgZGlnaXRhbFNpZ25hdHVyZSBzZXQsIHRoZSB2ZXJpZmllciBzaGFsbCB2ZXJp ZnkgYWxsIHRoZSBzaWduYXR1cmVzIGZvciB3aGljaCBpdCBkb2VzIGhhdmUgc3VwcG9ydCBmb3Iu PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gbGFuZz0iRU4tR0IiPlRoZSByYXRpb25hbGUgZm9yIHRoaXMgaXMgdGhhdCBpZiBJIGNlcnRp ZnkgYSBwdWJsaWMga2V5IGluIHRoZSBjZXJ0aWZpY2F0ZSwgeW91IHNob3VsZCBiZSBhYmxlIHRv IHVzZSB0aGUgcHJpdmF0ZSBrZXkgdG8gZ2VuZXJhdGUgdGhlIHNpZ25hdHVyZSwgdGhlcmVmb3Jl IHRoZSBhcHByb2FjaCBpcyB0aGUgc2FtZSBhcyB1c3VhbDogc2lnbiB3aXRoIHlvdXIga2V5Lg0K IEluIHRoaXMgY2FzZSwgaXQganVzdCBoYXBwZW5zIHRoYXQgdG8gZ2VuZXJhdGUgdGhlIHNpZ25h dHVyZSB5b3UgaGF2ZSB0byBnZW5lcmF0ZSBtdWx0aXBsZSBvbmVzIGFuZCB0aGVuIGNvbWJpbmUg dGhlbSB0b2dldGhlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Rm9yIHRoZSBhcHBsaWNhdGlvbiB0aGF0IHZl cmlmaWVzIHRob3NlIHNpZ25hdHVyZXMsIGl0IGlzIGFsd2F5cyBhIHF1ZXN0aW9uIG9mIHdoYXQg aXMgdGhlIHRocmVzaG9sZCB0aGF0IGlzIGFjY2VwdGFibGUgZm9yIHRoZSBhcHBsaWNhdGlvbiAo aW4gdGVybXMgb2YgcmlzaykgaW4gY2FzZSBpdCBkb2VzIG5vdCBzdXBwb3J0IGFsbCBvZiB0aGUg YWxnb3JpdGhtcw0KIHRoYXQgYXJlIHVzZWQgdG8gZ2VuZXJhdGUgdGhlIGNvbXBvc2l0ZSBzaWdu YXR1cmUuIElkZWFsbHkgaXQgd291bGQgdmVyaWZ5IGFsbCwgYnV0IGl0IG1heSBkZWNpZGUgdG8g dmVyaWZ5IGxlc3MgKGF0IGxlYXN0IG9uZSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPkkgYWxzbyBzYXcgdGhl IG90aGVyIGUtbWFpbCBmcm9tIEppbSBvbiB0aGlzIHRvcGljIGFuZCBJIHRoaW5rIGl0IGNvdWxk IGJlIGEgZ29vZCBpZGVhIC0gdGhlIHVzZSBvZiB0aGUgdHdvIE9JRHMgaXMgYW5vdGhlciB3YXkg dG8gZ28gdG8gY29kaWZ5IHRoZSB2YWxpZGF0aW9uIHByb2Nlc3MgcmVxdWlyZWQuIFRlY2huaWNh bGx5LCB0aGF0IG1ha2VzIHNlbnNlIHRvDQogbWUsIGhvd2V2ZXIgSSBhbSBjb25mbGljdGVkIGFz IHRoaXMgYXBwcm9hY2ggcmVxdWlyZXMgdGhhdCB0aGUgc2lnbmVyIGhhcyBhbiB1bmRlcnN0YW5k aW5nIG9mIHdoYXQgdGhlIHZlcmlmaWVyJ3MgY2FwYWJpbGl0aWVzIGFyZS4uLiBJIHRoaW5rIHRo YXQgZGVmaW5pbmcgdHdvIE9JRHMgZm9yIHRoZSBzaWduYXR1cmVzIGNvdWxkIHN0aWxsIGJlIHVz ZWZ1bCBiZWNhdXNlIHRoZSBzaWduZXIgbWlnaHQgdGhlbiBkZWNpZGUgdGhlICZxdW90O3JlY29t bWVuZGVkJnF1b3Q7LyZxdW90O2ludGVuZGVkJnF1b3Q7DQogdmVyaWZpY2F0aW9uIGJlaGF2aW9y Li4uIEkgY2FuIHNlZSBzb21lIHVzZS1jYXNlcyB0aGF0IG1pZ2h0IGhhdmUgYSBjb21wb3NpdGUg a2V5IHdpdGggeyBSU0EsIEVDIH0gYW5kIHRoZSAmcXVvdDtNdXN0LVZlcmlmeS1BbGwmcXVvdDsg T0lEIGZvciB0aGUgc2lnbmF0dXJlLCBhbmQgYW5vdGhlciB1c2UtY2FzZSB3aGVyZSB3ZSBoYXZl IGEgY29tcG9zaXRlIGtleSB3aXRoIHsgUlNBLCBIQVNILUJBU0VEIH0gYW5kIGZvciB0aGUgc2ln bmF0dXJlICZxdW90O011c3QtVmVyaWZ5LUF0LUxlYXN0LU9uZSZxdW90Oy48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1H QiI+RG9lcyB0aGlzIG1ha2Ugc2Vuc2U/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPkNoZWVycyw8YnI+DQpNYXg8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIGxhbmc9IkVOLUdCIj5PbiA5LzEyLzE4IDY6MTIgQU0sIFJ1c3MgSG91c2xleSB3 cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPk1heDogPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPkR1cmluZyBhIHRyYW5z aXRpb24gdG8gcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJlcywgYSBzaWduZXIgd2FudHMgdG8g cHV0IGEgdHJhZGl0aW9uYWwgc2lnbmF0dXJlIGFuZCBhIHF1YW50dW0tcmVzaXN0YW50IHNpZ25h dHVyZSBvbiBhbiBvYmplY3QuICZuYnNwO0dpdmVuIHlvdXIgZGVzY3JpcHRpb24gb2YmbmJzcDtr ZXlVc2FnZSBhbmQgZXh0ZW5kZWRLZXlVc2FnZSwNCiBib3RoIHdvdWxkIGhhdmUgdGhlIGRpZ2l0 YWxTaWduYXR1cmUgYml0IHNldC4gJm5ic3A7SG93IGRvZXMgYSBjbGllbnQga25vdyBpZiBqdXN0 IG9uZSBvciBib3RoIHNpZ25hdHVyZXMgbXVzdCBiZSB2YWxpZD88L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPkFzIEppbSBTY2hhYWQgYWxyZWFkeSBzYWlkLCBS RkMmbmJzcDs1NzUyIHRhbGtzIGFib3V0IHRoaXMgaXNzdWUgd2hlbiBhIENNUyBTaWduZWREYXRh IGNvbnRhaW5zIG1vcmUgdGhhbiBvbmUgU2lnbmVySW5mby48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPlJ1c3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdp bi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxz cGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5n PSJFTi1HQiI+T24gU2VwIDExLCAyMDE4LCBhdCA0OjQ1IFBNLCBNYXggUGFsYSAmbHQ7PC9zcGFu PjxhIGhyZWY9Im1haWx0bzpNLlBhbGFAY2FibGVsYWJzLmNvbSI+PHNwYW4gbGFuZz0iRU4tR0Ii Pk0uUGFsYUBjYWJsZWxhYnMuY29tPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiI+Jmd0OyB3 cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+SGkgQWxsLA0KPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OkhlbHZldGljYSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNh Ij5JIGFtIHdvcmtpbmcgb24gYSBzaW1pbGFyIC0gYnV0IGRpZmZlcmVudCAtIHNvbHV0aW9uLCBp biBwYXJ0aWN1bGFyIEkgc29sdmUgdGhlIGlzc3VlIG9mIChhKSBiZWluZyBhYmxlIHRvIGNvbWJp bmUgbW9yZSB0aGFuIG9uZSBwdWJsaWMga2V5LCAoYikNCiBvbmx5IG9uZSAoYWN0dWFsbHkgdHdv KSBPSURzIHJlcXVpcmVkLCBhbmQgKGMpIHNpbXBseSB0aGUgcHJvY2Vzc2luZyBieSByZS11dGls aXppbmcgdGhlIHNhbWUgZGF0YSBzdHJ1Y3R1cmVzIHdlIGhhdmUgdG9kYXkuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTpIZWx2ZXRpY2EiPkkgcGFydGljdWxhciwgSSBkZWZpbmUgYSDigJxjb21wb3NpdGUgcHVibGlj IGtleeKAnSBhbmQg4oCcY29tcG9zaXRlIHNpZ25hdHVyZeKAnS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTpIZWx2ZXRpY2EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZl dGljYSI+VGhlIGZpcnN0IG9uZSBlbmNvZGVzIGluIHRoZSBrZXkgdmFsdWXigJlzIEJJVFNUUklO RyB0aGUgREVSIHZhbHVlIG9mIHRoZSBTRVFVRU5DRSBvZiBwdWJsaWMga2V5cyAoZWFjaCBvZiB3 aGljaCBpcyBhIHRoZSBzdWJqZWN0UHVibGljS2V5SW5mbyBzdHJ1Y3R1cmUpDQogYW5kIHVzZXMg YSBzcGVjaWZpYyBPSUQgdGhhdCBpZGVudGlmaWVzIHRoZSBwdWJsaWMga2V5IHR5cGUuIFRoZSBw YXJhbWV0ZXJzIG9mIHRoZSBjb21wb3NpdGVLZXkgYWxnb3JpdGhtIGNhbiBiZSB1c2VkIHRvIGVu Y29kZSB0aGUga2V5VXNhZ2UgYW5kIHRoZSBleHRlbmRlZEtleVVzYWdlIGZvciBlYWNoIG9mIHRo ZSBrZXlzIGluIHRoZSBjb21wb3NpdGUga2V5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5UaGUg c2FtZSBhcHByb2FjaCBpcyB1c2VkIGZvciB0aGUg4oCcQ29tcG9zaXRlIFNpZ25hdHVyZeKAnSBj YXNlIHdoZXJlIHRoZSB2YWx1ZSBvZiB0aGUgc2lnbmF0dXJlIGlzIHRoZSBERVIgcmVwcmVzZW50 YXRpb24gb2YgdGhlIFNFUVVFTkNFIG9mIHNpZ25hdHVyZXMNCiBtYWRlIHdpdGggZWFjaCBvZiB0 aGUga2V5cy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+QXMgc29vbiBhcyBJIGhhdmUgc29tZSBz cGFyZSB0aW1lLCBJIHdpbGwgc3VibWl0IHRoZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUg ZGlzY3Vzc2VkIGluIEJhbmdrb2s/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNh Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPlRoaXMgc2ltcGxl IGlkZWEgYWxsb3dzIHVzIHRvIGhhdmUgYWxsIHRoZSBvdGhlciBwcm9jZWR1cmVzIHJlbGF0ZWQg dG8gUEtJcyB3b3JrIC0gdGhpcyBtZWFucyB3ZSBjYW4gY29tYmluZSBFQ0Mgd2l0aCBSU0Egb3Ig d2l0aCBhIFF1YW50dW0tUmVzaXN0YW50DQogYWxnb3JpdGhtICh3aGVuIGZpbmFsbHkgYXZhaWxh YmxlIGFuZCBzdGFuZGFyZGl6ZWQpLiBBIHN0ZXAgZm9yd2FyZCBmb3IgdGhlIGRlcGxveW1lbnQg b2YgaHlicmlkLVBLSXMgd2hlcmUgbXVsdGlwbGUgTGFnb3MgZm9yIGtleXMgY2FuIGJlIHVzZWQg dG8gYXV0aGVudGljYXRlIGRhdGEsIGNlcnRzLCByZXZvY2F0aW9uIGRhdGEsIGV0Yy4uLiB3ZSBw bGFuIHRvIHVzZSB0aGlzIGluIG91ciBpbmZyYXN0cnVjdHVyZXMgdG8gcHJvdmlkZSBhIHRyYW5z aXRpb25hbA0KIHBhdGggZm9yIHBvc3QtUXVhbnR1bSB0cmFuc2l0aW9uIGFuZCB0byBmdXJ0aGVy IGltcHJvdmUgdGhlIGFsZ29yaXRobS1hZ2lsaXR5IGNhcGFiaWxpdHkgb2YgUEtJcy48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OkhlbHZldGljYSI+V2hhdCBkbyB5b3UgdGhpbms/PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTpIZWx2ZXRpY2EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YSI+Q2hlZXJzLA0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+TWF4PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6SGVsdmV0aWNhIj4tLS0NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Q2hlZXJzLA0KPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OkhlbHZldGljYSI+TWF4PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoz Ni4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhIj5PbiBTZXAgMTEsIDIwMTgsIGF0IDg6MzggQU0sIFRpbSBIb2xsZWJl ZWsgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20i PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjpwdXJwbGUiPnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpI ZWx2ZXRpY2EiPiZndDsNCiB3cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5VbmZvcnR1bmF0ZWx5LCDigJxub3Qg ZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZOKAnSBpbnRyb2R1Y2VzIGEgbG90 IG9mIHBvbGl0aWNzIGFyb3VuZCBjaG9vc2luZyB3aGljaCBjb21iaW5hdGlvbnMg4oCcbmVlZCB0 bw0KIGJlIGNvdmVyZWTigJ0sIGEgc3ViamVjdCBvbiB3aGljaCBpbmV2aXRhYmx5IG5vdCBldmVy eW9uZSBhZ3JlZXMuJm5ic3A7IEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNz aW9ucyBhbmQgdGhlIHVubmVjZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SSBwZXJzb25hbGx5IGRvbuKAmXQgdGhpbmsgYSBzaW5nbGUgQWxnSUQgd2hpY2ggaW1wbGllcyBh IFNFUVVFTkNFIG9mIEFMRyBJRHMgaXMgYW4gaW1wcm92ZW1lbnQgb3ZlciBhIFNFUVVFTkNFIG9m IEFMRyBJRHMsIG9yIGl0cyBtb3JhbA0KIGVxdWl2YWxlbnQuJm5ic3A7IEZvciBzaW1wbGUgaHli cmlkIHVzZSBjYXNlcywgdGhlcmUgaXMgYWxzbyBhIGxvdCBvZiB2YWx1ZSBpbiBoYXZpbmcgdGhl IGNsYXNzaWNhbCBhbGdvcml0aG0gSUQgYmVpbmcgdGhlIHNhbWUgYXMgaXQgdXN1YWxseSBpcywg dG8gYWxsb3cgZWFzaWVyIGludGVyb3BlcmFiaWxpdHkgd2l0aCBvbGRlciBzeXN0ZW1zIHRoYXQg ZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBuZXdlciBhbGdvcml0aG1zIChhbmQgY2FuIGJsaXNzZnVs bHkNCiBpZ25vcmUgdGhlbSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+LVRpbTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzoz LjBwdCAwY20gMGNtIDBjbSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8 L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+U2FudG9zaA0KIENob2toYW5pICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRv OnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOnB1cnBsZSI+c2FudG9zaC5jaG9raGFuaUBnbWFpbC5jb208L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlR1ZXNkYXksIFNlcHRlbWJlciAxMSwgMjAx OCAxMDoyOSBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+VGltIEhvbGxlYmVlayAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0 bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjpwdXJwbGUiPnRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPC9zcGFuPjwvYT48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7Ow0KICdFcmlrIEFuZGVyc2VuJyAmbHQ7PC9z cGFuPjxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpwdXJwbGUiPmVyYUB4NTAwLmV1PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mZ3Q7OyAnU1BBU00nICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNw YXNtQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+ c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZn dDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bh bj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9y Zzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U3ViamVj dDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJF OiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+VGhhbmtzIFRpbS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+VGhlcmUgYXJlIHdheXMgdG8gYWNjb21tb2RhdGUgeW91ciBjb25jZXJuLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5PbmUgd2F5IHRvIGhhbmRsZSB0aGlzIGlz IGRlZmluaW5nIGEgc2luZ2xlIEFsZyBJRCBBIHdoaWNoIGltcGxpZXMgYSBTRVFVRU5DRSBvZiBB TEcgSURzIGFuZCBkZWZpbmUgdGhlIHJlbHlpbmcgcGFydHkNCiBydWxlcyBpbiB0ZXJtcyBvZiBp dHMgYWJpbGl0eSB0byBwcm9jZXNzIG9uZSBvciBhbGwgQUxHIElEcy48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QW5vdGhlciB3YXkgdG8gZG8gdGhpcyBpcyBub3QgZXZl cnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZCBhbmQgdGhlIHVzZXIgY29tbXVuaXR5 IGRlZmluZXMgaXRzIG93biAmbmJzcDtBbGcgSUQgWGkNCiB3aGljaCBtYXBzIHRvIGEgU0VRVUVO Q0Ugb2YgQUxHIElEcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29s aWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48Yj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TcGFzbQ0KIFs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6cHVycGxlIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bh bj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+XTxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0KIEJlaGFsZiBPZjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+VGltIEhvbGxlYmVlazxi cj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5UdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMTA6MDMgQU08YnI+DQo8Yj5Ubzo8 L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkVyaWsg QW5kZXJzZW4gJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxh bmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzsNCiAnU1BBU00nICZsdDs8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0 cy5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj54NTAwc3Rh bmRhcmRAZnJlZWxpc3RzLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkRvZXNu4oCZdCB0aGUgY29tYmluYXRvcmljIGV4cGxvc2lvbiByZW5k ZXIgdGhpcyBjb21wbGV0ZWx5IGltcHJhY3RpY2FsPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPllvdSBuZWVkIE5fYyB4 IE5fcHEgYWxnb3JpdGhtIGlkZW50aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRoZSBzaW1wbGUgaHli cmlkIHVzZSBjYXNlIHdoZXJlIGEgc2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0aG0gaXMgYmVpbmcg dXNlZA0KIGluIGNvbmp1bmN0aW9uIHdpdGggYSBzaW5nbGUgcG9zdC1xdWFudHVtIGFsZ29yaXRo bS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5BbmQgdGhlcmUgYXJlIHBlb3BsZSB3aG8gd2FudCB0byB1c2UgbXVsdGlw bGUgcG9zdC1xdWFudHVtIGFsZ29yaXRobXMgdG8gaGVkZ2UgYWdhaW5zdCBwb3RlbnRpYWwgeWV0 IHRvIGJlIGRpc2NvdmVyZWQgd2Vha25lc3NlcyBpbg0KIHBvc3QtcXVhbnR1bSBhbGdvcml0aG1z Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPknigJltIG5vdCByZWFsbHkgbG9va2luZyBmb3J3YXJkIHRvIHRyeWluZyB0 byBhbGxvY2F0ZSBvciBtYW5hZ2UgTyhOX2MgeCBOX3BxXjMpIGFsZ29yaXRobSBpZGVudGlmaWVy c+KApjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPi1UaW08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7 cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAw Y20iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNw YXNtDQogJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZyI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtLWJvdW5jZXNA aWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24NCiBCZWhh bGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9i PkVyaWsgQW5kZXJzZW48YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4IDM6MTAg QU08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPidTUEFTTScgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5v cmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbUBpZXRm Lm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10g RG91YmxlIHNpZ25hdHVyZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5IaSBTYW50b3NoLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Zb3Ug aGF2ZSBwcm9wb3NlZCBzb21ldGhpbmcgbGlrZSB0aGlzIGJlZm9yZS4gSXQgc3RpbGwgcHV6emxp bmcgaW4gbXkgYnJhaW4uIEFzIEkgdW5kZXJzdGFuZCwgaXQgcmVxdWlyZXMgdGhhdCB3ZSBkZWZp bmUNCiBhIHBhcnRpY3VsYXIgYWxnb3JpdGhtIHRoYXQgaGFzIGEgcGFyYW1ldGVyIHRoYXQgaW5j bHVkZXMgdGhlIHRoaW5ncyB5b3Ugc3VnZ2VzdC4gSXQgaXMgd29ydGh5IHRvIGJlIGFuYWx5c2Vk Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5FcmlrPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzoz LjBwdCAwY20gMGNtIDBjbSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJhOjwvc3Bh bj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iREEi IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5TcGFzbQ0KIFs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmci PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5tYWlsdG86c3Bhc20tYm91 bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+XTxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Qw6UNCiB2ZWdu ZSBhZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+ U2FudG9zaCBDaG9raGFuaTxicj4NCjxiPlNlbmR0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+MTAgU2VwdGVtYmVyIDIwMTggMTk6MTg8YnI+DQo8 Yj5UaWw6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj4nSmltIFNjaGFhZCcgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86aWV0ZkBhdWd1c3RjZWxs YXJzLmNvbSI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmlldGZAYXVn dXN0Y2VsbGFycy5jb208L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7 DQogJ1J5YW4gU2xlZXZpJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyeWFuLWlldGZAc2xl ZXZpLmNvbSI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnJ5YW4taWV0 ZkBzbGVldmkuY29tPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7Ozxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEg aHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi Pjxicj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+J1NQQVNNJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9y ZyI+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3Jn PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRv Ong1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxzcGFuIGxh bmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxiPkVtbmU6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJl czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPldoeSBub3QgbGV0IGFs Z29yaXRobSBpZGVudGlmaWVyIGRpY3RhdGUgdGhlIG51bWJlciBvZiBzaWduYXR1cmVzIGFuZCB0 aGVpciBzeW50YXg/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20NCiBbPC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOnB1cnBsZSI+bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+ PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPl08c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24NCiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPkppbSBTY2hhYWQ8YnI+DQo8 Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+TW9uZGF5LCBTZXB0ZW1iZXIgMTAsIDIwMTggMTowNyBQTTxicj4NCjxiPlRvOjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+J1J5YW4gU2xlZXZp JyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyeWFuLWlldGZAc2xlZXZpLmNvbSI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnJ5YW4taWV0ZkBzbGVldmkuY29t PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFp bHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBs ZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxi cj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+J1NQQVNNJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3Jn PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFp bHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBzXSBEb3Vi bGUgc2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SeWFuLDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PlRoZSBkaXNjdXNzaW9uIGluIExvbmRvbiBkZWFsdCB3aXRoIGEgY29tcGxldGVseSBkaWZmZXJl bnQgcHJvcG9zYWwgdGhhbiB0aGlzIG9uZS4mbmJzcDsgV2hpbGUgSSB0aGluayB0aGVyZSBhcmUg cHJvYmxlbXMgd2l0aCB0aGlzIHRoYXQNCiBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleSBhcmUg bW9zdGx5IG5vdCB0aGUgc2FtZSBzZXQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RXJpayw8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5XaHkg aXMgdGhpcyBjb25zaWRlcmVkIHRvIGJlIGEgcHJlZmVycmVkIHNvbHV0aW9uIHRvIGRlZmluaW5n IGEgbmV3IHNpZ25hdHVyZSBhbGdvcml0aG0gd2hpY2ggY29udGFpbnMgYXMgdGhlIHBhcmFtZXRl ciB0aGUgc2VxdWVuY2UNCiBvZiBhbGdvcml0aG0gaWRlbnRpZmllcnMgYW5kIGFzIHRoZSBzaWdu YXR1cmUgdmFsdWUgYSBzZXF1ZW5jZSBvZiBzaWduYXR1cmUgdmFsdWVzLiZuYnNwOyBUaGUgcHJv YmxlbSB3aXRoIGp1c3QgZGVmaW5pbmcgdGhlIGV4dGVuc2lvbiB0byBTSUdORUQgaXMgdGhhdCBv bmUgbmVlZHMgdG8gbWFrZSBzdXJlIHRoYXQgdGhlIHNldCBvZiBzaWduYXR1cmUgYWxnb3JpdGht cyBhbmQgcGFyYW1ldGVycyBhcmUgYWxzbyBwYXJ0IG9mIHRoZSBkYXRhIHRvIGJlIHNpZ25lZA0K IGFuZCBJIGFtIG5vdCBzZWVpbmcgdGhhdCBoaWdobGlnaHRlZCBoZXJlLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkpp bTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBj bSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbTtib3Jk ZXItdG9wLWNvbG9yOnJnYigyMjUsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgMjI1LCAyMjUpIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5TcGFzbQ0KICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNA aWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFz bS1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxi Pk9uDQogQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvYj5SeWFuIFNsZWV2aTxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Nb25kYXksIFNlcHRlbWJlciAxMCwgMjAx OCA4OjUzIEFNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+ PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxiPkNjOjwvYj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U1BBU00gJmx0Ozwvc3Bh bj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxp c3RzLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPng1MDBz dGFuZGFyZEBmcmVlbGlzdHMub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21h cmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4N CjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIE1vbiwgU2Vw IDEwLCAyMDE4IGF0IDEwOjU2IEFNIEVyaWsgQW5kZXJzZW4gJmx0Ozwvc3Bhbj48YSBocmVmPSJt YWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVy cGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jmd0Ow0KIHdyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAx LjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0O21hcmdpbi1ib3R0 b206NS4uMHB0O21hcmdpbi1ib3R0b206NS4uMHB0O21hcmdpbi1ib3R0b206NS4uMHB0O2JvcmRl ci1sZWZ0LWNvbG9yOnJnYigyMDQsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDIwNCwgMjA0KSI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5IaSBGb2xrLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkRBIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkluIElUVS1UIHdlIGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRv dWJsZSBzaWduYXR1cmVzIHVzaW5nIHRoZSBTSUdORUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBk ZWZpbmVkIGluIFguNTA5IHRvIGNvcGUgd2l0aCBzaXR1YXRpb24NCiBhcyBkZXNjcmliZWQgaW4g dGhlIGludGVybmV0IGRyYWZ0OiDigJxNdWx0aXBsZSBQdWJsaWMtS2V5IEFsZ29yaXRobSBYLjUw OSBDZXJ0aWZpY2F0ZXMgKGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDktMDEp 4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+V2Ugc3VnZ2VzdCB0byBlbmhhbmNlIHRoZSBTSUdORUQgZGF0YSB0eXBl IGFzIHNob3duIGJlbG93Ojwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij5TSUdORUR7VG9CZVNpZ25lZH0gOjo9IFNFUVVFTkNF IHs8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsm cXVvdDsiPiZuYnNwOyBDT01QT05FTlRTIE9GIFNJR05BVFVSRSw8L3NwYW4+PC9iPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyAuLi4uLi4u Li48L3NwYW4+PC9iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7IFw7Y29sb3JcOlwjQzAwMDAwJnF1b3Q7 Ij4sPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7 IGNvbG9yXDogcmVkJnF1b3Q7Ij4mbmJzcDsgYWx0QWxnb3JpdGhtSWRlbnRpZmllciZuYnNwOyBB bGdvcml0aG1JZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0gT1BUSU9OQUwsPC9zcGFu PjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7IGNvbG9yXDog cmVkJnF1b3Q7Ij4mbmJzcDsgYWx0U2lnbmF0dXJlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJJVCBTVFJJTkcgT1BUSU9O QUwmbmJzcDs8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcgXDsgY29sb3JcOiByZWQmcXVvdDsiPiZuYnNwOyZuYnNwOzwvc3Bhbj48L2I+PGI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcgXDsmcXVvdDsiPn08L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7IFw7Y29sb3JcOnJlZCZxdW90OyI+Jm5ic3A7 PC9zcGFuPjwvYj48L3NwYW4+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDs7Y29sb3I6cmVkIj4o V0lUSA0KIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRpZmllciBQUkVTRU5ULCBh bHRTaWduYXR1cmUgUFJFU0VOVCB9IHw8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcgXDsgY29sb3JcOiByZWQmcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBXSVRIIENPTVBPTkVOVFMgey4uLiwgYWx0QWxnb3JpdGhtSWRlbnRpZmllciBBQlNF TlQsJm5ic3A7IGFsdFNpZ25hdHVyZSBBQlNFTlQgfSApPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PC9iPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2UgYXJl IG9wZW4gdG8gY29tbWVudHMuIFdlIGtub3cgdGhhdCBJRVRGIGlzIG5vdCBhIGhlYXZ5IHVzZXIg b2YgdGhpcyBkYXRhIHR5cGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2UgaGF2ZSBubyBpbnRlbnRpb24gdG8gdXNl IHRoaXMgZXh0ZW5kZWQgZGF0YSB0eXBlIGZvciBjZXJ0aWZpY2F0ZXMgYW5kIENSTHMuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Rm9yIHlvdXIgaW5mb3JtYXRpb24sIFNJR05BVFVSRSBpcyBkZWZpbmVkIGFzOjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1 b3Q7Ij5TSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHs8L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyBhbGdvcml0aG1JZGVudGlm aWVyJm5ic3A7IEFsZ29yaXRobUlkZW50aWZpZXJ7e1N1cHBvcnRlZEFsZ29yaXRobXN9fSw8L3Nw YW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsi PiZuYnNwOyBzaWduYXR1cmUmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQklUIFNUUklORyw8L3NwYW4+PC9iPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyAuLi4uLi4u IH08L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Gcm9tIHRoZSBkaXNjdXNzaW9ucyBpbiBMb25kb24gKDEwMSksIHRoZXJl IHdlcmUgYSBudW1iZXIgb2YgY2hhbGxlbmdlcyBpZGVudGlmaWVkIGR1cmluZyB0aGUgZGlzY3Vz c2lvbiAtJm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcv bWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4dCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvbWVldGluZy8xMDEvbWF0ZXJpYWxzL21pbnV0ZXMtMTAxLWxhbXBzLTAxLnR4dDwvc3Bh bj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj4tDQogdGhhdCBmdW5kYW1lbnRhbGx5IHF1ZXN0aW9uZWQgdGhhdCBhcHByb2FjaC48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5IYXMgdGhlIElUVS1UIGFk ZHJlc3NlZCBvciByZXNvbHZlZCB0aG9zZSBjb25jZXJucz8gQXJlIHRoZXkgbm90IGFwcGxpY2Fi bGUgZm9yIHNvbWUgcmVhc29uIHNwZWNpZmljIHRvIElUVS1UPyZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KU3Bhc20g bWFpbGluZyBsaXN0PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpTcGFzbUBpZXRmLm9yZyI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhO2NvbG9yOnB1cnBsZSI+U3Bhc21AaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJy Pg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v c3Bhc20iPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OkhlbHZldGljYTtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Bhc208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+LS0gPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1HQiI+QmVzdCBSZWdhcmRzLCA8 L3NwYW4+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9Im1hcmdpbi1ib3R0b206Ny41cHQi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g bGFuZz0iRU4tR0IiPk1hc3NpbWlsaWFubyBQYWxhLCBQaC5ELjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PGltZyBib3JkZXI9IjAiIHdpZHRoPSIxMjAiIGhlaWdodD0iMTgiIHN0eWxlPSJ3aWR0aDox LjI1aW47aGVpZ2h0Oi4xODc1aW4iIGlkPSJQaWN0dXJlX3gwMDIwXzEiIHNyYz0iY2lkOmltYWdl MDAxLnBuZ0AwMUQ0NTJEQS43NjQ4RkNGMCIgYWx0PSJDYWJsZUxhYnMiPjxzcGFuIGxhbmc9IkVO LUdCIj48YnI+DQpQcmluY2lwYWwgQXJjaGl0ZWN0PGJyPg0KU2VjdXJpdHkgU2VydmljZXMsIFIm YW1wO0Q8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDozNi4wcHQiPg0KJm5ic3A7PG86cD48L286 cD48L3A+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+U3Bhc20gbWFpbGluZyBsaXN0PG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGEgaHJlZj0ibWFpbHRvOlNwYXNt QGlldGYub3JnIj5TcGFzbUBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3NwYXNtIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3NwYXNtPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_0BB17F8431A640CF8451E785F78DFDA2isaracom_-- --_004_0BB17F8431A640CF8451E785F78DFDA2isaracom_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=1893; creation-date="Sat, 22 Sep 2018 23:12:15 GMT"; modification-date="Sat, 22 Sep 2018 23:12:15 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYIIA --_004_0BB17F8431A640CF8451E785F78DFDA2isaracom_-- From nobody Sun Sep 23 08:45:20 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52CF4130E05 for ; Sun, 23 Sep 2018 08:45:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O0uDNByN-cJA for ; Sun, 23 Sep 2018 08:45:16 -0700 (PDT) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D73FD130E01 for ; Sun, 23 Sep 2018 08:45:15 -0700 (PDT) Received: from unknown (HELO V0501WEXGPR01.isaracorp.com) ([10.5.8.20]) by ip1.isaracorp.com with ESMTP; 23 Sep 2018 15:45:12 +0000 Received: from V0501WEXGPR01.isaracorp.com (10.5.8.20) by V0501WEXGPR01.isaracorp.com (10.5.8.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1466.3; Sun, 23 Sep 2018 11:45:12 -0400 Received: from V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba]) by V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba%7]) with mapi id 15.01.1466.003; Sun, 23 Sep 2018 11:45:12 -0400 From: Daniel Van Geest To: Russ Housley , SPASM Thread-Topic: [lamps] New Version Notification for draft-ietf-lamps-cms-hash-sig-00.txt Thread-Index: AQHURJGd3FhU+mTXlk+eAOgH9lLEPKT+hEUA Date: Sun, 23 Sep 2018 15:45:12 +0000 Message-ID: References: <153609366946.14267.16426510024257902857.idtracker@ietfa.amsl.com> <5AB05085-94A0-4ECB-BB57-2360087345D4@vigilsec.com> In-Reply-To: <5AB05085-94A0-4ECB-BB57-2360087345D4@vigilsec.com> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.5.17.158] Content-Type: text/plain; charset="utf-8" Content-ID: <82BC48CB136ADB43BE40DD8A592EB4ED@isara.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] New Version Notification for draft-ietf-lamps-cms-hash-sig-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Sep 2018 15:45:18 -0000 SGkgUnVzcywgc29tZSBjb21tZW50cy4NCg0KMS4gUmVnYXJkaW5nIHRoZSByZWNvbW1lbmRhdGlv biB0aGF0IFNIQS0yNTYgYmUgdXNlZCB0byBjb21wdXRlIHRoZSBtZXNzYWdlIGRpZ2VzdC4NClRo ZSBMTS1PVFMgc2lnbmF0dXJlIGdlbmVyYXRpb24gcHJlcGVuZHMgYSByYW5kb20gc3RyaW5nIChw bHVzIG90aGVyIG1ldGFkYXRhKSB0byB0aGUgbWVzc2FnZSBiZWZvcmUgaGFzaGluZyBpdCBbMV06 DQogICAgICAgIFEgPSBIKEkgfHwgdTMyc3RyKHEpIHx8IHUxNnN0cihEX01FU0cpIHx8IEMgfHwg bWVzc2FnZSkNClRoaXMgcmVkdWNlcyB0aGUgY2hhbmNlcyBvZiBiZWluZyBhYmxlIHRvIGZpbmQg Y29sbGlzaW9ucywgZWZmZWN0aXZlbHkgY2hhbmdpbmcgdGhlIHByb2JsZW0gdG8gZmluZGluZyBh IHNlY29uZCBwcmVpbWFnZS4gIEEgc2Vjb25kIHByZWltYWdlIGNhbiBiZSBmb3VuZCBpbiBPKDJe KG4vMikpIHF1ZXJpZXMgd2l0aCBHcm92ZXIncyBhbGdvcml0aG0uICBGb3IgU0hBLTI1NiB0aGlz IGlzIE8oMl4xMjgpLCB3aGljaCBpcyBzdWZmaWNpZW50bHkgc2VjdXJlLg0KDQpCdXQgYnkgdXNp bmcgU0hBLTI1NiB0byBjb21wdXRlIHRoZSBtZXNzYWdlIGRpZ2VzdCBpbiBDTVMsIGFuZCBwYXNz aW5nIHRoYXQgZGlnZXN0IHRvIEhTUyB0byBiZSAocmFuZG9taXplZC1oYXNoZWQgYW5kKSBzaWdu ZWQsIHRoaXMgcmVtb3ZlcyB0aGUgYWR2YW50YWdlIGdpdmVuIGJ5IHRoZSByYW5kb21pemVkIGhh c2guICBBbiBhdHRhY2tlciBjb3VsZCBsb29rIGZvciBjb2xsaXNpb25zIG9uIHRoZSBDTVMgcHJl LWhhc2ggaW5zdGVhZCBvZiB0aGUgSFNTIHJhbmRvbWl6ZWQgaGFzaC4gIEEgcXVhbnR1bSBjb21w dXRlciBjYW4gZmluZCBjb2xsaXNpb25zIGluIE8oMl4obi8zKSkgcXVlcmllc1syXSwgb3IgTygy Xjg1LjMpIGZvciBTSEEtMjU2LCB3aGljaCBpcyBwcm9iYWJseSBub3Qgc3VmZmljaWVudGx5IHNl Y3VyZS4gIFRoYXQgc2FpZCwgdGhlcmUgYXJlIGFyZ3VtZW50c1szXSB0aGF0IHRoZSBoYXJkd2Fy ZSBjb3N0IGZvciB0aGUgYWxnb3JpdGhtIGluIFsyXSBpcyBncmVhdGVyIHRoYW4gdGhlIHF1ZXJ5 IGNvc3QuICBUaGlzIGFyZ3VtZW50IG1ha2VzIGNlcnRhaW4gYXNzdW1wdGlvbnMgb24gaGFyZHdh cmUgbGltaXRhdGlvbnMsIGFuZCBJIGRvbid0IHRoaW5rIGl0IHByZWNsdWRlcyB0aGUgcG9zc2li aWxpdHkgb2YgYSBxdWFudHVtIGFsZ29yaXRobSB3aXRoIHRoZSBzYW1lIHF1ZXJ5IGNvbXBsZXhp dHkgYXMgWzJdIGJ1dCB3aXRoIGJldHRlciBoYXJkd2FyZSBjb3N0cy4NCg0KU28gYW55d2F5cywg Zm9yIHRoaXMgZHJhZnQgeW91IG1pZ2h0IHdhbnQgdG8gY29uc2lkZXIgdGhhdCBhIFNIQS0yNTYg bWVzc2FnZSBkaWdlc3Qgd2l0aGluIENNUyBtaWdodCBwcm92aWRlIGluc3VmZmljaWVudCBzZWN1 cml0eSBhZ2FpbnN0IGEgcXVhbnR1bSBjb2xsaXNpb24gYXR0YWNrIGFuZCByZWNvbW1lbmQgU0hB LTUxMiAob3IgU0hBLTM4NCkgaW5zdGVhZC4NCg0KDQoyLiBUaGUgZHJhZnQncyBBU04uMSBtb2R1 bGUgZGVmaW5lcyB0aGUgSFNTIHB1YmxpYyBrZXkgKHBrLUhTUy1MTVMtSGFzaFNpZyksIGJ1dCB0 aGUgcmVzdCBvZiB0aGUgZHJhZnQgbWFrZXMgbm8gbWVudGlvbiBvZiBIU1MgcHVibGljIGtleSBh bGdvcml0aG0gaWRlbnRpZmllciBvciBwcm9wZXJ0aWVzIChwYXJhbWV0ZXJzLCBrZXkgdXNhZ2Us IHB1YmxpYyBrZXkgZW5jb2RpbmcpLiAgSXMgdGhpcyBzb21ldGhpbmcgdGhhdCBzaG91bGQgYmUg c3BlY2lmaWVkIGluIHRoaXMgZHJhZnQ/ICBJbiBhbm90aGVyIGRyYWZ0PyAgTXkgZW1wbG95ZXIg aGFzIHNlZW4gaW50ZXJlc3QgaW4gSFNTIChhbmQgWE1TUykgZm9yIHJvb3QgY2VydGlmaWNhdGVz IGFuZCBjb2RlIHNpZ25pbmcgY2VydGlmaWNhdGVzIHNvIEkgd2FzIGdvaW5nIHRvIHdyaXRlIGFu ZCBwcm9wb3NlIGEgZHJhZnQgZm9yIEhTUy9YTVNTIGluIFguNTA5IGNlcnRpZmljYXRlcyB0byBz dXBwb3J0IHRob3NlIHVzZSBjYXNlcy4gIElmIHRoZSBwdWJsaWMga2V5IGlzIHdlbGwgZGVmaW5l ZCBpbiB0aGUgQ01TIGRyYWZ0IEkgY2FuIHJlZmVyZW5jZSBpdCwgb3IgSSBjYW4gdGFrZSBvbiB0 aGUgZGVmaW5pdGlvbi4NCg0KDQozLiBJdCBoYWQgYmVlbiBzdWdnZXN0ZWQgYnkgUGFub3MgaW4g dGhpcyBkcmFmdCdzIGNhbGwgdG8gYWRkIHRvIHRoZSByZWNoYXJ0ZXIgdGhhdCBpdCBiZSBleHBh bmRlZCB0byBpbmNsdWRlIG90aGVyIGhhc2gtYmFzZWQgc2lnbmF0dXJlcyBsaWtlIFhNU1MuICBT aW5jZSB0aGF0IHdhcyBub3QgaW5jbHVkZWQgaW4gdGhlIHJlY2hhcnRlciwgaXMgaXQgb2ZmIHRo ZSB0YWJsZT8NCg0KDQo0LiBOaXRzOg0KLSBTZXZlcmFsIHBsYWNlcyBpbiBTZWN0aW9uIDMgaWQt YWxnLWhzcy1sbXMtaGFzaHNpZyBpcyByZWZlcnJlZCB0byBhcyBhbiBhbGdvcml0aG0gaWRlbnRp ZmllciwgYnV0IGl0IGlzIGFuIG9iamVjdCBpZGVudGlmaWVyLg0KLSBpbiAyLjEgc2lnbmVkX3B1 YmxpY19rZXkgaXMgbWlzc3BlbGxlZCBhcyBzaWdlbmRfcHVibGljX2tleSBpbiBvbmUgcGxhY2Uu DQotIGRyYWZ0LW1jZ3Jldy1oYXNoLXNpZ3MtMTMgZGVmaW5lcyBOc3BrID0gTC0xIHdoZXJlIEwg aXMgdGhlIG51bWJlciBvZiBsZXZlbHMsIGFuZCB0aGVuIGFuIEhTUyBzaWduYXR1cmUgYXM6DQog ICAgdTMyc3RyKE5zcGspIHx8IHNpZ25lZF9wdWJfa2V5WzBdIHx8IC4uLiB8fCBzaWduZWRfcHVi X2tleVtOc3BrLTFdIHx8IHNpZ1tOc3BrXQ0KVGhlIENNUyBkcmFmdCBpc24ndCBjb25zaXN0ZW50 IHdpdGggdGhhdCwgc28gdGhpczoNCgkgICBUaGUgZWxlbWVudHMgb2YgdGhlIEhTUyBzaWduYXR1 cmUgdmFsdWUgZm9yIGEgdHJlZSB3aXRoIE5zcGsgbGV2ZWxzDQoJICAgY2FuIGJlIHN1bW1hcml6 ZWQgYXM6DQoNCgkgICAgICB1MzJzdHIoTnNwaykgfHwNCgkgICAgICBzaWduZWRfcHVibGljX2tl eVsxXSB8fA0KCSAgICAgIHNpZ25lZF9wdWJsaWNfa2V5WzJdIHx8DQoJICAgICAgICAgLi4uDQoJ ICAgICAgc2lnZW5kX3B1YmxpY19rZXlbTnNway0xXSB8fA0KCSAgICAgIHNpZ25lZF9wdWJsaWNf a2V5W05zcGtdIHx8DQoJICAgICAgbG1zX3NpZ25hdHVyZV9vbl9tZXNzYWdlDQpzaG91bGQgYmU6 DQoJICAgVGhlIGVsZW1lbnRzIG9mIHRoZSBIU1Mgc2lnbmF0dXJlIHZhbHVlIGZvciBhIHRyZWUg d2l0aCBMIGxldmVscw0KCSAgIGNhbiBiZSBzdW1tYXJpemVkIGFzOg0KDQoJICAgICAgdTMyc3Ry KEwtMSkgfHwNCgkgICAgICBzaWduZWRfcHVibGljX2tleVswXSB8fA0KCSAgICAgIHNpZ25lZF9w dWJsaWNfa2V5WzFdIHx8DQoJICAgICAgICAgLi4uDQoJICAgICAgc2lnbmVkX3B1YmxpY19rZXlb TC0yXSB8fA0KCSAgICAgIGxtc19zaWduYXR1cmVfb25fbWVzc2FnZQ0Kb3Igc29tZXRoaW5nIHRv IHRoZSBzYW1lIGVmZmVjdC4NCg0KVGhhbmtzLA0KRGFuaWVsDQoNClsxXSBodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtbWNncmV3LWhhc2gtc2lncy0xMyNzZWN0aW9uLTQuNQ0KWzJd IGh0dHBzOi8vd3d3LmNzLnByaW5jZXRvbi5lZHUvfm16aGFuZHJ5L2RvY3MvcGFwZXJzL1FDb2wu cGRmDQpbM10gaHR0cHM6Ly9jci55cC50by9oYXNoL2NvbGxpc2lvbmNvc3QtMjAwOTA4MjMucGRm DQoNCg0KDQrvu79PbiAyMDE4LTA5LTA0LCAxMDo1NSBQTSwgIlNwYXNtIG9uIGJlaGFsZiBvZiBS dXNzIEhvdXNsZXkiIDxzcGFzbS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBob3VzbGV5 QHZpZ2lsc2VjLmNvbT4gd3JvdGU6DQoNCiAgICBUaHJvdWdob3V0IHRoZSBkb2N1bWVudCwgdGhl IHRlcm1pbm9sb2d5IHdhcyBjaGFuZ2VkIHRvIG1ha2UgaXQgY2xlYXIgdGhhdCB0aGlzIGhzIGFi b3V0IEhTUy9MTVMgaGFzaC1iYXNlZCBzaWduYXR1cmVzLg0KICAgIA0KICAgIFJ1c3MNCiAgICAN CiAgICANCiAgICA+IEEgbmV3IHZlcnNpb24gb2YgSS1ELCBkcmFmdC1pZXRmLWxhbXBzLWNtcy1o YXNoLXNpZy0wMC50eHQNCiAgICA+IGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkg UnVzcyBIb3VzbGV5IGFuZCBwb3N0ZWQgdG8gdGhlDQogICAgPiBJRVRGIHJlcG9zaXRvcnkuDQog ICAgPiANCiAgICA+IE5hbWU6CQlkcmFmdC1pZXRmLWxhbXBzLWNtcy1oYXNoLXNpZw0KICAgID4g UmV2aXNpb246CTAwDQogICAgPiBUaXRsZToJCVVzZSBvZiB0aGUgSFNTL0xNUyBIYXNoLWJhc2Vk IFNpZ25hdHVyZSBBbGdvcml0aG0gaW4gdGhlIENyeXB0b2dyYXBoaWMgTWVzc2FnZSBTeW50YXgg KENNUykNCiAgICA+IERvY3VtZW50IGRhdGU6CTIwMTgtMDgtMzENCiAgICA+IEdyb3VwOgkJbGFt cHMNCiAgICA+IFBhZ2VzOgkJMTMNCiAgICA+IFVSTDogICAgICAgICAgICBodHRwczovL3d3dy5p ZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtaWV0Zi1sYW1wcy1jbXMtaGFzaC1zaWctMDAu dHh0DQogICAgPiBTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvZHJhZnQtaWV0Zi1sYW1wcy1jbXMtaGFzaC1zaWcvDQogICAgPiBIdG1saXplZDogICAgICAg aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtbGFtcHMtY21zLWhhc2gtc2ln LTAwDQogICAgPiBIdG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9k b2MvaHRtbC9kcmFmdC1pZXRmLWxhbXBzLWNtcy1oYXNoLXNpZw0KICAgID4gDQogICAgPiANCiAg ICA+IEFic3RyYWN0Og0KICAgID4gICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyB0aGUgY29udmVu dGlvbnMgZm9yIHVzaW5nIHRoZSB0aGUgSFNTL0xNUw0KICAgID4gICBoYXNoLWJhc2VkIHNpZ25h dHVyZSBhbGdvcml0aG0gd2l0aCB0aGUgQ3J5cHRvZ3JhcGhpYyBNZXNzYWdlIFN5bnRheA0KICAg ID4gICAoQ01TKS4gIFRoZSBIU1MvTE1TIGFsZ29yaXRobSBpcyBvbmUgZm9ybSBvZiBoYXNoLWJh c2VkIGRpZ2l0YWwNCiAgICA+ICAgc2lnbmF0dXJlOyBpdCBpcyBkZXNjcmliZWQgaW4gW0hBU0hT SUddLg0KICAgID4gDQogICAgPiANCiAgICA+IA0KICAgID4gDQogICAgPiBQbGVhc2Ugbm90ZSB0 aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJt aXNzaW9uDQogICAgPiB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZh aWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KICAgID4gDQogICAgPiBUaGUgSUVURiBTZWNyZXRh cmlhdA0KICAgID4gDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCiAgICBTcGFzbSBtYWlsaW5nIGxpc3QNCiAgICBTcGFzbUBpZXRmLm9y Zw0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Bhc20NCiAgICAN Cg0K From nobody Sun Sep 23 12:45:43 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C66AC130E42 for ; Sun, 23 Sep 2018 12:45:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id whwzYWtTICUK for ; Sun, 23 Sep 2018 12:45:40 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E9CB130E3D for ; Sun, 23 Sep 2018 12:45:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 6D234300A1E for ; Sun, 23 Sep 2018 15:45:37 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 9F9qaYbtUwiS for ; Sun, 23 Sep 2018 15:45:36 -0400 (EDT) Received: from [172.20.4.108] (h48.74.129.40.static.ip.windstream.net [40.129.74.48]) by mail.smeinc.net (Postfix) with ESMTPSA id E925B300494; Sun, 23 Sep 2018 15:45:35 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Russ Housley In-Reply-To: Date: Sun, 23 Sep 2018 15:45:36 -0400 Cc: SPASM Content-Transfer-Encoding: quoted-printable Message-Id: References: <153609366946.14267.16426510024257902857.idtracker@ietfa.amsl.com> <5AB05085-94A0-4ECB-BB57-2360087345D4@vigilsec.com> To: Daniel Van Geest X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] New Version Notification for draft-ietf-lamps-cms-hash-sig-00.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Sep 2018 19:45:43 -0000 Daniel: Thanks for the review. > 1. Regarding the recommendation that SHA-256 be used to compute the = message digest. > The LM-OTS signature generation prepends a random string (plus other = metadata) to the message before hashing it [1]: > Q =3D H(I || u32str(q) || u16str(D_MESG) || C || message) > This reduces the chances of being able to find collisions, effectively = changing the problem to finding a second preimage. A second preimage = can be found in O(2^(n/2)) queries with Grover's algorithm. For SHA-256 = this is O(2^128), which is sufficiently secure. >=20 > But by using SHA-256 to compute the message digest in CMS, and passing = that digest to HSS to be (randomized-hashed and) signed, this removes = the advantage given by the randomized hash. An attacker could look for = collisions on the CMS pre-hash instead of the HSS randomized hash. A = quantum computer can find collisions in O(2^(n/3)) queries[2], or = O(2^85.3) for SHA-256, which is probably not sufficiently secure. That = said, there are arguments[3] that the hardware cost for the algorithm in = [2] is greater than the query cost. This argument makes certain = assumptions on hardware limitations, and I don't think it precludes the = possibility of a quantum algorithm with the same query complexity as [2] = but with better hardware costs. >=20 > So anyways, for this draft you might want to consider that a SHA-256 = message digest within CMS might provide insufficient security against a = quantum collision attack and recommend SHA-512 (or SHA-384) instead. Thanks for the careful review. Does anyone have a preference for a way = forward here? > 2. The draft's ASN.1 module defines the HSS public key = (pk-HSS-LMS-HashSig), but the rest of the draft makes no mention of HSS = public key algorithm identifier or properties (parameters, key usage, = public key encoding). Is this something that should be specified in = this draft? In another draft? My employer has seen interest in HSS = (and XMSS) for root certificates and code signing certificates so I was = going to write and propose a draft for HSS/XMSS in X.509 certificates to = support those use cases. If the public key is well defined in the CMS = draft I can reference it, or I can take on the definition. Yes, the ASN.1 does include the object identifier for the public key. = I'll be glad to add as section to the body of the Internet-Draft about = it. > 3. It had been suggested by Panos in this draft's call to add to the = recharter that it be expanded to include other hash-based signatures = like XMSS. Since that was not included in the recharter, is it off the = table? NO. At the time, no one else spoke in support of the work. We need to = hear that people want to do the work, that people want to review the = work, and that people are interested in deploying. When we look for new = work items in the future, speak up. > 4. Nits: > - Several places in Section 3 id-alg-hss-lms-hashsig is referred to as = an algorithm identifier, but it is an object identifier. An ASN.1 AlgorithmIdentifier is an OBJECT IDENTIFIER with OPTIONAL = parameters. In this case, the parameters are always absent, so I think = that both names are accurate. > - in 2.1 signed_public_key is misspelled as sigend_public_key in one = place. Will fix. > - draft-mcgrew-hash-sigs-13 defines Nspk =3D L-1 where L is the number = of levels, and then an HSS signature as: > u32str(Nspk) || signed_pub_key[0] || ... || signed_pub_key[Nspk-1] = || sig[Nspk] > The CMS draft isn't consistent with that, so this: > The elements of the HSS signature value for a tree with Nspk = levels > can be summarized as: >=20 > u32str(Nspk) || > signed_public_key[1] || > signed_public_key[2] || > ... > sigend_public_key[Nspk-1] || > signed_public_key[Nspk] || > lms_signature_on_message > should be: > The elements of the HSS signature value for a tree with L = levels > can be summarized as: >=20 > u32str(L-1) || > signed_public_key[0] || > signed_public_key[1] || > ... > signed_public_key[L-2] || > lms_signature_on_message > or something to the same effect. Oops. I seem to have missed a change along the way. I will check = alignment. Russ From nobody Sun Sep 23 14:31:37 2018 Return-Path: X-Original-To: spasm@ietf.org Delivered-To: spasm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 735B1130E80; Sun, 23 Sep 2018 14:31:29 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.84.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: spasm@ietf.org Message-ID: <153773828944.29214.3317396448213914064@ietfa.amsl.com> Date: Sun, 23 Sep 2018 14:31:29 -0700 Archived-At: Subject: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-01.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Sep 2018 21:31:29 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF. Title : Use of the HSS/LMS Hash-based Signature Algorithm in the Cryptographic Message Syntax (CMS) Author : Russ Housley Filename : draft-ietf-lamps-cms-hash-sig-01.txt Pages : 14 Date : 2018-09-23 Abstract: This document specifies the conventions for using the the HSS/LMS hash-based signature algorithm with the Cryptographic Message Syntax (CMS). The HSS/LMS algorithm is one form of hash-based digital signature; it is described in [HASHSIG]. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-hash-sig/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-lamps-cms-hash-sig-01 https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-hash-sig-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-cms-hash-sig-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Sep 23 14:35:52 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3B54130E9C for ; Sun, 23 Sep 2018 14:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6tH3SJds3W0r for ; Sun, 23 Sep 2018 14:35:49 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ACC8130E80 for ; Sun, 23 Sep 2018 14:35:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 10E11300A1E for ; Sun, 23 Sep 2018 17:35:47 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 2EOIy4J2TqeB for ; Sun, 23 Sep 2018 17:35:45 -0400 (EDT) Received: from [172.20.4.108] (h48.74.129.40.static.ip.windstream.net [40.129.74.48]) by mail.smeinc.net (Postfix) with ESMTPSA id CF76F3002C7 for ; Sun, 23 Sep 2018 17:35:45 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Sun, 23 Sep 2018 17:35:45 -0400 References: <153773828944.29214.3317396448213914064@ietfa.amsl.com> To: SPASM In-Reply-To: <153773828944.29214.3317396448213914064@ietfa.amsl.com> Message-Id: X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-01.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Sep 2018 21:35:52 -0000 This update does not address the first comment in Daniel's message, but = it does address the rest of them. You can see his comments here: = https://mailarchive.ietf.org/arch/msg/spasm/tGTrASQXNEK03SL3_Mv3sfg7QYc I would like to hear from others on this list before I address his first = comment. Russ > On Sep 23, 2018, at 5:31 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Limited Additional Mechanisms for = PKIX and SMIME WG of the IETF. >=20 > Title : Use of the HSS/LMS Hash-based Signature = Algorithm in the Cryptographic Message Syntax (CMS) > Author : Russ Housley > Filename : draft-ietf-lamps-cms-hash-sig-01.txt > Pages : 14 > Date : 2018-09-23 >=20 > Abstract: > This document specifies the conventions for using the the HSS/LMS > hash-based signature algorithm with the Cryptographic Message Syntax > (CMS). The HSS/LMS algorithm is one form of hash-based digital > signature; it is described in [HASHSIG]. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-hash-sig/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-lamps-cms-hash-sig-01 > https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-hash-sig-01 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-lamps-cms-hash-sig-01 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. From nobody Mon Sep 24 08:26:58 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92869130DCF for ; Mon, 24 Sep 2018 08:26:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mPAeb2nM3axI for ; Mon, 24 Sep 2018 08:26:51 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DFD51252B7 for ; Mon, 24 Sep 2018 08:26:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=118691; q=dns/txt; s=iport; t=1537802811; x=1539012411; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=wa8EeU/1hP6yrSqZM8jPhxjbt5YMQXWtkz7FGjyv8Ps=; b=hKl0d5orPV06I63b/r7hbnOd/0nj4Z4G0cz5Glul9Jztsx9wrpUC3g+A tN611WrALflV7UlufZCHG/zb+lX09g+2frEWkWOZQCUBg6V7m98n+3TSW BFHqus48U3DIQur9oNQr4Y9VXP+NycBLyxTvzsp6P0f90Aq2/u5zD2Bej M=; X-Files: image001.png : 1892 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AGAADGAalb/4cNJK1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUYEXSC9lfygKg2qIFYwpgg2IXo1xgXcDCAECGAEMhEc?= =?us-ascii?q?CF4NCITQYAQMBAQIBAQJtHAyFOAEBAQEDAQEDFQEIAggBQAsQAgEIDgMEAQE?= =?us-ascii?q?GAQEBGAEGAwICAgUQAQkFAQsUCQgCBAoEBAEGAgYGB0uCPIFpAxUPojWBLh+?= =?us-ascii?q?EDAGCfw2CQgoFingXgUE/gREBghR+glZFAQEDgTsWBxQJDxACgkmCVwKIJBI?= =?us-ascii?q?OMIR2hXWDTIFHg2EsCQKFZAFchk2DER+PLIcbhF9th3sCERSBJR04gVVwFTu?= =?us-ascii?q?CbIIkAReIWoU+bwGKbSuBAYEeAQE?= X-IronPort-AV: E=Sophos;i="5.54,298,1534809600"; d="png'150?scan'150,208,217,150";a="175505337" Received: from alln-core-2.cisco.com ([173.36.13.135]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Sep 2018 15:26:49 +0000 Received: from XCH-RCD-010.cisco.com (xch-rcd-010.cisco.com [173.37.102.20]) by alln-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id w8OFQna6000904 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 24 Sep 2018 15:26:49 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-RCD-010.cisco.com (173.37.102.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 24 Sep 2018 10:26:48 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Mon, 24 Sep 2018 10:26:48 -0500 From: "Panos Kampanakis (pkampana)" To: Jim Schaad CC: "spasm@ietf.org" Thread-Topic: [lamps] Double signatures Thread-Index: AdRJE8Ft784CpTSnSY6kx9oi8PdHNwANHy+AAAKWWwAAAGJ/gAAdEOUAAA5m/4AAAOuWAAAAVAsAAAzUEYAAIGE4gAASdg2AAFmu0YABHhS8AAATr4MAAAUjhrAAQ0jzgABxNrDw Date: Mon, 24 Sep 2018 15:26:48 +0000 Message-ID: References: <005a01d44916$7c9cb560$75d62020$@x500.eu> <004a01d44928$b1500d40$13f027c0$@augustcellars.com> <04ce01d4492a$39400ce0$abc026a0$@gmail.com> <003601d4499e$7c8be3b0$75a3ab10$@x500.eu> <087c01d449db$c78e6350$56ab29f0$@gmail.com> <9A1A8BFC-9670-42EA-8D8D-B3DC2494CB95@cablelabs.com> <798ACAFB-7417-42F5-BF1C-6C0765606AC0@vigilsec.com> <002001d44c42$80388fd0$80a9af70$@x500.eu> <9c5c57bdbd9b4fe4aee5040f319f46a2@XCH-ALN-010.cisco.com> <7edda3b2-7a45-83ca-b4d9-698dbb7ca8c3@openca.org> <000001d4522b$44713c10$cd53b430$@augustcellars.com> In-Reply-To: <000001d4522b$44713c10$cd53b430$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.116.108.5] Content-Type: multipart/related; boundary="_004_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_"; type="multipart/alternative" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.37.102.20, xch-rcd-010.cisco.com X-Outbound-Node: alln-core-2.cisco.com Archived-At: Subject: Re: [lamps] Double signatures X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Sep 2018 15:26:57 -0000 --_004_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_ Content-Type: multipart/alternative; boundary="_000_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_" --_000_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIEppbS4gQWdyZWVkLiBBIGxvdCBvZiBkZXRhaWxzIHRvIGhhc2ggb3V0Lg0KDQpJIGRp ZG7igJl0IHdhbnQgdG8gbG9zZSB0cmFjayBvZiB0aGUgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkg b2ZmZXJlZCBpbiBkcmFmdC10cnVza292c2t5LWxhbXBzLXBxLWh5YnJpZC4gQW5kIGFsc28gd2Fu dGVkIHRvIGxldmVyYWdlIHRoZSBjb21wb3NpdGUgUEsgYW5kIFNpZyBmb3IgdGhlIGNhc2Ugd2hl cmUgd2UgZG9u4oCZdCBmdWxseSB0cnVzdCBvbiBQUSBzY2hlbWUgdGhhdCBNYXggYW5kIEVyaWvi gJlzIHByb3Bvc2FsIGFyZSB0cnlpbmcgdG8gYWRkcmVzcy4gQW5vdGhlciBpc3N1ZSB0aGVyZSBp cyBzaXplLiBTb21lIFBRIGNhbmRpZGF0ZXMgaGF2ZSByZWFsbHkgYmlnIHNpemVzLCBzbyBJIGRv buKAmXQgdGhpbmsgdGhlcmUgd2lsbCBiZSBhIGNvbWJpbmF0b3JpY3MgaXNzdWUgZm9yIGNhc2Vz IHdoZXJlIHRoZSBQSytTaWcgYXJlIHRyYW5zZmVycmVkIG9uIHRoZSBmbHkuDQoNCkkgdGhpbmsg dGhlcmUgaXMgdmFsdWUgaGVyZSB0byBiZSBhcnRpY3VsYXRlZCwgYnV0IHdlIG5lZWQgdG8gYmUg Y29nbml6YW50IG9mIGFsbCB0aGUgcG9pbnRzIHlvdSBhcmUgYnJpbmdpbmcgdXAgYW5kIGZpbmQg dGhlIGRldmlsIGluIHRoZSBkZXRhaWxzLg0KDQpQYW5vcw0KDQoNCkZyb206IEppbSBTY2hhYWQg W21haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tXQ0KU2VudDogU2F0dXJkYXksIFNlcHRlbWJl ciAyMiwgMjAxOCAxMjoxOCBBTQ0KVG86IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGth bXBhbmFAY2lzY28uY29tPg0KQ2M6IHNwYXNtQGlldGYub3JnDQpTdWJqZWN0OiBSRTogW2xhbXBz XSBEb3VibGUgc2lnbmF0dXJlcw0KDQpQYW5vcywNCg0KV2l0aG91dCBhIHJlYWxseSBkZXRhaWxl ZCBhbmFseXNpcyBvZiB5b3VyIHByb3Bvc2FsIGFuZCBob3cgaXQgd2lsbCBpbnRlcmFjdCB3aXRo IGV4aXN0aW5nIGNvZGUgSSBjb3VsZCBub3QgcG9zc2libHkgc3VwcG9ydCBpdC4gICBBIHF1aWNr IGxpc3Qgb2YgcHJvYmxlbXMgdGhhdCBJIHdvdWxkIGxpc3QgKHdpdGhvdXQgdGhvdWdodCkgYXJl Og0KDQoNCiAgMS4gIEhpc3RvcmljYWxseSwgbG90cyBvZiBwZW9wbGUgY2Fubm90IGdldCBERVIg ZW5jb2RpbmcgY29ycmVjdC4gIFBldGVyIEd1dG1hbm4gaGFzIGEgaHVnZSBjb2xsZWN0aW9uIG9m IGNlcnRpZmljYXRlcyB0aGF0IHdlcmUgaXNzdWVkIGJ5IENBcyB0aGF0IHdlcmUgbm90IGNvcnJl Y3RseSBERVIgZW5jb2RlZC4NCiAgMi4gIEV2ZXJ5Ym9keSB3aG8gd2FudHMgdG8gc3VwcG9ydCBQ USBhbGdvcml0aG1zIGlzIG5vdyByZXF1aXJlZCB0byBhZGQgYSBERVIgZW5jb2RlciB0byB0aGVp ciBzeXN0ZW1zLiAgRm9yIHRoaW5ncyB3aGljaCBvbmx5IGNvbnN1bWUgY2VydGlmaWNhdGVzLCBj cmxzLCBjbXMgb2JqZWN0cyB0aGlzIG1lYW5zIHRoYXQgdGhleSBub3cgaGF2ZSBlbmxhcmdlZCBj b2RlIHNpemUuDQogIDMuICBJIGhhdmUgbm8gaWRlYSB3aGF0IHRoZSBydWxlcyBhcmUgZm9yIG1h dGNoaW5nIENSTHMgYW5kIGNlcnRpZmljYXRlcyBpbiB0ZXJtcyBvZiBzaWduYXR1cmUgYWxnb3Jp dGhtcywgSSB3b3VsZCBhc3N1bWUgdGhhdCB5b3UgbmVlZCB0aGUgc2FtZSBwcm90ZWN0aW9ucyBm b3IgQ1JMcy4NCiAgNC4gIFlvdSBhcmUgbm90IHNpZ25pbmcgdGhlIGFsdCBzaWduYXR1cmUgYWxn b3JpdGhtIGFzIHBhcnQgb2YgdGhlIFRCUyAoZWFzeSB0byBmaXgpDQogIDUuICBIb3cgYXJlIHRo ZSBjZXJ0aWZpY2F0ZXMgZm9yIHRoZSBpc3N1ZXIgc2V0dXA/ICBBcmUgdGhlcmUgc2VwYXJhdGUg Y2VydGlmaWNhdGVzIG9yIHRoZSBzYW1lIGNlcnRpZmljYXRlPw0KICA2LiAgSnVzdCBob3cgYmFk bHkgZG9lcyB0aGlzIGFmZmVjdCB0aGUgcGF0aCBidWlsZGluZyBjb2RlIGFzIGl0IG5vdyBuZWVk cyB0byBiZSBtb2RpZmllZCB0byBoYXZlIGFkZGl0aW9uYWwgaW5wdXRzLg0KICA3LiAgRG8geW91 IHdhbnQgdG8gY2hhbmdlIHRoZSBBS0kgZmllbGQgdG8gbWFrZSBjaGFpbiBidWlsZGluZyBiZXR0 ZXIgb3IgYXJlIHlvdSBnb2luZyB0byBjYXVzZSBub24tc3VwcG9ydGluZyBzeXN0ZW1zIHRvIHBv dGVudGlhbGx5IHN0YXJ0IGRvd25sb2FkaW5nIGxvdHMgb2Ygb3RoZXIgY2VydGlmaWNhdGVzIGFz IHdlbGwuDQogIDguICBTYW1lIGlzc3VlcyBhcHBseWluZyB0byBDUkwgZGlzdHJpYnV0aW9uIHBv aW50cyDigJMgaXQgd291bGQgcG90ZW50aWFsbHkgYmUgbW9yZSBlZmZpY2llbnQgdG8gaGF2ZSBz ZXBhcmF0ZSBDUkxzIHJhdGhlciB0aGFuIGNvbWJpbmVkIG9uZXMgYXMgeW91IGNvdWxkIG5vdCB1 c2UgdGhlIGV4dGVuc2lvbiBpbiB0aGF0IGNhc2UuDQogIDkuICBIb3cgaXMgQUlBIGdvaW5nIHRv IHdvcmsuDQogIDEwLiBJZiB5b3UgcmVxdWlyZSB0aGF0IHRoZSBzYW1lIGFsZ29yaXRobXMgYmUg dXNlZCwgd2hhdCBoYXBwZW5zIHdpdGggT0NTUCByZXNwb25zZXMgYW5kIGRlbGVnYXRlZCBDUkwg aXNzdWVycz/igJkNCg0KDQpKaW0NCg0KDQpGcm9tOiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFu YSkgPHBrYW1wYW5hQGNpc2NvLmNvbTxtYWlsdG86cGthbXBhbmFAY2lzY28uY29tPj4NClNlbnQ6 IEZyaWRheSwgU2VwdGVtYmVyIDIxLCAyMDE4IDg6MDggUE0NClRvOiBEci4gUGFsYSA8bWFkd29s ZkBvcGVuY2Eub3JnPG1haWx0bzptYWR3b2xmQG9wZW5jYS5vcmc+PjsgSmltIFNjaGFhZCA8aWV0 ZkBhdWd1c3RjZWxsYXJzLmNvbTxtYWlsdG86aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT4+DQpDYzog c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtsYW1w c10gRG91YmxlIHNpZ25hdHVyZXMNCg0KSGkgTWF4LCBKaW0sDQoNCkFncmVlZC4gSW4gc3VtbWFy eSwgdGhlcmUgYXJlIHRvbyBnb29kIHByb3Bvc2FscyAoRXJpaywgTWF44oCZcykgdGhhdCBjYW4g Y29tYmluZSBtdWx0aXBsZSBQS3MgYW5kIFNpZ3MuIFRoYXQgd291bGQgYWxsb3cgdXMgdG8gdXMg bW9yZSB0aGFuIG9uZSBQUSBhbGdvcyBpZiB0aGV5IGFyZSBub3QgdHJ1c3RlZC4NCg0KZHJhZnQt dHJ1c2tvdnNreS1sYW1wcy1wcS1oeWJyaWQgYWxsb3dzIGZvciBiYWNrd2FyZHMgY29tcGF0aWJp bGl0eSBieSBkZWZpbmluZyBvbmUgb25seSBQUSBrZXkgYW5kIHNpZyBhcyBub24tY3JpdGljYWwg ZXh0ZW5zaW9ucy4NCg0KSSB3b25kZXIgaWYgdGhlIHR3byBjb25jZXB0cyBjb3VsZCBiZSBtZXJn ZWQuIE1lYW5pbmcgdXNlIHRoZSBjb21wb3NpdGUga2V5ICsgc2lncyBjYW4gbm9uLWNyaXRpY2Fs IGV4dGVuc2lvbnMuIE9sZCBjbGllbnRzIGRpc3JlZ2FyZCB0aGUgUFEgZXh0ZW5zaW9ucy4gTmV3 IGNsaWVudHMgdmVyaWZ5IHRoZSBjbGFzc2ljYWwgIGFuZCB0aGUgUFEgYWxnb3MgZGVmaW5lZCBp biB0aGUgY29tcG9zaXRlIE9JRCBjb250YWluZWQgaW4gdGhlIG5vbi1jcml0aWNhbCBleHRlbnNp b24uDQoNClBhbm9zDQoNCg0KRnJvbTogU3Bhc20gW21haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYu b3JnXSBPbiBCZWhhbGYgT2YgRHIuIFBhbGENClNlbnQ6IFRodXJzZGF5LCBTZXB0ZW1iZXIgMjAs IDIwMTggMTo0NCBQTQ0KVG86IHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4N ClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoNCg0KSGkgUGFub3MsIGFs bCwNCg0KdGhhdCBpcyBjb3JyZWN0IC0gc2luY2UgdGhlIG5ldyBPSURzIGZvciB0aGUgS2V5IGFu ZCB0aGUgU2lnbmF0dXJlcyB3b3VsZCBiZSBuZXcsIGNsaWVudHMgd291bGQgZmFpbCBzaW5jZSB0 aGV5IGRvIG5vdCBrbm93IHRoZSAiY29tcG9zaXRlIiBhbGdvcml0aG0gOkQNCg0KQWx0aG91Z2gg ZGV2ZWxvcGluZyBzdXBwb3J0IGZvciBpdCBzaG91bGQgbm90IGJlIHRvbyBkaWZmaWN1bHQsIHRo ZSBzb2x1dGlvbiBpdCBpcyBub3QgbWVhbnQgdG8gYmUgYmFja3dhcmQgY29tcGF0aWJsZSBhcyB3 ZSB3YW50IGFwcGxpY2F0aW9ucyB0byBiZSBhYmxlIHRvIGZhaWwgaWYgdGhleSBkbyBub3QgZXZl biBrbm93IHRoZXkgd2VyZSBzdXBwb3NlZCB0byBnZW5lcmF0ZSBvciB2ZXJpZnkgbXVsdGlwbGUg c2lnbmF0dXJlcyBpbnN0ZWFkIG9mIGp1c3Qgb25lLg0KDQpGcm9tIGEgdXNhZ2UgcGVyc3BlY3Rp dmUsIEkgYW0gbGVhbmluZyB0b3dhcmRzIHRoZSBuZWVkIGZvciB0aGUgb3duZXIgb2YgdGhlIGNl cnRpZmljYXRlcyB0byBnZW5lcmF0ZSBzaWduYXR1cmVzIHdpdGggYWxsIHRoZSBrZXlzLCBhbmQg Zm9yIHRoZSBlbnRpdHkgdGhhdCB2YWxpZGF0ZXMgdGhlIHNpZ25hdHVyZXMgaXQgc2hvdWxkIHZh bGlkYXRlIGFsbCB0aGUgc2lnbmF0dXJlcyBpdCBzdXBwb3J0cyBhbmQgbWF5IGFjY2VwdCBzaWdu YXR1cmVzIGV2ZW4gaWYgaXQgZG9lcyBub3QgdW5kZXJzdGFuZCBhbGwgdGhlIGFsZ29yaXRobXMg KHRoaXMgaXMgbW9yZSBhbiBhcHBsaWNhdGlvbiBkZWNpc2lvbiBiYXNlZCBvbiB0aGUgcmlzayBh bmQgdGhyZWF0IG1vZGVsKS4NCg0KQXMgSSBzYWlkLCB0aGlzIHNvbHV0aW9uIGZpdHMgbm90IG9u bHkgY2VydGlmaWNhdGVzLCBidXQgYWxzbyBPQ1NQIHJlc3BvbnNlcywgQ1JMcywgQ01TLCBQS0NT IzcsIGV0Yy4gYW5kIHRoYXQgaXMgcGFydCBvZiB3aGF0IGlzIGludGVyZXN0aW5nIGZvciB1cyA6 RCBJIHN0aWxsIG5lZWQgdG8gY2hlY2sgd2hhdCBhcmUgdGhlIG5lZWRlZCBjaGFuZ2VzIGZvciBv dGhlciBmb3JtYXRzIGxpa2UgUEtDUyMxLyM4LyMxMiBmb3Igc3RvcmluZyB0aGUgY29tcG9zaXRl IHB1YmxpYyBhbmQgcHJpdmF0ZSBrZXlzICh0aGlzIHBhcnQgc3RpbGwgbWlzc2luZyksIGJ1dCBJ IGhvcGUgdGhhdCBzb2x2aW5nIHRoYXQgcGFydCB3aWxsIG5vdCBiZSB0b28gZGlmZmljdWx0Li4u DQoNCkNoZWVycywNCk1heA0KDQpPbiA5LzIwLzE4IDc6MjYgQU0sIFBhbm9zIEthbXBhbmFraXMg KHBrYW1wYW5hKSB3cm90ZToNCkhpIE1heCwNClRvIHJlcGhyYXNlIEVyaWPigJlzIHF1ZXN0aW9u LCB3b3VsZCB0aGUgQ29tcG9zaXRlS2V5K0NvbXBvc2l0ZVNpZyBwcm9wb3NhbCBiZSBiYWNrd2Fy ZHMgY29tcGF0aWJsZSB3aXRoIGV4aXN0aW5nIHN5c3RlbXM/DQpJIG1lYW4gaXQgZ2l2ZXMgeW91 IHRoZSBjaGFuZ2UgdG8gdXNlIG1vcmUgdGhhbiBvbmUgYWxnb3MgaW4gY2FzZSB5b3UgZG9u4oCZ dCB0cnVzdCBhbGwgb2YgdGhlbS4gQnV0IGFuIG9sZCBjbGllbnQgd291bGRu4oCZdCBiZSBhYmxl IHRvIGp1c3QgdXNlIHRoZSB0cmFkaXRpb25hbCBrZXkrc2lnIHVubGVzcyBoZSB3YXMgdXBncmFk ZWQgdG8gdW5kZXJzdGFuZCBDb21wb3NpdGVLZXkrQ29tcG9zaXRlU2lnIGFuZCBpdHMgT0lEcywg cmlnaHQ/DQpQYW5vcw0KDQpGcm9tOiBTcGFzbSBbbWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5v cmddIE9uIEJlaGFsZiBPZiBFcmlrIEFuZGVyc2VuDQpTZW50OiBGcmlkYXksIFNlcHRlbWJlciAx NCwgMjAxOCAxMTo0OSBBTQ0KVG86ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPjxtYWlsdG86c3Bh c21AaWV0Zi5vcmc+OyBEaXJlY3RvcnkgbGlzdCA8eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+ PG1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNd IERvdWJsZSBzaWduYXR1cmVzDQoNClRoZSBkb3VibGUgc2lnbmF0dXJlIGlzIGludGVuZGVkIGFz IGEgbWlncmF0aW9uIHRvb2wuDQoNCkluIHRoZSBub3JtYWwgb3BlcmF0aW9uLCBvbmx5IG9uZSBz aWduYXR1cmUgaXMgdXNlZCAodGhlIG5hdGl2ZSBzaWduYXR1cmUpLiBXaGVuIGl0IGlzIHJlYWxp emVkIHRoYXQgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gd2lsbCBiZSB0b28gd2VlayBpIHNvbWUg ZnV0dXJlLCB0aGUgbWlncmF0aW9uIHBlcmlvZCBzdGFydHMgYW5kIGFuIGFsdGVybmF0aXZlLCBh c3N1bWluZyBzdHJvbmdlciBzaWduYXR1cmUgaXMgcHJvdmlkZWQgZm9yIHRob3NlIGFibGUgdG8g aGFuZGxlIGl0LiAgTGVnYWN5IHN5c3RlbXMgd2lsbCBpZ25vcmUgdGhpcyBhbHRlcm5hdGl2ZSBz aWduYXR1cmUuIEFmdGVyIHRoZSBtaWdyYXRpb24gcGVyaW9kLCB0aGVyZSB3aWxsIGJlIG5vIGFs dGVybmF0aXZlIHNpZ25hdHVyZSBhbmQgdGhlIG5ldyBzdHJvbmdlciBzaWduYXR1cmUgd2lsbCBi ZSB0aGUgbmF0aXZlIHNpZ25hdHVyZS4NCg0KRG9lcyB0aGF0IG1ha2Ugc2Vuc2U/DQoNCkVyaWsN Cg0KRnJhOiBNYXNzaW1pbGlhbm8gUGFsYSBbbWFpbHRvOm0ucGFsYUBjYWJsZWxhYnMuY29tXQ0K U2VuZHQ6IDEyIFNlcHRlbWJlciAyMDE4IDIzOjAxDQpUaWw6IFJ1c3MgSG91c2xleSA8aG91c2xl eUB2aWdpbHNlYy5jb208bWFpbHRvOmhvdXNsZXlAdmlnaWxzZWMuY29tPj4NCkNjOiBTUEFTTSA8 c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IEVyaWsgQW5kZXJzZW4gPGVy YUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4+DQpFbW5lOiBSZTogW2xhbXBzXSBEb3VibGUg c2lnbmF0dXJlcw0KDQoNCkhpIFJ1c3MsIGFsbCwNCg0KbXkgcGVyc29uYWwgcG9zaXRpb24gaXMg dGhhdCB0aGUgc2lnbmVyIE1VU1QgdXNlIGFsbCB0aGUga2V5cyB0aGF0IGhhdmUgZGlnaXRhbFNp Z25hdHVyZSBzZXQsIHRoZSB2ZXJpZmllciBzaGFsbCB2ZXJpZnkgYWxsIHRoZSBzaWduYXR1cmVz IGZvciB3aGljaCBpdCBkb2VzIGhhdmUgc3VwcG9ydCBmb3IuDQoNClRoZSByYXRpb25hbGUgZm9y IHRoaXMgaXMgdGhhdCBpZiBJIGNlcnRpZnkgYSBwdWJsaWMga2V5IGluIHRoZSBjZXJ0aWZpY2F0 ZSwgeW91IHNob3VsZCBiZSBhYmxlIHRvIHVzZSB0aGUgcHJpdmF0ZSBrZXkgdG8gZ2VuZXJhdGUg dGhlIHNpZ25hdHVyZSwgdGhlcmVmb3JlIHRoZSBhcHByb2FjaCBpcyB0aGUgc2FtZSBhcyB1c3Vh bDogc2lnbiB3aXRoIHlvdXIga2V5LiBJbiB0aGlzIGNhc2UsIGl0IGp1c3QgaGFwcGVucyB0aGF0 IHRvIGdlbmVyYXRlIHRoZSBzaWduYXR1cmUgeW91IGhhdmUgdG8gZ2VuZXJhdGUgbXVsdGlwbGUg b25lcyBhbmQgdGhlbiBjb21iaW5lIHRoZW0gdG9nZXRoZXIuDQoNCkZvciB0aGUgYXBwbGljYXRp b24gdGhhdCB2ZXJpZmllcyB0aG9zZSBzaWduYXR1cmVzLCBpdCBpcyBhbHdheXMgYSBxdWVzdGlv biBvZiB3aGF0IGlzIHRoZSB0aHJlc2hvbGQgdGhhdCBpcyBhY2NlcHRhYmxlIGZvciB0aGUgYXBw bGljYXRpb24gKGluIHRlcm1zIG9mIHJpc2spIGluIGNhc2UgaXQgZG9lcyBub3Qgc3VwcG9ydCBh bGwgb2YgdGhlIGFsZ29yaXRobXMgdGhhdCBhcmUgdXNlZCB0byBnZW5lcmF0ZSB0aGUgY29tcG9z aXRlIHNpZ25hdHVyZS4gSWRlYWxseSBpdCB3b3VsZCB2ZXJpZnkgYWxsLCBidXQgaXQgbWF5IGRl Y2lkZSB0byB2ZXJpZnkgbGVzcyAoYXQgbGVhc3Qgb25lKS4NCg0KSSBhbHNvIHNhdyB0aGUgb3Ro ZXIgZS1tYWlsIGZyb20gSmltIG9uIHRoaXMgdG9waWMgYW5kIEkgdGhpbmsgaXQgY291bGQgYmUg YSBnb29kIGlkZWEgLSB0aGUgdXNlIG9mIHRoZSB0d28gT0lEcyBpcyBhbm90aGVyIHdheSB0byBn byB0byBjb2RpZnkgdGhlIHZhbGlkYXRpb24gcHJvY2VzcyByZXF1aXJlZC4gVGVjaG5pY2FsbHks IHRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUsIGhvd2V2ZXIgSSBhbSBjb25mbGljdGVkIGFzIHRoaXMg YXBwcm9hY2ggcmVxdWlyZXMgdGhhdCB0aGUgc2lnbmVyIGhhcyBhbiB1bmRlcnN0YW5kaW5nIG9m IHdoYXQgdGhlIHZlcmlmaWVyJ3MgY2FwYWJpbGl0aWVzIGFyZS4uLiBJIHRoaW5rIHRoYXQgZGVm aW5pbmcgdHdvIE9JRHMgZm9yIHRoZSBzaWduYXR1cmVzIGNvdWxkIHN0aWxsIGJlIHVzZWZ1bCBi ZWNhdXNlIHRoZSBzaWduZXIgbWlnaHQgdGhlbiBkZWNpZGUgdGhlICJyZWNvbW1lbmRlZCIvImlu dGVuZGVkIiB2ZXJpZmljYXRpb24gYmVoYXZpb3IuLi4gSSBjYW4gc2VlIHNvbWUgdXNlLWNhc2Vz IHRoYXQgbWlnaHQgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJTQSwgRUMgfSBhbmQgdGhl ICJNdXN0LVZlcmlmeS1BbGwiIE9JRCBmb3IgdGhlIHNpZ25hdHVyZSwgYW5kIGFub3RoZXIgdXNl LWNhc2Ugd2hlcmUgd2UgaGF2ZSBhIGNvbXBvc2l0ZSBrZXkgd2l0aCB7IFJTQSwgSEFTSC1CQVNF RCB9IGFuZCBmb3IgdGhlIHNpZ25hdHVyZSAiTXVzdC1WZXJpZnktQXQtTGVhc3QtT25lIi4NCg0K RG9lcyB0aGlzIG1ha2Ugc2Vuc2U/DQoNCkNoZWVycywNCk1heA0KDQpPbiA5LzEyLzE4IDY6MTIg QU0sIFJ1c3MgSG91c2xleSB3cm90ZToNCk1heDoNCg0KRHVyaW5nIGEgdHJhbnNpdGlvbiB0byBx dWFudHVtLXJlc2lzdGFudCBzaWduYXR1cmVzLCBhIHNpZ25lciB3YW50cyB0byBwdXQgYSB0cmFk aXRpb25hbCBzaWduYXR1cmUgYW5kIGEgcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJlIG9uIGFu IG9iamVjdC4gIEdpdmVuIHlvdXIgZGVzY3JpcHRpb24gb2Yga2V5VXNhZ2UgYW5kIGV4dGVuZGVk S2V5VXNhZ2UsIGJvdGggd291bGQgaGF2ZSB0aGUgZGlnaXRhbFNpZ25hdHVyZSBiaXQgc2V0LiAg SG93IGRvZXMgYSBjbGllbnQga25vdyBpZiBqdXN0IG9uZSBvciBib3RoIHNpZ25hdHVyZXMgbXVz dCBiZSB2YWxpZD8NCg0KQXMgSmltIFNjaGFhZCBhbHJlYWR5IHNhaWQsIFJGQyA1NzUyIHRhbGtz IGFib3V0IHRoaXMgaXNzdWUgd2hlbiBhIENNUyBTaWduZWREYXRhIGNvbnRhaW5zIG1vcmUgdGhh biBvbmUgU2lnbmVySW5mby4NCg0KUnVzcw0KDQoNCk9uIFNlcCAxMSwgMjAxOCwgYXQgNDo0NSBQ TSwgTWF4IFBhbGEgPE0uUGFsYUBjYWJsZWxhYnMuY29tPG1haWx0bzpNLlBhbGFAY2FibGVsYWJz LmNvbT4+IHdyb3RlOg0KDQpIaSBBbGwsDQoNCkkgYW0gd29ya2luZyBvbiBhIHNpbWlsYXIgLSBi dXQgZGlmZmVyZW50IC0gc29sdXRpb24sIGluIHBhcnRpY3VsYXIgSSBzb2x2ZSB0aGUgaXNzdWUg b2YgKGEpIGJlaW5nIGFibGUgdG8gY29tYmluZSBtb3JlIHRoYW4gb25lIHB1YmxpYyBrZXksIChi KSBvbmx5IG9uZSAoYWN0dWFsbHkgdHdvKSBPSURzIHJlcXVpcmVkLCBhbmQgKGMpIHNpbXBseSB0 aGUgcHJvY2Vzc2luZyBieSByZS11dGlsaXppbmcgdGhlIHNhbWUgZGF0YSBzdHJ1Y3R1cmVzIHdl IGhhdmUgdG9kYXkuDQoNCkkgcGFydGljdWxhciwgSSBkZWZpbmUgYSDigJxjb21wb3NpdGUgcHVi bGljIGtleeKAnSBhbmQg4oCcY29tcG9zaXRlIHNpZ25hdHVyZeKAnS4NCg0KVGhlIGZpcnN0IG9u ZSBlbmNvZGVzIGluIHRoZSBrZXkgdmFsdWXigJlzIEJJVFNUUklORyB0aGUgREVSIHZhbHVlIG9m IHRoZSBTRVFVRU5DRSBvZiBwdWJsaWMga2V5cyAoZWFjaCBvZiB3aGljaCBpcyBhIHRoZSBzdWJq ZWN0UHVibGljS2V5SW5mbyBzdHJ1Y3R1cmUpIGFuZCB1c2VzIGEgc3BlY2lmaWMgT0lEIHRoYXQg aWRlbnRpZmllcyB0aGUgcHVibGljIGtleSB0eXBlLiBUaGUgcGFyYW1ldGVycyBvZiB0aGUgY29t cG9zaXRlS2V5IGFsZ29yaXRobSBjYW4gYmUgdXNlZCB0byBlbmNvZGUgdGhlIGtleVVzYWdlIGFu ZCB0aGUgZXh0ZW5kZWRLZXlVc2FnZSBmb3IgZWFjaCBvZiB0aGUga2V5cyBpbiB0aGUgY29tcG9z aXRlIGtleS4NCg0KVGhlIHNhbWUgYXBwcm9hY2ggaXMgdXNlZCBmb3IgdGhlIOKAnENvbXBvc2l0 ZSBTaWduYXR1cmXigJ0gY2FzZSB3aGVyZSB0aGUgdmFsdWUgb2YgdGhlIHNpZ25hdHVyZSBpcyB0 aGUgREVSIHJlcHJlc2VudGF0aW9uIG9mIHRoZSBTRVFVRU5DRSBvZiBzaWduYXR1cmVzIG1hZGUg d2l0aCBlYWNoIG9mIHRoZSBrZXlzLg0KDQpBcyBzb29uIGFzIEkgaGF2ZSBzb21lIHNwYXJlIHRp bWUsIEkgd2lsbCBzdWJtaXQgdGhlIGRyYWZ0IC0gbWF5YmUgdGhpcyBjb3VsZCBiZSBkaXNjdXNz ZWQgaW4gQmFuZ2tvaz8NCg0KVGhpcyBzaW1wbGUgaWRlYSBhbGxvd3MgdXMgdG8gaGF2ZSBhbGwg dGhlIG90aGVyIHByb2NlZHVyZXMgcmVsYXRlZCB0byBQS0lzIHdvcmsgLSB0aGlzIG1lYW5zIHdl IGNhbiBjb21iaW5lIEVDQyB3aXRoIFJTQSBvciB3aXRoIGEgUXVhbnR1bS1SZXNpc3RhbnQgYWxn b3JpdGhtICh3aGVuIGZpbmFsbHkgYXZhaWxhYmxlIGFuZCBzdGFuZGFyZGl6ZWQpLiBBIHN0ZXAg Zm9yd2FyZCBmb3IgdGhlIGRlcGxveW1lbnQgb2YgaHlicmlkLVBLSXMgd2hlcmUgbXVsdGlwbGUg TGFnb3MgZm9yIGtleXMgY2FuIGJlIHVzZWQgdG8gYXV0aGVudGljYXRlIGRhdGEsIGNlcnRzLCBy ZXZvY2F0aW9uIGRhdGEsIGV0Yy4uLiB3ZSBwbGFuIHRvIHVzZSB0aGlzIGluIG91ciBpbmZyYXN0 cnVjdHVyZXMgdG8gcHJvdmlkZSBhIHRyYW5zaXRpb25hbCBwYXRoIGZvciBwb3N0LVF1YW50dW0g dHJhbnNpdGlvbiBhbmQgdG8gZnVydGhlciBpbXByb3ZlIHRoZSBhbGdvcml0aG0tYWdpbGl0eSBj YXBhYmlsaXR5IG9mIFBLSXMuDQoNCldoYXQgZG8geW91IHRoaW5rPw0KDQpDaGVlcnMsDQpNYXgN Cg0KDQotLS0NCg0KQ2hlZXJzLA0KTWF4DQpPbiBTZXAgMTEsIDIwMTgsIGF0IDg6MzggQU0sIFRp bSBIb2xsZWJlZWsgPHRpbS5ob2xsZWJlZWtAZGlnaWNlcnQuY29tPG1haWx0bzp0aW0uaG9sbGVi ZWVrQGRpZ2ljZXJ0LmNvbT4+IHdyb3RlOg0KVW5mb3J0dW5hdGVseSwg4oCcbm90IGV2ZXJ5IGNv bWJpbmF0aW9uIG5lZWRzIHRvIGJlIGNvdmVyZWTigJ0gaW50cm9kdWNlcyBhIGxvdCBvZiBwb2xp dGljcyBhcm91bmQgY2hvb3Npbmcgd2hpY2ggY29tYmluYXRpb25zIOKAnG5lZWQgdG8gYmUgY292 ZXJlZOKAnSwgYSBzdWJqZWN0IG9uIHdoaWNoIGluZXZpdGFibHkgbm90IGV2ZXJ5b25lIGFncmVl cy4gIEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNzaW9ucyBhbmQgdGhlIHVu bmVjZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuDQoNCkkgcGVyc29uYWxseSBkb27igJl0IHRo aW5rIGEgc2luZ2xlIEFsZ0lEIHdoaWNoIGltcGxpZXMgYSBTRVFVRU5DRSBvZiBBTEcgSURzIGlz IGFuIGltcHJvdmVtZW50IG92ZXIgYSBTRVFVRU5DRSBvZiBBTEcgSURzLCBvciBpdHMgbW9yYWwg ZXF1aXZhbGVudC4gIEZvciBzaW1wbGUgaHlicmlkIHVzZSBjYXNlcywgdGhlcmUgaXMgYWxzbyBh IGxvdCBvZiB2YWx1ZSBpbiBoYXZpbmcgdGhlIGNsYXNzaWNhbCBhbGdvcml0aG0gSUQgYmVpbmcg dGhlIHNhbWUgYXMgaXQgdXN1YWxseSBpcywgdG8gYWxsb3cgZWFzaWVyIGludGVyb3BlcmFiaWxp dHkgd2l0aCBvbGRlciBzeXN0ZW1zIHRoYXQgZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBuZXdlciBh bGdvcml0aG1zIChhbmQgY2FuIGJsaXNzZnVsbHkgaWdub3JlIHRoZW0pLg0KDQotVGltDQoNCkZy b206IFNhbnRvc2ggQ2hva2hhbmkgPHNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tPG1haWx0bzpz YW50b3NoLmNob2toYW5pQGdtYWlsLmNvbT4+DQpTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEs IDIwMTggMTA6MjkgQU0NClRvOiBUaW0gSG9sbGViZWVrIDx0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0 LmNvbTxtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20+PjsgJ0VyaWsgQW5kZXJzZW4n IDxlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+PjsgJ1NQQVNNJyA8c3Bhc21AaWV0Zi5v cmc8bWFpbHRvOnNwYXNtQGlldGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1h aWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJFOiBbbGFtcHNdIERv dWJsZSBzaWduYXR1cmVzDQoNClRoYW5rcyBUaW0uDQoNClRoZXJlIGFyZSB3YXlzIHRvIGFjY29t bW9kYXRlIHlvdXIgY29uY2Vybi4NCg0KT25lIHdheSB0byBoYW5kbGUgdGhpcyBpcyBkZWZpbmlu ZyBhIHNpbmdsZSBBbGcgSUQgQSB3aGljaCBpbXBsaWVzIGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBh bmQgZGVmaW5lIHRoZSByZWx5aW5nIHBhcnR5IHJ1bGVzIGluIHRlcm1zIG9mIGl0cyBhYmlsaXR5 IHRvIHByb2Nlc3Mgb25lIG9yIGFsbCBBTEcgSURzLg0KDQpBbm90aGVyIHdheSB0byBkbyB0aGlz IGlzIG5vdCBldmVyeSBjb21iaW5hdGlvbiBuZWVkcyB0byBiZSBjb3ZlcmVkIGFuZCB0aGUgdXNl ciBjb21tdW5pdHkgZGVmaW5lcyBpdHMgb3duICBBbGcgSUQgWGkgd2hpY2ggbWFwcyB0byBhIFNF UVVFTkNFIG9mIEFMRyBJRHMuDQoNCkZyb206IFNwYXNtIFttYWlsdG86c3Bhc20tYm91bmNlc0Bp ZXRmLm9yZ10gT24gQmVoYWxmIE9mIFRpbSBIb2xsZWJlZWsNClNlbnQ6IFR1ZXNkYXksIFNlcHRl bWJlciAxMSwgMjAxOCAxMDowMyBBTQ0KVG86IEVyaWsgQW5kZXJzZW4gPGVyYUB4NTAwLmV1PG1h aWx0bzplcmFAeDUwMC5ldT4+OyAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21A aWV0Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFy ZEBmcmVlbGlzdHMub3JnPg0KU3ViamVjdDogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMN Cg0KRG9lc27igJl0IHRoZSBjb21iaW5hdG9yaWMgZXhwbG9zaW9uIHJlbmRlciB0aGlzIGNvbXBs ZXRlbHkgaW1wcmFjdGljYWw/DQoNCllvdSBuZWVkIE5fYyB4IE5fcHEgYWxnb3JpdGhtIGlkZW50 aWZpZXJzIGp1c3QgdG8gaGFuZGxlIHRoZSBzaW1wbGUgaHlicmlkIHVzZSBjYXNlIHdoZXJlIGEg c2luZ2xlIGNsYXNzaWNhbCBhbGdvcml0aG0gaXMgYmVpbmcgdXNlZCBpbiBjb25qdW5jdGlvbiB3 aXRoIGEgc2luZ2xlIHBvc3QtcXVhbnR1bSBhbGdvcml0aG0uDQoNCkFuZCB0aGVyZSBhcmUgcGVv cGxlIHdobyB3YW50IHRvIHVzZSBtdWx0aXBsZSBwb3N0LXF1YW50dW0gYWxnb3JpdGhtcyB0byBo ZWRnZSBhZ2FpbnN0IHBvdGVudGlhbCB5ZXQgdG8gYmUgZGlzY292ZXJlZCB3ZWFrbmVzc2VzIGlu IHBvc3QtcXVhbnR1bSBhbGdvcml0aG1zLg0KDQpJ4oCZbSBub3QgcmVhbGx5IGxvb2tpbmcgZm9y d2FyZCB0byB0cnlpbmcgdG8gYWxsb2NhdGUgb3IgbWFuYWdlIE8oTl9jIHggTl9wcV4zKSBhbGdv cml0aG0gaWRlbnRpZmllcnPigKYNCg0KLVRpbQ0KDQpGcm9tOiBTcGFzbSA8c3Bhc20tYm91bmNl c0BpZXRmLm9yZzxtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBF cmlrIEFuZGVyc2VuDQpTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMzoxMCBBTQ0K VG86ICdTUEFTTScgPHNwYXNtQGlldGYub3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAw c3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxtYWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+ DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlcw0KDQpIaSBTYW50b3NoLA0K DQpZb3UgaGF2ZSBwcm9wb3NlZCBzb21ldGhpbmcgbGlrZSB0aGlzIGJlZm9yZS4gSXQgc3RpbGwg cHV6emxpbmcgaW4gbXkgYnJhaW4uIEFzIEkgdW5kZXJzdGFuZCwgaXQgcmVxdWlyZXMgdGhhdCB3 ZSBkZWZpbmUgYSBwYXJ0aWN1bGFyIGFsZ29yaXRobSB0aGF0IGhhcyBhIHBhcmFtZXRlciB0aGF0 IGluY2x1ZGVzIHRoZSB0aGluZ3MgeW91IHN1Z2dlc3QuIEl0IGlzIHdvcnRoeSB0byBiZSBhbmFs eXNlZC4NCg0KRXJpaw0KDQpGcmE6IFNwYXNtIFttYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9y Z10gUMOlIHZlZ25lIGFmIFNhbnRvc2ggQ2hva2hhbmkNClNlbmR0OiAxMCBTZXB0ZW1iZXIgMjAx OCAxOToxOA0KVGlsOiAnSmltIFNjaGFhZCcgPGlldGZAYXVndXN0Y2VsbGFycy5jb208bWFpbHRv OmlldGZAYXVndXN0Y2VsbGFycy5jb20+PjsgJ1J5YW4gU2xlZXZpJyA8cnlhbi1pZXRmQHNsZWV2 aS5jb208bWFpbHRvOnJ5YW4taWV0ZkBzbGVldmkuY29tPj47IGVyYUB4NTAwLmV1PG1haWx0bzpl cmFAeDUwMC5ldT4NCkNjOiAnU1BBU00nIDxzcGFzbUBpZXRmLm9yZzxtYWlsdG86c3Bhc21AaWV0 Zi5vcmc+PjsgeDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8bWFpbHRvOng1MDBzdGFuZGFyZEBm cmVlbGlzdHMub3JnPg0KRW1uZTogUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXMNCg0KV2h5 IG5vdCBsZXQgYWxnb3JpdGhtIGlkZW50aWZpZXIgZGljdGF0ZSB0aGUgbnVtYmVyIG9mIHNpZ25h dHVyZXMgYW5kIHRoZWlyIHN5bnRheD8NCg0KRnJvbTogU3Bhc20gW21haWx0bzpzcGFzbS1ib3Vu Y2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgSmltIFNjaGFhZA0KU2VudDogTW9uZGF5LCBTZXB0 ZW1iZXIgMTAsIDIwMTggMTowNyBQTQ0KVG86ICdSeWFuIFNsZWV2aScgPHJ5YW4taWV0ZkBzbGVl dmkuY29tPG1haWx0bzpyeWFuLWlldGZAc2xlZXZpLmNvbT4+OyBlcmFAeDUwMC5ldTxtYWlsdG86 ZXJhQHg1MDAuZXU+DQpDYzogJ1NQQVNNJyA8c3Bhc21AaWV0Zi5vcmc8bWFpbHRvOnNwYXNtQGll dGYub3JnPj47IHg1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnPG1haWx0bzp4NTAwc3RhbmRhcmRA ZnJlZWxpc3RzLm9yZz4NClN1YmplY3Q6IFJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzDQoN ClJ5YW4sDQoNClRoZSBkaXNjdXNzaW9uIGluIExvbmRvbiBkZWFsdCB3aXRoIGEgY29tcGxldGVs eSBkaWZmZXJlbnQgcHJvcG9zYWwgdGhhbiB0aGlzIG9uZS4gIFdoaWxlIEkgdGhpbmsgdGhlcmUg YXJlIHByb2JsZW1zIHdpdGggdGhpcyB0aGF0IG5lZWQgdG8gYmUgZGVhbHQgd2l0aCB0aGV5IGFy ZSBtb3N0bHkgbm90IHRoZSBzYW1lIHNldC4NCg0KRXJpaywNCg0KV2h5IGlzIHRoaXMgY29uc2lk ZXJlZCB0byBiZSBhIHByZWZlcnJlZCBzb2x1dGlvbiB0byBkZWZpbmluZyBhIG5ldyBzaWduYXR1 cmUgYWxnb3JpdGhtIHdoaWNoIGNvbnRhaW5zIGFzIHRoZSBwYXJhbWV0ZXIgdGhlIHNlcXVlbmNl IG9mIGFsZ29yaXRobSBpZGVudGlmaWVycyBhbmQgYXMgdGhlIHNpZ25hdHVyZSB2YWx1ZSBhIHNl cXVlbmNlIG9mIHNpZ25hdHVyZSB2YWx1ZXMuICBUaGUgcHJvYmxlbSB3aXRoIGp1c3QgZGVmaW5p bmcgdGhlIGV4dGVuc2lvbiB0byBTSUdORUQgaXMgdGhhdCBvbmUgbmVlZHMgdG8gbWFrZSBzdXJl IHRoYXQgdGhlIHNldCBvZiBzaWduYXR1cmUgYWxnb3JpdGhtcyBhbmQgcGFyYW1ldGVycyBhcmUg YWxzbyBwYXJ0IG9mIHRoZSBkYXRhIHRvIGJlIHNpZ25lZCBhbmQgSSBhbSBub3Qgc2VlaW5nIHRo YXQgaGlnaGxpZ2h0ZWQgaGVyZS4NCg0KSmltDQoNCg0KRnJvbTogU3Bhc20gPHNwYXNtLWJvdW5j ZXNAaWV0Zi5vcmc8bWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2Yg UnlhbiBTbGVldmkNClNlbnQ6IE1vbmRheSwgU2VwdGVtYmVyIDEwLCAyMDE4IDg6NTMgQU0NClRv OiBlcmFAeDUwMC5ldTxtYWlsdG86ZXJhQHg1MDAuZXU+DQpDYzogU1BBU00gPHNwYXNtQGlldGYu b3JnPG1haWx0bzpzcGFzbUBpZXRmLm9yZz4+OyB4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzxt YWlsdG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc+DQpTdWJqZWN0OiBSZTogW2xhbXBzXSBE b3VibGUgc2lnbmF0dXJlcw0KDQoNCk9uIE1vbiwgU2VwIDEwLCAyMDE4IGF0IDEwOjU2IEFNIEVy aWsgQW5kZXJzZW4gPGVyYUB4NTAwLmV1PG1haWx0bzplcmFAeDUwMC5ldT4+IHdyb3RlOg0KSGkg Rm9saywNCg0KSW4gSVRVLVQgd2UgaGF2ZSBwbGFucyB0byBhbGxvdyBmb3IgZG91YmxlIHNpZ25h dHVyZXMgdXNpbmcgdGhlIFNJR05FRCBwYXJhbWV0cml6ZWQgZGF0YSB0eXBlIGRlZmluZWQgaW4g WC41MDkgdG8gY29wZSB3aXRoIHNpdHVhdGlvbiBhcyBkZXNjcmliZWQgaW4gdGhlIGludGVybmV0 IGRyYWZ0OiDigJxNdWx0aXBsZSBQdWJsaWMtS2V5IEFsZ29yaXRobSBYLjUwOSBDZXJ0aWZpY2F0 ZXMgKGRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDktMDEp4oCdDQoNCldlIHN1 Z2dlc3QgdG8gZW5oYW5jZSB0aGUgU0lHTkVEIGRhdGEgdHlwZSBhcyBzaG93biBiZWxvdzoNCg0K U0lHTkVEe1RvQmVTaWduZWR9IDo6PSBTRVFVRU5DRSB7DQogIENPTVBPTkVOVFMgT0YgU0lHTkFU VVJFLA0KICAuLi4uLi4uLA0KICBhbHRBbGdvcml0aG1JZGVudGlmaWVyICBBbGdvcml0aG1JZGVu dGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0gT1BUSU9OQUwsDQogIGFsdFNpZ25hdHVyZSAg ICAgICAgICAgIEJJVCBTVFJJTkcgT1BUSU9OQUwNCiAgfSAoV0lUSCBDT01QT05FTlRTIHsuLi4s IGFsdEFsZ29yaXRobUlkZW50aWZpZXIgUFJFU0VOVCwgYWx0U2lnbmF0dXJlIFBSRVNFTlQgfSB8 DQogICAgIFdJVEggQ09NUE9ORU5UUyB7Li4uLCBhbHRBbGdvcml0aG1JZGVudGlmaWVyIEFCU0VO VCwgIGFsdFNpZ25hdHVyZSBBQlNFTlQgfSApDQoNCldlIGFyZSBvcGVuIHRvIGNvbW1lbnRzLiBX ZSBrbm93IHRoYXQgSUVURiBpcyBub3QgYSBoZWF2eSB1c2VyIG9mIHRoaXMgZGF0YSB0eXBlLg0K DQpXZSBoYXZlIG5vIGludGVudGlvbiB0byB1c2UgdGhpcyBleHRlbmRlZCBkYXRhIHR5cGUgZm9y IGNlcnRpZmljYXRlcyBhbmQgQ1JMcy4NCg0KRm9yIHlvdXIgaW5mb3JtYXRpb24sIFNJR05BVFVS RSBpcyBkZWZpbmVkIGFzOg0KDQpTSUdOQVRVUkUgOjo9IFNFUVVFTkNFIHsNCiAgYWxnb3JpdGht SWRlbnRpZmllciAgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxnb3JpdGhtc319LA0K ICBzaWduYXR1cmUgICAgICAgICAgICBCSVQgU1RSSU5HLA0KICAuLi4uLi4uIH0NCg0KRnJvbSB0 aGUgZGlzY3Vzc2lvbnMgaW4gTG9uZG9uICgxMDEpLCB0aGVyZSB3ZXJlIGEgbnVtYmVyIG9mIGNo YWxsZW5nZXMgaWRlbnRpZmllZCBkdXJpbmcgdGhlIGRpc2N1c3Npb24gLSBodHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTAxL21hdGVyaWFscy9taW51dGVzLTEwMS1sYW1wcy0w MS50eHQgLSB0aGF0IGZ1bmRhbWVudGFsbHkgcXVlc3Rpb25lZCB0aGF0IGFwcHJvYWNoLg0KDQpI YXMgdGhlIElUVS1UIGFkZHJlc3NlZCBvciByZXNvbHZlZCB0aG9zZSBjb25jZXJucz8gQXJlIHRo ZXkgbm90IGFwcGxpY2FibGUgZm9yIHNvbWUgcmVhc29uIHNwZWNpZmljIHRvIElUVS1UPw0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClNwYXNtIG1haWxp bmcgbGlzdA0KU3Bhc21AaWV0Zi5vcmc8bWFpbHRvOlNwYXNtQGlldGYub3JnPg0KaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zcGFzbQ0KDQoNCi0tDQpCZXN0IFJlZ2FyZHMs DQpNYXNzaW1pbGlhbm8gUGFsYSwgUGguRC4NCltDYWJsZUxhYnNdDQpQcmluY2lwYWwgQXJjaGl0 ZWN0DQpTZWN1cml0eSBTZXJ2aWNlcywgUiZEDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCg0KU3Bhc20gbWFpbGluZyBsaXN0DQoNClNwYXNtQGll dGYub3JnPG1haWx0bzpTcGFzbUBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9zcGFzbQ0KDQo= --_000_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXcgXDsiO30NCkBmb250LWZhY2UNCgl7Zm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3IFw7IGNvbG9yXDogcmVkIjt9DQpAZm9udC1mYWNlDQoJe2Zv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyBcOyBcO2NvbG9yXDpcI0MwMDAwMCI7fQ0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXcgXDsgXDtjb2xvclw6cmVkIjt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNr O30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNw YW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcHJl DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOmJsYWNr O30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQ YXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjsNCgljb2xvcjpibGFjazt9DQpzcGFuLkhUTUxQcmVm b3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsN Cgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIjsNCglmb250LWZhbWlseTpDb25zb2xhczsNCgljb2xvcjpibGFjazt9DQpwLm1zb25vcm1h bDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25v cm1hbDsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJn aW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3 IFJvbWFuIixzZXJpZjsNCgljb2xvcjpibGFjazt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFj ZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28t c3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5 N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjUNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFu LkVtYWlsU3R5bGUyNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjU1ODcw NjYzMTsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTYxNjc5ODgwMjt9DQpAbGlzdCBsMQ0KCXtt c28tbGlzdC1pZDoxMzQ5NzkxNzk2Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczotMTQ3MTExNjg1MCA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5 ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlz dCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDIN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9t YW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJ e21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7 DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDph bHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50 Oi05LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9t OjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGFua3Mg SmltLiBBZ3JlZWQuIEEgbG90IG9mIGRldGFpbHMgdG8gaGFzaCBvdXQuDQo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgZGlkbuKAmXQgd2FudCB0byBsb3NlIHRy YWNrIG9mIHRoZSBiYWNrd2FyZHMgY29tcGF0aWJpbGl0eSBvZmZlcmVkIGluDQo8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmRyYWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHli cmlkLiBBbmQgYWxzbyB3YW50ZWQgdG8NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+bGV2ZXJhZ2UgdGhlIGNvbXBvc2l0ZSBQSyBhbmQgU2lnIGZvciB0aGUgY2FzZSB3aGVy ZSB3ZSBkb27igJl0IGZ1bGx5IHRydXN0IG9uIFBRIHNjaGVtZSB0aGF0IE1heCBhbmQgRXJpa+KA mXMgcHJvcG9zYWwgYXJlIHRyeWluZyB0byBhZGRyZXNzLiBBbm90aGVyIGlzc3VlIHRoZXJlIGlz IHNpemUuIFNvbWUNCiBQUSBjYW5kaWRhdGVzIGhhdmUgcmVhbGx5IGJpZyBzaXplcywgc28gSSBk b27igJl0IHRoaW5rIHRoZXJlIHdpbGwgYmUgYSBjb21iaW5hdG9yaWNzIGlzc3VlIGZvciBjYXNl cyB3aGVyZSB0aGUgUEsmIzQzO1NpZyBhcmUgdHJhbnNmZXJyZWQgb24gdGhlIGZseS4NCjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB0aGluayB0aGVyZSBpcyB2 YWx1ZSBoZXJlIHRvIGJlIGFydGljdWxhdGVkLCBidXQgd2UgbmVlZCB0byBiZSBjb2duaXphbnQg b2YgYWxsIHRoZSBwb2ludHMgeW91IGFyZSBicmluZ2luZyB1cCBhbmQgZmluZCB0aGUgZGV2aWwg aW4gdGhlIGRldGFpbHMuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPlBhbm9zPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3Rl eHQiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+IEpp bSBTY2hhYWQgW21haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29tXQ0KPGJyPg0KPGI+U2VudDo8 L2I+IFNhdHVyZGF5LCBTZXB0ZW1iZXIgMjIsIDIwMTggMTI6MTggQU08YnI+DQo8Yj5Ubzo8L2I+ IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSAmbHQ7cGthbXBhbmFAY2lzY28uY29tJmd0Ozxi cj4NCjxiPkNjOjwvYj4gc3Bhc21AaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFts YW1wc10gRG91YmxlIHNpZ25hdHVyZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+UGFub3MsPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5XaXRob3V0IGEg cmVhbGx5IGRldGFpbGVkIGFuYWx5c2lzIG9mIHlvdXIgcHJvcG9zYWwgYW5kIGhvdyBpdCB3aWxs IGludGVyYWN0IHdpdGggZXhpc3RpbmcgY29kZSBJIGNvdWxkIG5vdCBwb3NzaWJseSBzdXBwb3J0 IGl0LiZuYnNwOyZuYnNwOyBBIHF1aWNrIGxpc3Qgb2YgcHJvYmxlbXMNCiB0aGF0IEkgd291bGQg bGlzdCAod2l0aG91dCB0aG91Z2h0KSBhcmU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIx IiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5IaXN0b3JpY2FsbHks IGxvdHMgb2YgcGVvcGxlIGNhbm5vdCBnZXQgREVSIGVuY29kaW5nIGNvcnJlY3QuJm5ic3A7IFBl dGVyIEd1dG1hbm4gaGFzIGEgaHVnZSBjb2xsZWN0aW9uIG9mIGNlcnRpZmljYXRlcyB0aGF0IHdl cmUNCiBpc3N1ZWQgYnkgQ0FzIHRoYXQgd2VyZSBub3QgY29ycmVjdGx5IERFUiBlbmNvZGVkLiZu YnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i Y29sb3I6d2luZG93dGV4dDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5FdmVyeWJvZHkgd2hvIHdhbnRzIHRvIHN1cHBvcnQgUFEgYWxnb3JpdGhtcyBpcyBub3cgcmVx dWlyZWQgdG8gYWRkIGEgREVSIGVuY29kZXIgdG8gdGhlaXIgc3lzdGVtcy4mbmJzcDsgRm9yIHRo aW5ncyB3aGljaCBvbmx5DQogY29uc3VtZSBjZXJ0aWZpY2F0ZXMsIGNybHMsIGNtcyBvYmplY3Rz IHRoaXMgbWVhbnMgdGhhdCB0aGV5IG5vdyBoYXZlIGVubGFyZ2VkIGNvZGUgc2l6ZS48bzpwPjwv bzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JIGhhdmUgbm8g aWRlYSB3aGF0IHRoZSBydWxlcyBhcmUgZm9yIG1hdGNoaW5nIENSTHMgYW5kIGNlcnRpZmljYXRl cyBpbiB0ZXJtcyBvZiBzaWduYXR1cmUgYWxnb3JpdGhtcywgSSB3b3VsZCBhc3N1bWUgdGhhdA0K IHlvdSBuZWVkIHRoZSBzYW1lIHByb3RlY3Rpb25zIGZvciBDUkxzLjxvOnA+PC9vOnA+PC9zcGFu PjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O21zby1s aXN0OmwxIGxldmVsMSBsZm8zIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPllvdSBhcmUgbm90IHNpZ25pbmcg dGhlIGFsdCBzaWduYXR1cmUgYWxnb3JpdGhtIGFzIHBhcnQgb2YgdGhlIFRCUyAoZWFzeSB0byBm aXgpPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNv bG9yOndpbmRvd3RleHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SG93IGFyZSB0aGUgY2VydGlmaWNhdGVzIGZvciB0aGUgaXNzdWVyIHNldHVwPyZuYnNwOyBBcmUg dGhlcmUgc2VwYXJhdGUgY2VydGlmaWNhdGVzIG9yIHRoZSBzYW1lIGNlcnRpZmljYXRlPzxvOnA+ PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0O21zby1saXN0OmwxIGxldmVsMSBsZm8zIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkp1c3QgaG93 IGJhZGx5IGRvZXMgdGhpcyBhZmZlY3QgdGhlIHBhdGggYnVpbGRpbmcgY29kZSBhcyBpdCBub3cg bmVlZHMgdG8gYmUgbW9kaWZpZWQgdG8gaGF2ZSBhZGRpdGlvbmFsIGlucHV0cy48bzpwPjwvbzpw Pjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5EbyB5b3Ugd2FudCB0 byBjaGFuZ2UgdGhlIEFLSSBmaWVsZCB0byBtYWtlIGNoYWluIGJ1aWxkaW5nIGJldHRlciBvciBh cmUgeW91IGdvaW5nIHRvIGNhdXNlIG5vbi1zdXBwb3J0aW5nIHN5c3RlbXMgdG8gcG90ZW50aWFs bHkNCiBzdGFydCBkb3dubG9hZGluZyBsb3RzIG9mIG90aGVyIGNlcnRpZmljYXRlcyBhcyB3ZWxs LiZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iY29sb3I6d2luZG93dGV4dDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5TYW1lIGlzc3VlcyBhcHBseWluZyB0byBDUkwgZGlzdHJpYnV0aW9uIHBvaW50cyDigJMg aXQgd291bGQgcG90ZW50aWFsbHkgYmUgbW9yZSBlZmZpY2llbnQgdG8gaGF2ZSBzZXBhcmF0ZSBD UkxzIHJhdGhlciB0aGFuDQogY29tYmluZWQgb25lcyBhcyB5b3UgY291bGQgbm90IHVzZSB0aGUg ZXh0ZW5zaW9uIGluIHRoYXQgY2FzZS48bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDttc28tbGlzdDpsMSBsZXZlbDEgbGZv MyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Ib3cgaXMgQUlBIGdvaW5nIHRvIHdvcmsuPG86cD48L286cD48 L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7 bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SWYgeW91IHJlcXVpcmUg dGhhdCB0aGUgc2FtZSBhbGdvcml0aG1zIGJlIHVzZWQsIHdoYXQgaGFwcGVucyB3aXRoIE9DU1Ag cmVzcG9uc2VzIGFuZCBkZWxlZ2F0ZWQgQ1JMIGlzc3VlcnM/4oCZPG86cD48L286cD48L3NwYW4+ PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndp bmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2lu ZG93dGV4dCI+SmltPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0 ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQi Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPiBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFu YSkgJmx0OzxhIGhyZWY9Im1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20iPnBrYW1wYW5hQGNpc2Nv LmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBTZXB0ZW1iZXIgMjEsIDIw MTggODowOCBQTTxicj4NCjxiPlRvOjwvYj4gRHIuIFBhbGEgJmx0OzxhIGhyZWY9Im1haWx0bzpt YWR3b2xmQG9wZW5jYS5vcmciPm1hZHdvbGZAb3BlbmNhLm9yZzwvYT4mZ3Q7OyBKaW0gU2NoYWFk ICZsdDs8YSBocmVmPSJtYWlsdG86aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbSI+aWV0ZkBhdWd1c3Rj ZWxsYXJzLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86c3Bhc21A aWV0Zi5vcmciPnNwYXNtQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW2xh bXBzXSBEb3VibGUgc2lnbmF0dXJlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBNYXgsIEppbSw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFncmVlZC4gSW4gc3Vt bWFyeSwgdGhlcmUgYXJlIHRvbyBnb29kIHByb3Bvc2FscyAoRXJpaywgTWF44oCZcykgdGhhdCBj YW4gY29tYmluZSBtdWx0aXBsZSBQS3MgYW5kIFNpZ3MuIFRoYXQgd291bGQgYWxsb3cgdXMgdG8g dXMgbW9yZSB0aGFuIG9uZSBQUSBhbGdvcyBpZiB0aGV5DQogYXJlIG5vdCB0cnVzdGVkLiA8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmRyYWZ0LXRydXNrb3Zza3kt bGFtcHMtcHEtaHlicmlkIGFsbG93cyBmb3IgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkgYnkgZGVm aW5pbmcgb25lIG9ubHkgUFEga2V5IGFuZCBzaWcgYXMgbm9uLWNyaXRpY2FsIGV4dGVuc2lvbnMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHdvbmRlciBpZiB0 aGUgdHdvIGNvbmNlcHRzIGNvdWxkIGJlIG1lcmdlZC4gTWVhbmluZyB1c2UgdGhlIGNvbXBvc2l0 ZSBrZXkgJiM0Mzsgc2lncyBjYW4gbm9uLWNyaXRpY2FsIGV4dGVuc2lvbnMuIE9sZCBjbGllbnRz IGRpc3JlZ2FyZCB0aGUgUFEgZXh0ZW5zaW9ucy4gTmV3IGNsaWVudHMNCiB2ZXJpZnkgdGhlIGNs YXNzaWNhbCAmbmJzcDthbmQgdGhlIFBRIGFsZ29zIGRlZmluZWQgaW4gdGhlIGNvbXBvc2l0ZSBP SUQgY29udGFpbmVkIGluIHRoZSBub24tY3JpdGljYWwgZXh0ZW5zaW9uLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+UGFub3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gU3Bhc20gWzxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3Vu Y2VzQGlldGYub3JnIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvYT5dDQo8Yj5PbiBC ZWhhbGYgT2YgPC9iPkRyLiBQYWxhPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBTZXB0ZW1i ZXIgMjAsIDIwMTggMTo0NCBQTTxicj4NCjxiPlRvOjwvYj4gPGEgaHJlZj0ibWFpbHRvOnNwYXNt QGlldGYub3JnIj5zcGFzbUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFts YW1wc10gRG91YmxlIHNpZ25hdHVyZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5IaSBQ YW5vcywgYWxsLDxvOnA+PC9vOnA+PC9wPg0KPHA+dGhhdCBpcyBjb3JyZWN0IC0gc2luY2UgdGhl IG5ldyBPSURzIGZvciB0aGUgS2V5IGFuZCB0aGUgU2lnbmF0dXJlcyB3b3VsZCBiZSBuZXcsIGNs aWVudHMgd291bGQgZmFpbCBzaW5jZSB0aGV5IGRvIG5vdCBrbm93IHRoZSAmcXVvdDtjb21wb3Np dGUmcXVvdDsgYWxnb3JpdGhtIDpEPG86cD48L286cD48L3A+DQo8cD5BbHRob3VnaCBkZXZlbG9w aW5nIHN1cHBvcnQgZm9yIGl0IHNob3VsZCBub3QgYmUgdG9vIGRpZmZpY3VsdCwgdGhlIHNvbHV0 aW9uIGl0IGlzIG5vdCBtZWFudCB0byBiZSBiYWNrd2FyZCBjb21wYXRpYmxlIGFzIHdlIHdhbnQg YXBwbGljYXRpb25zIHRvIGJlIGFibGUgdG8gZmFpbCBpZiB0aGV5IGRvIG5vdCBldmVuIGtub3cg dGhleSB3ZXJlIHN1cHBvc2VkIHRvIGdlbmVyYXRlIG9yIHZlcmlmeSBtdWx0aXBsZSBzaWduYXR1 cmVzIGluc3RlYWQNCiBvZiBqdXN0IG9uZS48bzpwPjwvbzpwPjwvcD4NCjxwPkZyb20gYSB1c2Fn ZSBwZXJzcGVjdGl2ZSwgSSBhbSBsZWFuaW5nIHRvd2FyZHMgdGhlIG5lZWQgZm9yIHRoZSBvd25l ciBvZiB0aGUgY2VydGlmaWNhdGVzIHRvIGdlbmVyYXRlIHNpZ25hdHVyZXMgd2l0aCBhbGwgdGhl IGtleXMsIGFuZCBmb3IgdGhlIGVudGl0eSB0aGF0IHZhbGlkYXRlcyB0aGUgc2lnbmF0dXJlcyBp dCBzaG91bGQgdmFsaWRhdGUgYWxsIHRoZSBzaWduYXR1cmVzIGl0IHN1cHBvcnRzIGFuZCBtYXkg YWNjZXB0IHNpZ25hdHVyZXMNCiBldmVuIGlmIGl0IGRvZXMgbm90IHVuZGVyc3RhbmQgYWxsIHRo ZSBhbGdvcml0aG1zICh0aGlzIGlzIG1vcmUgYW4gYXBwbGljYXRpb24gZGVjaXNpb24gYmFzZWQg b24gdGhlIHJpc2sgYW5kIHRocmVhdCBtb2RlbCkuPG86cD48L286cD48L3A+DQo8cD5BcyBJIHNh aWQsIHRoaXMgc29sdXRpb24gZml0cyBub3Qgb25seSBjZXJ0aWZpY2F0ZXMsIGJ1dCBhbHNvIE9D U1AgcmVzcG9uc2VzLCBDUkxzLCBDTVMsIFBLQ1MjNywgZXRjLiBhbmQgdGhhdCBpcyBwYXJ0IG9m IHdoYXQgaXMgaW50ZXJlc3RpbmcgZm9yIHVzIDpEIEkgc3RpbGwgbmVlZCB0byBjaGVjayB3aGF0 IGFyZSB0aGUgbmVlZGVkIGNoYW5nZXMgZm9yIG90aGVyIGZvcm1hdHMgbGlrZSBQS0NTIzEvIzgv IzEyIGZvciBzdG9yaW5nIHRoZQ0KIGNvbXBvc2l0ZSBwdWJsaWMgYW5kIHByaXZhdGUga2V5cyAo dGhpcyBwYXJ0IHN0aWxsIG1pc3NpbmcpLCBidXQgSSBob3BlIHRoYXQgc29sdmluZyB0aGF0IHBh cnQgd2lsbCBub3QgYmUgdG9vIGRpZmZpY3VsdC4uLjxvOnA+PC9vOnA+PC9wPg0KPHA+Q2hlZXJz LDxicj4NCk1heDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gOS8yMC8xOCA3OjI2 IEFNLCBQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkhpIE1heCw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VG8gcmVwaHJhc2UgRXJpY+KAmXMgcXVlc3Rp b24sIHdvdWxkIHRoZSBDb21wb3NpdGVLZXkmIzQzO0NvbXBvc2l0ZVNpZyBwcm9wb3NhbCBiZSBi YWNrd2FyZHMgY29tcGF0aWJsZSB3aXRoIGV4aXN0aW5nIHN5c3RlbXM/PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkkgbWVhbiBpdCBnaXZlcyB5b3UgdGhlIGNoYW5nZSB0byB1c2UgbW9yZSB0aGFuIG9uZSBh bGdvcyBpbiBjYXNlIHlvdSBkb27igJl0IHRydXN0IGFsbCBvZiB0aGVtLiBCdXQgYW4gb2xkIGNs aWVudCB3b3VsZG7igJl0IGJlIGFibGUgdG8ganVzdCB1c2UgdGhlIHRyYWRpdGlvbmFsDQoga2V5 JiM0MztzaWcgdW5sZXNzIGhlIHdhcyB1cGdyYWRlZCB0byB1bmRlcnN0YW5kIENvbXBvc2l0ZUtl eSYjNDM7Q29tcG9zaXRlU2lnIGFuZCBpdHMgT0lEcywgcmlnaHQ/PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlBhbm9zPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4w cHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gU3Bhc20gWzwvc3Bhbj48YSBocmVmPSJtYWlsdG86 c3Bhc20tYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5tYWlsdG86c3Bhc20tYm91 bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQi Pl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+RXJpayBBbmRlcnNlbjxicj4NCjxiPlNlbnQ6PC9iPiBG cmlkYXksIFNlcHRlbWJlciAxNCwgMjAxOCAxMTo0OSBBTTxicj4NCjxiPlRvOjwvYj4gJ1NQQVNN JyA8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZsdDtzcGFzbUBpZXRmLm9yZyZndDs8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3 aW5kb3d0ZXh0Ij47IERpcmVjdG9yeSBsaXN0DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBz dGFuZGFyZEBmcmVlbGlzdHMub3JnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZsdDt4NTAwc3RhbmRhcmRA ZnJlZWxpc3RzLm9yZyZndDs8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0 ZXh0Ij48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoZSBkb3VibGUgc2lnbmF0dXJlIGlz IGludGVuZGVkIGFzIGEgbWlncmF0aW9uIHRvb2wuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkluIHRoZSBub3JtYWwg b3BlcmF0aW9uLCBvbmx5IG9uZSBzaWduYXR1cmUgaXMgdXNlZCAodGhlIG5hdGl2ZSBzaWduYXR1 cmUpLiBXaGVuIGl0IGlzIHJlYWxpemVkIHRoYXQgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gd2ls bCBiZSB0b28gd2VlayBpIHNvbWUNCiBmdXR1cmUsIHRoZSBtaWdyYXRpb24gcGVyaW9kIHN0YXJ0 cyBhbmQgYW4gYWx0ZXJuYXRpdmUsIGFzc3VtaW5nIHN0cm9uZ2VyIHNpZ25hdHVyZSBpcyBwcm92 aWRlZCBmb3IgdGhvc2UgYWJsZSB0byBoYW5kbGUgaXQuJm5ic3A7IExlZ2FjeSBzeXN0ZW1zIHdp bGwgaWdub3JlIHRoaXMgYWx0ZXJuYXRpdmUgc2lnbmF0dXJlLiBBZnRlciB0aGUgbWlncmF0aW9u IHBlcmlvZCwgdGhlcmUgd2lsbCBiZSBubyBhbHRlcm5hdGl2ZSBzaWduYXR1cmUgYW5kIHRoZQ0K IG5ldyBzdHJvbmdlciBzaWduYXR1cmUgd2lsbCBiZSB0aGUgbmF0aXZlIHNpZ25hdHVyZS48L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+RG9lcyB0aGF0IG1ha2Ugc2Vuc2U/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkVyaWs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPkZyYTo8L3NwYW4+PC9iPjxz cGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+IE1hc3NpbWlsaWFubyBQ YWxhIFs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOm0ucGFsYUBjYWJsZWxhYnMuY29tIj48c3BhbiBs YW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5tYWlsdG86bS5wYWxhQGNhYmxlbGFicy5jb208L3NwYW4+PC9h PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+XQ0KPGJyPg0KPGI+ U2VuZHQ6PC9iPiAxMiBTZXB0ZW1iZXIgMjAxOCAyMzowMTxicj4NCjxiPlRpbDo8L2I+IFJ1c3Mg SG91c2xleSAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpob3VzbGV5QHZpZ2lsc2VjLmNvbSI+ PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+aG91c2xleUB2aWdpbHNlYy5jb208L3NwYW4+PC9h PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+Jmd0Ozxicj4NCjxi PkNjOjwvYj4gU1BBU00gJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc21AaWV0Zi5vcmci PjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPnNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT48c3Bh biBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPiZndDs7IEVyaWsgQW5kZXJz ZW4NCiAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzplcmFAeDUwMC5ldSI+PHNwYW4gbGFuZz0i REEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6d2luZG93dGV4dCI+Jmd0Ozxicj4NCjxiPkVtbmU6PC9iPiBSZTogW2xhbXBz XSBEb3VibGUgc2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHA+PHNwYW4gbGFuZz0iRU4tR0IiPkhpIFJ1c3MsIGFsbCw8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+bXkgcGVyc29uYWwgcG9zaXRp b24gaXMgdGhhdCB0aGUgc2lnbmVyIE1VU1QgdXNlIGFsbCB0aGUga2V5cyB0aGF0IGhhdmUgZGln aXRhbFNpZ25hdHVyZSBzZXQsIHRoZSB2ZXJpZmllciBzaGFsbCB2ZXJpZnkgYWxsIHRoZSBzaWdu YXR1cmVzIGZvciB3aGljaCBpdCBkb2VzIGhhdmUgc3VwcG9ydCBmb3IuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHA+PHNwYW4gbGFuZz0iRU4tR0IiPlRoZSByYXRpb25hbGUgZm9yIHRoaXMgaXMg dGhhdCBpZiBJIGNlcnRpZnkgYSBwdWJsaWMga2V5IGluIHRoZSBjZXJ0aWZpY2F0ZSwgeW91IHNo b3VsZCBiZSBhYmxlIHRvIHVzZSB0aGUgcHJpdmF0ZSBrZXkgdG8gZ2VuZXJhdGUgdGhlIHNpZ25h dHVyZSwgdGhlcmVmb3JlIHRoZSBhcHByb2FjaCBpcyB0aGUgc2FtZSBhcyB1c3VhbDogc2lnbiB3 aXRoIHlvdXIga2V5LiBJbiB0aGlzIGNhc2UsIGl0IGp1c3QgaGFwcGVucw0KIHRoYXQgdG8gZ2Vu ZXJhdGUgdGhlIHNpZ25hdHVyZSB5b3UgaGF2ZSB0byBnZW5lcmF0ZSBtdWx0aXBsZSBvbmVzIGFu ZCB0aGVuIGNvbWJpbmUgdGhlbSB0b2dldGhlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48 c3BhbiBsYW5nPSJFTi1HQiI+Rm9yIHRoZSBhcHBsaWNhdGlvbiB0aGF0IHZlcmlmaWVzIHRob3Nl IHNpZ25hdHVyZXMsIGl0IGlzIGFsd2F5cyBhIHF1ZXN0aW9uIG9mIHdoYXQgaXMgdGhlIHRocmVz aG9sZCB0aGF0IGlzIGFjY2VwdGFibGUgZm9yIHRoZSBhcHBsaWNhdGlvbiAoaW4gdGVybXMgb2Yg cmlzaykgaW4gY2FzZSBpdCBkb2VzIG5vdCBzdXBwb3J0IGFsbCBvZiB0aGUgYWxnb3JpdGhtcyB0 aGF0IGFyZSB1c2VkIHRvIGdlbmVyYXRlDQogdGhlIGNvbXBvc2l0ZSBzaWduYXR1cmUuIElkZWFs bHkgaXQgd291bGQgdmVyaWZ5IGFsbCwgYnV0IGl0IG1heSBkZWNpZGUgdG8gdmVyaWZ5IGxlc3Mg KGF0IGxlYXN0IG9uZSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHA+PHNwYW4gbGFuZz0iRU4t R0IiPkkgYWxzbyBzYXcgdGhlIG90aGVyIGUtbWFpbCBmcm9tIEppbSBvbiB0aGlzIHRvcGljIGFu ZCBJIHRoaW5rIGl0IGNvdWxkIGJlIGEgZ29vZCBpZGVhIC0gdGhlIHVzZSBvZiB0aGUgdHdvIE9J RHMgaXMgYW5vdGhlciB3YXkgdG8gZ28gdG8gY29kaWZ5IHRoZSB2YWxpZGF0aW9uIHByb2Nlc3Mg cmVxdWlyZWQuIFRlY2huaWNhbGx5LCB0aGF0IG1ha2VzIHNlbnNlIHRvIG1lLCBob3dldmVyIEkg YW0gY29uZmxpY3RlZA0KIGFzIHRoaXMgYXBwcm9hY2ggcmVxdWlyZXMgdGhhdCB0aGUgc2lnbmVy IGhhcyBhbiB1bmRlcnN0YW5kaW5nIG9mIHdoYXQgdGhlIHZlcmlmaWVyJ3MgY2FwYWJpbGl0aWVz IGFyZS4uLiBJIHRoaW5rIHRoYXQgZGVmaW5pbmcgdHdvIE9JRHMgZm9yIHRoZSBzaWduYXR1cmVz IGNvdWxkIHN0aWxsIGJlIHVzZWZ1bCBiZWNhdXNlIHRoZSBzaWduZXIgbWlnaHQgdGhlbiBkZWNp ZGUgdGhlICZxdW90O3JlY29tbWVuZGVkJnF1b3Q7LyZxdW90O2ludGVuZGVkJnF1b3Q7IHZlcmlm aWNhdGlvbg0KIGJlaGF2aW9yLi4uIEkgY2FuIHNlZSBzb21lIHVzZS1jYXNlcyB0aGF0IG1pZ2h0 IGhhdmUgYSBjb21wb3NpdGUga2V5IHdpdGggeyBSU0EsIEVDIH0gYW5kIHRoZSAmcXVvdDtNdXN0 LVZlcmlmeS1BbGwmcXVvdDsgT0lEIGZvciB0aGUgc2lnbmF0dXJlLCBhbmQgYW5vdGhlciB1c2Ut Y2FzZSB3aGVyZSB3ZSBoYXZlIGEgY29tcG9zaXRlIGtleSB3aXRoIHsgUlNBLCBIQVNILUJBU0VE IH0gYW5kIGZvciB0aGUgc2lnbmF0dXJlICZxdW90O011c3QtVmVyaWZ5LUF0LUxlYXN0LU9uZSZx dW90Oy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1HQiI+RG9lcyB0 aGlzIG1ha2Ugc2Vuc2U/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHA+PHNwYW4gbGFuZz0iRU4t R0IiPkNoZWVycyw8YnI+DQpNYXg8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5PbiA5LzEyLzE4 IDY6MTIgQU0sIFJ1c3MgSG91c2xleSB3cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPk1heDogPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkR1cmluZyBhIHRyYW5z aXRpb24gdG8gcXVhbnR1bS1yZXNpc3RhbnQgc2lnbmF0dXJlcywgYSBzaWduZXIgd2FudHMgdG8g cHV0IGEgdHJhZGl0aW9uYWwgc2lnbmF0dXJlIGFuZCBhIHF1YW50dW0tcmVzaXN0YW50IHNpZ25h dHVyZSBvbiBhbiBvYmplY3QuICZuYnNwO0dpdmVuIHlvdXIgZGVzY3JpcHRpb24gb2YmbmJzcDtr ZXlVc2FnZSBhbmQgZXh0ZW5kZWRLZXlVc2FnZSwgYm90aCB3b3VsZCBoYXZlDQogdGhlIGRpZ2l0 YWxTaWduYXR1cmUgYml0IHNldC4gJm5ic3A7SG93IGRvZXMgYSBjbGllbnQga25vdyBpZiBqdXN0 IG9uZSBvciBib3RoIHNpZ25hdHVyZXMgbXVzdCBiZSB2YWxpZD88L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkFzIEppbSBTY2hhYWQgYWxyZWFkeSBzYWlk LCBSRkMmbmJzcDs1NzUyIHRhbGtzIGFib3V0IHRoaXMgaXNzdWUgd2hlbiBhIENNUyBTaWduZWRE YXRhIGNvbnRhaW5zIG1vcmUgdGhhbiBvbmUgU2lnbmVySW5mby48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPlJ1c3M8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIj5PbiBTZXAgMTEsIDIwMTgsIGF0IDQ6NDUgUE0sIE1heCBQYWxhICZsdDs8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOk0uUGFsYUBjYWJsZWxhYnMuY29tIj48c3BhbiBsYW5nPSJF Ti1HQiI+TS5QYWxhQGNhYmxlbGFicy5jb208L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIj4m Z3Q7IHdyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPkhpIEFsbCwNCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgYW0gd29ya2luZyBvbiBhIHNpbWlsYXIgLSBidXQg ZGlmZmVyZW50IC0gc29sdXRpb24sIGluIHBhcnRpY3VsYXIgSSBzb2x2ZSB0aGUgaXNzdWUgb2Yg KGEpIGJlaW5nIGFibGUgdG8gY29tYmluZSBtb3JlIHRoYW4gb25lIHB1YmxpYyBrZXksIChiKSBv bmx5IG9uZSAoYWN0dWFsbHkNCiB0d28pIE9JRHMgcmVxdWlyZWQsIGFuZCAoYykgc2ltcGx5IHRo ZSBwcm9jZXNzaW5nIGJ5IHJlLXV0aWxpemluZyB0aGUgc2FtZSBkYXRhIHN0cnVjdHVyZXMgd2Ug aGF2ZSB0b2RheS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgcGFydGljdWxhciwgSSBkZWZpbmUgYSDigJxj b21wb3NpdGUgcHVibGljIGtleeKAnSBhbmQg4oCcY29tcG9zaXRlIHNpZ25hdHVyZeKAnS48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPlRoZSBmaXJzdCBvbmUgZW5jb2RlcyBpbiB0aGUga2V5IHZhbHVl4oCZcyBC SVRTVFJJTkcgdGhlIERFUiB2YWx1ZSBvZiB0aGUgU0VRVUVOQ0Ugb2YgcHVibGljIGtleXMgKGVh Y2ggb2Ygd2hpY2ggaXMgYSB0aGUgc3ViamVjdFB1YmxpY0tleUluZm8gc3RydWN0dXJlKSBhbmQg dXNlcw0KIGEgc3BlY2lmaWMgT0lEIHRoYXQgaWRlbnRpZmllcyB0aGUgcHVibGljIGtleSB0eXBl LiBUaGUgcGFyYW1ldGVycyBvZiB0aGUgY29tcG9zaXRlS2V5IGFsZ29yaXRobSBjYW4gYmUgdXNl ZCB0byBlbmNvZGUgdGhlIGtleVVzYWdlIGFuZCB0aGUgZXh0ZW5kZWRLZXlVc2FnZSBmb3IgZWFj aCBvZiB0aGUga2V5cyBpbiB0aGUgY29tcG9zaXRlIGtleS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBz YW1lIGFwcHJvYWNoIGlzIHVzZWQgZm9yIHRoZSDigJxDb21wb3NpdGUgU2lnbmF0dXJl4oCdIGNh c2Ugd2hlcmUgdGhlIHZhbHVlIG9mIHRoZSBzaWduYXR1cmUgaXMgdGhlIERFUiByZXByZXNlbnRh dGlvbiBvZiB0aGUgU0VRVUVOQ0Ugb2Ygc2lnbmF0dXJlcyBtYWRlIHdpdGgNCiBlYWNoIG9mIHRo ZSBrZXlzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+QXMgc29vbiBhcyBJIGhhdmUgc29tZSBzcGFyZSB0aW1l LCBJIHdpbGwgc3VibWl0IHRoZSBkcmFmdCAtIG1heWJlIHRoaXMgY291bGQgYmUgZGlzY3Vzc2Vk IGluIEJhbmdrb2s/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIHNpbXBsZSBpZGVhIGFsbG93cyB1cyB0 byBoYXZlIGFsbCB0aGUgb3RoZXIgcHJvY2VkdXJlcyByZWxhdGVkIHRvIFBLSXMgd29yayAtIHRo aXMgbWVhbnMgd2UgY2FuIGNvbWJpbmUgRUNDIHdpdGggUlNBIG9yIHdpdGggYSBRdWFudHVtLVJl c2lzdGFudCBhbGdvcml0aG0NCiAod2hlbiBmaW5hbGx5IGF2YWlsYWJsZSBhbmQgc3RhbmRhcmRp emVkKS4gQSBzdGVwIGZvcndhcmQgZm9yIHRoZSBkZXBsb3ltZW50IG9mIGh5YnJpZC1QS0lzIHdo ZXJlIG11bHRpcGxlIExhZ29zIGZvciBrZXlzIGNhbiBiZSB1c2VkIHRvIGF1dGhlbnRpY2F0ZSBk YXRhLCBjZXJ0cywgcmV2b2NhdGlvbiBkYXRhLCBldGMuLi4gd2UgcGxhbiB0byB1c2UgdGhpcyBp biBvdXIgaW5mcmFzdHJ1Y3R1cmVzIHRvIHByb3ZpZGUgYSB0cmFuc2l0aW9uYWwNCiBwYXRoIGZv ciBwb3N0LVF1YW50dW0gdHJhbnNpdGlvbiBhbmQgdG8gZnVydGhlciBpbXByb3ZlIHRoZSBhbGdv cml0aG0tYWdpbGl0eSBjYXBhYmlsaXR5IG9mIFBLSXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5XaGF0IGRv IHlvdSB0aGluaz88L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLA0KPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj5NYXg8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+LS0tDQo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5DaGVlcnMsDQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk1heDwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9u IFNlcCAxMSwgMjAxOCwgYXQgODozOCBBTSwgVGltIEhvbGxlYmVlayAmbHQ7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzp0aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbSI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj50aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTwvc3Bh bj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDsNCiB3cm90ZTo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5VbmZvcnR1bmF0ZWx5LCDigJxub3Qg ZXZlcnkgY29tYmluYXRpb24gbmVlZHMgdG8gYmUgY292ZXJlZOKAnSBpbnRyb2R1Y2VzIGEgbG90 IG9mIHBvbGl0aWNzIGFyb3VuZCBjaG9vc2luZyB3aGljaCBjb21iaW5hdGlvbnMg4oCcbmVlZCB0 byBiZSBjb3ZlcmVk4oCdLCBhIHN1YmplY3Qgb24gd2hpY2gNCiBpbmV2aXRhYmx5IG5vdCBldmVy eW9uZSBhZ3JlZXMuJm5ic3A7IEkgd291bGQgcmF0aGVyIGF2b2lkIGFsbCB0aG9zZSBkaXNjdXNz aW9ucyBhbmQgdGhlIHVubmVjZXNzYXJ5IHdvcmsgdGhleSByZXByZXNlbnQuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+SSBwZXJzb25hbGx5IGRvbuKAmXQgdGhpbmsgYSBzaW5nbGUgQWxnSUQgd2hpY2ggaW1wbGll cyBhIFNFUVVFTkNFIG9mIEFMRyBJRHMgaXMgYW4gaW1wcm92ZW1lbnQgb3ZlciBhIFNFUVVFTkNF IG9mIEFMRyBJRHMsIG9yIGl0cyBtb3JhbCBlcXVpdmFsZW50LiZuYnNwOyBGb3Igc2ltcGxlDQog aHlicmlkIHVzZSBjYXNlcywgdGhlcmUgaXMgYWxzbyBhIGxvdCBvZiB2YWx1ZSBpbiBoYXZpbmcg dGhlIGNsYXNzaWNhbCBhbGdvcml0aG0gSUQgYmVpbmcgdGhlIHNhbWUgYXMgaXQgdXN1YWxseSBp cywgdG8gYWxsb3cgZWFzaWVyIGludGVyb3BlcmFiaWxpdHkgd2l0aCBvbGRlciBzeXN0ZW1zIHRo YXQgZG9u4oCZdCB1bmRlcnN0YW5kIHRoZSBuZXdlciBhbGdvcml0aG1zIChhbmQgY2FuIGJsaXNz ZnVsbHkgaWdub3JlIHRoZW0pLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi1UaW08L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzow aW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPlNhbnRvc2gNCiBDaG9raGFuaSAmbHQ7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpzYW50b3NoLmNob2toYW5pQGdtYWlsLmNvbSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNhbnRvc2guY2hva2hhbmlAZ21haWwuY29tPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UdWVzZGF5LCBTZXB0ZW1iZXIg MTEsIDIwMTggMTA6MjkgQU08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlRpbSBIb2xsZWJlZWsgJmx0Ozwvc3Bhbj48YSBocmVm PSJtYWlsdG86dGltLmhvbGxlYmVla0BkaWdpY2VydC5jb20iPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6cHVycGxlIj50aW0uaG9sbGViZWVrQGRpZ2ljZXJ0LmNvbTwvc3Bhbj48 L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzsNCiAnRXJpayBBbmRlcnNlbicg Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzsgJ1NQQVNNJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1h aWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpw dXJwbGUiPnNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVs aXN0cy5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxi PlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5SRTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rcyBUaW0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPlRoZXJlIGFyZSB3YXlzIHRvIGFjY29tbW9kYXRlIHlvdXIgY29u Y2Vybi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+T25lIHdheSB0 byBoYW5kbGUgdGhpcyBpcyBkZWZpbmluZyBhIHNpbmdsZSBBbGcgSUQgQSB3aGljaCBpbXBsaWVz IGEgU0VRVUVOQ0Ugb2YgQUxHIElEcyBhbmQgZGVmaW5lIHRoZSByZWx5aW5nIHBhcnR5IHJ1bGVz IGluIHRlcm1zIG9mIGl0cyBhYmlsaXR5DQogdG8gcHJvY2VzcyBvbmUgb3IgYWxsIEFMRyBJRHMu PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFub3RoZXIgd2F5IHRv IGRvIHRoaXMgaXMgbm90IGV2ZXJ5IGNvbWJpbmF0aW9uIG5lZWRzIHRvIGJlIGNvdmVyZWQgYW5k IHRoZSB1c2VyIGNvbW11bml0eSBkZWZpbmVzIGl0cyBvd24gJm5ic3A7QWxnIElEIFhpIHdoaWNo IG1hcHMgdG8gYSBTRVFVRU5DRSBvZg0KIEFMRyBJRHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUx RTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9i PjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+U3Bhc20NCiBbPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3Jn Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+bWFpbHRvOnNwYXNt LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi Pl08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24N CiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PC9iPlRpbSBIb2xsZWJlZWs8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VHVlc2RheSwgU2VwdGVtYmVyIDExLCAyMDE4 IDEwOjAzIEFNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj5FcmlrIEFuZGVyc2VuICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRv OmVyYUB4NTAwLmV1Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+ ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7 DQogJ1NQQVNNJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3JnPC9z cGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRv Ong1MDBzdGFuZGFyZEBmcmVlbGlzdHMub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOnB1cnBsZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBzXSBEb3VibGUg c2lnbmF0dXJlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Eb2VzbuKAmXQgdGhlIGNv bWJpbmF0b3JpYyBleHBsb3Npb24gcmVuZGVyIHRoaXMgY29tcGxldGVseSBpbXByYWN0aWNhbD88 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Zb3UgbmVlZCBOX2MgeCBOX3BxIGFsZ29yaXRobSBpZGVudGlmaWVycyBq dXN0IHRvIGhhbmRsZSB0aGUgc2ltcGxlIGh5YnJpZCB1c2UgY2FzZSB3aGVyZSBhIHNpbmdsZSBj bGFzc2ljYWwgYWxnb3JpdGhtIGlzIGJlaW5nIHVzZWQgaW4gY29uanVuY3Rpb24gd2l0aCBhIHNp bmdsZQ0KIHBvc3QtcXVhbnR1bSBhbGdvcml0aG0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QW5kIHRoZXJlIGFy ZSBwZW9wbGUgd2hvIHdhbnQgdG8gdXNlIG11bHRpcGxlIHBvc3QtcXVhbnR1bSBhbGdvcml0aG1z IHRvIGhlZGdlIGFnYWluc3QgcG90ZW50aWFsIHlldCB0byBiZSBkaXNjb3ZlcmVkIHdlYWtuZXNz ZXMgaW4gcG9zdC1xdWFudHVtIGFsZ29yaXRobXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SeKAmW0gbm90IHJl YWxseSBsb29raW5nIGZvcndhcmQgdG8gdHJ5aW5nIHRvIGFsbG9jYXRlIG9yIG1hbmFnZSBPKE5f YyB4IE5fcHFeMykgYWxnb3JpdGhtIGlkZW50aWZpZXJz4oCmPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+LVRpbTwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1 ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAw aW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+U3Bhc20NCiAmbHQ7PC9zcGFuPjxh IGhyZWY9Im1haWx0bzpzcGFzbS1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0KIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+RXJpayBBbmRlcnNlbjxicj4N CjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5UdWVzZGF5LCBTZXB0ZW1iZXIgMTEsIDIwMTggMzoxMCBBTTxicj4NCjxiPlRvOjwvYj48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+J1NQQVNNJyAm bHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpzcGFzbUBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPnNwYXNtQGlldGYub3JnPC9zcGFuPjwvYT48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOng1MDBzdGFuZGFy ZEBmcmVlbGlzdHMub3JnIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBs ZSI+eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdC IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW2xhbXBzXSBEb3VibGUgc2lnbmF0dXJlczwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhpIFNhbnRvc2gsPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPllvdSBoYXZlIHByb3Bvc2Vk IHNvbWV0aGluZyBsaWtlIHRoaXMgYmVmb3JlLiBJdCBzdGlsbCBwdXp6bGluZyBpbiBteSBicmFp bi4gQXMgSSB1bmRlcnN0YW5kLCBpdCByZXF1aXJlcyB0aGF0IHdlIGRlZmluZSBhIHBhcnRpY3Vs YXIgYWxnb3JpdGhtIHRoYXQNCiBoYXMgYSBwYXJhbWV0ZXIgdGhhdCBpbmNsdWRlcyB0aGUgdGhp bmdzIHlvdSBzdWdnZXN0LiBJdCBpcyB3b3J0aHkgdG8gYmUgYW5hbHlzZWQuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkVyaWs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0Ux RTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5GcmE6PC9zcGFuPjwvYj48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBsYW5nPSJEQSIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNwYXNt DQogWzwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4g bGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPm1haWx0bzpzcGFzbS1ib3VuY2VzQGll dGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5dPHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPlDDpQ0KIHZlZ25lIGFmPHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5TYW50b3No IENob2toYW5pPGJyPg0KPGI+U2VuZHQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj4xMCBTZXB0ZW1iZXIgMjAxOCAxOToxODxicj4NCjxiPlRpbDo8 L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPidKaW0g U2NoYWFkJyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzppZXRmQGF1Z3VzdGNlbGxhcnMuY29t Ij48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aWV0ZkBhdWd1c3RjZWxs YXJzLmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jmd0OzsNCiAnUnlh biBTbGVldmknICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnJ5YW4taWV0ZkBzbGVldmkuY29t Ij48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+cnlhbi1pZXRmQHNsZWV2 aS5jb208L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJt YWlsdG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxl Ij5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0K PGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj4nU1BBU00nICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48c3Bh biBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8L3NwYW4+ PC9hPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86eDUwMHN0 YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIGxhbmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVy cGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iREEi IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PGJyPg0KPGI+RW1uZTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJsZSBzaWduYXR1cmVzPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+V2h5IG5vdCBsZXQgYWxnb3Jp dGhtIGlkZW50aWZpZXIgZGljdGF0ZSB0aGUgbnVtYmVyIG9mIHNpZ25hdHVyZXMgYW5kIHRoZWly IHN5bnRheD88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBp biAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwv c3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TcGFzbQ0KIFs8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6cHVycGxlIj5tYWlsdG86c3Bhc20tYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48 L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0KIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+SmltIFNjaGFhZDxicj4NCjxi PlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5Nb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCAxOjA3IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4nUnlhbiBTbGVldmkn ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnJ5YW4taWV0ZkBzbGVldmkuY29tIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+cnlhbi1pZXRmQHNsZWV2aS5jb208 L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWls dG86ZXJhQHg1MDAuZXUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxl Ij5lcmFAeDUwMC5ldTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj4nU1BBU00nICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtQGlldGYub3JnIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+c3Bhc21AaWV0Zi5vcmc8 L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWls dG86eDUwMHN0YW5kYXJkQGZyZWVsaXN0cy5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6cHVycGxlIj54NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZzwvc3Bhbj48L2E+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbbGFtcHNdIERvdWJs ZSBzaWduYXR1cmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlJ5YW4sPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+VGhlIGRpc2N1c3Npb24gaW4gTG9uZG9uIGRlYWx0IHdpdGggYSBjb21wbGV0ZWx5IGRp ZmZlcmVudCBwcm9wb3NhbCB0aGFuIHRoaXMgb25lLiZuYnNwOyBXaGlsZSBJIHRoaW5rIHRoZXJl IGFyZSBwcm9ibGVtcyB3aXRoIHRoaXMgdGhhdCBuZWVkIHRvIGJlIGRlYWx0IHdpdGggdGhleQ0K IGFyZSBtb3N0bHkgbm90IHRoZSBzYW1lIHNldC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5FcmlrLDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPldoeSBpcyB0aGlzIGNvbnNpZGVyZWQgdG8gYmUgYSBwcmVmZXJyZWQgc29sdXRpb24g dG8gZGVmaW5pbmcgYSBuZXcgc2lnbmF0dXJlIGFsZ29yaXRobSB3aGljaCBjb250YWlucyBhcyB0 aGUgcGFyYW1ldGVyIHRoZSBzZXF1ZW5jZSBvZiBhbGdvcml0aG0gaWRlbnRpZmllcnMgYW5kDQog YXMgdGhlIHNpZ25hdHVyZSB2YWx1ZSBhIHNlcXVlbmNlIG9mIHNpZ25hdHVyZSB2YWx1ZXMuJm5i c3A7IFRoZSBwcm9ibGVtIHdpdGgganVzdCBkZWZpbmluZyB0aGUgZXh0ZW5zaW9uIHRvIFNJR05F RCBpcyB0aGF0IG9uZSBuZWVkcyB0byBtYWtlIHN1cmUgdGhhdCB0aGUgc2V0IG9mIHNpZ25hdHVy ZSBhbGdvcml0aG1zIGFuZCBwYXJhbWV0ZXJzIGFyZSBhbHNvIHBhcnQgb2YgdGhlIGRhdGEgdG8g YmUgc2lnbmVkIGFuZCBJIGFtIG5vdCBzZWVpbmcgdGhhdA0KIGhpZ2hsaWdodGVkIGhlcmUuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+SmltPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVl IDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluO2JvcmRlci10b3AtY29sb3I6cmdiKDIyNSwNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgMjI1LCAyMjUpIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5T cGFzbQ0KICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnNwYXNtLWJvdW5jZXNAaWV0Zi5vcmci PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5zcGFzbS1ib3VuY2Vz QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uDQogQmVo YWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwv Yj5SeWFuIFNsZWV2aTxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5Nb25kYXksIFNlcHRlbWJlciAxMCwgMjAxOCA4OjUzIEFN PGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVyYUB4NTAwLmV1Ij48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+ZXJhQHg1MDAuZXU8L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U1BBU00gJmx0Ozwvc3Bhbj48YSBocmVm PSJtYWlsdG86c3Bhc21AaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6cHVycGxlIj5zcGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Jmd0Ozs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp4NTAwc3RhbmRhcmRAZnJlZWxpc3RzLm9yZyI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPng1MDBzdGFuZGFyZEBm cmVlbGlzdHMub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+ DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+UmU6IFtsYW1wc10gRG91YmxlIHNpZ25hdHVyZXM8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+T24gTW9uLCBTZXAgMTAsIDIwMTgg YXQgMTA6NTYgQU0gRXJpayBBbmRlcnNlbiAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzplcmFA eDUwMC5ldSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmVyYUB4 NTAwLmV1PC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mZ3Q7DQogd3Jv dGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQ7bWFyZ2luLWJvdHRvbTo1Li4wcHQ7 Ym9yZGVyLWxlZnQtY29sb3I6cmdiKDIwNCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDIwNCwgMjA0KSI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJEQSIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5IaSBGb2xrLDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkRBIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkluIElUVS1UIHdlIGhhdmUgcGxhbnMgdG8gYWxsb3cgZm9yIGRvdWJsZSBzaWduYXR1cmVzIHVz aW5nIHRoZSBTSUdORUQgcGFyYW1ldHJpemVkIGRhdGEgdHlwZSBkZWZpbmVkIGluIFguNTA5IHRv IGNvcGUgd2l0aCBzaXR1YXRpb24gYXMgZGVzY3JpYmVkIGluIHRoZSBpbnRlcm5ldA0KIGRyYWZ0 OiDigJxNdWx0aXBsZSBQdWJsaWMtS2V5IEFsZ29yaXRobSBYLjUwOSBDZXJ0aWZpY2F0ZXMgKGRy YWZ0LXRydXNrb3Zza3ktbGFtcHMtcHEtaHlicmlkLXg1MDktMDEp4oCdPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ V2Ugc3VnZ2VzdCB0byBlbmhhbmNlIHRoZSBTSUdORUQgZGF0YSB0eXBlIGFzIHNob3duIGJlbG93 Ojwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3IFw7JnF1b3Q7Ij5TSUdORUR7VG9CZVNpZ25lZH0gOjo9IFNFUVVFTkNFIHs8L3NwYW4+PC9i PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyBDT01QT05FTlRTIE9GIFNJR05BVFVSRSw8 L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcgXDsmcXVvdDsiPiZuYnNwOyAuLi4uLi4uPC9zcGFuPjwv Yj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyBcOyBcO2NvbG9yXDpcI0MwMDAwMCZxdW90OyI+LDwvc3Bhbj48 L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyBcOyBjb2xvclw6IHJlZCZxdW90OyI+Jm5ic3A7IGFsdEFsZ29yaXRo bUlkZW50aWZpZXImbmJzcDsgQWxnb3JpdGhtSWRlbnRpZmllcnt7U3VwcG9ydGVkQWxnb3JpdGht c319IE9QVElPTkFMLDwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyBjb2xvclw6IHJlZCZxdW90 OyI+Jm5ic3A7IGFsdFNpZ25hdHVyZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBCSVQgU1RSSU5HIE9QVElPTkFMJm5ic3A7 PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7IGNvbG9yXDogcmVkJnF1b3Q7Ij4mbmJzcDsmbmJz cDs8L3NwYW4+PC9iPjxiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij59PC9zcGFuPjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyBcO2Nv bG9yXDpyZWQmcXVvdDsiPiZuYnNwOzwvc3Bhbj48L2I+PC9zcGFuPjxiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 IFw7JnF1b3Q7O2NvbG9yOnJlZCI+KFdJVEgNCiBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRo bUlkZW50aWZpZXIgUFJFU0VOVCwgYWx0U2lnbmF0dXJlIFBSRVNFTlQgfSB8PC9zcGFuPjwvYj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3IFw7IGNvbG9yXDogcmVkJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgV0lUSCBDT01QT05FTlRTIHsuLi4sIGFsdEFsZ29yaXRobUlkZW50aWZpZXIgQUJTRU5ULCZu YnNwOyBhbHRTaWduYXR1cmUgQUJTRU5UIH0gKTwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyBcOyZx dW90OyI+Jm5ic3A7PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldlIGFyZSBv cGVuIHRvIGNvbW1lbnRzLiBXZSBrbm93IHRoYXQgSUVURiBpcyBub3QgYSBoZWF2eSB1c2VyIG9m IHRoaXMgZGF0YSB0eXBlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldlIGhhdmUgbm8gaW50ZW50aW9uIHRvIHVz ZSB0aGlzIGV4dGVuZGVkIGRhdGEgdHlwZSBmb3IgY2VydGlmaWNhdGVzIGFuZCBDUkxzLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkZvciB5b3VyIGluZm9ybWF0aW9uLCBTSUdOQVRVUkUgaXMgZGVmaW5lZCBhczo8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyBcOyZxdW90OyI+U0lHTkFUVVJFIDo6PSBTRVFVRU5DRSB7PC9zcGFuPjwvYj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3IFw7JnF1b3Q7Ij4mbmJzcDsgYWxnb3JpdGhtSWRlbnRpZmllciZuYnNwOyBBbGdvcml0aG1J ZGVudGlmaWVye3tTdXBwb3J0ZWRBbGdvcml0aG1zfX0sPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 IFw7JnF1b3Q7Ij4mbmJzcDsgc2lnbmF0dXJlJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEJJVCBTVFJJTkcsPC9zcGFuPjwv Yj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3IFw7JnF1b3Q7Ij4mbmJzcDsgLi4uLi4uLiB9PC9zcGFuPjwvYj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbSB0aGUgZGlzY3Vzc2lvbnMgaW4gTG9uZG9uICgxMDEpLCB0aGVyZSB3ZXJlIGEgbnVtYmVy IG9mIGNoYWxsZW5nZXMgaWRlbnRpZmllZCBkdXJpbmcgdGhlIGRpc2N1c3Npb24gLSZuYnNwOzwv c3Bhbj48YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTAxL21h dGVyaWFscy9taW51dGVzLTEwMS1sYW1wcy0wMS50eHQiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6cHVycGxlIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcv MTAxL21hdGVyaWFscy9taW51dGVzLTEwMS1sYW1wcy0wMS50eHQ8L3NwYW4+PC9hPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+LQ0KIHRo YXQgZnVuZGFtZW50YWxseSBxdWVzdGlvbmVkIHRoYXQgYXBwcm9hY2guPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SGFzIHRoZSBJVFUtVCBhZGRyZXNzZWQgb3Ig cmVzb2x2ZWQgdGhvc2UgY29uY2VybnM/IEFyZSB0aGV5IG5vdCBhcHBsaWNhYmxlIGZvciBzb21l IHJlYXNvbiBzcGVjaWZpYyB0byBJVFUtVD8mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KU3Bhc20gbWFpbGluZyBsaXN0PGJy Pg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpTcGFzbUBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5TcGFzbUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vc3Bhc208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+LS0gPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+QmVzdCBSZWdhcmRz LCA8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tYm90dG9tOjcuNXB0 Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5NYXNzaW1pbGlhbm8g UGFsYSwgUGguRC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxpbWcgYm9yZGVyPSIwIiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjE4IiBpZD0iUGljdHVy ZV94MDAyMF8xIiBzcmM9ImNpZDppbWFnZTAwMS5wbmdAMDFENDUzRjkuMzlENTlERDAiIGFsdD0i Q2FibGVMYWJzIj48c3BhbiBsYW5nPSJFTi1HQiI+PGJyPg0KUHJpbmNpcGFsIEFyY2hpdGVjdDxi cj4NClNlY3VyaXR5IFNlcnZpY2VzLCBSJmFtcDtEPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEy LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cHJlPl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3ByZT4NCjxwcmU+U3Bhc20gbWFp bGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFpbHRvOlNwYXNtQGll dGYub3JnIj5TcGFzbUBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48YSBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NwYXNtPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8 L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_-- --_004_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=1892; creation-date="Mon, 24 Sep 2018 15:26:47 GMT"; modification-date="Mon, 24 Sep 2018 15:26:47 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAHgAAAASCAQAAAA6AtJlAAAAAmJLR0QA/4ePzL8AAAcdSURBVFjD ldh5kFXVEQbw35sFkGEUEAwRog0SdiIuQaIpzYhKEVHBKG5AMJZKpSyMiQo4iEsZoyZYkUSr2FxB IC5BWbIoRpkgSxEhWhoTUE90ICGyCDjINvPyx7x5zAyD4HlVr+r26dvd3z3dX/e9GQJJtNLTINfo odpqsyyzLn3uCFa0N1wre8xJm5rYLTTIyYq9nNYexk5fV3s0VTqiFcWu0t6MtN1XWkVq4Z5rgvNy skJnOAML4pG0JKTD2ehokuPss1QTgBUb4SpsdRjATjbeHxwhYM2NdYoXfEXABSGJIX6Xh3tgXWR+ DE7icDb2q8IO+5vczaoCXzi8HYew0bTdnbarOcJ8QFwSd0frgiTOMcuxqLHE1Y7X2Q1WglYWR6eE aAQ7jshFg5VpeieOMNwmtDNfupuPOYQkynRyjDuLopVyx2C/O9Ivc7rTY7oRpmkua7lvkBC9jdZf oe2e8lKUutQeG9Kr+SdeGL2N01nG//zaaruiidATmejtx3pqZru5FtuckzcJNYkiXWKgk/zHCmtV RTsneU91HvLxcYb+qr1prY25eySKnRRXqvGsD9X4us06iiLdnQ/Gp8l1jkNiVvxbd/sVxwnpY2KC CUpzcXzfPE+bijfVAW7mJiMV566GmRfl6YM4OPyj3WOMFjnRYCvi/rQgNQ01k7LRy+1+mBcvigd1 8qwyK1Ftf9zsFifmdj+KOR5OW0ISzd1hEpholLlec7Fq04pytftmmlxLX/X+K1Tk3U933YGkxBVO AzvzklKjFTTQ6B6Xp/X1ISdY4OwGyAZ4Jq5If2oMOAf3Mo9p70kLbdBWf+X6W4q9yNrnGWXW+IX3 0M3N7jA4hqSNGGCSF03R1gRzYln6JOYotq3IKPDsodOKuM21Mtjr9x51olv11vWgGs3YbZ6ndDNO yOjn1ri5kaX7nI2sSo9Y5XrDtHKMh+O7adtBkLMx3GxfGJpeyokWx1xv+UHuqkYHHfw5DcpdV5gZ TxhtVgxOe5SpNC6tJ6rNM9GNaScU6AXec2i4pc5TiErfSVemijQr9XN3E4qrRRqd/pKmpi5m5k75 eNl6lvq4HXvcl05Ik1NFGqWHNejlJ034bWGkInekl2rpJ4T0vsH21lN6LQ06QKiRSdear8xwtFfg KPBHXXPJTT4Ja76UJLtit9vTW3VcmH7uH420dpqUNkUdV97oPbTWs4HlkQrxmeIoj4kxMSYa6S21 +gevb+prQ/ptXTEkSWRUmFqPpW+qleeqPotJKIsiixzv8biQtDdtqI2sdvD4m9PQxxuHTOlSLbHb q7Vpn+PAF5U30Npi1YFKTTXxil7omD/hLI6VwXFuO8hHSbSsnwvga9r5a/1SCykbvJ0fkD6ytRFD UGmrHlp63VxXmh+fme6utC/lT3gWGEE6VEfLyqDGngaktqOJUaD++iIXVMOpK4OMwga/g/XqABXZ Vr/UUq2X3XnB7saDSlBjr0KZtMsoIzxlvwlWR6cDo+XrtVwZ49MDqX5bEqdoo0YzO+xCc30ty+1k UtbQRuG10cfSfK/lTPBpntsz+ExWxmaz7crJs/Yj44u0KzKNLO7wuW4NyTTIaJcvwxO0tKURt5do b4U9pH1mmx3tPeBHprqw1k6RdV52Me6LZuneuhOMZm50ryw2GqBSZyXujaG1TJeycYH+jcI7xi2x PO3LDSmX5ZrP+w1a1Rr7NHO05WleHsIAWcVNTuGf+Ei/6JrWNyi2QiPygEuc54kDhxQSlyu0VGmc KaUPSZ/Gg852el2mFKQqD9mGQvfE2hgSbeO4uMYaU7TWRhsD0+dWqcG5lsa3o2W0irHmN5GEQy2N PnFUtIv7zaltI1L97p2etB7NPBM/jVbRMk6NlZZboUKzxgMoqdJKReZEQYOkfi43AdSux2Ng/pAk 0cWv/NdrOlvigZxOteoDzF4U0rIYaYYOONmCRsx7RdqEu5Q5Ff2sUpM7syolDXRrMMA7+X2q/CZV RfMGFX6O9x2r2GST6907Ps/5raNj/v6scj0M9E6M8a49CnUw2RAbdMw9nF32eyVutNBOWaUxyJOq jEt/JzYpi2GWKHCp7mbWlUZREtKiGKbckEYntshDaWkgVcVQM3MjaG0475rpYZSiUAm2e9719Rrd FmMtAS1BC0LaHIM95vQGfu7xaKrJvarOyL1bwVHKXWSCckuttENz/bXwkEpTFMo42kY/c6dp1vlY Vkc9bTQ2vRASF3nD8yoUOUuFW+tSOpP/AFCij4tdqpsa/zTHK95NVfXm2lJnu8EFmltrioWKjbHL B+n5aOcyrWw21/fcYqAC75pqYUoEhc73LcUWpLdznto6y3XOU+JfZlhgXaoOSfQ1tMFLZLElVinS xTmG6Wy7xRZ4R1dXmWaT4Uo8rYUBLnGWQuu84PVUmesxGT2MMdBmczyXttbxwP8BZwCMHYT3svkA AAAASUVORK5CYII= --_004_dfbe86d8bc414ca19f707830bb43db58XCHALN010ciscocom_-- From nobody Mon Sep 24 13:41:42 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 916E2130F8E for ; Mon, 24 Sep 2018 13:41:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M5kkIdbor7wq for ; Mon, 24 Sep 2018 13:41:38 -0700 (PDT) Received: from esa1.isaracorp.com (esa1.isaracorp.com [207.107.152.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32FA0130E60 for ; Mon, 24 Sep 2018 13:41:37 -0700 (PDT) Received: from unknown (HELO V0501WEXGPR02.isaracorp.com) ([10.5.9.20]) by ip1.isaracorp.com with ESMTP; 24 Sep 2018 20:41:37 +0000 Received: from V0501WEXGPR01.isaracorp.com (10.5.8.20) by V0501WEXGPR02.isaracorp.com (10.5.9.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1466.3; Mon, 24 Sep 2018 16:41:36 -0400 Received: from V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba]) by V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba%7]) with mapi id 15.01.1466.003; Mon, 24 Sep 2018 16:41:36 -0400 From: Daniel Van Geest To: Russ Housley , SPASM Thread-Topic: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-01.txt Thread-Index: AQHUU4TYSmMGfk6iMkO5uooRYUz8SKT+psmAgAGkvQA= Date: Mon, 24 Sep 2018 20:41:36 +0000 Message-ID: References: <153773828944.29214.3317396448213914064@ietfa.amsl.com> In-Reply-To: Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.5.17.159] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-01.txt X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Sep 2018 20:41:41 -0000 SGkgUnVzcywNCg0KQ29tbWVudHMgb24geW91ciByZWNlbnQgY2hhbmdlczoNCg0KCSAgIFRoZSBw dWJsaWMga2V5IHZhbHVlIGlzIGFuIE9DVEVUIFNUUklORy4gIExpa2UgdGhlIHNpZ25hdHVyZSBm b3JtYXQsCQ0KIAkgICBpdCBpcyBkZXNpZ25lZCBmb3IgZWFzeSBwYXJzaW5nLiAgVGhlIHZhbHVl IGlzIGEgbGVuZ3RoLCBMLCBmb2xsb3dlZAkNCiAJICAgYnkgdGhlIHB1YmxpYyBrZXkgaXRzZWxm Lg0KDQpMIGlzIHRoZSBudW1iZXIgb2YgbGV2ZWxzIChpbiB0aGUgcHJpdmF0ZSBrZXkgJiB0aHVz IHRoZSBzaWduYXR1cmUpLCBub3QgYSBsZW5ndGguDQoNCg0KVGhlIHNpZ25hdHVyZSBmb3JtYXQg aXMgc3RpbGwgb2ZmOg0KDQoJICAgVGhlIGVsZW1lbnRzIG9mIHRoZSBIU1Mgc2lnbmF0dXJlIHZh bHVlIGZvciBhIHRyZWUgd2l0aCBOc3BrIGxldmVscw0KCSAgIGNhbiBiZSBzdW1tYXJpemVkIGFz Og0KDQpJbiBbSEFTSFNJR10sIEwgaXMgdGhlIG51bWJlciBvZiBsZXZlbHMuICBOc3BrIGlzIEwg LSAxLiAgSWYgeW91IGtlZXAgdGhlIHVwZGF0ZWQgaW5kZXhpbmcgb2YgdGhlIHNpZ25lZF9wdWJs aWNfa2V5IGFycmF5IGluIHRoZSBzaWduYXR1cmUsIHRoZW4gdGhlIGFib3ZlIHNlbnRlbmNlIHNo b3VsZCBiZToNCg0KCSAgIFRoZSBlbGVtZW50cyBvZiB0aGUgSFNTIHNpZ25hdHVyZSB2YWx1ZSBm b3IgYSB0cmVlIHdpdGggTnNwayArIDEgbGV2ZWxzDQoJICAgY2FuIGJlIHN1bW1hcml6ZWQgYXM6 DQoNCg0KVGhhbmtzLA0KRGFuaWVsDQoNCg0KDQrvu79PbiAyMDE4LTA5LTIzLCAxMTozNSBQTSwg IlNwYXNtIG9uIGJlaGFsZiBvZiBSdXNzIEhvdXNsZXkiIDxzcGFzbS1ib3VuY2VzQGlldGYub3Jn IG9uIGJlaGFsZiBvZiBob3VzbGV5QHZpZ2lsc2VjLmNvbT4gd3JvdGU6DQoNCiAgICBUaGlzIHVw ZGF0ZSBkb2VzIG5vdCBhZGRyZXNzIHRoZSBmaXJzdCBjb21tZW50IGluIERhbmllbCdzIG1lc3Nh Z2UsIGJ1dCBpdCBkb2VzIGFkZHJlc3MgdGhlIHJlc3Qgb2YgdGhlbS4gIFlvdSBjYW4gc2VlIGhp cyBjb21tZW50cyBoZXJlOg0KICAgIA0KICAgIAlodHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL3NwYXNtL3RHVHJBU1FYTkVLMDNTTDNfTXYzc2ZnN1FZYw0KICAgIA0KICAgIEkg d291bGQgbGlrZSB0byBoZWFyIGZyb20gb3RoZXJzIG9uIHRoaXMgbGlzdCBiZWZvcmUgSSBhZGRy ZXNzIGhpcyBmaXJzdCBjb21tZW50Lg0KICAgIA0KICAgIFJ1c3MNCiAgICANCiAgICANCiAgICA+ IE9uIFNlcCAyMywgMjAxOCwgYXQgNTozMSBQTSwgaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnIHdy b3RlOg0KICAgID4gDQogICAgPiANCiAgICA+IEEgTmV3IEludGVybmV0LURyYWZ0IGlzIGF2YWls YWJsZSBmcm9tIHRoZSBvbi1saW5lIEludGVybmV0LURyYWZ0cyBkaXJlY3Rvcmllcy4NCiAgICA+ IFRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIExpbWl0ZWQgQWRkaXRpb25hbCBNZWNo YW5pc21zIGZvciBQS0lYIGFuZCBTTUlNRSBXRyBvZiB0aGUgSUVURi4NCiAgICA+IA0KICAgID4g ICAgICAgIFRpdGxlICAgICAgICAgICA6IFVzZSBvZiB0aGUgSFNTL0xNUyBIYXNoLWJhc2VkIFNp Z25hdHVyZSBBbGdvcml0aG0gaW4gdGhlIENyeXB0b2dyYXBoaWMgTWVzc2FnZSBTeW50YXggKENN UykNCiAgICA+ICAgICAgICBBdXRob3IgICAgICAgICAgOiBSdXNzIEhvdXNsZXkNCiAgICA+IAlG aWxlbmFtZSAgICAgICAgOiBkcmFmdC1pZXRmLWxhbXBzLWNtcy1oYXNoLXNpZy0wMS50eHQNCiAg ICA+IAlQYWdlcyAgICAgICAgICAgOiAxNA0KICAgID4gCURhdGUgICAgICAgICAgICA6IDIwMTgt MDktMjMNCiAgICA+IA0KICAgID4gQWJzdHJhY3Q6DQogICAgPiAgIFRoaXMgZG9jdW1lbnQgc3Bl Y2lmaWVzIHRoZSBjb252ZW50aW9ucyBmb3IgdXNpbmcgdGhlIHRoZSBIU1MvTE1TDQogICAgPiAg IGhhc2gtYmFzZWQgc2lnbmF0dXJlIGFsZ29yaXRobSB3aXRoIHRoZSBDcnlwdG9ncmFwaGljIE1l c3NhZ2UgU3ludGF4DQogICAgPiAgIChDTVMpLiAgVGhlIEhTUy9MTVMgYWxnb3JpdGhtIGlzIG9u ZSBmb3JtIG9mIGhhc2gtYmFzZWQgZGlnaXRhbA0KICAgID4gICBzaWduYXR1cmU7IGl0IGlzIGRl c2NyaWJlZCBpbiBbSEFTSFNJR10uDQogICAgPiANCiAgICA+IA0KICAgID4gVGhlIElFVEYgZGF0 YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgPiBodHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWxhbXBzLWNtcy1oYXNoLXNpZy8NCiAg ICA+IA0KICAgID4gVGhlcmUgYXJlIGFsc28gaHRtbGl6ZWQgdmVyc2lvbnMgYXZhaWxhYmxlIGF0 Og0KICAgID4gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtbGFtcHMtY21z LWhhc2gtc2lnLTAxDQogICAgPiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1s L2RyYWZ0LWlldGYtbGFtcHMtY21zLWhhc2gtc2lnLTAxDQogICAgPiANCiAgICA+IEEgZGlmZiBm cm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBhdDoNCiAgICA+IGh0dHBzOi8v d3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLWxhbXBzLWNtcy1oYXNoLXNpZy0w MQ0KICAgID4gDQogICAgPiANCiAgICA+IFBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBj b3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Npb24NCiAgICA+IHVudGls IHRoZSBodG1saXplZCB2ZXJzaW9uIGFuZCBkaWZmIGFyZSBhdmFpbGFibGUgYXQgdG9vbHMuaWV0 Zi5vcmcuDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCiAgICBTcGFzbSBtYWlsaW5nIGxpc3QNCiAgICBTcGFzbUBpZXRmLm9yZw0KICAg IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Bhc20NCiAgICANCg0K From nobody Wed Sep 26 09:59:06 2018 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 759A9130EFA for ; Wed, 26 Sep 2018 09:59:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vl5KR9qJT9Bz for ; Wed, 26 Sep 2018 09:59:02 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3986130DF3 for ; Wed, 26 Sep 2018 09:59:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=24356; q=dns/txt; s=iport; t=1537981142; x=1539190742; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=Kd+ZmTw1zJ7Om4lzbzxNVDpTaVQOMbonhd1d16yrvMA=; b=CCCjnEPI8HiBHWObU2Yiqp6/nRG9kPUvZRMQHaSxlCJix3Kf6lzB3yS0 ceTMAsgnpr0si0+6AtG0UlKzxNO1b3say//7DB2ImdZeLnQQptXvBvsaY XkkOryETFIUmG3W7lvivQXQQnnO+Qr9s0s5hLJlYaa2e+vL3CR16gOyjl 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AGAACVuatb/4gNJK1bGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUYEXSC9lfygKi3+OPpZPgXoLJ4RFAoN9ITQYAQMBAQI?= =?us-ascii?q?BAQJtHAyFOAEBAQEDLUwQAgEIDgMEAQEhBwcyFAkIAQEEDgUIgxqBHWQPpHG?= =?us-ascii?q?KEAWKexeBQT+BEoMSgxsCAhiBfYUiAo1shXeJJAkChkGJYh+BRodZhhWHG4R?= =?us-ascii?q?ghgmCZgIRFIElHTiBVXAVgyeCJBiDRopSb4wpgR4BAQ?= X-IronPort-AV: E=Sophos;i="5.54,307,1534809600"; d="scan'208,217";a="177085162" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2018 16:59:00 +0000 Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id w8QGx04G021826 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 26 Sep 2018 16:59:00 GMT Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 26 Sep 2018 11:58:59 -0500 Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1395.000; Wed, 26 Sep 2018 11:58:59 -0500 From: "Panos Kampanakis (pkampana)" To: Jim Schaad CC: "spasm@ietf.org" , "'Dang, Quynh (Fed)'" , "'Russ Housley'" Thread-Topic: WGLC: draft-ietf-lamps-pkix-shake-02 Thread-Index: AdQrWI/gim0DHC1IRr6kopVYbZGOFwZx5lJ0AA1powAEGQmOkA== Date: Wed, 26 Sep 2018 16:58:59 +0000 Message-ID: References: <00b801d42b61$cf059a60$6d10cf20$@augustcellars.com> <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> In-Reply-To: <083901d4452b$e97f95b0$bc7ec110$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.116.108.5] Content-Type: multipart/alternative; boundary="_000_b2dc9e5da2194b0ea3f2022bf24522d3XCHALN010ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [lamps] WGLC: draft-ietf-lamps-pkix-shake-02 X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Sep 2018 16:59:06 -0000 --_000_b2dc9e5da2194b0ea3f2022bf24522d3XCHALN010ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jim, Thank you for the thorough review. All your comments (other than the ASN.1 which we deferred for later) were a= ddressed and they are in https://github.com/csosto-pk/adding-shake-to-pkix/= issues?utf8=3D%E2%9C%93&q=3Dis%3Aissue+is%3Aclosed+draft-ietf-lamps-pkix-sh= ake-02 The latest, current version of the draft is in https://github.com/csosto-pk= /adding-shake-to-pkix/blob/master/draft-ietf-lamps-pkix-shake-current.txt Rgs, Panos From: Jim Schaad [mailto:ietf@augustcellars.com] Sent: Wednesday, September 05, 2018 11:20 AM To: 'Dang, Quynh (Fed)' Cc: 'Russ Housley' ; 'Tim Hollebeek' ; Panos Kampanakis (pkampana) ; spasm@ietf.= org Subject: RE: WGLC: draft-ietf-lamps-pkix-shake-02 Mostly looks fine - one comment below From: Dang, Quynh (Fed) > Sent: Wednesday, September 5, 2018 7:08 AM To: Jim Schaad > Cc: 'Russ Housley' >; Tim= Hollebeek >;= Panos Kampanakis (pkampana) = > Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02 Hi Jim, We appreciate your review and comments. By the co-chairs' direction, let's try to improve the doc using your commen= ts. ________________________________ From: Jim Schaad > Sent: Friday, August 3, 2018 3:40 PM To: draft-ietf-lamps-pkix-shake@ietf.org Subject: WGLC: draft-ietf-lamps-pkix-shake-02 Not ready for progression. * Run the NITS on this document and fix them. Examples of problems are the fact that MUST language section is missing, possible incorrect references, and you have lines that are too long. Comment 1: correct. Will fix it. * Introduction - I have a problem with the cardinality of items in the second and third paragraphs here. I do not ask that you fix the problems that I have but you should be ready to address this is you get the same questions from the RFC Editor or the IESG. I would consider SHAKE to be a family of extendable-output hash functions and thus has a cardinality of one. The two specific hash functions have a cardinality of greater than one. The question of cardinality comes in terms of the usage of 'A', 'is', 'are'. Comment 2: "the SHAKE hash functions " in second paragraph in the intro. sh= ould be changed to "the SHAKEs" for a smooth read. A SHAKE is defined as o= ne function with variable output length. * Introduction - paragraph 2 - I find the last sentence to be difficult to read. The usage of 'and' here seems to be incorrect and it may be difficul= t to figure out which pair comes first - resistance or function. Comment 3: It would read better if the sentence "The corresponding collision and prei= mage resistance security levels for SHAKE128 and SHAKE256 are respectively min(d/2,128) and min(d,128) and min(d/2,256) and min(d,256) bits." to b= e replaced with "The corresponding collision and second preimage resistance= strengths for SHAKE128 are min(d/2,128) and min(d,128) respectively. And, = the corresponding collision and second preimage resistance strengths for SH= AKE256 are min(d/2,256) and min(d,256) bits respectively. " * Introduction - paragraph 3 - I am unaware that ECDSA has a mask generatin= g function associated with it. This sentence needs to be cleaned up Comment 4: This sentence " SHAKEs can be used as the message digest function (to hash the message to be signed) and as the hash function in the mask generating functions in RSASSA-PSS and ECDSA." should be replaced with " SHAKEs can be used as the message digest function (to hash the message to be signed) in RSASSA-PSS and ECDSA and as the hash function i= n the mask generating functions in RSASSA-PSS." * Introduction - paragraph 3 - Consider putting in a reference to the algorithm identifiers that are not changing. Probably overkill but still useful Comment 5: Adding " see section 3 below" at the end of this sentence: "In t= his document, we define four new OIDs for RSASSA-PSS and ECDSA when SHAKE12= 8 and SHAKE256 are used as hash functions.". * Identifiers - This section needs to nail down all parameters associated w= / the different SHAKE functions when used here. Otherwise you end up with th= e first assumption that I made which was d =3D 128 for SHAKE128 which would n= ot produce an acceptable result. Comment 6: The specification of output lengths of the 2 SHAKEs is in Sectio= ns 4.1.1 and 4.1.2. Adding a sentence " See Sections 4.1.1 and 4.1.2 for s= pecification of a required output length for each use of SHAKE128 or SHAKE2= 56 in RSASSA-PSS and ECDSA." * Signatures - Para #3 - you refer to section 3 for OIDs, but they are not there for public keys. Comment 7: Adding this " Conforming CA implementations MUST specify the algorithms explicitly by using the OIDs specified in Section 3 when encoding public keys for = RSASSA-PSS and ECDSA with SHAKE signatures in certificates and CRLs." as th= e first paragraph in Section 4.2 "Public keys". * IANA Considerations is incorrect and MUST be updated Comment 8: IANA Considerations is incorrect and will be updated. * Why is there no reference to deterministic ECDSA signatures in the document. Comment 9: Deterministic ECDSA has a different signing function because of = the way k is generated. The working group has not adopted this option yet. = Verification is the same. [JLS] If you want to say that it is a different signature algorithm that is= fine. I'll call and raise. It should be that it is required that ECDSA w= / SHAKE implements deterministic ECDSA and MUST NOT use a random generator = for k. * The ASN.1 module is absent and needs to be instantiated. Even doing so with TBD is sufficient for now. Comment 10: Yes. The ASN.1 module is absent and needs to be instantiated. Are you ok with the proposed resolutions ? Regards, Quynh. --_000_b2dc9e5da2194b0ea3f2022bf24522d3XCHALN010ciscocom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Jim,

Thank you for the thor= ough review.

All your comments (oth= er than the ASN.1 which we deferred for later) were addressed and they are = in https://github.com/csosto-pk/adding-shake-to-pkix/issues?utf8=3D%E2%9C%93&a= mp;q=3Dis%3Aissue+is%3Aclosed+draft-ietf-lamps-pkix-shake-02

The latest, current ve= rsion of the draft is in https://github.com/csosto-pk/adding-shake-to-pkix/blob/master/draft-ietf-la= mps-pkix-shake-current.txt  

Rgs,=

Panos

 

 

 

From: Jim Schaad [mailto:ietf@augustcellars.c= om]
Sent: Wednesday, September 05, 2018 11:20 AM
To: 'Dang, Quynh (Fed)' <quynh.dang@nist.gov>
Cc: 'Russ Housley' <housley@vigilsec.com>; 'Tim Hollebeek' <= ;tim.hollebeek@digicert.com>; Panos Kampanakis (pkampana) <pkampana@c= isco.com>; spasm@ietf.org
Subject: RE: WGLC: draft-ietf-lamps-pkix-shake-02

 

Mostly looks fine – one comment below

 

From: Dang, Quynh (Fed) <quynh.dang@nist.gov>
Sent: Wednesday, September 5, 2018 7:08 AM
To: Jim Schaad <ietf@au= gustcellars.com>
Cc: 'Russ Housley' <housl= ey@vigilsec.com>; Tim Hollebeek <tim.hollebeek@digicert.com>; Panos Kampanakis (pkampan= a) <pkampana@cisco.com>
Subject: Re: WGLC: draft-ietf-lamps-pkix-shake-02

 

Hi Jim,

 

We appreciate your review and comments.=

 

By the co-chairs' direction, let's try to im= prove the doc using your comments.

 

From: Jim Schaad <ietf@augustcellars.com>
Sent: Friday, August 3, 2018 3:40 PM
To: draft-ie= tf-lamps-pkix-shake@ietf.org
Subject: WGLC: draft-ietf-lamps-pkix-shake-02

 <= o:p>

Not ready for progressio= n.

* Run the NITS on this document and fix them.  Examples of problems ar= e the
fact that MUST language section is missing, possible incorrect references,<= br> and you have lines that are too long.

 =

Comment 1= : correct. Will fix it.

 =


*  Introduction - I have a problem with the cardinality of items in th= e
second and third paragraphs here.  I do not ask that you fix the probl= ems
that I have but you should be ready to address this is you get the same
questions from the RFC Editor or the IESG.  I would consider SHAKE to = be a
family of extendable-output hash functions and thus has a cardinality of one.  The two specific hash functions have a cardinality of greater th= an
one.  The question of cardinality comes in terms of the usage of 'A', = 'is',
'are'.

 =

Comment 2= : "the SHAKE hash functions " in second paragraph in the int= ro. should be changed to "the SHAKEs" for a smooth read.  A = SHAKE is defined as one function with variable output length. 



* Introduction - paragraph 2 - I find the last sentence to be difficult to<= br> read.  The usage of 'and' here seems to be incorrect and it may be dif= ficult
to figure out which pair comes first - resistance or function.

 =

Comment 3= :

It would = read better if the sentence  "The corresponding collision an= d preimage resistance security levels for SHAKE128 and SHAKE256 are re= spectively
   min(d/2,128)= and min(d,128) and min(d/2,256) and min(d,256) bits."  to be rep= laced with "The corresponding collision and second preimage resis= tance strengths for SHAKE128 are min(d/2,128) and min(d,128) resp= ectively. And, the corresponding collision and second preimage resistance = strengths for SHAKE256 are min(d/2,256) and min(d,256) bits respe= ctively. "



* Introduction - paragraph 3 - I am unaware that ECDSA has a mask generatin= g
function associated with it.  This sentence needs to be cleaned up

 =

 =

Comment 4= : This sentence "

SHAKEs ca= n be used as the message digest function (to hash the
   message to b= e signed) and as the hash function in the mask generating
   functions in= RSASSA-PSS and ECDSA." should be replaced with "

SHAKEs ca= n be used as the message digest function (to hash the
   message to b= e signed) in RSASSA-PSS and ECDSA and as the hash function in the mask= generating functions in RSASSA-PSS."



* Introduction - paragraph 3 - Consider putting in a reference to the
algorithm identifiers that are not changing.  Probably overkill but st= ill
useful

 =

Comment 5= : Adding " see section 3 below" at the end of this sentence: &quo= t;In this document, we define four new OIDs for RSASSA-PSS and ECDSA w= hen SHAKE128 and SHAKE256 are used as hash functions.".

 =


* Identifiers - This section needs to nail down all parameters associated w= /
the different SHAKE functions when used here.  Otherwise you end up wi= th the
first assumption that I made which was d =3D 128 for SHAKE128 which would n= ot
produce an acceptable result.

 =

Comment 6= : The specification of output lengths of the 2 SHAKEs is in Sections 4.1.1 = and 4.1.2.  Adding a sentence " See Sections 4.1.1 and 4.1.2 for = specification of a required output length for each use of SHAKE128 or SHAKE256 in RSASSA-PSS and ECDSA."

 =



* Signatures - Para #3 - you refer to section 3 for OIDs, but they are not<= br> there for public keys.

 =

Comment 7= : Adding this "

Conformin= g CA implementations MUST specify the algorithms explicitly
   by using the OIDs specified in Secti= on 3 when encoding  public keys for RSASSA-PSS and ECDS= A with SHAKE signatures in certificates and CRLs." as the fi= rst paragraph in Section 4.2 "Public keys". 



* IANA Considerations is incorrect and MUST be updated

 =

 =

Comment 8= : IANA Considerations is incorrect and will be updated.

 =


* Why is there no reference to deterministic ECDSA signatures in the
document.

 =

Comment 9= : Deterministic ECDSA has a different signing function because of the way k= is generated. The working group has not adopted this option yet. Verificat= ion is the same. 

 

[JLS] If you want to s= ay that it is a different signature algorithm that is fine.  I’l= l call and raise.  It should be that it is required that ECDSA w/ SHAK= E implements deterministic ECDSA and MUST NOT use a random generator for k.



* The ASN.1 module is absent and needs to be instantiated.  Even doing= so
with TBD is sufficient for now.

 =

Comment 1= 0: Yes. 

The ASN.1= module is absent and needs to be instantiated. 

 =


Are you ok with the proposed resolutions ?

 =

Regards,

Quynh. 

--_000_b2dc9e5da2194b0ea3f2022bf24522d3XCHALN010ciscocom_--